WitFoo-Artifact ::: message={"device_id":"8a9af11f840642dd9fdf120a51bd3551","timestamp":"2023-11-14T16:13:29Z","behavior_id":"4748","filename":"msedge.exe","filepath":"\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe","alleged_filetype":"exe","cmdline":"\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2052,i,11849213268837189055,16613787588176336786,262144 /prefetch:3","scenario":"NGAV","objective":"Falcon Detection Method","tactic":"Malware","tactic_id":"CSTA0001","technique":"PUP","technique_id":"CST0013","display_name":"Detect OnWrite Adware/PUP Hash","description":"A file written to the file-system was classified as Adware/PUP based on its SHA256 hash.","severity":30,"confidence":100,"ioc_type":"","ioc_value":"","ioc_source":"","ioc_description":"","user_name":"bob","user_id":"S-1-12-1-3524866106-1250543537-2299143350-2362608680","control_graph_id":"ctg:8a9af11f840642dd9fdf120a51bd3551:227635083624","triggering_process_graph_id":"pid:8a9af11f840642dd9fdf120a51bd3551:1877720048920","sha256":"68455b27eddb80b636127783478f0014aeb80abe98d788c37f18b342ae15be27","md5":"d5174a0327dd4ad65f24959049c7113d","parent_details":{"parent_sha256":"68455b27eddb80b636127783478f0014aeb80abe98d788c37f18b342ae15be27","parent_md5":"d5174a0327dd4ad65f24959049c7113d","parent_cmdline":"\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --profile-directory=Default","parent_process_graph_id":"pid:8a9af11f840642dd9fdf120a51bd3551:1877714451043"},"pattern_disposition":128,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_mstarkine":false,"quarantine_file":true,"policy_disabled":false,"kill_parent":false,"operation_blocked":false,"process_blocked":false,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=232.81.222.128 ::: fileHash=68455b27eddb80b636127783478f0014aeb80abe98d788c37f18b342ae15be27 ::: fileName=msedge.exe ::: filePath=\Device\HarddiskVolume3\Program Files (x86)\Microsoft\Edge\Application\msedge.exe ::: userName=bob ::: clientMAC=00ff16b691c6 ::: created_at=2023-11-14T16:13:29Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-11-14T16:13:29Z ::: clientHostname=EMARTIN_LT.undefined ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Falcon by Crowdstrike. The following fields were extracted from the message:
clienthostname: EMARTIN_LT.undefined
clientmac: 00ff16b691c6
filehash: 68455b27eddb80b636127783478f0014aeb80abe98d788c37f18b342ae15be27
filename: msedge.exe
filepath: \Device\HarddiskVolume3\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
messagetype: endpoint_protection_event
productids: [7]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 4
severitylabel: warning
sourceinfo: unknown
starttimeutc: 2023-11-14T16:13:29Z
tags: ['Crowdstrike Detection', 'endpoint_protection_event']
streamName: Crowdstrike Detection
clientIP: 232.81.222.128
userName: bob