WitFoo-Artifact ::: clientIP=12.98.97.254 ::: clientHostname=SSTEWART-LT3 ::: userName=charlie ::: filePath=\Device\HarddiskVolume3\ProgramData\Package Cwaynee\{0f788410-644e-4b6e-8a93-8014fcfa3383}\triPOS Setup.exe ::: fileHash=978ff3ff4d68cd1084e12aca5914bdfd1797e56173b604d13a1ae7d58909be9b ::: fileName=triPOS Setup.exe ::: clientMAC=00-ff-c8-e9-2f-db ::: streamName=Crowdstrike Detection ::: program=crowdstrike_falcon ::: message={"behaviors":[{"alleged_filetype":"exe","behavior_id":"458","cmdline":"\"C:\\ProgramData\\Package Cwaynee\\{0f788410-644e-4b6e-8a93-8014fcfa3383}\\triPOS Setup.exe\" -q -burn.elevated BurnPipe.{157CF558-98A5-411B-B7A5-99D480459896} {CED9AE2D-1FF1-49C4-B123-2E248FB6B4F0} 29776","confidence":60,"control_graph_id":"ctg:3810ea13b98a42adb0ff227fbaf6169f:154619006482","description":"A process attempted to delete a Volume Shadow Snapshot.","device_id":"3810ea13b98a42adb0ff227fbaf6169f","display_name":"VolumeShadowSnapshotDeleted","filename":"triPOS Setup.exe","filepath":"\\Device\\HarddiskVolume3\\ProgramData\\Package Cwaynee\\{0f788410-644e-4b6e-8a93-8014fcfa3383}\\triPOS Setup.exe","ioc_description":"","ioc_source":"","ioc_type":"","ioc_value":"","md5":"6468e92d1ad408df05df38c1192de790","objective":"Follow Through","parent_details":{"parent_cmdline":"\"C:\\ProgramData\\Package Cwaynee\\{0f788410-644e-4b6e-8a93-8014fcfa3383}\\triPOS Setup.exe\" -burn.clean.room=\"C:\\ProgramData\\Package Cwaynee\\{0f788410-644e-4b6e-8a93-8014fcfa3383}\\triPOS Setup.exe\" -burn.filehandle.attwayneed=536 -burn.filehandle.self=544 /uninstall","parent_md5":"6468e92d1ad408df05df38c1192de790","parent_process_graph_id":"pid:3810ea13b98a42adb0ff227fbaf6169f:22826319327295","parent_sha256":"978ff3ff4d68cd1084e12aca5914bdfd1797e56173b604d13a1ae7d58909be9b"},"pattern_disposition":1024,"pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":true,"policy_disabled":false,"process_blocked":false,"quarantine_file":false,"quarantine_mwayneine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"scenario":"ransomware","severity":50,"sha256":"978ff3ff4d68cd1084e12aca5914bdfd1797e56173b604d13a1ae7d58909be9b","tactic":"Impact","tactic_id":"TA0040","technique":"Inhibit System Recovery","technique_id":"T1490","timestamp":"2024-05-10T15:46:45Z","triggering_process_graph_id":"pid:3810ea13b98a42adb0ff227fbaf6169f:22826338144393","user_id":"S-1-12-1-942142572-1204970278-157880471-3270697999","user_name":"charlie"}],"behaviors_processed":["pid:3810ea13b98a42adb0ff227fbaf6169f:22826338144393:458"],"cid":"47b7f823f5804dd9862681183ba9999d","created_timestamp":"2024-05-10T15:46:52.112770748Z","date_updated":"2024-05-10T15:46:56Z","detection_id":"ldt:3810ea13b98a42adb0ff227fbaf6169f:154619006482","device":{"agent_load_flags":"1","agent_local_time":"2024-05-08T23:47:06.818Z","agent_version":"7.13.18308.0","bios_manufacturer":"Dell Inc.","bios_version":"1.21.0","cid":"47b7f823f5804dd9862681183ba9999d","config_id_base":"65994763","config_id_build":"18308","config_id_platform":"3","device_id":"3810ea13b98a42adb0ff227fbaf6169f","external_ip":"75.231.140.51","first_seen":"2023-03-10T14:06:56Z","groups":["6297e232e6564507aa02babd05cadd3c"],"hostname":"SSTEWART-LT3","last_login_timestamp":"2024-05-09T03:50:36Z","last_login_user":"charlie","last_seen":"2024-05-10T15:27:29Z","local_ip":"12.98.97.254","mac_address":"00-ff-c8-e9-2f-db","major_version":"10","minor_version":"0","modified_timestamp":"2024-05-10T15:29:07Z","os_version":"Windows 10","platform_id":"0","platform_name":"Windows","product_type":"1","product_type_desc":"Workstation","status":"normal","system_manufacturer":"Dell Inc.","system_product_name":"Latitude 5511"},"email_sent":false,"first_behavior":"2024-05-10T15:46:45Z","hostinfo":{"domain":""},"last_behavior":"2024-05-10T15:46:45Z","max_confidence":60,"max_severity":50,"max_severity_displayname":"Medium","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new"} ::: messageType=endpoint_protection_event
{
    "clienthostname": "SSTEWART-LT3",
    "clientmac": "00-ff-c8-e9-2f-db",
    "filehash": "978ff3ff4d68cd1084e12aca5914bdfd1797e56173b604d13a1ae7d58909be9b",
    "filename": "triPOS Setup.exe",
    "filepath": "\\Device\\HarddiskVolume3\\ProgramData\\Package Cache\\{0f788410-644e-4b6e-8a93-8014fcfa3383}\\triPOS Setup.exe",
    "message": "WitFoo-Artifact ::: clientIP=12.98.97.254 ::: clientHostname=SSTEWART-LT3 ::: userName=charlie ::: filePath=\\Device\\HarddiskVolume3\\ProgramData\\Package Cwaynee\\{0f788410-644e-4b6e-8a93-8014fcfa3383}\\triPOS Setup.exe ::: fileHash=978ff3ff4d68cd1084e12aca5914bdfd1797e56173b604d13a1ae7d58909be9b ::: fileName=triPOS Setup.exe ::: clientMAC=00-ff-c8-e9-2f-db ::: streamName=Crowdstrike Detection ::: program=crowdstrike_falcon ::: message={\"behaviors\":[{\"alleged_filetype\":\"exe\",\"behavior_id\":\"458\",\"cmdline\":\"\\\"C:\\\\ProgramData\\\\Package Cwaynee\\\\{0f788410-644e-4b6e-8a93-8014fcfa3383}\\\\triPOS Setup.exe\\\" -q -burn.elevated BurnPipe.{157CF558-98A5-411B-B7A5-99D480459896} {CED9AE2D-1FF1-49C4-B123-2E248FB6B4F0} 29776\",\"confidence\":60,\"control_graph_id\":\"ctg:3810ea13b98a42adb0ff227fbaf6169f:154619006482\",\"description\":\"A process attempted to delete a Volume Shadow Snapshot.\",\"device_id\":\"3810ea13b98a42adb0ff227fbaf6169f\",\"display_name\":\"VolumeShadowSnapshotDeleted\",\"filename\":\"triPOS Setup.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\ProgramData\\\\Package Cwaynee\\\\{0f788410-644e-4b6e-8a93-8014fcfa3383}\\\\triPOS Setup.exe\",\"ioc_description\":\"\",\"ioc_source\":\"\",\"ioc_type\":\"\",\"ioc_value\":\"\",\"md5\":\"6468e92d1ad408df05df38c1192de790\",\"objective\":\"Follow Through\",\"parent_details\":{\"parent_cmdline\":\"\\\"C:\\\\ProgramData\\\\Package Cwaynee\\\\{0f788410-644e-4b6e-8a93-8014fcfa3383}\\\\triPOS Setup.exe\\\" -burn.clean.room=\\\"C:\\\\ProgramData\\\\Package Cwaynee\\\\{0f788410-644e-4b6e-8a93-8014fcfa3383}\\\\triPOS Setup.exe\\\" -burn.filehandle.attwayneed=536 -burn.filehandle.self=544 /uninstall\",\"parent_md5\":\"6468e92d1ad408df05df38c1192de790\",\"parent_process_graph_id\":\"pid:3810ea13b98a42adb0ff227fbaf6169f:22826319327295\",\"parent_sha256\":\"978ff3ff4d68cd1084e12aca5914bdfd1797e56173b604d13a1ae7d58909be9b\"},\"pattern_disposition\":1024,\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":true,\"policy_disabled\":false,\"process_blocked\":false,\"quarantine_file\":false,\"quarantine_mwayneine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"scenario\":\"ransomware\",\"severity\":50,\"sha256\":\"978ff3ff4d68cd1084e12aca5914bdfd1797e56173b604d13a1ae7d58909be9b\",\"tactic\":\"Impact\",\"tactic_id\":\"TA0040\",\"technique\":\"Inhibit System Recovery\",\"technique_id\":\"T1490\",\"timestamp\":\"2024-05-10T15:46:45Z\",\"triggering_process_graph_id\":\"pid:3810ea13b98a42adb0ff227fbaf6169f:22826338144393\",\"user_id\":\"S-1-12-1-942142572-1204970278-157880471-3270697999\",\"user_name\":\"charlie\"}],\"behaviors_processed\":[\"pid:3810ea13b98a42adb0ff227fbaf6169f:22826338144393:458\"],\"cid\":\"47b7f823f5804dd9862681183ba9999d\",\"created_timestamp\":\"2024-05-10T15:46:52.112770748Z\",\"date_updated\":\"2024-05-10T15:46:56Z\",\"detection_id\":\"ldt:3810ea13b98a42adb0ff227fbaf6169f:154619006482\",\"device\":{\"agent_load_flags\":\"1\",\"agent_local_time\":\"2024-05-08T23:47:06.818Z\",\"agent_version\":\"7.13.18308.0\",\"bios_manufacturer\":\"Dell Inc.\",\"bios_version\":\"1.21.0\",\"cid\":\"47b7f823f5804dd9862681183ba9999d\",\"config_id_base\":\"65994763\",\"config_id_build\":\"18308\",\"config_id_platform\":\"3\",\"device_id\":\"3810ea13b98a42adb0ff227fbaf6169f\",\"external_ip\":\"75.231.140.51\",\"first_seen\":\"2023-03-10T14:06:56Z\",\"groups\":[\"6297e232e6564507aa02babd05cadd3c\"],\"hostname\":\"SSTEWART-LT3\",\"last_login_timestamp\":\"2024-05-09T03:50:36Z\",\"last_login_user\":\"charlie\",\"last_seen\":\"2024-05-10T15:27:29Z\",\"local_ip\":\"12.98.97.254\",\"mac_address\":\"00-ff-c8-e9-2f-db\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2024-05-10T15:29:07Z\",\"os_version\":\"Windows 10\",\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"status\":\"normal\",\"system_manufacturer\":\"Dell Inc.\",\"system_product_name\":\"Latitude 5511\"},\"email_sent\":false,\"first_behavior\":\"2024-05-10T15:46:45Z\",\"hostinfo\":{\"domain\":\"\"},\"last_behavior\":\"2024-05-10T15:46:45Z\",\"max_confidence\":60,\"max_severity\":50,\"max_severity_displayname\":\"Medium\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\"} ::: messageType=endpoint_protection_event",
    "messagetype": "endpoint_protection_event",
    "productids": [
        7
    ],
    "program": "crowdstrike_falcon",
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "sourceinfo": "unknown",
    "tags": [
        "Crowdstrike Detection",
        "endpoint_protection_event"
    ],
    "streamName": "Crowdstrike Detection",
    "clientIP": "12.98.97.254",
    "userName": "charlie"
}