WitFoo-Artifact ::: message={"device_id":"3810ea13b98a42adb0ff227fbaf6169f","timestamp":"2023-06-12T13:04:28Z","behavior_id":"458","filename":"setup.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\fish\\AppData\\Local\\Temp\\{3D7277B3-B0BE-497C-A626-55F063254B5B}\\setup.exe","alleged_filetype":"exe","cmdline":"C:\\Users\\STEVEN~1\\AppData\\Local\\Temp\\{3D7277B3-B0BE-497C-A626-55F063254B5B}\\setup.exe /clone_wait \"/W32:8923024:1024\"","scenario":"ransomware","objective":"Follow Through","tactic":"Impact","tactic_id":"TA0040","technique":"Inhibit System Recovery","technique_id":"T1490","display_name":"VolumeShadowSnapshotDeleted","description":"A process attempted to delete a Volume Shadow Snapshot.","severity":50,"confidence":60,"ioc_type":"","ioc_value":"","ioc_source":"","ioc_description":"","user_name":"fish","user_id":"S-1-12-1-942142572-1204970278-157880471-3270697999","control_graph_id":"ctg:3810ea13b98a42adb0ff227fbaf6169f:17183496355","triggering_process_graph_id":"pid:3810ea13b98a42adb0ff227fbaf6169f:1607035893889","sha256":"3a8c7d9d5c4d92c41168bf073e9112799955fee0b66768aff89d9452cdfa8249","md5":"8ca190715cd1b0f67a9e14ecbc7bc27e","parent_details":{"parent_sha256":"4070ac7249ec3a90c1119236726050a34bb50110e1a7095f4855b1f7b9524eee","parent_md5":"ab7850166bd390bb01602ddc766cc662","parent_cmdline":"\"C:\\Users\\fish\\Downloads\\TMVirtualPortDriver870a.exe\" ","parent_process_graph_id":"pid:3810ea13b98a42adb0ff227fbaf6169f:1607032416516"},"pattern_disposition":1024,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_mstarkine":false,"quarantine_file":false,"policy_disabled":false,"kill_parent":false,"operation_blocked":true,"process_blocked":false,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=115.188.14.113 ::: fileHash=3a8c7d9d5c4d92c41168bf073e9112799955fee0b66768aff89d9452cdfa8249 ::: fileName=setup.exe ::: filePath=\Device\HarddiskVolume3\Users\fish\AppData\Local\Temp\{3D7277B3-B0BE-497C-A626-55F063254B5B}\setup.exe ::: userName=fish ::: clientMAC=00155d4a00da ::: created_at=2023-06-12T13:04:28Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-06-12T13:04:28Z ::: clientHostname=SSTEWART-LT3.undefined ::: pipelineEntrypoint=dispatch
{
    "clienthostname": "SSTEWART-LT3.undefined",
    "clientmac": "00155d4a00da",
    "filehash": "3a8c7d9d5c4d92c41168bf073e9112799955fee0b66768aff89d9452cdfa8249",
    "filename": "setup.exe",
    "filepath": "\\Device\\HarddiskVolume3\\Users\\StevenStewart\\AppData\\Local\\Temp\\{3D7277B3-B0BE-497C-A626-55F063254B5B}\\setup.exe",
    "message": "WitFoo-Artifact ::: message={\"device_id\":\"3810ea13b98a42adb0ff227fbaf6169f\",\"timestamp\":\"2023-06-12T13:04:28Z\",\"behavior_id\":\"458\",\"filename\":\"setup.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\fish\\\\AppData\\\\Local\\\\Temp\\\\{3D7277B3-B0BE-497C-A626-55F063254B5B}\\\\setup.exe\",\"alleged_filetype\":\"exe\",\"cmdline\":\"C:\\\\Users\\\\STEVEN~1\\\\AppData\\\\Local\\\\Temp\\\\{3D7277B3-B0BE-497C-A626-55F063254B5B}\\\\setup.exe /clone_wait \\\"/W32:8923024:1024\\\"\",\"scenario\":\"ransomware\",\"objective\":\"Follow Through\",\"tactic\":\"Impact\",\"tactic_id\":\"TA0040\",\"technique\":\"Inhibit System Recovery\",\"technique_id\":\"T1490\",\"display_name\":\"VolumeShadowSnapshotDeleted\",\"description\":\"A process attempted to delete a Volume Shadow Snapshot.\",\"severity\":50,\"confidence\":60,\"ioc_type\":\"\",\"ioc_value\":\"\",\"ioc_source\":\"\",\"ioc_description\":\"\",\"user_name\":\"fish\",\"user_id\":\"S-1-12-1-942142572-1204970278-157880471-3270697999\",\"control_graph_id\":\"ctg:3810ea13b98a42adb0ff227fbaf6169f:17183496355\",\"triggering_process_graph_id\":\"pid:3810ea13b98a42adb0ff227fbaf6169f:1607035893889\",\"sha256\":\"3a8c7d9d5c4d92c41168bf073e9112799955fee0b66768aff89d9452cdfa8249\",\"md5\":\"8ca190715cd1b0f67a9e14ecbc7bc27e\",\"parent_details\":{\"parent_sha256\":\"4070ac7249ec3a90c1119236726050a34bb50110e1a7095f4855b1f7b9524eee\",\"parent_md5\":\"ab7850166bd390bb01602ddc766cc662\",\"parent_cmdline\":\"\\\"C:\\\\Users\\\\fish\\\\Downloads\\\\TMVirtualPortDriver870a.exe\\\" \",\"parent_process_graph_id\":\"pid:3810ea13b98a42adb0ff227fbaf6169f:1607032416516\"},\"pattern_disposition\":1024,\"pattern_disposition_details\":{\"indicator\":false,\"detect\":false,\"inddet_mask\":false,\"sensor_only\":false,\"rooting\":false,\"kill_process\":false,\"kill_subprocess\":false,\"quarantine_mstarkine\":false,\"quarantine_file\":false,\"policy_disabled\":false,\"kill_parent\":false,\"operation_blocked\":true,\"process_blocked\":false,\"registry_operation_blocked\":false,\"critical_process_disabled\":false,\"bootup_safeguard_enabled\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"kill_action_failed\":false,\"blocking_unsupported_or_disabled\":false,\"suspend_process\":false,\"suspend_parent\":false}} ::: clientIP=115.188.14.113 ::: fileHash=3a8c7d9d5c4d92c41168bf073e9112799955fee0b66768aff89d9452cdfa8249 ::: fileName=setup.exe ::: filePath=\\Device\\HarddiskVolume3\\Users\\fish\\AppData\\Local\\Temp\\{3D7277B3-B0BE-497C-A626-55F063254B5B}\\setup.exe ::: userName=fish ::: clientMAC=00155d4a00da ::: created_at=2023-06-12T13:04:28Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-06-12T13:04:28Z ::: clientHostname=SSTEWART-LT3.undefined ::: pipelineEntrypoint=dispatch",
    "messagetype": "endpoint_protection_event",
    "productids": [
        7
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 4,
    "severitylabel": "warning",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-06-12T13:04:28Z",
    "tags": [
        "Crowdstrike Detection",
        "endpoint_protection_event"
    ],
    "streamName": "Crowdstrike Detection",
    "clientIP": "115.188.14.113",
    "userName": "fish"
}