WitFoo-Artifact ::: message={"device_id":"dfbb62cf44104a3d85ad81cfd5bebb3c","timestamp":"2023-08-29T18:24:34Z","template_instance_id":"1384","behavior_id":"10447","filename":"PsExec.exe","filepath":"\\Device\\HarddiskVolume1\\Users\\bob\\Downloads\\PSTools\\PsExec.exe","alleged_filetype":"exe","cmdline":"\"C:\\Users\\bob\\Downloads\\PSTools\\PsExec.exe\" -i -s cmd.exe","scenario":"suspicious_activity","objective":"Gain Access","tactic":"Privilege Escalation","tactic_id":"TA0004","technique":"Abuse Elevation Control Mechanism","technique_id":"T1548","display_name":"SuspiciousPrivEsc","description":"A process has escalated privileges, this could be as a result of an adversary's attempt to bypass access controls or as part of legitimate system administration. Please check the process tree and surrounding events to determine if this activity was expected.","severity":30,"confidence":80,"ioc_type":"","ioc_value":"","ioc_source":"","ioc_description":"","user_name":"bob","user_id":"S-1-5-21-1959957726-1537299114-1298153393-94611","control_graph_id":"ctg:dfbb62cf44104a3d85ad81cfd5bebb3c:674313837342","triggering_process_graph_id":"pid:dfbb62cf44104a3d85ad81cfd5bebb3c:675598189738","sha256":"078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b","md5":"24a648a48741b1ac809e47b9543c6f12","parent_details":{"parent_sha256":"de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c","parent_md5":"7353f60b1739074eb17c5f4dddefe239","parent_cmdline":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" ","parent_process_graph_id":"pid:dfbb62cf44104a3d85ad81cfd5bebb3c:675576884426"},"pattern_disposition":0,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_mwayneine":false,"quarantine_file":false,"policy_disabled":false,"kill_parent":false,"operation_blocked":false,"process_blocked":false,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=198.90.191.201 ::: fileHash=078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b ::: fileName=PsExec.exe ::: filePath=\Device\HarddiskVolume1\Users\bob\Downloads\PSTools\PsExec.exe ::: userName=bob ::: clientMAC=0edeb6ae9241 ::: created_at=2023-08-29T18:24:34Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-08-29T18:24:34Z ::: clientHostname=NVIINFRDEVAPP02.devnvi.wayneint.com ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Falcon by Crowdstrike. The following fields were extracted from the message:
clienthostname: NVIINFRDEVAPP02.devnvi.paygoint.com
clientmac: 0edeb6ae9241
filehash: 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b
filename: PsExec.exe
filepath: \Device\HarddiskVolume1\Users\INFRDEV-pentest\Downloads\PSTools\PsExec.exe
messagetype: endpoint_protection_event
productids: [7]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 4
severitylabel: warning
sourceinfo: unknown
starttimeutc: 2023-08-29T18:24:34Z
tags: ['Crowdstrike Detection', 'endpoint_protection_event']
streamName: Crowdstrike Detection
clientIP: 198.90.191.201
userName: bob