WitFoo-Artifact ::: message={"device_id":"3810ea13b98a42adb0ff227fbaf6169f","timestamp":"2023-04-28T18:16:33Z","behavior_id":"5734","filename":"chrome.exe","filepath":"\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe","alleged_filetype":"exe","cmdline":"\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1888,i,13207831043762660145,13298087965543831545,131072 /prefetch:8","scenario":"NGAV","objective":"Falcon Detection Method","tactic":"Macmeine Learning","tactic_id":"CSTA0004","technique":"Cloud-based ML","technique_id":"CST0008","display_name":"","description":"A file written to the file-system meets the File Analysis ML algorithm's high-confidence threshold for malware.","severity":70,"confidence":70,"ioc_type":"","ioc_value":"","ioc_source":"","ioc_description":"","user_name":"alice","user_id":"S-1-12-1-942142572-1204970278-157880471-3270697999","control_graph_id":"ctg:3810ea13b98a42adb0ff227fbaf6169f:12886709935","triggering_process_graph_id":"pid:3810ea13b98a42adb0ff227fbaf6169f:556881520473","sha256":"c0c9b49dfdfeb829001924231ed9a1cdaf1c239cfb5f0810e2367dd2959a9f0e","md5":"43a43c601f1b1584cdcfc1452cdcb165","parent_details":{"parent_sha256":"c0c9b49dfdfeb829001924231ed9a1cdaf1c239cfb5f0810e2367dd2959a9f0e","parent_md5":"43a43c601f1b1584cdcfc1452cdcb165","parent_cmdline":"\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --restart","parent_process_graph_id":"pid:3810ea13b98a42adb0ff227fbaf6169f:556876742408"},"pattern_disposition":128,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_macmeine":false,"quarantine_file":true,"policy_disabled":false,"kill_parent":false,"operation_blocked":false,"process_blocked":false,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=236.155.121.93 ::: fileHash=c0c9b49dfdfeb829001924231ed9a1cdaf1c239cfb5f0810e2367dd2959a9f0e ::: fileName=chrome.exe ::: filePath=\Device\HarddiskVolume3\Program Files\Google\Chrome\Application\chrome.exe ::: userName=alice ::: clientMAC=00ffc8e92fdb ::: created_at=2023-04-28T18:16:33Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-04-28T18:16:33Z ::: clientHostname=SSTEWART-LT3.undefined ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Falcon by Crowdstrike. The following fields were extracted from the message:
clienthostname: SSTEWART-LT3.undefined
clientmac: 00ffc8e92fdb
filehash: c0c9b49dfdfeb829001924231ed9a1cdaf1c239cfb5f0810e2367dd2959a9f0e
filename: chrome.exe
filepath: \Device\HarddiskVolume3\Program Files\Google\Chrome\Application\chrome.exe
messagetype: endpoint_protection_event
productids: [7]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 4
severitylabel: warning
sourceinfo: unknown
starttimeutc: 2023-04-28T18:16:33Z
tags: ['Crowdstrike Detection', 'endpoint_protection_event']
streamName: Crowdstrike Detection
clientIP: 236.155.121.93
userName: alice