WitFoo-Artifact ::: fileHash=350570713e0a7e3733f59623f880a442e98979b29a8d59b95555625a38ed1054 ::: clientHostname=JBETRO-LT4 ::: messageType=endpoint_protection_event ::: filePath=\Device\HarddiskVolume3\Windows\explorer.exe ::: program=crowdstrike_falcon ::: streamName=Crowdstrike Detection ::: message={"behaviors":[{"alleged_filetype":"exe","behavior_id":"10381","cmdline":"C:\\Windows\\Explorer.EXE","confidence":80,"control_graph_id":"ctg:6e36ac138a7a426fa5d2e4a45da72961:223339237035","description":"A process attempted to modify files used for Falcon sensor dynamic configuration. This is indicative of an attempt to tamper with Falcon sensor. Investigate the file system operation and process tree.","device_id":"6e36ac138a7a426fa5d2e4a45da72961","display_name":"FileSystemTamperFalconSensorDynamicConfiguration","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","ioc_description":"","ioc_source":"","ioc_type":"","ioc_value":"","md5":"d264f62721590f14bc54344f48a05912","objective":"Keep Access","parent_details":{"parent_cmdline":"C:\\Windows\\system32\\userinit.exe","parent_md5":"5cdc907c7818fbaa658fc9f2abb238f1","parent_process_graph_id":"pid:6e36ac138a7a426fa5d2e4a45da72961:2281788360679","parent_sha256":"0043369966e39c40b96c941ebe06ba53139dc314785f0d2d5d490def51dfb86c"},"pattern_disposition":32768,"pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":true,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":false,"quarantine_file":false,"quarantine_mstarkine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"scenario":"suspicious_activity","severity":70,"sha256":"350570713e0a7e3733f59623f880a442e98979b29a8d59b95555625a38ed1054","tactic":"Defense Evasion","tactic_id":"TA0005","technique":"Disable or Modify Tools","technique_id":"T1562.001","template_instance_id":"2933","timestamp":"2024-07-19T09:06:08Z","triggering_process_graph_id":"pid:6e36ac138a7a426fa5d2e4a45da72961:2281794660807","user_id":"S-1-12-1-1960846385-1299844409-3992341668-2149414984","user_name":"nighthawk"}],"behaviors_processed":["pid:6e36ac138a7a426fa5d2e4a45da72961:2281794660807:10381"],"cid":"47b7f823f5804dd9862681183ba9999d","created_timestamp":"2024-07-19T09:06:17.051656144Z","date_updated":"2024-07-19T09:06:24Z","detection_id":"ldt:6e36ac138a7a426fa5d2e4a45da72961:223339237035","device":{"agent_load_flags":"0","agent_local_time":"2024-07-17T07:18:20.541Z","agent_version":"7.15.18513.0","bios_manufacturer":"Dell Inc.","bios_version":"1.28.0","cid":"47b7f823f5804dd9862681183ba9999d","config_id_base":"65994763","config_id_build":"18513","config_id_platform":"3","device_id":"6e36ac138a7a426fa5d2e4a45da72961","external_ip":"99.56.191.170","first_seen":"2023-03-13T11:34:15Z","groups":["6297e232e6564507aa02babd05cadd3c"],"hostname":"JBETRO-LT4","last_login_timestamp":"2024-07-19T05:29:58Z","last_login_user":"nighthawk","last_seen":"2024-07-19T08:47:56Z","local_ip":"9.38.219.36","mac_address":"00-ff-c0-d6-f8-46","major_version":"10","minor_version":"0","modified_timestamp":"2024-07-19T08:48:28Z","os_version":"Windows 10","platform_id":"0","platform_name":"Windows","product_type":"1","product_type_desc":"Workstation","status":"normal","system_manufacturer":"Dell Inc.","system_product_name":"Dell G15 5511"},"email_sent":false,"first_behavior":"2024-07-19T09:06:08Z","hostinfo":{"domain":""},"last_behavior":"2024-07-19T09:06:08Z","max_confidence":80,"max_severity":70,"max_severity_displayname":"High","seconds_to_resolved":0,"seconds_to_triaged":0,"show_in_ui":true,"status":"new"} ::: clientIP=9.38.219.36 ::: clientMAC=00-ff-c0-d6-f8-46 ::: fileName=explorer.exe ::: userName=nighthawk
{
    "clienthostname": "JBETRO-LT4",
    "clientmac": "00-ff-c0-d6-f8-46",
    "filehash": "350570713e0a7e3733f59623f880a442e98979b29a8d59b95555625a38ed1054",
    "filename": "explorer.exe",
    "filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe",
    "message": "WitFoo-Artifact ::: fileHash=350570713e0a7e3733f59623f880a442e98979b29a8d59b95555625a38ed1054 ::: clientHostname=JBETRO-LT4 ::: messageType=endpoint_protection_event ::: filePath=\\Device\\HarddiskVolume3\\Windows\\explorer.exe ::: program=crowdstrike_falcon ::: streamName=Crowdstrike Detection ::: message={\"behaviors\":[{\"alleged_filetype\":\"exe\",\"behavior_id\":\"10381\",\"cmdline\":\"C:\\\\Windows\\\\Explorer.EXE\",\"confidence\":80,\"control_graph_id\":\"ctg:6e36ac138a7a426fa5d2e4a45da72961:223339237035\",\"description\":\"A process attempted to modify files used for Falcon sensor dynamic configuration. This is indicative of an attempt to tamper with Falcon sensor. Investigate the file system operation and process tree.\",\"device_id\":\"6e36ac138a7a426fa5d2e4a45da72961\",\"display_name\":\"FileSystemTamperFalconSensorDynamicConfiguration\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"ioc_description\":\"\",\"ioc_source\":\"\",\"ioc_type\":\"\",\"ioc_value\":\"\",\"md5\":\"d264f62721590f14bc54344f48a05912\",\"objective\":\"Keep Access\",\"parent_details\":{\"parent_cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"parent_md5\":\"5cdc907c7818fbaa658fc9f2abb238f1\",\"parent_process_graph_id\":\"pid:6e36ac138a7a426fa5d2e4a45da72961:2281788360679\",\"parent_sha256\":\"0043369966e39c40b96c941ebe06ba53139dc314785f0d2d5d490def51dfb86c\"},\"pattern_disposition\":32768,\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":true,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":false,\"quarantine_file\":false,\"quarantine_mstarkine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"scenario\":\"suspicious_activity\",\"severity\":70,\"sha256\":\"350570713e0a7e3733f59623f880a442e98979b29a8d59b95555625a38ed1054\",\"tactic\":\"Defense Evasion\",\"tactic_id\":\"TA0005\",\"technique\":\"Disable or Modify Tools\",\"technique_id\":\"T1562.001\",\"template_instance_id\":\"2933\",\"timestamp\":\"2024-07-19T09:06:08Z\",\"triggering_process_graph_id\":\"pid:6e36ac138a7a426fa5d2e4a45da72961:2281794660807\",\"user_id\":\"S-1-12-1-1960846385-1299844409-3992341668-2149414984\",\"user_name\":\"nighthawk\"}],\"behaviors_processed\":[\"pid:6e36ac138a7a426fa5d2e4a45da72961:2281794660807:10381\"],\"cid\":\"47b7f823f5804dd9862681183ba9999d\",\"created_timestamp\":\"2024-07-19T09:06:17.051656144Z\",\"date_updated\":\"2024-07-19T09:06:24Z\",\"detection_id\":\"ldt:6e36ac138a7a426fa5d2e4a45da72961:223339237035\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2024-07-17T07:18:20.541Z\",\"agent_version\":\"7.15.18513.0\",\"bios_manufacturer\":\"Dell Inc.\",\"bios_version\":\"1.28.0\",\"cid\":\"47b7f823f5804dd9862681183ba9999d\",\"config_id_base\":\"65994763\",\"config_id_build\":\"18513\",\"config_id_platform\":\"3\",\"device_id\":\"6e36ac138a7a426fa5d2e4a45da72961\",\"external_ip\":\"99.56.191.170\",\"first_seen\":\"2023-03-13T11:34:15Z\",\"groups\":[\"6297e232e6564507aa02babd05cadd3c\"],\"hostname\":\"JBETRO-LT4\",\"last_login_timestamp\":\"2024-07-19T05:29:58Z\",\"last_login_user\":\"nighthawk\",\"last_seen\":\"2024-07-19T08:47:56Z\",\"local_ip\":\"9.38.219.36\",\"mac_address\":\"00-ff-c0-d6-f8-46\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2024-07-19T08:48:28Z\",\"os_version\":\"Windows 10\",\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"status\":\"normal\",\"system_manufacturer\":\"Dell Inc.\",\"system_product_name\":\"Dell G15 5511\"},\"email_sent\":false,\"first_behavior\":\"2024-07-19T09:06:08Z\",\"hostinfo\":{\"domain\":\"\"},\"last_behavior\":\"2024-07-19T09:06:08Z\",\"max_confidence\":80,\"max_severity\":70,\"max_severity_displayname\":\"High\",\"seconds_to_resolved\":0,\"seconds_to_triaged\":0,\"show_in_ui\":true,\"status\":\"new\"} ::: clientIP=9.38.219.36 ::: clientMAC=00-ff-c0-d6-f8-46 ::: fileName=explorer.exe ::: userName=nighthawk",
    "messagetype": "endpoint_protection_event",
    "productids": [
        7
    ],
    "program": "crowdstrike_falcon",
    "senderhost": "kafka.precinct",
    "sensitivity": "normal",
    "sourceinfo": "unknown",
    "tags": [
        "Crowdstrike Detection",
        "endpoint_protection_event"
    ],
    "streamName": "Crowdstrike Detection",
    "clientIP": "9.38.219.36",
    "userName": "nighthawk"
}