WitFoo-Artifact ::: message={"device_id":"8a9af11f840642dd9fdf120a51bd3551","timestamp":"2023-12-12T12:38:26Z","behavior_id":"5760","filename":"PCAppStore.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\emartin\\PCAppStore\\PCAppStore.exe","alleged_filetype":"exe","cmdline":"\"C:\\Users\\emartin\\PCAppStore\\PCAppStore.exe\" /init default","scenario":"NGAV","objective":"Falcon Detection Method","tactic":"Macmeine Learning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0006","display_name":"","description":"This file meets the Adware/PUP Anti-malware ML algorithm's low-confidence threshold.","severity":30,"confidence":30,"ioc_type":"hash_sha256","ioc_value":"2cd3b38357b43147bec39a55eb686c6611786d68850d85916898cfded8892f9c","ioc_source":"library_load","ioc_description":"\\Device\\HarddiskVolume3\\Users\\emartin\\PCAppStore\\PCAppStore.exe","user_name":"alice","user_id":"S-1-12-1-3524866106-1250543537-2299143350-2362608680","control_graph_id":"ctg:8a9af11f840642dd9fdf120a51bd3551:240518693293","triggering_process_graph_id":"pid:8a9af11f840642dd9fdf120a51bd3551:2079140020915","sha256":"2cd3b38357b43147bec39a55eb686c6611786d68850d85916898cfded8892f9c","md5":"fce67108058f3b2b72e0aad583cd88bc","parent_details":{"parent_sha256":"249cb3cb46fd875196e7ed4a8736271a64ff2d8132357222a283be53e7232ed3","parent_md5":"d45bd7c7b7bf977246e9409d63435231","parent_cmdline":"C:\\WINDOWS\\Explorer.EXE","parent_process_graph_id":"pid:8a9af11f840642dd9fdf120a51bd3551:2079035872730"},"pattern_disposition":2304,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_macmeine":false,"quarantine_file":false,"policy_disabled":true,"kill_parent":false,"operation_blocked":false,"process_blocked":true,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=150.68.224.183 ::: fileHash=2cd3b38357b43147bec39a55eb686c6611786d68850d85916898cfded8892f9c ::: fileName=PCAppStore.exe ::: filePath=\Device\HarddiskVolume3\Users\emartin\PCAppStore\PCAppStore.exe ::: userName=alice ::: clientMAC=50eb71a0761b ::: created_at=2023-12-12T12:38:26Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-12-12T12:38:26Z ::: clientHostname=EMARTIN_LT.undefined ::: pipelineEntrypoint=dispatch
Product: Falcon
Vendor: Crowdstrike