WitFoo-Artifact ::: message={"device_id":"dfbb62cf44104a3d85ad81cfd5bebb3c","timestamp":"2023-08-29T18:24:34Z","template_instance_id":"1384","behavior_id":"10447","filename":"PsExec.exe","filepath":"\\Device\\HarddiskVolume1\\Users\\alice\\Downloads\\PSTools\\PsExec.exe","alleged_filetype":"exe","cmdline":"\"C:\\Users\\alice\\Downloads\\PSTools\\PsExec.exe\" -i -s cmd.exe","scenario":"suspicious_activity","objective":"Gain Access","tactic":"Privilege Escalation","tactic_id":"TA0004","technique":"Abuse Elevation Control Mechanism","technique_id":"T1548","display_name":"SuspiciousPrivEsc","description":"A process has escalated privileges, this could be as a result of an adversary's attempt to bypass access controls or as part of legitimate system administration. Please check the process tree and surrounding events to determine if this activity was expected.","severity":30,"confidence":80,"ioc_type":"","ioc_value":"","ioc_source":"","ioc_description":"","user_name":"alice","user_id":"S-1-5-21-1959957726-1537299114-1298153393-94611","control_graph_id":"ctg:dfbb62cf44104a3d85ad81cfd5bebb3c:674313837342","triggering_process_graph_id":"pid:dfbb62cf44104a3d85ad81cfd5bebb3c:675598189738","sha256":"078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b","md5":"24a648a48741b1ac809e47b9543c6f12","parent_details":{"parent_sha256":"de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c","parent_md5":"7353f60b1739074eb17c5f4dddefe239","parent_cmdline":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" ","parent_process_graph_id":"pid:dfbb62cf44104a3d85ad81cfd5bebb3c:675576884426"},"pattern_disposition":0,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_mstarkine":false,"quarantine_file":false,"policy_disabled":false,"kill_parent":false,"operation_blocked":false,"process_blocked":false,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=189.233.57.135 ::: fileHash=078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b ::: fileName=PsExec.exe ::: filePath=\Device\HarddiskVolume1\Users\alice\Downloads\PSTools\PsExec.exe ::: userName=alice ::: clientMAC=0edeb6ae9241 ::: created_at=2023-08-29T18:24:34Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-08-29T18:24:34Z ::: clientHostname=NVIINFRDEVAPP02.devnvi.starkint.com ::: pipelineEntrypoint=dispatch
Product: Falcon
Vendor: Crowdstrike