WitFoo-Artifact ::: clientMAC=00-ff-8f-c9-6f-e9 ::: streamName=Crowdstrike Detection ::: clientIP=181.174.161.143 ::: fileHash=a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048 ::: program=crowdstrike_falcon ::: clientHostname=SMONDIER-LT ::: filePath=\Device\HarddiskVolume3\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x86.exe ::: userName=charlie ::: fileName=vcredist_x86.exe ::: message={"behaviors":[{"alleged_filetype":"exe","behavior_id":"458","cmdline":"\"C:\\Program Files (x86)\\Steam\\steamapps\\common\\Steamworks Shared\\_CommonRedist\\vcredist\\2013\\vcredist_x86.exe\" /quiet /norestart","confidence":60,"control_graph_id":"ctg:272598e4bace4ca89a48f3cd1667ae4f:300648175993","description":"A process attempted to delete a Volume Shadow Snapshot.","device_id":"272598e4bace4ca89a48f3cd1667ae4f","display_name":"VolumeShadowSnapshotDeleted","filename":"vcredist_x86.exe","filepath":"\\Device\\HarddiskVolume3\\Program Files (x86)\\Steam\\steamapps\\common\\Steamworks Shared\\_CommonRedist\\vcredist\\2013\\vcredist_x86.exe","ioc_description":"","ioc_source":"","ioc_type":"","ioc_value":"","md5":"0fc525b6b7b96a87523daa7a0013c69d","objective":"Follow Through","parent_details":{"parent_cmdline":"\"C:\\Program Files (x86)\\Common Files\\Steam\\steamservice.exe\" /installscript \"C:\\Program Files (x86)\\Steam\\steamapps\\common\\Steamworks Shared\\runasadmin.vdf\" 262060","parent_md5":"e99f72d05025b89eb741a72d16e92137","parent_process_graph_id":"pid:272598e4bace4ca89a48f3cd1667ae4f:2545219553614","parent_sha256":"3ef2d57118e6488b0163b21a644c349fa88a9d70c0d88c501b5f15ba041df04e"},"pattern_disposition":1024,"pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":true,"policy_disabled":false,"process_blocked":false,"quarantine_file":false,"quarantine_moscorpine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"scenario":"ransomware","severity":50,"sha256":"a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048","tactic":"Impact","tactic_id":"TA0040","technique":"Inhibit System Recovery","technique_id":"T1490","timestamp":"2024-04-10T20:31:33Z","triggering_process_graph_id":"pid:272598e4bace4ca89a48f3cd1667ae4f:2545223830741","user_id":"S-1-12-1-3975548328-1167315461-1214838696-538192925","user_name":"charlie"}],"behaviors_processed":["pid:272598e4bace4ca89a48f3cd1667ae4f:2545223830741:458"],"cid":"47b7f823f5804dd9862681183ba9999d","created_timestamp":"2024-04-10T20:31:39.184432241Z","date_updated":"2024-04-10T20:31:57Z","detection_id":"ldt:272598e4bace4ca89a48f3cd1667ae4f:300648175993","device":{"agent_load_flags":"0","agent_local_time":"2024-04-08T18:53:11.836Z","agent_version":"7.12.18207.0","bios_manufacturer":"Dell Inc.","bios_version":"1.21.1","cid":"47b7f823f5804dd9862681183ba9999d","config_id_base":"65994763","config_id_build":"18207","config_id_platform":"3","device_id":"272598e4bace4ca89a48f3cd1667ae4f","external_ip":"98.97.180.201","first_seen":"2023-03-10T15:21:31Z","groups":["6297e232e6564507aa02babd05cadd3c"],"hostname":"SMONDIER-LT","last_login_timestamp":"2024-03-27T15:17:33Z","last_login_user":"charlie","last_seen":"2024-04-10T20:24:12Z","local_ip":"181.174.161.143","mac_address":"00-ff-8f-c9-6f-e9","major_version":"10","minor_version":"0","modified_timestamp":"2024-04-10T20:24:14Z","os_version":"Windows 10","platform_id":"0","platform_name":"Windows","product_type":"1","product_type_desc":"Workstation","status":"normal","system_manufacturer":"Dell Inc.","system_product_name":"Dell G15 5511"},"email_sent":false,"first_behavior":"2024-04-10T20:31:33Z","hostinfo":{"domain":""},"last_behavior":"2024-04-10T20:31:33Z","max_confidence":60,"max_severity":50,"max_severity_displayname":"Medium","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new"} ::: messageType=endpoint_protection_event
This is a syslog message from a product called Falcon by Crowdstrike. The following fields were extracted from the message:
clienthostname: SMONDIER-LT
clientmac: 00-ff-8f-c9-6f-e9
filehash: a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048
filename: vcredist_x86.exe
filepath: \Device\HarddiskVolume3\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x86.exe
messagetype: endpoint_protection_event
productids: [7]
program: crowdstrike_falcon
senderhost: kafka.precinct
sensitivity: normal
sourceinfo: unknown
tags: ['Crowdstrike Detection', 'endpoint_protection_event']
streamName: Crowdstrike Detection
clientIP: 181.174.161.143
userName: charlie