WitFoo-Artifact ::: emailTo=reese@umbrella.com ::: messageType=malicious_session ::: message={"activityGroupName":null,"alertDetections":[],"assignedTo":null,"azureSubscriptionId":null,"azureTenantId":"4055bd5f-b117-4bb4-befa-de484bd06de8","category":"ThreatManagement","closedDateTime":null,"cloudAppStates":[],"comments":["New alert"],"confidence":null,"createdDateTime":"2024-07-04T19:01:43.9866667Z","description":"Emails with malicious file that were delivered and later removed -V1.0.0.3","detectionIds":[],"eventDateTime":"2024-07-04T18:59:52.7166539Z","feedback":null,"fileStates":[{"fileHash":{"hashType":"sha256","hashValue":"g/sAnVdplFEev8NWwCpR2jx2fgYJrTq9tS3awXlj2JI="},"name":"Netflix- Membership.","path":null,"riskScore":null}],"historyStates":[],"hostStates":[],"id":"f28b88a7-49c4-e690-f200-08dc9c5b5d3c","incidentIds":[],"investigationSecurityStates":[],"lastEventDateTime":null,"lastModifiedDateTime":"2024-07-11T23:14:26.4166667Z","malwareStates":[{"category":null,"family":"5d0cc7ca-ac7e-4336-d850-08dc9b0cd3f9-3600466711026277654-1","name":null,"severity":null,"wasRunning":null}],"messageSecurityStates":[],"networkConnections":[],"processes":[],"recommendedActions":[],"registryKeyStates":[],"riskScore":null,"securityResources":[],"severity":"informational","sourceMaterials":["https://security.microsoft.com/viewalerts?id=f28b88a7-49c4-e690-f200-08dc9c5b5d3c"],"status":"inProgress","tags":[],"title":"Email messages containing malicious file removed after delivery​","triggers":[],"uriClickSecurityStates":[],"userStates":[{"aadUserId":null,"accountName":"rob.phillipstd9tj","domainName":"yxgoamwv.ibrunei1u.site","emailRole":"sender","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":"139.118.222.235","logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"rob.phillipstd9tj@yxgoamwv.ibrunei1u.site"},{"aadUserId":null,"accountName":"reese","domainName":"umbrella.com","emailRole":"recipient","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":null,"logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"reese@umbrella.com"}],"vendorInformation":{"provider":"Office 365 Security and Compliance","providerVersion":null,"subProvider":null,"vendor":"Microsoft"},"vulnerabilityStates":[]} ::: severityLabel=informational ::: streamName=azure_security_alert ::: severityCode=5 ::: created_at=2024-07-04T18:59:52.7166539Z ::: emailFrom=rob.phillipstd9tj@yxgoamwv.ibrunei1u.site ::: program=azure_security ::: serverIP=139.118.222.235 ::: endTimeUTC=2024-07-11T23:14:26.4166667Z ::: startTimeUTC=2024-07-04T18:59:52.7166539Z ::: application=ThreatManagement ::: tags=[Emails with malicious file that were delivered and later removed -V1.0.0.3,Email messages containing malicious file removed after delivery​]
{
    "application": "ThreatManagement",
    "emailfrom": "rob.phillipstd9tj@yxgoamwv.ibrunei1u.site",
    "emailto": "reese@witfoo.com",
    "endtimeutc": "2024-07-11T23:14:26.4166667Z",
    "message": "WitFoo-Artifact ::: emailTo=reese@umbrella.com ::: messageType=malicious_session ::: message={\"activityGroupName\":null,\"alertDetections\":[],\"assignedTo\":null,\"azureSubscriptionId\":null,\"azureTenantId\":\"4055bd5f-b117-4bb4-befa-de484bd06de8\",\"category\":\"ThreatManagement\",\"closedDateTime\":null,\"cloudAppStates\":[],\"comments\":[\"New alert\"],\"confidence\":null,\"createdDateTime\":\"2024-07-04T19:01:43.9866667Z\",\"description\":\"Emails with malicious file that were delivered and later removed -V1.0.0.3\",\"detectionIds\":[],\"eventDateTime\":\"2024-07-04T18:59:52.7166539Z\",\"feedback\":null,\"fileStates\":[{\"fileHash\":{\"hashType\":\"sha256\",\"hashValue\":\"g/sAnVdplFEev8NWwCpR2jx2fgYJrTq9tS3awXlj2JI=\"},\"name\":\"Netflix- Membership.\",\"path\":null,\"riskScore\":null}],\"historyStates\":[],\"hostStates\":[],\"id\":\"f28b88a7-49c4-e690-f200-08dc9c5b5d3c\",\"incidentIds\":[],\"investigationSecurityStates\":[],\"lastEventDateTime\":null,\"lastModifiedDateTime\":\"2024-07-11T23:14:26.4166667Z\",\"malwareStates\":[{\"category\":null,\"family\":\"5d0cc7ca-ac7e-4336-d850-08dc9b0cd3f9-3600466711026277654-1\",\"name\":null,\"severity\":null,\"wasRunning\":null}],\"messageSecurityStates\":[],\"networkConnections\":[],\"processes\":[],\"recommendedActions\":[],\"registryKeyStates\":[],\"riskScore\":null,\"securityResources\":[],\"severity\":\"informational\",\"sourceMaterials\":[\"https://security.microsoft.com/viewalerts?id=f28b88a7-49c4-e690-f200-08dc9c5b5d3c\"],\"status\":\"inProgress\",\"tags\":[],\"title\":\"Email messages containing malicious file removed after delivery\u200b\",\"triggers\":[],\"uriClickSecurityStates\":[],\"userStates\":[{\"aadUserId\":null,\"accountName\":\"rob.phillipstd9tj\",\"domainName\":\"yxgoamwv.ibrunei1u.site\",\"emailRole\":\"sender\",\"isVpn\":null,\"logonDateTime\":null,\"logonId\":null,\"logonIp\":\"139.118.222.235\",\"logonLocation\":null,\"logonType\":null,\"onPremisesSecurityIdentifier\":null,\"riskScore\":null,\"userAccountType\":null,\"userPrincipalName\":\"rob.phillipstd9tj@yxgoamwv.ibrunei1u.site\"},{\"aadUserId\":null,\"accountName\":\"reese\",\"domainName\":\"umbrella.com\",\"emailRole\":\"recipient\",\"isVpn\":null,\"logonDateTime\":null,\"logonId\":null,\"logonIp\":null,\"logonLocation\":null,\"logonType\":null,\"onPremisesSecurityIdentifier\":null,\"riskScore\":null,\"userAccountType\":null,\"userPrincipalName\":\"reese@umbrella.com\"}],\"vendorInformation\":{\"provider\":\"Office 365 Security and Compliance\",\"providerVersion\":null,\"subProvider\":null,\"vendor\":\"Microsoft\"},\"vulnerabilityStates\":[]} ::: severityLabel=informational ::: streamName=azure_security_alert ::: severityCode=5 ::: created_at=2024-07-04T18:59:52.7166539Z ::: emailFrom=rob.phillipstd9tj@yxgoamwv.ibrunei1u.site ::: program=azure_security ::: serverIP=139.118.222.235 ::: endTimeUTC=2024-07-11T23:14:26.4166667Z ::: startTimeUTC=2024-07-04T18:59:52.7166539Z ::: application=ThreatManagement ::: tags=[Emails with malicious file that were delivered and later removed -V1.0.0.3,Email messages containing malicious file removed after delivery\u200b]",
    "messagetype": "malicious_session",
    "program": "azure_security",
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 5,
    "severitylabel": "notice",
    "sourceinfo": "unknown",
    "starttimeutc": "2024-07-04T18:59:52.7166539Z",
    "tags": [
        "Emails with malicious file that were delivered and later removed -V1.0.0.3",
        "Email messages containing malicious file removed after delivery\u200b",
        "azure_security_alert",
        "malicious_session"
    ],
    "streamName": "azure_security_alert",
    "serverIP": "139.118.222.235"
}