WitFoo-Artifact ::: message={"device_id":"289d83eb622a40d58196e54957152b03","timestamp":"2023-08-25T11:20:20Z","behavior_id":"5737","filename":"VBCSCompiler.exe","filepath":"\\Device\\HarddiskVolume3\\PayGo\\QA_SRP_Latest\\Portal\\bin\\roslyn\\VBCSCompiler.exe","alleged_filetype":"exe","cmdline":"\"D:\\PayGo\\QA_SRP_Latest\\Portal\\bin\\roslyn\\VBCSCompiler.exe\" \"-pipename:janedoe.F.A34eygCs1aJfPpzR6O_cjJw2t\"","scenario":"NGAV","objective":"Falcon Detection Method","tactic":"Mwayneine Learning","tactic_id":"CSTA0004","technique":"Sensor-based ML","technique_id":"CST0007","display_name":"Mwayneine Learning Identified Medium Confidence Malicious File","description":"A file written to the file system meets the on-sensor mwayneine learning medium confidence threshold for malicious files. Detection is based on a high degree of entropy, packing, anti-malware evasion, or other similarity to known malware.","severity":50,"confidence":50,"ioc_type":"hash_sha256","ioc_value":"1ce7339d5637cc12a82bb8c64dc223ccb637a888cb641446c01229d1512df5d5","ioc_source":"file_write","ioc_description":"\\Device\\HarddiskVolume1\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Temporary ASP.NET Files\\portal\\6e657b17\\3c955147\\App_Web_kvvwjyjq.dll","user_name":"janedoe","user_id":"S-1-5-21-1959957726-1537299114-1298153393-1249","control_graph_id":"ctg:289d83eb622a40d58196e54957152b03:60130083149","triggering_process_graph_id":"pid:289d83eb622a40d58196e54957152b03:770815250147","sha256":"1ce7339d5637cc12a82bb8c64dc223ccb637a888cb641446c01229d1512df5d5","md5":"","parent_details":{"parent_sha256":"29fc4e96f2553c5c309ee321a18ee5ad18686b5586e64422c1a7870748ce908d","parent_md5":"7dc642657b7cb790d687332f6d18feae","parent_cmdline":"\"D:\\PayGo\\QA_SRP_Latest\\Portal\\bin\\roslyn\\csc.exe\" /shared /keepalive:\"10\" /noconfig  /fullpaths @\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Temporary ASP.NET Files\\portal\\6e657b17\\3c955147\\pqwjm4kv.cmdline\"","parent_process_graph_id":"pid:289d83eb622a40d58196e54957152b03:770812509131"},"pattern_disposition":128,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_mwayneine":false,"quarantine_file":true,"policy_disabled":false,"kill_parent":false,"operation_blocked":false,"process_blocked":false,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=137.56.53.133 ::: fileHash=1ce7339d5637cc12a82bb8c64dc223ccb637a888cb641446c01229d1512df5d5 ::: fileName=VBCSCompiler.exe ::: filePath=\Device\HarddiskVolume3\PayGo\QA_SRP_Latest\Portal\bin\roslyn\VBCSCompiler.exe ::: userName=janedoe ::: clientMAC=0accca51756b ::: created_at=2023-08-25T11:20:20Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-08-25T11:20:20Z ::: clientHostname=NVISAASQATWEB01.devnvi.wayneint.com ::: pipelineEntrypoint=dispatch
{
    "clienthostname": "NVISAASQATWEB01.devnvi.paygoint.com",
    "clientmac": "0accca51756b",
    "filehash": "1ce7339d5637cc12a82bb8c64dc223ccb637a888cb641446c01229d1512df5d5",
    "filename": "VBCSCompiler.exe",
    "filepath": "\\Device\\HarddiskVolume3\\PayGo\\QA_SRP_Latest\\Portal\\bin\\roslyn\\VBCSCompiler.exe",
    "message": "WitFoo-Artifact ::: message={\"device_id\":\"289d83eb622a40d58196e54957152b03\",\"timestamp\":\"2023-08-25T11:20:20Z\",\"behavior_id\":\"5737\",\"filename\":\"VBCSCompiler.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\PayGo\\\\QA_SRP_Latest\\\\Portal\\\\bin\\\\roslyn\\\\VBCSCompiler.exe\",\"alleged_filetype\":\"exe\",\"cmdline\":\"\\\"D:\\\\PayGo\\\\QA_SRP_Latest\\\\Portal\\\\bin\\\\roslyn\\\\VBCSCompiler.exe\\\" \\\"-pipename:janedoe.F.A34eygCs1aJfPpzR6O_cjJw2t\\\"\",\"scenario\":\"NGAV\",\"objective\":\"Falcon Detection Method\",\"tactic\":\"Mwayneine Learning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Sensor-based ML\",\"technique_id\":\"CST0007\",\"display_name\":\"Mwayneine Learning Identified Medium Confidence Malicious File\",\"description\":\"A file written to the file system meets the on-sensor mwayneine learning medium confidence threshold for malicious files. Detection is based on a high degree of entropy, packing, anti-malware evasion, or other similarity to known malware.\",\"severity\":50,\"confidence\":50,\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"1ce7339d5637cc12a82bb8c64dc223ccb637a888cb641446c01229d1512df5d5\",\"ioc_source\":\"file_write\",\"ioc_description\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v4.0.30319\\\\Temporary ASP.NET Files\\\\portal\\\\6e657b17\\\\3c955147\\\\App_Web_kvvwjyjq.dll\",\"user_name\":\"janedoe\",\"user_id\":\"S-1-5-21-1959957726-1537299114-1298153393-1249\",\"control_graph_id\":\"ctg:289d83eb622a40d58196e54957152b03:60130083149\",\"triggering_process_graph_id\":\"pid:289d83eb622a40d58196e54957152b03:770815250147\",\"sha256\":\"1ce7339d5637cc12a82bb8c64dc223ccb637a888cb641446c01229d1512df5d5\",\"md5\":\"\",\"parent_details\":{\"parent_sha256\":\"29fc4e96f2553c5c309ee321a18ee5ad18686b5586e64422c1a7870748ce908d\",\"parent_md5\":\"7dc642657b7cb790d687332f6d18feae\",\"parent_cmdline\":\"\\\"D:\\\\PayGo\\\\QA_SRP_Latest\\\\Portal\\\\bin\\\\roslyn\\\\csc.exe\\\" /shared /keepalive:\\\"10\\\" /noconfig  /fullpaths @\\\"C:\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\v4.0.30319\\\\Temporary ASP.NET Files\\\\portal\\\\6e657b17\\\\3c955147\\\\pqwjm4kv.cmdline\\\"\",\"parent_process_graph_id\":\"pid:289d83eb622a40d58196e54957152b03:770812509131\"},\"pattern_disposition\":128,\"pattern_disposition_details\":{\"indicator\":false,\"detect\":false,\"inddet_mask\":false,\"sensor_only\":false,\"rooting\":false,\"kill_process\":false,\"kill_subprocess\":false,\"quarantine_mwayneine\":false,\"quarantine_file\":true,\"policy_disabled\":false,\"kill_parent\":false,\"operation_blocked\":false,\"process_blocked\":false,\"registry_operation_blocked\":false,\"critical_process_disabled\":false,\"bootup_safeguard_enabled\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"kill_action_failed\":false,\"blocking_unsupported_or_disabled\":false,\"suspend_process\":false,\"suspend_parent\":false}} ::: clientIP=137.56.53.133 ::: fileHash=1ce7339d5637cc12a82bb8c64dc223ccb637a888cb641446c01229d1512df5d5 ::: fileName=VBCSCompiler.exe ::: filePath=\\Device\\HarddiskVolume3\\PayGo\\QA_SRP_Latest\\Portal\\bin\\roslyn\\VBCSCompiler.exe ::: userName=janedoe ::: clientMAC=0accca51756b ::: created_at=2023-08-25T11:20:20Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-08-25T11:20:20Z ::: clientHostname=NVISAASQATWEB01.devnvi.wayneint.com ::: pipelineEntrypoint=dispatch",
    "messagetype": "endpoint_protection_event",
    "productids": [
        7
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 4,
    "severitylabel": "warning",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-08-25T11:20:20Z",
    "tags": [
        "Crowdstrike Detection",
        "endpoint_protection_event"
    ],
    "streamName": "Crowdstrike Detection",
    "clientIP": "137.56.53.133",
    "userName": "janedoe"
}