WitFoo-Artifact ::: message={"device_id":"3810ea13b98a42adb0ff227fbaf6169f","timestamp":"2023-06-12T12:46:27Z","behavior_id":"458","filename":"setup.exe","filepath":"\\Device\\HarddiskVolume3\\PayGo\\CashDeskInstall\\OPOSADK\\ADK280ER12\\Disk1\\setup.exe","alleged_filetype":"exe","cmdline":"\"C:\\PayGo\\CashDeskInstall\\OPOSADK\\ADK280ER12\\Disk1\\setup.exe\" ","scenario":"ransomware","objective":"Follow Through","tactic":"Impact","tactic_id":"TA0040","technique":"Inhibit System Recovery","technique_id":"T1490","display_name":"VolumeShadowSnapshotDeleted","description":"A process attempted to delete a Volume Shadow Snapshot.","severity":50,"confidence":60,"ioc_type":"","ioc_value":"","ioc_source":"","ioc_description":"","user_name":"charlie","user_id":"S-1-12-1-942142572-1204970278-157880471-3270697999","control_graph_id":"ctg:3810ea13b98a42adb0ff227fbaf6169f:17182842475","triggering_process_graph_id":"pid:3810ea13b98a42adb0ff227fbaf6169f:1606487204572","sha256":"15ff52f3a2d8f23241bf7f8f90095ee3741e66fa177fb5b6dc729decc82a4a99","md5":"fbab280d0cac5e21c72f0a1a7b5b9608","parent_details":{"parent_sha256":"249cb3cb46fd875196e7ed4a8736271a64ff2d8132357222a283be53e7232ed3","parent_md5":"d45bd7c7b7bf977246e9409d63435231","parent_cmdline":"explorer.exe","parent_process_graph_id":"pid:3810ea13b98a42adb0ff227fbaf6169f:1549101992291"},"pattern_disposition":1024,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_mstarkine":false,"quarantine_file":false,"policy_disabled":false,"kill_parent":false,"operation_blocked":true,"process_blocked":false,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=37.205.162.85 ::: fileHash=15ff52f3a2d8f23241bf7f8f90095ee3741e66fa177fb5b6dc729decc82a4a99 ::: fileName=setup.exe ::: filePath=\Device\HarddiskVolume3\PayGo\CashDeskInstall\OPOSADK\ADK280ER12\Disk1\setup.exe ::: userName=charlie ::: clientMAC=00155d4a00da ::: created_at=2023-06-12T12:46:27Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-06-12T12:46:27Z ::: clientHostname=SSTEWART-LT3.undefined ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Falcon by Crowdstrike. The following fields were extracted from the message:
clienthostname: SSTEWART-LT3.undefined
clientmac: 00155d4a00da
filehash: 15ff52f3a2d8f23241bf7f8f90095ee3741e66fa177fb5b6dc729decc82a4a99
filename: setup.exe
filepath: \Device\HarddiskVolume3\PayGo\CashDeskInstall\OPOSADK\ADK280ER12\Disk1\setup.exe
messagetype: endpoint_protection_event
productids: [7]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 4
severitylabel: warning
sourceinfo: unknown
starttimeutc: 2023-06-12T12:46:27Z
tags: ['Crowdstrike Detection', 'endpoint_protection_event']
streamName: Crowdstrike Detection
clientIP: 37.205.162.85
userName: charlie