WitFoo-Artifact ::: message={"device_id":"8a9af11f840642dd9fdf120a51bd3551","timestamp":"2023-11-14T16:13:29Z","behavior_id":"4748","filename":"msedge.exe","filepath":"\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe","alleged_filetype":"exe","cmdline":"\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2052,i,11849213268837189055,16613787588176336786,262144 /prefetch:3","scenario":"NGAV","objective":"Falcon Detection Method","tactic":"Malware","tactic_id":"CSTA0001","technique":"PUP","technique_id":"CST0013","display_name":"Detect OnWrite Adware/PUP Hash","description":"A file written to the file-system was classified as Adware/PUP based on its SHA256 hash.","severity":30,"confidence":100,"ioc_type":"","ioc_value":"","ioc_source":"","ioc_description":"","user_name":"bob","user_id":"S-1-12-1-3524866106-1250543537-2299143350-2362608680","control_graph_id":"ctg:8a9af11f840642dd9fdf120a51bd3551:227635083624","triggering_process_graph_id":"pid:8a9af11f840642dd9fdf120a51bd3551:1877720048920","sha256":"68455b27eddb80b636127783478f0014aeb80abe98d788c37f18b342ae15be27","md5":"d5174a0327dd4ad65f24959049c7113d","parent_details":{"parent_sha256":"68455b27eddb80b636127783478f0014aeb80abe98d788c37f18b342ae15be27","parent_md5":"d5174a0327dd4ad65f24959049c7113d","parent_cmdline":"\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --profile-directory=Default","parent_process_graph_id":"pid:8a9af11f840642dd9fdf120a51bd3551:1877714451043"},"pattern_disposition":128,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_mumbrellaine":false,"quarantine_file":true,"policy_disabled":false,"kill_parent":false,"operation_blocked":false,"process_blocked":false,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=210.218.246.176 ::: fileHash=68455b27eddb80b636127783478f0014aeb80abe98d788c37f18b342ae15be27 ::: fileName=msedge.exe ::: filePath=\Device\HarddiskVolume3\Program Files (x86)\Microsoft\Edge\Application\msedge.exe ::: userName=bob ::: clientMAC=00ff16b691c6 ::: created_at=2023-11-14T16:13:29Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-11-14T16:13:29Z ::: clientHostname=EMARTIN_LT.undefined ::: pipelineEntrypoint=dispatch
{
    "clienthostname": "EMARTIN_LT.undefined",
    "clientmac": "00ff16b691c6",
    "filehash": "68455b27eddb80b636127783478f0014aeb80abe98d788c37f18b342ae15be27",
    "filename": "msedge.exe",
    "filepath": "\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
    "message": "WitFoo-Artifact ::: message={\"device_id\":\"8a9af11f840642dd9fdf120a51bd3551\",\"timestamp\":\"2023-11-14T16:13:29Z\",\"behavior_id\":\"4748\",\"filename\":\"msedge.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe\",\"alleged_filetype\":\"exe\",\"cmdline\":\"\\\"C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe\\\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2052,i,11849213268837189055,16613787588176336786,262144 /prefetch:3\",\"scenario\":\"NGAV\",\"objective\":\"Falcon Detection Method\",\"tactic\":\"Malware\",\"tactic_id\":\"CSTA0001\",\"technique\":\"PUP\",\"technique_id\":\"CST0013\",\"display_name\":\"Detect OnWrite Adware/PUP Hash\",\"description\":\"A file written to the file-system was classified as Adware/PUP based on its SHA256 hash.\",\"severity\":30,\"confidence\":100,\"ioc_type\":\"\",\"ioc_value\":\"\",\"ioc_source\":\"\",\"ioc_description\":\"\",\"user_name\":\"bob\",\"user_id\":\"S-1-12-1-3524866106-1250543537-2299143350-2362608680\",\"control_graph_id\":\"ctg:8a9af11f840642dd9fdf120a51bd3551:227635083624\",\"triggering_process_graph_id\":\"pid:8a9af11f840642dd9fdf120a51bd3551:1877720048920\",\"sha256\":\"68455b27eddb80b636127783478f0014aeb80abe98d788c37f18b342ae15be27\",\"md5\":\"d5174a0327dd4ad65f24959049c7113d\",\"parent_details\":{\"parent_sha256\":\"68455b27eddb80b636127783478f0014aeb80abe98d788c37f18b342ae15be27\",\"parent_md5\":\"d5174a0327dd4ad65f24959049c7113d\",\"parent_cmdline\":\"\\\"C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe\\\" --profile-directory=Default\",\"parent_process_graph_id\":\"pid:8a9af11f840642dd9fdf120a51bd3551:1877714451043\"},\"pattern_disposition\":128,\"pattern_disposition_details\":{\"indicator\":false,\"detect\":false,\"inddet_mask\":false,\"sensor_only\":false,\"rooting\":false,\"kill_process\":false,\"kill_subprocess\":false,\"quarantine_mumbrellaine\":false,\"quarantine_file\":true,\"policy_disabled\":false,\"kill_parent\":false,\"operation_blocked\":false,\"process_blocked\":false,\"registry_operation_blocked\":false,\"critical_process_disabled\":false,\"bootup_safeguard_enabled\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"kill_action_failed\":false,\"blocking_unsupported_or_disabled\":false,\"suspend_process\":false,\"suspend_parent\":false}} ::: clientIP=210.218.246.176 ::: fileHash=68455b27eddb80b636127783478f0014aeb80abe98d788c37f18b342ae15be27 ::: fileName=msedge.exe ::: filePath=\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe ::: userName=bob ::: clientMAC=00ff16b691c6 ::: created_at=2023-11-14T16:13:29Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-11-14T16:13:29Z ::: clientHostname=EMARTIN_LT.undefined ::: pipelineEntrypoint=dispatch",
    "messagetype": "endpoint_protection_event",
    "productids": [
        7
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 4,
    "severitylabel": "warning",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-11-14T16:13:29Z",
    "tags": [
        "Crowdstrike Detection",
        "endpoint_protection_event"
    ],
    "streamName": "Crowdstrike Detection",
    "clientIP": "210.218.246.176",
    "userName": "bob"
}