WitFoo-Artifact ::: userName=charlie ::: clientIP=217.86.253.107 ::: messageType=endpoint_protection_event ::: message={"behaviors":[{"alleged_filetype":"exe","behavior_id":"5728","cmdline":"\"C:\\Program Files (x86)\\GeoComply\\PlayerLocationCheck\\Application\\service.exe\" /version","confidence":100,"control_graph_id":"ctg:18acc81076e241c088970c7453ac7d82:188978627930","description":"This file is classified as Adware/PUP based on its SHA256 hash.","device_id":"18acc81076e241c088970c7453ac7d82","display_name":"","filename":"service.exe","filepath":"\\Device\\HarddiskVolume3\\Program Files (x86)\\GeoComply\\PlayerLocationCheck\\Application\\service.exe","ioc_description":"\\Device\\HarddiskVolume3\\Program Files (x86)\\GeoComply\\PlayerLocationCheck\\Application\\service.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"6c7b762db04c70d286c9fba229383ca55818c09e70dd53ff8174570214a772de","md5":"dffd1e8edb7e8ccdf67151829dbf640d","objective":"Falcon Detection Method","parent_details":{"parent_cmdline":"\"C:\\Program Files (x86)\\GeoComply\\PlayerLocationCheck\\Update\\\\GeoComplyUpdateH.exe\"  /config=C:\\Windows\\Temp\\tmp92240bumbrellaaa\\Update\\\\Update\\upgrade.manifest.xml /appid={AAEB56C9-F527-490C-BE11-134A248B901B} /appver=4.0.1.28 /userid={S-1-5-18-CA6AE347-7E7C7366-5229A58A-E5F9E4D3-558989D8-013BF42A-S-1-16-16384} /upgrade=self /installer_key=TLOoAM7PIv /omaha_server_url=https://ums.geocomply.com/api/v1 /silent=true /autoupdate=true","parent_md5":"0604fc4da47154c218ec23d2e0ac3477","parent_process_graph_id":"pid:18acc81076e241c088970c7453ac7d82:1585323057060","parent_sha256":"486d41a394eac7529a8f90ce4e6d1def46e5508bcf01443d9afe456fbbfdce25"},"pattern_disposition":2176,"pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_mumbrellaine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"scenario":"NGAV","severity":30,"sha256":"6c7b762db04c70d286c9fba229383ca55818c09e70dd53ff8174570214a772de","tactic":"Malware","tactic_id":"CSTA0001","technique":"PUP","technique_id":"CST0013","timestamp":"2024-02-12T11:40:14Z","triggering_process_graph_id":"pid:18acc81076e241c088970c7453ac7d82:1585323607054","user_id":"S-1-5-18","user_name":"charlie"}],"behaviors_processed":["pid:18acc81076e241c088970c7453ac7d82:1585323607054:5728"],"cid":"47b7f823f5804dd9862681183ba9999d","created_timestamp":"2024-02-12T11:40:21.579305261Z","date_updated":"2024-02-12T11:40:56Z","detection_id":"ldt:18acc81076e241c088970c7453ac7d82:188978627930","device":{"agent_load_flags":"1","agent_local_time":"2024-02-02T10:44:08.293Z","agent_version":"7.06.17806.0","bios_manufacturer":"Dell Inc.","bios_version":"1.11.1","cid":"47b7f823f5804dd9862681183ba9999d","config_id_base":"65994763","config_id_build":"17806","config_id_platform":"3","device_id":"18acc81076e241c088970c7453ac7d82","external_ip":"75.63.121.145","first_seen":"2023-03-10T15:38:31Z","groups":["6297e232e6564507aa02babd05cadd3c"],"hostname":"PGRIMES-LT2","last_seen":"2024-02-12T11:15:20Z","local_ip":"217.86.253.107","mac_address":"50-eb-71-a0-77-6a","major_version":"10","minor_version":"0","modified_timestamp":"2024-02-12T11:16:23Z","os_version":"Windows 10","platform_id":"0","platform_name":"Windows","product_type":"1","product_type_desc":"Workstation","status":"normal","system_manufacturer":"Dell Inc.","system_product_name":"Latitude 5501"},"email_sent":false,"first_behavior":"2024-02-12T11:40:14Z","hostinfo":{"domain":""},"last_behavior":"2024-02-12T11:40:14Z","max_confidence":100,"max_severity":30,"max_severity_displayname":"Low","quarantined_files":[{"id":"18acc81076e241c088970c7453ac7d82_6c7b762db04c70d286c9fba229383ca55818c09e70dd53ff8174570214a772de","sha256":"6c7b762db04c70d286c9fba229383ca55818c09e70dd53ff8174570214a772de","state":"quarantined"}],"seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new"} ::: clientMAC=50-eb-71-a0-77-6a ::: fileHash=6c7b762db04c70d286c9fba229383ca55818c09e70dd53ff8174570214a772de ::: filePath=\Device\HarddiskVolume3\Program Files (x86)\GeoComply\PlayerLocationCheck\Application\service.exe ::: program=crowdstrike_falcon ::: streamName=Crowdstrike Detection ::: clientHostname=PGRIMES-LT2 ::: fileName=service.exe
This is a syslog message from a product called Falcon by Crowdstrike. The following fields were extracted from the message:
clienthostname: PGRIMES-LT2
clientmac: 50-eb-71-a0-77-6a
filehash: 6c7b762db04c70d286c9fba229383ca55818c09e70dd53ff8174570214a772de
filename: service.exe
filepath: \Device\HarddiskVolume3\Program Files (x86)\GeoComply\PlayerLocationCheck\Application\service.exe
messagetype: endpoint_protection_event
productids: [7]
program: crowdstrike_falcon
senderhost: kafka.precinct
sensitivity: normal
sourceinfo: unknown
tags: ['Crowdstrike Detection', 'endpoint_protection_event']
streamName: Crowdstrike Detection
clientIP: 217.86.253.107
userName: charlie