WitFoo-Artifact ::: message={"device_id":"dfbb62cf44104a3d85ad81cfd5bebb3c","timestamp":"2023-08-09T17:21:58Z","template_instance_id":"9162","behavior_id":"10250","filename":"reg.exe","filepath":"\\Device\\HarddiskVolume1\\Windows\\System32\\reg.exe","alleged_filetype":"exe","cmdline":"\"C:\\Windows\\system32\\reg.exe\" query HKLM/f password /t REG_SZ /s","scenario":"suspicious_activity","objective":"Explore","tactic":"Discovery","tactic_id":"TA0007","technique":"System Network Configuration Discovery","technique_id":"T1016","display_name":"ReconCommands2","description":"A process tree contains characteristics often asumbrellaiated with an adversary performing reconnaissance. This might be related to expected administrator activity. If this is unexpected, review the process tree.","severity":70,"confidence":80,"ioc_type":"hash_sha256","ioc_value":"19316d4266d0b776d9b2a05d5903d8cbc8f0ea1520e9c2a7e6d5960b6fa4dcaf","ioc_source":"library_load","ioc_description":"\\Device\\HarddiskVolume1\\Windows\\System32\\reg.exe","user_name":"alice","user_id":"S-1-5-21-3008783154-4189408168-2363429128-1618","control_graph_id":"ctg:dfbb62cf44104a3d85ad81cfd5bebb3c:597001528958","triggering_process_graph_id":"pid:dfbb62cf44104a3d85ad81cfd5bebb3c:599743696330","sha256":"19316d4266d0b776d9b2a05d5903d8cbc8f0ea1520e9c2a7e6d5960b6fa4dcaf","md5":"8a93acac33151793f8d52000071c0b06","parent_details":{"parent_sha256":"de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c","parent_md5":"7353f60b1739074eb17c5f4dddefe239","parent_cmdline":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" ","parent_process_graph_id":"pid:dfbb62cf44104a3d85ad81cfd5bebb3c:599722485826"},"pattern_disposition":2048,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_mumbrellaine":false,"quarantine_file":false,"policy_disabled":false,"kill_parent":false,"operation_blocked":false,"process_blocked":true,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=228.87.154.14 ::: fileHash=19316d4266d0b776d9b2a05d5903d8cbc8f0ea1520e9c2a7e6d5960b6fa4dcaf ::: fileName=reg.exe ::: filePath=\Device\HarddiskVolume1\Windows\System32\reg.exe ::: userName=alice ::: clientMAC=0edeb6ae9241 ::: created_at=2023-08-09T17:21:58Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-08-09T17:21:58Z ::: clientHostname=NVIINFRDEVAPP02.devnvi.umbrellaint.com ::: pipelineEntrypoint=dispatch
{
    "clienthostname": "NVIINFRDEVAPP02.devnvi.paygoint.com",
    "clientmac": "0edeb6ae9241",
    "filehash": "19316d4266d0b776d9b2a05d5903d8cbc8f0ea1520e9c2a7e6d5960b6fa4dcaf",
    "filename": "reg.exe",
    "filepath": "\\Device\\HarddiskVolume1\\Windows\\System32\\reg.exe",
    "message": "WitFoo-Artifact ::: message={\"device_id\":\"dfbb62cf44104a3d85ad81cfd5bebb3c\",\"timestamp\":\"2023-08-09T17:21:58Z\",\"template_instance_id\":\"9162\",\"behavior_id\":\"10250\",\"filename\":\"reg.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\System32\\\\reg.exe\",\"alleged_filetype\":\"exe\",\"cmdline\":\"\\\"C:\\\\Windows\\\\system32\\\\reg.exe\\\" query HKLM/f password /t REG_SZ /s\",\"scenario\":\"suspicious_activity\",\"objective\":\"Explore\",\"tactic\":\"Discovery\",\"tactic_id\":\"TA0007\",\"technique\":\"System Network Configuration Discovery\",\"technique_id\":\"T1016\",\"display_name\":\"ReconCommands2\",\"description\":\"A process tree contains characteristics often asumbrellaiated with an adversary performing reconnaissance. This might be related to expected administrator activity. If this is unexpected, review the process tree.\",\"severity\":70,\"confidence\":80,\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"19316d4266d0b776d9b2a05d5903d8cbc8f0ea1520e9c2a7e6d5960b6fa4dcaf\",\"ioc_source\":\"library_load\",\"ioc_description\":\"\\\\Device\\\\HarddiskVolume1\\\\Windows\\\\System32\\\\reg.exe\",\"user_name\":\"alice\",\"user_id\":\"S-1-5-21-3008783154-4189408168-2363429128-1618\",\"control_graph_id\":\"ctg:dfbb62cf44104a3d85ad81cfd5bebb3c:597001528958\",\"triggering_process_graph_id\":\"pid:dfbb62cf44104a3d85ad81cfd5bebb3c:599743696330\",\"sha256\":\"19316d4266d0b776d9b2a05d5903d8cbc8f0ea1520e9c2a7e6d5960b6fa4dcaf\",\"md5\":\"8a93acac33151793f8d52000071c0b06\",\"parent_details\":{\"parent_sha256\":\"de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c\",\"parent_md5\":\"7353f60b1739074eb17c5f4dddefe239\",\"parent_cmdline\":\"\\\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\" \",\"parent_process_graph_id\":\"pid:dfbb62cf44104a3d85ad81cfd5bebb3c:599722485826\"},\"pattern_disposition\":2048,\"pattern_disposition_details\":{\"indicator\":false,\"detect\":false,\"inddet_mask\":false,\"sensor_only\":false,\"rooting\":false,\"kill_process\":false,\"kill_subprocess\":false,\"quarantine_mumbrellaine\":false,\"quarantine_file\":false,\"policy_disabled\":false,\"kill_parent\":false,\"operation_blocked\":false,\"process_blocked\":true,\"registry_operation_blocked\":false,\"critical_process_disabled\":false,\"bootup_safeguard_enabled\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"kill_action_failed\":false,\"blocking_unsupported_or_disabled\":false,\"suspend_process\":false,\"suspend_parent\":false}} ::: clientIP=228.87.154.14 ::: fileHash=19316d4266d0b776d9b2a05d5903d8cbc8f0ea1520e9c2a7e6d5960b6fa4dcaf ::: fileName=reg.exe ::: filePath=\\Device\\HarddiskVolume1\\Windows\\System32\\reg.exe ::: userName=alice ::: clientMAC=0edeb6ae9241 ::: created_at=2023-08-09T17:21:58Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-08-09T17:21:58Z ::: clientHostname=NVIINFRDEVAPP02.devnvi.umbrellaint.com ::: pipelineEntrypoint=dispatch",
    "messagetype": "endpoint_protection_event",
    "productids": [
        7
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 4,
    "severitylabel": "warning",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-08-09T17:21:58Z",
    "tags": [
        "Crowdstrike Detection",
        "endpoint_protection_event"
    ],
    "streamName": "Crowdstrike Detection",
    "clientIP": "228.87.154.14",
    "userName": "alice"
}