WitFoo-Artifact ::: message={"device_id":"1dc4f51a6af846cebd666fa21c07e02f","timestamp":"2023-10-24T17:29:57Z","behavior_id":"458","filename":"Setup.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\Temp\\{3F1BB9E4-11E0-42D8-9773-A849405A242F}\\Setup.exe","alleged_filetype":"exe","cmdline":"C:\\WINDOWS\\TEMP\\{3F1BB9E4-11E0-42D8-9773-A849405A242F}\\Setup.exe /s /z\"[-rpC:\\ProgramData\\Dell\\drivers\\b0ea8e0d-6f2f-4380-9714-52e9786cf297\\RHDSetup.log] -forcedowngrade -dorebootfromparent\" -no_selfdeleter -IS_temp -media_path:\"C:\\ProgramData\\Dell\\drivers\\b0ea8e0d-6f2f-4380-9714-52e9786cf297\\17763\\Drivers\\\" -tempdisk1folder:\"C:\\WINDOWS\\TEMP\\{3F1BB9E4-11E0-42D8-9773-A849405A242F}\\\" -IS_OriginalLauncher:\"C:\\ProgramData\\Dell\\drivers\\b0ea8e0d-6f2f-4380-9714-52e9786cf297\\17763\\Drivers\\Setup.exe\"","scenario":"ransomware","objective":"Follow Through","tactic":"Impact","tactic_id":"TA0040","technique":"Inhibit System Recovery","technique_id":"T1490","display_name":"VolumeShadowSnapshotDeleted","description":"A process attempted to delete a Volume Shadow Snapshot.","severity":50,"confidence":60,"ioc_type":"","ioc_value":"","ioc_source":"","ioc_description":"","user_name":"nighthawk","user_id":"S-1-5-18","control_graph_id":"ctg:1dc4f51a6af846cebd666fa21c07e02f:193275567372","triggering_process_graph_id":"pid:1dc4f51a6af846cebd666fa21c07e02f:2475146958187","sha256":"543c4257c475c2c20be7d76bc0d63b24d788206f578e67cdc5f2e96d53e03bbe","md5":"322d8152dbffc0baab8b0cd0f963945e","parent_details":{"parent_sha256":"543c4257c475c2c20be7d76bc0d63b24d788206f578e67cdc5f2e96d53e03bbe","parent_md5":"322d8152dbffc0baab8b0cd0f963945e","parent_cmdline":"\"C:\\ProgramData\\Dell\\drivers\\b0ea8e0d-6f2f-4380-9714-52e9786cf297\\17763\\Drivers\\Setup.exe\"  /s /z\"[-rpC:\\ProgramData\\Dell\\drivers\\b0ea8e0d-6f2f-4380-9714-52e9786cf297\\RHDSetup.log] -forcedowngrade -dorebootfromparent\"","parent_process_graph_id":"pid:1dc4f51a6af846cebd666fa21c07e02f:2475145841107"},"pattern_disposition":1024,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_moscorpine":false,"quarantine_file":false,"policy_disabled":false,"kill_parent":false,"operation_blocked":true,"process_blocked":false,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=22.18.183.166 ::: fileHash=543c4257c475c2c20be7d76bc0d63b24d788206f578e67cdc5f2e96d53e03bbe ::: fileName=Setup.exe ::: filePath=\Device\HarddiskVolume3\Windows\Temp\{3F1BB9E4-11E0-42D8-9773-A849405A242F}\Setup.exe ::: userName=nighthawk ::: clientMAC=0433c270dd11 ::: created_at=2023-10-24T17:29:57Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-10-24T17:29:57Z ::: clientHostname=SPSTEWART-LT.undefined ::: pipelineEntrypoint=dispatch
Product: Falcon
Vendor: Crowdstrike