WitFoo-Artifact ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: clientIP=99.117.165.3 ::: filePath=\Device\HarddiskVolume3\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x86.exe ::: program=crowdstrike_falcon ::: clientHostname=SMONDIER-LT ::: clientMAC=00-ff-8f-c9-6f-e9 ::: fileHash=a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048 ::: message={"behaviors":[{"alleged_filetype":"exe","behavior_id":"458","cmdline":"\"C:\\Program Files (x86)\\Steam\\steamapps\\common\\Steamworks Shared\\_CommonRedist\\vcredist\\2013\\vcredist_x86.exe\" /quiet /norestart","confidence":60,"control_graph_id":"ctg:272598e4bace4ca89a48f3cd1667ae4f:300648175993","description":"A process attempted to delete a Volume Shadow Snapshot.","device_id":"272598e4bace4ca89a48f3cd1667ae4f","display_name":"VolumeShadowSnapshotDeleted","filename":"vcredist_x86.exe","filepath":"\\Device\\HarddiskVolume3\\Program Files (x86)\\Steam\\steamapps\\common\\Steamworks Shared\\_CommonRedist\\vcredist\\2013\\vcredist_x86.exe","ioc_description":"","ioc_source":"","ioc_type":"","ioc_value":"","md5":"0fc525b6b7b96a87523daa7a0013c69d","objective":"Follow Through","parent_details":{"parent_cmdline":"\"C:\\Program Files (x86)\\Common Files\\Steam\\steamservice.exe\" /installscript \"C:\\Program Files (x86)\\Steam\\steamapps\\common\\Steamworks Shared\\runasadmin.vdf\" 262060","parent_md5":"e99f72d05025b89eb741a72d16e92137","parent_process_graph_id":"pid:272598e4bace4ca89a48f3cd1667ae4f:2545219553614","parent_sha256":"3ef2d57118e6488b0163b21a644c349fa88a9d70c0d88c501b5f15ba041df04e"},"pattern_disposition":1024,"pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":true,"policy_disabled":false,"process_blocked":false,"quarantine_file":false,"quarantine_mstarkine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"scenario":"ransomware","severity":50,"sha256":"a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048","tactic":"Impact","tactic_id":"TA0040","technique":"Inhibit System Recovery","technique_id":"T1490","timestamp":"2024-04-10T20:31:33Z","triggering_process_graph_id":"pid:272598e4bace4ca89a48f3cd1667ae4f:2545223830741","user_id":"S-1-12-1-3975548328-1167315461-1214838696-538192925","user_name":"bob"}],"behaviors_processed":["pid:272598e4bace4ca89a48f3cd1667ae4f:2545223830741:458"],"cid":"47b7f823f5804dd9862681183ba9999d","created_timestamp":"2024-04-10T20:31:39.184432241Z","date_updated":"2024-04-10T20:31:57Z","detection_id":"ldt:272598e4bace4ca89a48f3cd1667ae4f:300648175993","device":{"agent_load_flags":"0","agent_local_time":"2024-04-08T18:53:11.836Z","agent_version":"7.12.18207.0","bios_manufacturer":"Dell Inc.","bios_version":"1.21.1","cid":"47b7f823f5804dd9862681183ba9999d","config_id_base":"65994763","config_id_build":"18207","config_id_platform":"3","device_id":"272598e4bace4ca89a48f3cd1667ae4f","external_ip":"98.97.180.201","first_seen":"2023-03-10T15:21:31Z","groups":["6297e232e6564507aa02babd05cadd3c"],"hostname":"SMONDIER-LT","last_login_timestamp":"2024-03-27T15:17:33Z","last_login_user":"bob","last_seen":"2024-04-10T20:24:12Z","local_ip":"99.117.165.3","mac_address":"00-ff-8f-c9-6f-e9","major_version":"10","minor_version":"0","modified_timestamp":"2024-04-10T20:24:14Z","os_version":"Windows 10","platform_id":"0","platform_name":"Windows","product_type":"1","product_type_desc":"Workstation","status":"normal","system_manufacturer":"Dell Inc.","system_product_name":"Dell G15 5511"},"email_sent":false,"first_behavior":"2024-04-10T20:31:33Z","hostinfo":{"domain":""},"last_behavior":"2024-04-10T20:31:33Z","max_confidence":60,"max_severity":50,"max_severity_displayname":"Medium","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new"} ::: userName=bob ::: fileName=vcredist_x86.exe
{
    "clienthostname": "SMONDIER-LT",
    "clientmac": "00-ff-8f-c9-6f-e9",
    "filehash": "a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048",
    "filename": "vcredist_x86.exe",
    "filepath": "\\Device\\HarddiskVolume3\\Program Files (x86)\\Steam\\steamapps\\common\\Steamworks Shared\\_CommonRedist\\vcredist\\2013\\vcredist_x86.exe",
    "message": "WitFoo-Artifact ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: clientIP=99.117.165.3 ::: filePath=\\Device\\HarddiskVolume3\\Program Files (x86)\\Steam\\steamapps\\common\\Steamworks Shared\\_CommonRedist\\vcredist\\2013\\vcredist_x86.exe ::: program=crowdstrike_falcon ::: clientHostname=SMONDIER-LT ::: clientMAC=00-ff-8f-c9-6f-e9 ::: fileHash=a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048 ::: message={\"behaviors\":[{\"alleged_filetype\":\"exe\",\"behavior_id\":\"458\",\"cmdline\":\"\\\"C:\\\\Program Files (x86)\\\\Steam\\\\steamapps\\\\common\\\\Steamworks Shared\\\\_CommonRedist\\\\vcredist\\\\2013\\\\vcredist_x86.exe\\\" /quiet /norestart\",\"confidence\":60,\"control_graph_id\":\"ctg:272598e4bace4ca89a48f3cd1667ae4f:300648175993\",\"description\":\"A process attempted to delete a Volume Shadow Snapshot.\",\"device_id\":\"272598e4bace4ca89a48f3cd1667ae4f\",\"display_name\":\"VolumeShadowSnapshotDeleted\",\"filename\":\"vcredist_x86.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Program Files (x86)\\\\Steam\\\\steamapps\\\\common\\\\Steamworks Shared\\\\_CommonRedist\\\\vcredist\\\\2013\\\\vcredist_x86.exe\",\"ioc_description\":\"\",\"ioc_source\":\"\",\"ioc_type\":\"\",\"ioc_value\":\"\",\"md5\":\"0fc525b6b7b96a87523daa7a0013c69d\",\"objective\":\"Follow Through\",\"parent_details\":{\"parent_cmdline\":\"\\\"C:\\\\Program Files (x86)\\\\Common Files\\\\Steam\\\\steamservice.exe\\\" /installscript \\\"C:\\\\Program Files (x86)\\\\Steam\\\\steamapps\\\\common\\\\Steamworks Shared\\\\runasadmin.vdf\\\" 262060\",\"parent_md5\":\"e99f72d05025b89eb741a72d16e92137\",\"parent_process_graph_id\":\"pid:272598e4bace4ca89a48f3cd1667ae4f:2545219553614\",\"parent_sha256\":\"3ef2d57118e6488b0163b21a644c349fa88a9d70c0d88c501b5f15ba041df04e\"},\"pattern_disposition\":1024,\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":true,\"policy_disabled\":false,\"process_blocked\":false,\"quarantine_file\":false,\"quarantine_mstarkine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"scenario\":\"ransomware\",\"severity\":50,\"sha256\":\"a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048\",\"tactic\":\"Impact\",\"tactic_id\":\"TA0040\",\"technique\":\"Inhibit System Recovery\",\"technique_id\":\"T1490\",\"timestamp\":\"2024-04-10T20:31:33Z\",\"triggering_process_graph_id\":\"pid:272598e4bace4ca89a48f3cd1667ae4f:2545223830741\",\"user_id\":\"S-1-12-1-3975548328-1167315461-1214838696-538192925\",\"user_name\":\"bob\"}],\"behaviors_processed\":[\"pid:272598e4bace4ca89a48f3cd1667ae4f:2545223830741:458\"],\"cid\":\"47b7f823f5804dd9862681183ba9999d\",\"created_timestamp\":\"2024-04-10T20:31:39.184432241Z\",\"date_updated\":\"2024-04-10T20:31:57Z\",\"detection_id\":\"ldt:272598e4bace4ca89a48f3cd1667ae4f:300648175993\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2024-04-08T18:53:11.836Z\",\"agent_version\":\"7.12.18207.0\",\"bios_manufacturer\":\"Dell Inc.\",\"bios_version\":\"1.21.1\",\"cid\":\"47b7f823f5804dd9862681183ba9999d\",\"config_id_base\":\"65994763\",\"config_id_build\":\"18207\",\"config_id_platform\":\"3\",\"device_id\":\"272598e4bace4ca89a48f3cd1667ae4f\",\"external_ip\":\"98.97.180.201\",\"first_seen\":\"2023-03-10T15:21:31Z\",\"groups\":[\"6297e232e6564507aa02babd05cadd3c\"],\"hostname\":\"SMONDIER-LT\",\"last_login_timestamp\":\"2024-03-27T15:17:33Z\",\"last_login_user\":\"bob\",\"last_seen\":\"2024-04-10T20:24:12Z\",\"local_ip\":\"99.117.165.3\",\"mac_address\":\"00-ff-8f-c9-6f-e9\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2024-04-10T20:24:14Z\",\"os_version\":\"Windows 10\",\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"status\":\"normal\",\"system_manufacturer\":\"Dell Inc.\",\"system_product_name\":\"Dell G15 5511\"},\"email_sent\":false,\"first_behavior\":\"2024-04-10T20:31:33Z\",\"hostinfo\":{\"domain\":\"\"},\"last_behavior\":\"2024-04-10T20:31:33Z\",\"max_confidence\":60,\"max_severity\":50,\"max_severity_displayname\":\"Medium\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\"} ::: userName=bob ::: fileName=vcredist_x86.exe",
    "messagetype": "endpoint_protection_event",
    "productids": [
        7
    ],
    "program": "crowdstrike_falcon",
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "sourceinfo": "unknown",
    "tags": [
        "Crowdstrike Detection",
        "endpoint_protection_event"
    ],
    "streamName": "Crowdstrike Detection",
    "clientIP": "99.117.165.3",
    "userName": "bob"
}