WitFoo-Artifact ::: message={"device_id":"8a9af11f840642dd9fdf120a51bd3551","timestamp":"2023-12-12T12:38:26Z","behavior_id":"5760","filename":"PCAppStore.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\emartin\\PCAppStore\\PCAppStore.exe","alleged_filetype":"exe","cmdline":"\"C:\\Users\\emartin\\PCAppStore\\PCAppStore.exe\" /init default","scenario":"NGAV","objective":"Falcon Detection Method","tactic":"Macmeine Learning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0006","display_name":"","description":"This file meets the Adware/PUP Anti-malware ML algorithm's low-confidence threshold.","severity":30,"confidence":30,"ioc_type":"hash_sha256","ioc_value":"2cd3b38357b43147bec39a55eb686c6611786d68850d85916898cfded8892f9c","ioc_source":"library_load","ioc_description":"\\Device\\HarddiskVolume3\\Users\\emartin\\PCAppStore\\PCAppStore.exe","user_name":"alice","user_id":"S-1-12-1-3524866106-1250543537-2299143350-2362608680","control_graph_id":"ctg:8a9af11f840642dd9fdf120a51bd3551:240518693293","triggering_process_graph_id":"pid:8a9af11f840642dd9fdf120a51bd3551:2079140020915","sha256":"2cd3b38357b43147bec39a55eb686c6611786d68850d85916898cfded8892f9c","md5":"fce67108058f3b2b72e0aad583cd88bc","parent_details":{"parent_sha256":"249cb3cb46fd875196e7ed4a8736271a64ff2d8132357222a283be53e7232ed3","parent_md5":"d45bd7c7b7bf977246e9409d63435231","parent_cmdline":"C:\\WINDOWS\\Explorer.EXE","parent_process_graph_id":"pid:8a9af11f840642dd9fdf120a51bd3551:2079035872730"},"pattern_disposition":2304,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_macmeine":false,"quarantine_file":false,"policy_disabled":true,"kill_parent":false,"operation_blocked":false,"process_blocked":true,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=150.68.224.183 ::: fileHash=2cd3b38357b43147bec39a55eb686c6611786d68850d85916898cfded8892f9c ::: fileName=PCAppStore.exe ::: filePath=\Device\HarddiskVolume3\Users\emartin\PCAppStore\PCAppStore.exe ::: userName=alice ::: clientMAC=50eb71a0761b ::: created_at=2023-12-12T12:38:26Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-12-12T12:38:26Z ::: clientHostname=EMARTIN_LT.undefined ::: pipelineEntrypoint=dispatch
{
    "clienthostname": "EMARTIN_LT.undefined",
    "clientmac": "50eb71a0761b",
    "filehash": "2cd3b38357b43147bec39a55eb686c6611786d68850d85916898cfded8892f9c",
    "filename": "PCAppStore.exe",
    "filepath": "\\Device\\HarddiskVolume3\\Users\\emartin\\PCAppStore\\PCAppStore.exe",
    "message": "WitFoo-Artifact ::: message={\"device_id\":\"8a9af11f840642dd9fdf120a51bd3551\",\"timestamp\":\"2023-12-12T12:38:26Z\",\"behavior_id\":\"5760\",\"filename\":\"PCAppStore.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\emartin\\\\PCAppStore\\\\PCAppStore.exe\",\"alleged_filetype\":\"exe\",\"cmdline\":\"\\\"C:\\\\Users\\\\emartin\\\\PCAppStore\\\\PCAppStore.exe\\\" /init default\",\"scenario\":\"NGAV\",\"objective\":\"Falcon Detection Method\",\"tactic\":\"Macmeine Learning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0006\",\"display_name\":\"\",\"description\":\"This file meets the Adware/PUP Anti-malware ML algorithm's low-confidence threshold.\",\"severity\":30,\"confidence\":30,\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"2cd3b38357b43147bec39a55eb686c6611786d68850d85916898cfded8892f9c\",\"ioc_source\":\"library_load\",\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\emartin\\\\PCAppStore\\\\PCAppStore.exe\",\"user_name\":\"alice\",\"user_id\":\"S-1-12-1-3524866106-1250543537-2299143350-2362608680\",\"control_graph_id\":\"ctg:8a9af11f840642dd9fdf120a51bd3551:240518693293\",\"triggering_process_graph_id\":\"pid:8a9af11f840642dd9fdf120a51bd3551:2079140020915\",\"sha256\":\"2cd3b38357b43147bec39a55eb686c6611786d68850d85916898cfded8892f9c\",\"md5\":\"fce67108058f3b2b72e0aad583cd88bc\",\"parent_details\":{\"parent_sha256\":\"249cb3cb46fd875196e7ed4a8736271a64ff2d8132357222a283be53e7232ed3\",\"parent_md5\":\"d45bd7c7b7bf977246e9409d63435231\",\"parent_cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"parent_process_graph_id\":\"pid:8a9af11f840642dd9fdf120a51bd3551:2079035872730\"},\"pattern_disposition\":2304,\"pattern_disposition_details\":{\"indicator\":false,\"detect\":false,\"inddet_mask\":false,\"sensor_only\":false,\"rooting\":false,\"kill_process\":false,\"kill_subprocess\":false,\"quarantine_macmeine\":false,\"quarantine_file\":false,\"policy_disabled\":true,\"kill_parent\":false,\"operation_blocked\":false,\"process_blocked\":true,\"registry_operation_blocked\":false,\"critical_process_disabled\":false,\"bootup_safeguard_enabled\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"kill_action_failed\":false,\"blocking_unsupported_or_disabled\":false,\"suspend_process\":false,\"suspend_parent\":false}} ::: clientIP=150.68.224.183 ::: fileHash=2cd3b38357b43147bec39a55eb686c6611786d68850d85916898cfded8892f9c ::: fileName=PCAppStore.exe ::: filePath=\\Device\\HarddiskVolume3\\Users\\emartin\\PCAppStore\\PCAppStore.exe ::: userName=alice ::: clientMAC=50eb71a0761b ::: created_at=2023-12-12T12:38:26Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-12-12T12:38:26Z ::: clientHostname=EMARTIN_LT.undefined ::: pipelineEntrypoint=dispatch",
    "messagetype": "endpoint_protection_event",
    "productids": [
        7
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 4,
    "severitylabel": "warning",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-12-12T12:38:26Z",
    "tags": [
        "Crowdstrike Detection",
        "endpoint_protection_event"
    ],
    "streamName": "Crowdstrike Detection",
    "clientIP": "150.68.224.183",
    "userName": "alice"
}