WitFoo-Artifact ::: streamName=Crowdstrike Detection ::: clientHostname=EMARTIN_LT ::: clientMAC=00-ff-16-b6-91-c6 ::: fileHash=68455b27eddb80b636127783478f0014aeb80abe98d788c37f18b342ae15be27 ::: userName=bob ::: message={"behaviors":[{"alleged_filetype":"exe","behavior_id":"4748","cmdline":"\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2052,i,11849213268837189055,16613787588176336786,262144 /prefetch:3","confidence":100,"control_graph_id":"ctg:8a9af11f840642dd9fdf120a51bd3551:227635083624","description":"A file written to the file-system was classified as Adware/PUP based on its SHA256 hash.","device_id":"8a9af11f840642dd9fdf120a51bd3551","display_name":"Detect OnWrite Adware/PUP Hash","filename":"msedge.exe","filepath":"\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe","ioc_description":"","ioc_source":"","ioc_type":"","ioc_value":"","md5":"d5174a0327dd4ad65f24959049c7113d","objective":"Falcon Detection Method","parent_details":{"parent_cmdline":"\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --profile-directory=Default","parent_md5":"d5174a0327dd4ad65f24959049c7113d","parent_process_graph_id":"pid:8a9af11f840642dd9fdf120a51bd3551:1877714451043","parent_sha256":"68455b27eddb80b636127783478f0014aeb80abe98d788c37f18b342ae15be27"},"pattern_disposition":128,"pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":false,"quarantine_file":true,"quarantine_mstarkine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"scenario":"NGAV","severity":30,"sha256":"68455b27eddb80b636127783478f0014aeb80abe98d788c37f18b342ae15be27","tactic":"Malware","tactic_id":"CSTA0001","technique":"PUP","technique_id":"CST0013","timestamp":"2023-11-14T16:13:29Z","triggering_process_graph_id":"pid:8a9af11f840642dd9fdf120a51bd3551:1877720048920","user_id":"S-1-12-1-3524866106-1250543537-2299143350-2362608680","user_name":"bob"}],"behaviors_processed":["pid:8a9af11f840642dd9fdf120a51bd3551:1877720048920:4748"],"cid":"47b7f823f5804dd9862681183ba9999d","created_timestamp":"2023-11-14T16:13:37.337045693Z","date_updated":"2023-11-14T16:13:42Z","detection_id":"ldt:8a9af11f840642dd9fdf120a51bd3551:227635083624","device":{"agent_load_flags":"0","agent_local_time":"2023-11-13T19:06:32.562Z","agent_version":"7.04.17605.0","bios_manufacturer":"Dell Inc.","bios_version":"1.5.1","cid":"47b7f823f5804dd9862681183ba9999d","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"8a9af11f840642dd9fdf120a51bd3551","external_ip":"24.125.141.188","first_seen":"2023-03-10T14:31:51Z","groups":["6297e232e6564507aa02babd05cadd3c"],"hostname":"EMARTIN_LT","last_login_timestamp":"2023-11-14T11:56:51Z","last_login_user":"emartin@starkutilities.com","last_seen":"2023-11-14T16:05:35Z","local_ip":"121.125.83.169","mac_address":"00-ff-16-b6-91-c6","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-14T16:06:34Z","os_version":"Windows 10","platform_id":"0","platform_name":"Windows","product_type":"1","product_type_desc":"Workstation","status":"normal","system_manufacturer":"Dell Inc.","system_product_name":"Latitude 5501"},"email_sent":false,"first_behavior":"2023-11-14T16:13:29Z","hostinfo":{"domain":""},"last_behavior":"2023-11-14T16:13:29Z","max_confidence":100,"max_severity":30,"max_severity_displayname":"Low","quarantined_files":[{"id":"8a9af11f840642dd9fdf120a51bd3551_204259fc2caf158eb9bfae76aa4204dde93a18643f5cbb578d8f93260f11593d","sha256":"204259fc2caf158eb9bfae76aa4204dde93a18643f5cbb578d8f93260f11593d","state":"quarantined"}],"seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new"} ::: program=crowdstrike_falcon ::: fileName=msedge.exe ::: clientIP=121.125.83.169 ::: filePath=\Device\HarddiskVolume3\Program Files (x86)\Microsoft\Edge\Application\msedge.exe ::: messageType=endpoint_protection_event
This is a syslog message from a product called Falcon by Crowdstrike. The following fields were extracted from the message:
clienthostname: EMARTIN_LT
clientmac: 00-ff-16-b6-91-c6
filehash: 68455b27eddb80b636127783478f0014aeb80abe98d788c37f18b342ae15be27
filename: msedge.exe
filepath: \Device\HarddiskVolume3\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
messagetype: endpoint_protection_event
productids: [7]
program: crowdstrike_falcon
senderhost: kafka.precinct
sensitivity: normal
sourceinfo: unknown
tags: ['Crowdstrike Detection', 'endpoint_protection_event']
streamName: Crowdstrike Detection
clientIP: 121.125.83.169
userName: bob