WitFoo-Artifact ::: message={"device_id":"dfbb62cf44104a3d85ad81cfd5bebb3c","timestamp":"2023-08-09T17:22:37Z","template_instance_id":"9162","behavior_id":"10250","filename":"reg.exe","filepath":"\\Device\\HarddiskVolume1\\Windows\\System32\\reg.exe","alleged_filetype":"exe","cmdline":"reg  query HKLM /f password /t REG_SZ /s","scenario":"suspicious_activity","objective":"Explore","tactic":"Discovery","tactic_id":"TA0007","technique":"System Network Configuration Discovery","technique_id":"T1016","display_name":"ReconCommands2","description":"A process tree contains characteristics often asacmeiated with an adversary performing reconnaissance. This might be related to expected administrator activity. If this is unexpected, review the process tree.","severity":70,"confidence":80,"ioc_type":"hash_sha256","ioc_value":"19316d4266d0b776d9b2a05d5903d8cbc8f0ea1520e9c2a7e6d5960b6fa4dcaf","ioc_source":"library_load","ioc_description":"\\Device\\HarddiskVolume1\\Windows\\System32\\reg.exe","user_name":"janedoe","user_id":"S-1-5-21-3008783154-4189408168-2363429128-1618","control_graph_id":"ctg:dfbb62cf44104a3d85ad81cfd5bebb3c:597003887738","triggering_process_graph_id":"pid:dfbb62cf44104a3d85ad81cfd5bebb3c:599750968280","sha256":"19316d4266d0b776d9b2a05d5903d8cbc8f0ea1520e9c2a7e6d5960b6fa4dcaf","md5":"8a93acac33151793f8d52000071c0b06","parent_details":{"parent_sha256":"bc866cfcdda37e24dc2634dc282c7a0e6f55209da17a8fa105b07414c0e7c527","parent_md5":"911d039e71583a07320b32bde22f8e22","parent_cmdline":"\"C:\\Windows\\system32\\cmd.exe\" ","parent_process_graph_id":"pid:dfbb62cf44104a3d85ad81cfd5bebb3c:599747588388"},"pattern_disposition":2048,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_macmeine":false,"quarantine_file":false,"policy_disabled":false,"kill_parent":false,"operation_blocked":false,"process_blocked":true,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=141.133.24.38 ::: fileHash=19316d4266d0b776d9b2a05d5903d8cbc8f0ea1520e9c2a7e6d5960b6fa4dcaf ::: fileName=reg.exe ::: filePath=\Device\HarddiskVolume1\Windows\System32\reg.exe ::: userName=janedoe ::: clientMAC=0edeb6ae9241 ::: created_at=2023-08-09T17:22:37Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-08-09T17:22:37Z ::: clientHostname=NVIINFRDEVAPP02.devnvi.acmeint.com ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Falcon by Crowdstrike. The following fields were extracted from the message:
clienthostname: NVIINFRDEVAPP02.devnvi.paygoint.com
clientmac: 0edeb6ae9241
filehash: 19316d4266d0b776d9b2a05d5903d8cbc8f0ea1520e9c2a7e6d5960b6fa4dcaf
filename: reg.exe
filepath: \Device\HarddiskVolume1\Windows\System32\reg.exe
messagetype: endpoint_protection_event
productids: [7]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 4
severitylabel: warning
sourceinfo: unknown
starttimeutc: 2023-08-09T17:22:37Z
tags: ['Crowdstrike Detection', 'endpoint_protection_event']
streamName: Crowdstrike Detection
clientIP: 141.133.24.38
userName: janedoe