WitFoo-Artifact ::: fileHash=1617dbc49cb323ef31c7caea831fe8b9aa9b79ed88eaab0c1febcc169e3abc60 ::: messageType=endpoint_protection_event ::: program=crowdstrike_falcon ::: message={"behaviors":[{"alleged_filetype":"exe","behavior_id":"10381","cmdline":"C:\\WINDOWS\\Explorer.EXE","confidence":80,"control_graph_id":"ctg:3810ea13b98a42adb0ff227fbaf6169f:244813137472","description":"A process attempted to modify files used for Falcon sensor dynamic configuration. This is indicative of an attempt to tamper with Falcon sensor. Investigate the file system operation and process tree.","device_id":"3810ea13b98a42adb0ff227fbaf6169f","display_name":"FileSystemTamperFalconSensorDynamicConfiguration","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","ioc_description":"","ioc_source":"","ioc_type":"","ioc_value":"","md5":"d264f62721590f14bc54344f48a05912","objective":"Keep Access","parent_details":{"parent_cmdline":"C:\\WINDOWS\\system32\\userinit.exe","parent_md5":"5cdc907c7818fbaa658fc9f2abb238f1","parent_process_graph_id":"pid:3810ea13b98a42adb0ff227fbaf6169f:30847093154292","parent_sha256":"0043369966e39c40b96c941ebe06ba53139dc314785f0d2d5d490def51dfb86c"},"pattern_disposition":32768,"pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":true,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":false,"quarantine_file":false,"quarantine_macmeine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"scenario":"suspicious_activity","severity":70,"sha256":"350570713e0a7e3733f59623f880a442e98979b29a8d59b95555625a38ed1054","tactic":"Defense Evasion","tactic_id":"TA0005","technique":"Disable or Modify Tools","technique_id":"T1562.001","template_instance_id":"2933","timestamp":"2024-07-19T12:56:10Z","triggering_process_graph_id":"pid:3810ea13b98a42adb0ff227fbaf6169f:30847100571348","user_id":"S-1-12-1-942142572-1204970278-157880471-3270697999","user_name":"charlie"},{"alleged_filetype":"exe","behavior_id":"10381","cmdline":"\"C:\\Program Files\\PowerShell\\7\\pwsh.exe\" -WorkingDirectory ~","confidence":80,"control_graph_id":"ctg:3810ea13b98a42adb0ff227fbaf6169f:244813137472","description":"A process attempted to modify files used for Falcon sensor dynamic configuration. This is indicative of an attempt to tamper with Falcon sensor. Investigate the file system operation and process tree.","device_id":"3810ea13b98a42adb0ff227fbaf6169f","display_name":"FileSystemTamperFalconSensorDynamicConfiguration","filename":"pwsh.exe","filepath":"\\Device\\HarddiskVolume3\\Program Files\\PowerShell\\7\\pwsh.exe","ioc_description":"","ioc_source":"","ioc_type":"","ioc_value":"","md5":"cab368ed200c5b7e3ff38bca123b6d7b","objective":"Keep Access","parent_details":{"parent_cmdline":"C:\\WINDOWS\\Explorer.EXE","parent_md5":"d264f62721590f14bc54344f48a05912","parent_process_graph_id":"pid:3810ea13b98a42adb0ff227fbaf6169f:30847100571348","parent_sha256":"350570713e0a7e3733f59623f880a442e98979b29a8d59b95555625a38ed1054"},"pattern_disposition":32768,"pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":true,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":false,"quarantine_file":false,"quarantine_macmeine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"scenario":"suspicious_activity","severity":70,"sha256":"1617dbc49cb323ef31c7caea831fe8b9aa9b79ed88eaab0c1febcc169e3abc60","tactic":"Defense Evasion","tactic_id":"TA0005","technique":"Disable or Modify Tools","technique_id":"T1562.001","template_instance_id":"2933","timestamp":"2024-07-19T12:57:19Z","triggering_process_graph_id":"pid:3810ea13b98a42adb0ff227fbaf6169f:30848565445369","user_id":"S-1-12-1-942142572-1204970278-157880471-3270697999","user_name":"charlie"}],"behaviors_processed":["pid:3810ea13b98a42adb0ff227fbaf6169f:30847100571348:10381","pid:3810ea13b98a42adb0ff227fbaf6169f:30848565445369:10381"],"cid":"47b7f823f5804dd9862681183ba9999d","created_timestamp":"2024-07-19T12:56:18.663491715Z","date_updated":"2024-07-19T12:57:33Z","detection_id":"ldt:3810ea13b98a42adb0ff227fbaf6169f:244813137472","device":{"agent_load_flags":"1","agent_local_time":"2024-07-19T01:14:12.642Z","agent_version":"7.15.18513.0","bios_manufacturer":"Dell Inc.","bios_version":"1.21.0","cid":"47b7f823f5804dd9862681183ba9999d","config_id_base":"65994763","config_id_build":"18513","config_id_platform":"3","device_id":"3810ea13b98a42adb0ff227fbaf6169f","external_ip":"97.180.62.75","first_seen":"2023-03-10T14:06:56Z","groups":["6297e232e6564507aa02babd05cadd3c"],"hostname":"SSTEWART-LT3","last_login_timestamp":"2024-06-23T23:05:20Z","last_login_user":"sstewart@acmeelectric.com","last_seen":"2024-07-19T12:48:38Z","local_ip":"152.241.63.73","mac_address":"00-15-5d-26-72-11","major_version":"10","minor_version":"0","modified_timestamp":"2024-07-19T12:48:50Z","os_version":"Windows 10","platform_id":"0","platform_name":"Windows","product_type":"1","product_type_desc":"Workstation","status":"normal","system_manufacturer":"Dell Inc.","system_product_name":"Latitude 5511"},"email_sent":false,"first_behavior":"2024-07-19T12:56:10Z","hostinfo":{"domain":""},"last_behavior":"2024-07-19T12:57:19Z","max_confidence":80,"max_severity":70,"max_severity_displayname":"High","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new"} ::: streamName=Crowdstrike Detection ::: clientIP=152.241.63.73 ::: userName=charlie ::: fileName=pwsh.exe ::: clientHostname=SSTEWART-LT3 ::: clientMAC=00-15-5d-26-72-11 ::: filePath=\Device\HarddiskVolume3\Program Files\PowerShell\7\pwsh.exe
This is a syslog message from a product called Falcon by Crowdstrike. The following fields were extracted from the message:
clienthostname: SSTEWART-LT3
clientmac: 00-15-5d-26-72-11
filehash: 1617dbc49cb323ef31c7caea831fe8b9aa9b79ed88eaab0c1febcc169e3abc60
filename: pwsh.exe
filepath: \Device\HarddiskVolume3\Program Files\PowerShell\7\pwsh.exe
messagetype: endpoint_protection_event
productids: [7]
program: crowdstrike_falcon
senderhost: kafka.precinct
sensitivity: normal
sourceinfo: unknown
tags: ['Crowdstrike Detection', 'endpoint_protection_event']
streamName: Crowdstrike Detection
clientIP: 152.241.63.73
userName: charlie