WitFoo-Artifact ::: message={"device_id":"bc973bccb751496b9a4f0acdd3072e43","timestamp":"2023-05-02T18:33:03Z","behavior_id":"5734","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","alleged_filetype":"exe","cmdline":"C:\\Windows\\Explorer.EXE","scenario":"NGAV","objective":"Falcon Detection Method","tactic":"Mumbrellaine Learning","tactic_id":"CSTA0004","technique":"Cloud-based ML","technique_id":"CST0008","display_name":"","description":"A file written to the file-system meets the File Analysis ML algorithm's high-confidence threshold for malware.","severity":70,"confidence":70,"ioc_type":"hash_sha256","ioc_value":"b1fd18441460ed1bd9b6a8107f2f09ddc971ed33ddbca53c6a38124f6830b2d9","ioc_source":"file_write","ioc_description":"\\Device\\HarddiskVolume3\\Users\\johndoe\\Downloads\\ransim\\SimulatorSetup.exe","user_name":"johndoe","user_id":"S-1-12-1-4034892786-1127594642-3000148911-3523002053","control_graph_id":"ctg:bc973bccb751496b9a4f0acdd3072e43:38655428546","triggering_process_graph_id":"pid:bc973bccb751496b9a4f0acdd3072e43:257962090525","sha256":"b1fd18441460ed1bd9b6a8107f2f09ddc971ed33ddbca53c6a38124f6830b2d9","md5":"","parent_details":{"parent_sha256":"","parent_md5":"","parent_cmdline":"","parent_process_graph_id":""},"pattern_disposition":128,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_mumbrellaine":false,"quarantine_file":true,"policy_disabled":false,"kill_parent":false,"operation_blocked":false,"process_blocked":false,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=57.223.12.204 ::: fileHash=b1fd18441460ed1bd9b6a8107f2f09ddc971ed33ddbca53c6a38124f6830b2d9 ::: fileName=explorer.exe ::: filePath=\Device\HarddiskVolume3\Windows\explorer.exe ::: userName=johndoe ::: clientMAC=00ff21247f5a ::: created_at=2023-05-02T18:33:03Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-05-02T18:33:03Z ::: clientHostname=CGATES-LT.undefined ::: pipelineEntrypoint=dispatch
{
    "clienthostname": "CGATES-LT.undefined",
    "clientmac": "00ff21247f5a",
    "filehash": "b1fd18441460ed1bd9b6a8107f2f09ddc971ed33ddbca53c6a38124f6830b2d9",
    "filename": "explorer.exe",
    "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe",
    "message": "WitFoo-Artifact ::: message={\"device_id\":\"bc973bccb751496b9a4f0acdd3072e43\",\"timestamp\":\"2023-05-02T18:33:03Z\",\"behavior_id\":\"5734\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"alleged_filetype\":\"exe\",\"cmdline\":\"C:\\\\Windows\\\\Explorer.EXE\",\"scenario\":\"NGAV\",\"objective\":\"Falcon Detection Method\",\"tactic\":\"Mumbrellaine Learning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Cloud-based ML\",\"technique_id\":\"CST0008\",\"display_name\":\"\",\"description\":\"A file written to the file-system meets the File Analysis ML algorithm's high-confidence threshold for malware.\",\"severity\":70,\"confidence\":70,\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b1fd18441460ed1bd9b6a8107f2f09ddc971ed33ddbca53c6a38124f6830b2d9\",\"ioc_source\":\"file_write\",\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\johndoe\\\\Downloads\\\\ransim\\\\SimulatorSetup.exe\",\"user_name\":\"johndoe\",\"user_id\":\"S-1-12-1-4034892786-1127594642-3000148911-3523002053\",\"control_graph_id\":\"ctg:bc973bccb751496b9a4f0acdd3072e43:38655428546\",\"triggering_process_graph_id\":\"pid:bc973bccb751496b9a4f0acdd3072e43:257962090525\",\"sha256\":\"b1fd18441460ed1bd9b6a8107f2f09ddc971ed33ddbca53c6a38124f6830b2d9\",\"md5\":\"\",\"parent_details\":{\"parent_sha256\":\"\",\"parent_md5\":\"\",\"parent_cmdline\":\"\",\"parent_process_graph_id\":\"\"},\"pattern_disposition\":128,\"pattern_disposition_details\":{\"indicator\":false,\"detect\":false,\"inddet_mask\":false,\"sensor_only\":false,\"rooting\":false,\"kill_process\":false,\"kill_subprocess\":false,\"quarantine_mumbrellaine\":false,\"quarantine_file\":true,\"policy_disabled\":false,\"kill_parent\":false,\"operation_blocked\":false,\"process_blocked\":false,\"registry_operation_blocked\":false,\"critical_process_disabled\":false,\"bootup_safeguard_enabled\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"kill_action_failed\":false,\"blocking_unsupported_or_disabled\":false,\"suspend_process\":false,\"suspend_parent\":false}} ::: clientIP=57.223.12.204 ::: fileHash=b1fd18441460ed1bd9b6a8107f2f09ddc971ed33ddbca53c6a38124f6830b2d9 ::: fileName=explorer.exe ::: filePath=\\Device\\HarddiskVolume3\\Windows\\explorer.exe ::: userName=johndoe ::: clientMAC=00ff21247f5a ::: created_at=2023-05-02T18:33:03Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-05-02T18:33:03Z ::: clientHostname=CGATES-LT.undefined ::: pipelineEntrypoint=dispatch",
    "messagetype": "endpoint_protection_event",
    "productids": [
        7
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 4,
    "severitylabel": "warning",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-05-02T18:33:03Z",
    "tags": [
        "Crowdstrike Detection",
        "endpoint_protection_event"
    ],
    "streamName": "Crowdstrike Detection",
    "clientIP": "57.223.12.204",
    "userName": "johndoe"
}