WitFoo-Artifact ::: message={"device_id":"3dd8398c7bda470895e756116d398bf5","timestamp":"2023-11-08T03:51:04Z","behavior_id":"458","filename":"lpksetup.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\lpksetup.exe","alleged_filetype":"exe","cmdline":"\"C:\\Windows\\system32\\lpksetup.exe\" -Embedding","scenario":"ransomware","objective":"Follow Through","tactic":"Impact","tactic_id":"TA0040","technique":"Inhibit System Recovery","technique_id":"T1490","display_name":"VolumeShadowSnapshotDeleted","description":"A process attempted to delete a Volume Shadow Snapshot.","severity":50,"confidence":60,"ioc_type":"","ioc_value":"","ioc_source":"","ioc_description":"","user_name":"johndoe","user_id":"S-1-5-18","control_graph_id":"ctg:3dd8398c7bda470895e756116d398bf5:12885618049","triggering_process_graph_id":"pid:3dd8398c7bda470895e756116d398bf5:14819663752","sha256":"d44611189d3f2da01952291f40f7cf361e808b68716a4739b95dcdd632a26e5d","md5":"4470c7350bb7f2d945cc405ec81985d2","parent_details":{"parent_sha256":"","parent_md5":"","parent_cmdline":"","parent_process_graph_id":""},"pattern_disposition":1024,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_mumbrellaine":false,"quarantine_file":false,"policy_disabled":false,"kill_parent":false,"operation_blocked":true,"process_blocked":false,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=77.239.113.242 ::: fileHash=d44611189d3f2da01952291f40f7cf361e808b68716a4739b95dcdd632a26e5d ::: fileName=lpksetup.exe ::: filePath=\Device\HarddiskVolume3\Windows\System32\lpksetup.exe ::: userName=johndoe ::: clientMAC=00ff0d992884 ::: created_at=2023-11-08T03:51:04Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-11-08T03:51:04Z ::: clientHostname=KDHAMI-LT2.undefined ::: pipelineEntrypoint=dispatch
Product: Falcon
Vendor: Crowdstrike