WitFoo-Artifact ::: message={"behaviors":[{"alleged_filetype":"exe","behavior_id":"4748","cmdline":"\"C:\\Program Files\\Java\\jdk-20\\bin\\javaw.exe\" -Xmx4850m -classpath \"zap-2.14.0.jar\" org.zaproxy.zap.ZAP","confidence":100,"control_graph_id":"ctg:6e36ac138a7a426fa5d2e4a45da72961:163209757477","description":"A file written to the file-system was classified as Adware/PUP based on its SHA256 hash.","device_id":"6e36ac138a7a426fa5d2e4a45da72961","display_name":"Detect OnWrite Adware/PUP Hash","filename":"javaw.exe","filepath":"\\Device\\HarddiskVolume3\\Program Files\\Java\\jdk-20\\bin\\javaw.exe","ioc_description":"\\Device\\HarddiskVolume3\\Users\\alice\\ZAP\\fuzzers\\fuzzdb\\web-backdoors\\exe\\nc.exe","ioc_source":"file_write","ioc_type":"hash_sha256","ioc_value":"e355a8decae502578e5bb649b4336b89b13c5daa07b2b23c6737989ecc0fa851","md5":"","objective":"Falcon Detection Method","parent_details":{"parent_cmdline":"\"C:\\Program Files\\ZAP\\Zed Attack Proxy\\ZAP.exe\" ","parent_md5":"4bf8d9dff4936e44dbde2f3227a17064","parent_process_graph_id":"pid:6e36ac138a7a426fa5d2e4a45da72961:1776105169534","parent_sha256":"9abd01e48d71838c047db584bfe975178cdcf0781f62ee2eab7df8194205ebb6"},"pattern_disposition":128,"pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":false,"quarantine_file":true,"quarantine_mstarkine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"scenario":"NGAV","severity":30,"sha256":"e355a8decae502578e5bb649b4336b89b13c5daa07b2b23c6737989ecc0fa851","tactic":"Malware","tactic_id":"CSTA0001","technique":"PUP","technique_id":"CST0013","timestamp":"2024-03-18T13:05:34Z","triggering_process_graph_id":"pid:6e36ac138a7a426fa5d2e4a45da72961:1776106677678","user_id":"S-1-12-1-1960846385-1299844409-3992341668-2149414984","user_name":"alice"}],"behaviors_processed":["pid:6e36ac138a7a426fa5d2e4a45da72961:1776106677678:4748"],"cid":"47b7f823f5804dd9862681183ba9999d","created_timestamp":"2024-03-18T13:05:40.963244676Z","date_updated":"2024-03-18T13:05:44Z","detection_id":"ldt:6e36ac138a7a426fa5d2e4a45da72961:163209757477","device":{"agent_load_flags":"0","agent_local_time":"2024-03-14T07:32:17.384Z","agent_version":"7.11.18110.0","bios_manufacturer":"Dell Inc.","bios_version":"1.24.1","cid":"47b7f823f5804dd9862681183ba9999d","config_id_base":"65994763","config_id_build":"18110","config_id_platform":"3","device_id":"6e36ac138a7a426fa5d2e4a45da72961","external_ip":"99.56.191.170","first_seen":"2023-03-13T11:34:15Z","groups":["6297e232e6564507aa02babd05cadd3c"],"hostname":"JBETRO-LT4","last_login_timestamp":"2024-03-18T11:15:10Z","last_login_user":"alice","last_seen":"2024-03-18T12:57:09Z","local_ip":"24.63.245.89","mac_address":"00-ff-c0-d6-f8-46","major_version":"10","minor_version":"0","modified_timestamp":"2024-03-18T12:57:54Z","os_version":"Windows 10","platform_id":"0","platform_name":"Windows","product_type":"1","product_type_desc":"Workstation","status":"normal","system_manufacturer":"Dell Inc.","system_product_name":"Dell G15 5511"},"email_sent":false,"first_behavior":"2024-03-18T13:05:34Z","hostinfo":{"domain":""},"last_behavior":"2024-03-18T13:05:34Z","max_confidence":100,"max_severity":30,"max_severity_displayname":"Low","quarantined_files":[{"id":"6e36ac138a7a426fa5d2e4a45da72961_e355a8decae502578e5bb649b4336b89b13c5daa07b2b23c6737989ecc0fa851","sha256":"e355a8decae502578e5bb649b4336b89b13c5daa07b2b23c6737989ecc0fa851","state":"quarantined"}],"seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new"} ::: streamName=Crowdstrike Detection ::: clientHostname=JBETRO-LT4 ::: fileName=javaw.exe ::: filePath=\Device\HarddiskVolume3\Program Files\Java\jdk-20\bin\javaw.exe ::: fileHash=e355a8decae502578e5bb649b4336b89b13c5daa07b2b23c6737989ecc0fa851 ::: userName=alice ::: program=crowdstrike_falcon ::: messageType=endpoint_protection_event ::: clientIP=24.63.245.89 ::: clientMAC=00-ff-c0-d6-f8-46
{
    "clienthostname": "JBETRO-LT4",
    "clientmac": "00-ff-c0-d6-f8-46",
    "filehash": "e355a8decae502578e5bb649b4336b89b13c5daa07b2b23c6737989ecc0fa851",
    "filename": "javaw.exe",
    "filepath": "\\Device\\HarddiskVolume3\\Program Files\\Java\\jdk-20\\bin\\javaw.exe",
    "message": "WitFoo-Artifact ::: message={\"behaviors\":[{\"alleged_filetype\":\"exe\",\"behavior_id\":\"4748\",\"cmdline\":\"\\\"C:\\\\Program Files\\\\Java\\\\jdk-20\\\\bin\\\\javaw.exe\\\" -Xmx4850m -classpath \\\"zap-2.14.0.jar\\\" org.zaproxy.zap.ZAP\",\"confidence\":100,\"control_graph_id\":\"ctg:6e36ac138a7a426fa5d2e4a45da72961:163209757477\",\"description\":\"A file written to the file-system was classified as Adware/PUP based on its SHA256 hash.\",\"device_id\":\"6e36ac138a7a426fa5d2e4a45da72961\",\"display_name\":\"Detect OnWrite Adware/PUP Hash\",\"filename\":\"javaw.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Program Files\\\\Java\\\\jdk-20\\\\bin\\\\javaw.exe\",\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\alice\\\\ZAP\\\\fuzzers\\\\fuzzdb\\\\web-backdoors\\\\exe\\\\nc.exe\",\"ioc_source\":\"file_write\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"e355a8decae502578e5bb649b4336b89b13c5daa07b2b23c6737989ecc0fa851\",\"md5\":\"\",\"objective\":\"Falcon Detection Method\",\"parent_details\":{\"parent_cmdline\":\"\\\"C:\\\\Program Files\\\\ZAP\\\\Zed Attack Proxy\\\\ZAP.exe\\\" \",\"parent_md5\":\"4bf8d9dff4936e44dbde2f3227a17064\",\"parent_process_graph_id\":\"pid:6e36ac138a7a426fa5d2e4a45da72961:1776105169534\",\"parent_sha256\":\"9abd01e48d71838c047db584bfe975178cdcf0781f62ee2eab7df8194205ebb6\"},\"pattern_disposition\":128,\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":false,\"quarantine_file\":true,\"quarantine_mstarkine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"scenario\":\"NGAV\",\"severity\":30,\"sha256\":\"e355a8decae502578e5bb649b4336b89b13c5daa07b2b23c6737989ecc0fa851\",\"tactic\":\"Malware\",\"tactic_id\":\"CSTA0001\",\"technique\":\"PUP\",\"technique_id\":\"CST0013\",\"timestamp\":\"2024-03-18T13:05:34Z\",\"triggering_process_graph_id\":\"pid:6e36ac138a7a426fa5d2e4a45da72961:1776106677678\",\"user_id\":\"S-1-12-1-1960846385-1299844409-3992341668-2149414984\",\"user_name\":\"alice\"}],\"behaviors_processed\":[\"pid:6e36ac138a7a426fa5d2e4a45da72961:1776106677678:4748\"],\"cid\":\"47b7f823f5804dd9862681183ba9999d\",\"created_timestamp\":\"2024-03-18T13:05:40.963244676Z\",\"date_updated\":\"2024-03-18T13:05:44Z\",\"detection_id\":\"ldt:6e36ac138a7a426fa5d2e4a45da72961:163209757477\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2024-03-14T07:32:17.384Z\",\"agent_version\":\"7.11.18110.0\",\"bios_manufacturer\":\"Dell Inc.\",\"bios_version\":\"1.24.1\",\"cid\":\"47b7f823f5804dd9862681183ba9999d\",\"config_id_base\":\"65994763\",\"config_id_build\":\"18110\",\"config_id_platform\":\"3\",\"device_id\":\"6e36ac138a7a426fa5d2e4a45da72961\",\"external_ip\":\"99.56.191.170\",\"first_seen\":\"2023-03-13T11:34:15Z\",\"groups\":[\"6297e232e6564507aa02babd05cadd3c\"],\"hostname\":\"JBETRO-LT4\",\"last_login_timestamp\":\"2024-03-18T11:15:10Z\",\"last_login_user\":\"alice\",\"last_seen\":\"2024-03-18T12:57:09Z\",\"local_ip\":\"24.63.245.89\",\"mac_address\":\"00-ff-c0-d6-f8-46\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2024-03-18T12:57:54Z\",\"os_version\":\"Windows 10\",\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"status\":\"normal\",\"system_manufacturer\":\"Dell Inc.\",\"system_product_name\":\"Dell G15 5511\"},\"email_sent\":false,\"first_behavior\":\"2024-03-18T13:05:34Z\",\"hostinfo\":{\"domain\":\"\"},\"last_behavior\":\"2024-03-18T13:05:34Z\",\"max_confidence\":100,\"max_severity\":30,\"max_severity_displayname\":\"Low\",\"quarantined_files\":[{\"id\":\"6e36ac138a7a426fa5d2e4a45da72961_e355a8decae502578e5bb649b4336b89b13c5daa07b2b23c6737989ecc0fa851\",\"sha256\":\"e355a8decae502578e5bb649b4336b89b13c5daa07b2b23c6737989ecc0fa851\",\"state\":\"quarantined\"}],\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\"} ::: streamName=Crowdstrike Detection ::: clientHostname=JBETRO-LT4 ::: fileName=javaw.exe ::: filePath=\\Device\\HarddiskVolume3\\Program Files\\Java\\jdk-20\\bin\\javaw.exe ::: fileHash=e355a8decae502578e5bb649b4336b89b13c5daa07b2b23c6737989ecc0fa851 ::: userName=alice ::: program=crowdstrike_falcon ::: messageType=endpoint_protection_event ::: clientIP=24.63.245.89 ::: clientMAC=00-ff-c0-d6-f8-46",
    "messagetype": "endpoint_protection_event",
    "productids": [
        7
    ],
    "program": "crowdstrike_falcon",
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "sourceinfo": "unknown",
    "tags": [
        "Crowdstrike Detection",
        "endpoint_protection_event"
    ],
    "streamName": "Crowdstrike Detection",
    "clientIP": "24.63.245.89",
    "userName": "alice"
}