WitFoo-Artifact ::: message={"device_id":"3810ea13b98a42adb0ff227fbaf6169f","timestamp":"2023-04-28T18:16:33Z","behavior_id":"5734","filename":"chrome.exe","filepath":"\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe","alleged_filetype":"exe","cmdline":"\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1888,i,13207831043762660145,13298087965543831545,131072 /prefetch:8","scenario":"NGAV","objective":"Falcon Detection Method","tactic":"Mumbrellaine Learning","tactic_id":"CSTA0004","technique":"Cloud-based ML","technique_id":"CST0008","display_name":"","description":"A file written to the file-system meets the File Analysis ML algorithm's high-confidence threshold for malware.","severity":70,"confidence":70,"ioc_type":"","ioc_value":"","ioc_source":"","ioc_description":"","user_name":"bob","user_id":"S-1-12-1-942142572-1204970278-157880471-3270697999","control_graph_id":"ctg:3810ea13b98a42adb0ff227fbaf6169f:12886709935","triggering_process_graph_id":"pid:3810ea13b98a42adb0ff227fbaf6169f:556881520473","sha256":"c0c9b49dfdfeb829001924231ed9a1cdaf1c239cfb5f0810e2367dd2959a9f0e","md5":"43a43c601f1b1584cdcfc1452cdcb165","parent_details":{"parent_sha256":"c0c9b49dfdfeb829001924231ed9a1cdaf1c239cfb5f0810e2367dd2959a9f0e","parent_md5":"43a43c601f1b1584cdcfc1452cdcb165","parent_cmdline":"\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --restart","parent_process_graph_id":"pid:3810ea13b98a42adb0ff227fbaf6169f:556876742408"},"pattern_disposition":128,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_mumbrellaine":false,"quarantine_file":true,"policy_disabled":false,"kill_parent":false,"operation_blocked":false,"process_blocked":false,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=135.30.48.246 ::: fileHash=c0c9b49dfdfeb829001924231ed9a1cdaf1c239cfb5f0810e2367dd2959a9f0e ::: fileName=chrome.exe ::: filePath=\Device\HarddiskVolume3\Program Files\Google\Chrome\Application\chrome.exe ::: userName=bob ::: clientMAC=00ffc8e92fdb ::: created_at=2023-04-28T18:16:33Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-04-28T18:16:33Z ::: clientHostname=SSTEWART-LT3.undefined ::: pipelineEntrypoint=dispatch
{
    "clienthostname": "SSTEWART-LT3.undefined",
    "clientmac": "00ffc8e92fdb",
    "filehash": "c0c9b49dfdfeb829001924231ed9a1cdaf1c239cfb5f0810e2367dd2959a9f0e",
    "filename": "chrome.exe",
    "filepath": "\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
    "message": "WitFoo-Artifact ::: message={\"device_id\":\"3810ea13b98a42adb0ff227fbaf6169f\",\"timestamp\":\"2023-04-28T18:16:33Z\",\"behavior_id\":\"5734\",\"filename\":\"chrome.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\"alleged_filetype\":\"exe\",\"cmdline\":\"\\\"C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\\\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1888,i,13207831043762660145,13298087965543831545,131072 /prefetch:8\",\"scenario\":\"NGAV\",\"objective\":\"Falcon Detection Method\",\"tactic\":\"Mumbrellaine Learning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Cloud-based ML\",\"technique_id\":\"CST0008\",\"display_name\":\"\",\"description\":\"A file written to the file-system meets the File Analysis ML algorithm's high-confidence threshold for malware.\",\"severity\":70,\"confidence\":70,\"ioc_type\":\"\",\"ioc_value\":\"\",\"ioc_source\":\"\",\"ioc_description\":\"\",\"user_name\":\"bob\",\"user_id\":\"S-1-12-1-942142572-1204970278-157880471-3270697999\",\"control_graph_id\":\"ctg:3810ea13b98a42adb0ff227fbaf6169f:12886709935\",\"triggering_process_graph_id\":\"pid:3810ea13b98a42adb0ff227fbaf6169f:556881520473\",\"sha256\":\"c0c9b49dfdfeb829001924231ed9a1cdaf1c239cfb5f0810e2367dd2959a9f0e\",\"md5\":\"43a43c601f1b1584cdcfc1452cdcb165\",\"parent_details\":{\"parent_sha256\":\"c0c9b49dfdfeb829001924231ed9a1cdaf1c239cfb5f0810e2367dd2959a9f0e\",\"parent_md5\":\"43a43c601f1b1584cdcfc1452cdcb165\",\"parent_cmdline\":\"\\\"C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\\\" --restart\",\"parent_process_graph_id\":\"pid:3810ea13b98a42adb0ff227fbaf6169f:556876742408\"},\"pattern_disposition\":128,\"pattern_disposition_details\":{\"indicator\":false,\"detect\":false,\"inddet_mask\":false,\"sensor_only\":false,\"rooting\":false,\"kill_process\":false,\"kill_subprocess\":false,\"quarantine_mumbrellaine\":false,\"quarantine_file\":true,\"policy_disabled\":false,\"kill_parent\":false,\"operation_blocked\":false,\"process_blocked\":false,\"registry_operation_blocked\":false,\"critical_process_disabled\":false,\"bootup_safeguard_enabled\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"kill_action_failed\":false,\"blocking_unsupported_or_disabled\":false,\"suspend_process\":false,\"suspend_parent\":false}} ::: clientIP=135.30.48.246 ::: fileHash=c0c9b49dfdfeb829001924231ed9a1cdaf1c239cfb5f0810e2367dd2959a9f0e ::: fileName=chrome.exe ::: filePath=\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe ::: userName=bob ::: clientMAC=00ffc8e92fdb ::: created_at=2023-04-28T18:16:33Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-04-28T18:16:33Z ::: clientHostname=SSTEWART-LT3.undefined ::: pipelineEntrypoint=dispatch",
    "messagetype": "endpoint_protection_event",
    "productids": [
        7
    ],
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "severitycode": 4,
    "severitylabel": "warning",
    "sourceinfo": "unknown",
    "starttimeutc": "2023-04-28T18:16:33Z",
    "tags": [
        "Crowdstrike Detection",
        "endpoint_protection_event"
    ],
    "streamName": "Crowdstrike Detection",
    "clientIP": "135.30.48.246",
    "userName": "bob"
}