WitFoo-Artifact ::: endTimeUTC=2024-07-11T23:14:26.4166667Z ::: streamName=azure_security_alert ::: severityLabel=informational ::: serverIP=123.241.213.162 ::: message={"activityGroupName":null,"alertDetections":[],"assignedTo":null,"azureSubscriptionId":null,"azureTenantId":"4055bd5f-b117-4bb4-befa-de484bd06de8","category":"ThreatManagement","closedDateTime":null,"cloudAppStates":[],"comments":["New alert"],"confidence":null,"createdDateTime":"2024-07-04T19:01:43.9866667Z","description":"Emails with malicious file that were delivered and later removed -V1.0.0.3","detectionIds":[],"eventDateTime":"2024-07-04T18:59:52.7166539Z","feedback":null,"fileStates":[{"fileHash":{"hashType":"sha256","hashValue":"g/sAnVdplFEev8NWwCpR2jx2fgYJrTq9tS3awXlj2JI="},"name":"Netflix- Membership.","path":null,"riskScore":null}],"historyStates":[],"hostStates":[],"id":"f28b88a7-49c4-e690-f200-08dc9c5b5d3c","incidentIds":[],"investigationSecurityStates":[],"lastEventDateTime":null,"lastModifiedDateTime":"2024-07-11T23:14:26.4166667Z","malwareStates":[{"category":null,"family":"5d0cc7ca-ac7e-4336-d850-08dc9b0cd3f9-3600466711026277654-1","name":null,"severity":null,"wasRunning":null}],"messageSecurityStates":[],"networkConnections":[],"processes":[],"recommendedActions":[],"registryKeyStates":[],"riskScore":null,"securityResources":[],"severity":"informational","sourceMaterials":["https://security.microsoft.com/viewalerts?id=f28b88a7-49c4-e690-f200-08dc9c5b5d3c"],"status":"inProgress","tags":[],"title":"Email messages containing malicious file removed after delivery​","triggers":[],"uriClickSecurityStates":[],"userStates":[{"aadUserId":null,"accountName":"rob.phillipstd9tj","domainName":"yxgoamwv.ibrunei1u.site","emailRole":"sender","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":"123.241.213.162","logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"rob.phillipstd9tj@yxgoamwv.ibrunei1u.site"},{"aadUserId":null,"accountName":"reese","domainName":"wayne.com","emailRole":"recipient","isVpn":null,"logonDateTime":null,"logonId":null,"logonIp":null,"logonLocation":null,"logonType":null,"onPremisesSecurityIdentifier":null,"riskScore":null,"userAccountType":null,"userPrincipalName":"reese@wayne.com"}],"vendorInformation":{"provider":"Office 365 Security and Compliance","providerVersion":null,"subProvider":null,"vendor":"Microsoft"},"vulnerabilityStates":[]} ::: severityCode=5 ::: tags=[Emails with malicious file that were delivered and later removed -V1.0.0.3,Email messages containing malicious file removed after delivery​] ::: program=azure_security ::: created_at=2024-07-04T18:59:52.7166539Z ::: application=ThreatManagement ::: emailFrom=rob.phillipstd9tj@yxgoamwv.ibrunei1u.site ::: messageType=malicious_session ::: startTimeUTC=2024-07-04T18:59:52.7166539Z ::: emailTo=reese@wayne.com
This is a syslog message from a product called Azure Security by Microsoft. The following fields were extracted from the message:
application: ThreatManagement
emailfrom: rob.phillipstd9tj@yxgoamwv.ibrunei1u.site
emailto: reese@witfoo.com
endtimeutc: 2024-07-11T23:14:26.4166667Z
messagetype: malicious_session
program: azure_security
senderhost: kafka.precinct
sensitivity: normal
severitycode: 5
severitylabel: notice
sourceinfo: unknown
starttimeutc: 2024-07-04T18:59:52.7166539Z
tags: ['Emails with malicious file that were delivered and later removed -V1.0.0.3', 'Email messages containing malicious file removed after delivery\u200b', 'azure_security_alert', 'malicious_session']
streamName: azure_security_alert
serverIP: 123.241.213.162