WitFoo-Artifact ::: message={"device_id":"99994fe08640433a925c1d14d7175b2b","timestamp":"2023-10-18T15:34:44Z","behavior_id":"5737","filename":"VBCSCompiler.exe","filepath":"\\Device\\HarddiskVolume3\\PayGo\\UAT_Greer\\Portal\\bin\\roslyn\\VBCSCompiler.exe","alleged_filetype":"exe","cmdline":"\"D:\\PayGo\\UAT_Greer\\Portal\\bin\\roslyn\\VBCSCompiler.exe\" \"-pipename:nighthawk.F.Z_dua+xQpvLuzUtnGY1TVjD6x\"","scenario":"NGAV","objective":"Falcon Detection Method","tactic":"Mstarkine Learning","tactic_id":"CSTA0004","technique":"Sensor-based ML","technique_id":"CST0007","display_name":"Mstarkine Learning Identified Medium Confidence Malicious File","description":"A file written to the file system meets the on-sensor mstarkine learning medium confidence threshold for malicious files. Detection is based on a high degree of entropy, packing, anti-malware evasion, or other similarity to known malware.","severity":50,"confidence":50,"ioc_type":"hash_sha256","ioc_value":"4a5c38f64a2bfa8ce166f206f855e2be05899973c4cf01e37ae3f7eea6b902a9","ioc_source":"file_write","ioc_description":"\\Device\\HarddiskVolume1\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Temporary ASP.NET Files\\portal\\6fc660c9\\a8ee7210\\App_Web_jjafca5y.dll","user_name":"nighthawk","user_id":"S-1-5-21-1959957726-1537299114-1298153393-1290","control_graph_id":"ctg:99994fe08640433a925c1d14d7175b2b:77309819454","triggering_process_graph_id":"pid:99994fe08640433a925c1d14d7175b2b:761467075508","sha256":"4a5c38f64a2bfa8ce166f206f855e2be05899973c4cf01e37ae3f7eea6b902a9","md5":"","parent_details":{"parent_sha256":"29fc4e96f2553c5c309ee321a18ee5ad18686b5586e64422c1a7870748ce908d","parent_md5":"7dc642657b7cb790d687332f6d18feae","parent_cmdline":"\"D:\\PayGo\\UAT_Greer\\Portal\\bin\\roslyn\\csc.exe\" /shared /keepalive:\"10\" /noconfig  /fullpaths @\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Temporary ASP.NET Files\\portal\\6fc660c9\\a8ee7210\\uprfi4r5.cmdline\"","parent_process_graph_id":"pid:99994fe08640433a925c1d14d7175b2b:761464850144"},"pattern_disposition":128,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_mstarkine":false,"quarantine_file":true,"policy_disabled":false,"kill_parent":false,"operation_blocked":false,"process_blocked":false,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=1.49.13.120 ::: fileHash=4a5c38f64a2bfa8ce166f206f855e2be05899973c4cf01e37ae3f7eea6b902a9 ::: fileName=VBCSCompiler.exe ::: filePath=\Device\HarddiskVolume3\PayGo\UAT_Greer\Portal\bin\roslyn\VBCSCompiler.exe ::: userName=nighthawk ::: clientMAC=0a3ab18031e1 ::: created_at=2023-10-18T15:34:44Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-10-18T15:34:44Z ::: clientHostname=NVISAASUATWEB01.devnvi.starkint.com ::: pipelineEntrypoint=dispatch
This is a syslog message from a product called Falcon by Crowdstrike. The following fields were extracted from the message:
clienthostname: NVISAASUATWEB01.devnvi.paygoint.com
clientmac: 0a3ab18031e1
filehash: 4a5c38f64a2bfa8ce166f206f855e2be05899973c4cf01e37ae3f7eea6b902a9
filename: VBCSCompiler.exe
filepath: \Device\HarddiskVolume3\PayGo\UAT_Greer\Portal\bin\roslyn\VBCSCompiler.exe
messagetype: endpoint_protection_event
productids: [7]
senderhost: kafka.precinct
sensitivity: normal
severitycode: 4
severitylabel: warning
sourceinfo: unknown
starttimeutc: 2023-10-18T15:34:44Z
tags: ['Crowdstrike Detection', 'endpoint_protection_event']
streamName: Crowdstrike Detection
clientIP: 1.49.13.120
userName: nighthawk