WitFoo-Artifact ::: message={"device_id":"3dd8398c7bda470895e756116d398bf5","timestamp":"2023-11-10T14:55:46Z","behavior_id":"458","filename":"SystemPropertiesAdvanced.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\SystemPropertiesAdvanced.exe","alleged_filetype":"exe","cmdline":"\"C:\\Windows\\system32\\systempropertiesadvanced.exe\" ","scenario":"ransomware","objective":"Follow Through","tactic":"Impact","tactic_id":"TA0040","technique":"Inhibit System Recovery","technique_id":"T1490","display_name":"VolumeShadowSnapshotDeleted","description":"A process attempted to delete a Volume Shadow Snapshot.","severity":50,"confidence":60,"ioc_type":"","ioc_value":"","ioc_source":"","ioc_description":"","user_name":"fish","user_id":"S-1-12-1-3406249961-1335754729-220956057-3877065534","control_graph_id":"ctg:3dd8398c7bda470895e756116d398bf5:17180569445","triggering_process_graph_id":"pid:3dd8398c7bda470895e756116d398bf5:23840944133","sha256":"e32459fd6d5fbb3e7c98a2b9a21040ced0deba34ee299930d4cfe930651c62ea","md5":"5b087c14fc2288ad5f87d7d404cd6a5b","parent_details":{"parent_sha256":"2aea2888165721ac0f93217cd73a944c1849ab5aa682917bf4d6f80010adff8e","parent_md5":"b446258cc01360c20163078373970150","parent_cmdline":"\"C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe\" -ServerName:microsoft.windows.immersivecontrolpanel","parent_process_graph_id":"pid:3dd8398c7bda470895e756116d398bf5:22975873930"},"pattern_disposition":1024,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_mstarkine":false,"quarantine_file":false,"policy_disabled":false,"kill_parent":false,"operation_blocked":true,"process_blocked":false,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=21.167.40.36 ::: fileHash=e32459fd6d5fbb3e7c98a2b9a21040ced0deba34ee299930d4cfe930651c62ea ::: fileName=SystemPropertiesAdvanced.exe ::: filePath=\Device\HarddiskVolume3\Windows\System32\SystemPropertiesAdvanced.exe ::: userName=fish ::: clientMAC=00ff0d992884 ::: created_at=2023-11-10T14:55:46Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-11-10T14:55:46Z ::: clientHostname=KDHAMI-LT2.undefined ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Falcon by Crowdstrike. The following fields were extracted from the message:
clienthostname: KDHAMI-LT2.undefined
clientmac: 00ff0d992884
filehash: e32459fd6d5fbb3e7c98a2b9a21040ced0deba34ee299930d4cfe930651c62ea
filename: SystemPropertiesAdvanced.exe
filepath: \Device\HarddiskVolume3\Windows\System32\SystemPropertiesAdvanced.exe
messagetype: endpoint_protection_event
productids: [7]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 4
severitylabel: warning
sourceinfo: unknown
starttimeutc: 2023-11-10T14:55:46Z
tags: ['Crowdstrike Detection', 'endpoint_protection_event']
streamName: Crowdstrike Detection
clientIP: 21.167.40.36
userName: fish