WitFoo-Artifact ::: message={"device_id":"dfbb62cf44104a3d85ad81cfd5bebb3c","timestamp":"2023-08-29T16:53:52Z","template_instance_id":"9162","behavior_id":"10250","filename":"powershell.exe","filepath":"\\Device\\HarddiskVolume1\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","alleged_filetype":"exe","cmdline":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" ","scenario":"suspicious_activity","objective":"Explore","tactic":"Discovery","tactic_id":"TA0007","technique":"System Network Configuration Discovery","technique_id":"T1016","display_name":"ReconCommands2","description":"A process tree contains characteristics often aswayneiated with an adversary performing reconnaissance. This might be related to expected administrator activity. If this is unexpected, review the process tree.","severity":70,"confidence":80,"ioc_type":"","ioc_value":"","ioc_source":"","ioc_description":"","user_name":"janedoe","user_id":"S-1-5-21-1959957726-1537299114-1298153393-94611","control_graph_id":"ctg:dfbb62cf44104a3d85ad81cfd5bebb3c:674312640252","triggering_process_graph_id":"pid:dfbb62cf44104a3d85ad81cfd5bebb3c:675348787220","sha256":"de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c","md5":"7353f60b1739074eb17c5f4dddefe239","parent_details":{"parent_sha256":"e1ea06c6884a2ceb9dd0efeb788011ab2b17041f1c7438a9555415501e9e374c","parent_md5":"c6cd12bf63e9b9b4478e6f975e7c293d","parent_cmdline":"C:\\Windows\\Explorer.EXE","parent_process_graph_id":"pid:dfbb62cf44104a3d85ad81cfd5bebb3c:674712003826"},"pattern_disposition":512,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_mwayneine":false,"quarantine_file":false,"policy_disabled":false,"kill_parent":true,"operation_blocked":false,"process_blocked":false,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=151.150.194.219 ::: fileHash=de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c ::: fileName=powershell.exe ::: filePath=\Device\HarddiskVolume1\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ::: userName=janedoe ::: clientMAC=0edeb6ae9241 ::: created_at=2023-08-29T16:53:52Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-08-29T16:53:52Z ::: clientHostname=NVIINFRDEVAPP02.devnvi.wayneint.com ::: pipelineEntrypoint=dispatch
Product: Falcon
Vendor: Crowdstrike