diff --git a/contentctl.yml b/contentctl.yml index 90a0113452..e531b3f2a0 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -179,9 +179,9 @@ apps: - uid: 6207 title: Splunk Add-on for Microsoft Security appid: Splunk_TA_MS_Security - version: 2.4.0 + version: 2.4.1 description: description of app - hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-security_240.tgz + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-security_241.tgz - uid: 2734 title: URL Toolbox appid: URL_TOOLBOX diff --git a/data_sources/ms365_defender_incident_alerts.yml b/data_sources/ms365_defender_incident_alerts.yml index da2e05e468..3fd9ba4555 100644 --- a/data_sources/ms365_defender_incident_alerts.yml +++ b/data_sources/ms365_defender_incident_alerts.yml @@ -9,7 +9,7 @@ sourcetype: ms365:defender:incident:alerts supported_TA: - name: Splunk Add-on for Microsoft Security url: https://splunkbase.splunk.com/app/6207 - version: 2.4.0 + version: 2.4.1 fields: - actorName - alertId @@ -124,111 +124,60 @@ fields: - _sourcetype - _subsecond - _time -example_log: | - { - "alertId": "da638001130101730338_582949328", - "providerAlertId": "da638001130101730338_582949328", - "incidentId": 486, - "serviceSource": "MicrosoftDefenderForEndpoint", - "creationTime": "2022-09-30T05:36:50.1732198Z", - "lastUpdatedTime": "2022-11-19T01:35:42.7033333Z", - "resolvedTime": "2022-10-01T01:36:00.5066667Z", - "firstActivity": "2022-09-30T05:06:43.8196597Z", - "lastActivity": "2022-09-30T05:06:43.8196597Z", - "title": "Suspicious URL clicked", - "description": "A user opened a potentially malicious URL. This alert was triggered based on a Microsoft Defender for Office 365 alert.", - "category": "InitialAccess", - "status": "Resolved", - "severity": "High", - "investigationId": null, - "investigationState": "UnsupportedAlertType", - "classification": "TruePositive", - "determination": "SecurityTesting", - "detectionSource": "MTP", - "detectorId": "359b36eb-337c-4f1c-b280-8c5e08f9c4a0", - "assignedTo": "msftadmin@metal.m365dpoc.com", - "actorName": null, - "threatFamilyName": null, - "mitreTechniques": [ - "T1566.002" - ], - "devices": [ - { - "mdatpDeviceId": "c7e147cb0eb3534a4dcea5acb8e61c933713b145", - "aadDeviceId": null, - "deviceDnsName": "metal-win10v.metal.m365dpoc.com", - "osPlatform": "Windows10", - "version": "1809", - "osProcessor": "x64", - "osBuild": 17763, - "healthStatus": "Active", - "riskScore": "High", - "rbacGroupName": "Full Auto Clients", - "firstSeen": "2022-08-08T08:51:02.455Z", - "tags": [ - "Full auto" - ], - "defenderAvStatus": "Updated", - "onboardingStatus": "Onboarded", - "vmMetadata": { - "vmId": "17881b39-b03f-4a2c-9b56-078be1330bd0", - "cloudProvider": "Unknown", - "resourceId": "/subscriptions/29e73d07-8740-4164-a257-592a19a7b77c/resourceGroups/MSDXV2/providers/Microsoft.Compute/virtualMachines/MSDXV2-Win10V", - "subscriptionId": "29e73d07-8740-4164-a257-592a19a7b77c" - }, - "loggedOnUsers": [ - { - "accountName": "hetfield", - "domainName": "MSDXV2" - } - ] - } - ], - "entities": [ - { - "entityType": "Process", - "evidenceCreationTime": "2022-09-30T05:36:50.2133333Z", - "verdict": "Suspicious", - "remediationStatus": "None", - "sha1": "6cbce4a295c163791b60fc23d285e6d84f28ee4c", - "sha256": "de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c", - "fileName": "powershell.exe", - "filePath": "", - "processId": 7068, - "processCommandLine": "powershell.exe -command \" $Process = New-Object System.Diagnostics.Process; $Process.StartInfo.FileName = 'https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fgcajebahdi.corporatelogon.xyz%2Fab%2Fjnkmbkkdnlgedc&data=05%7C01%7Chetfield%40metal.m365dpoc.com%7Cca409616a82145bd6a5f08daa2a10255%7C1a49212958c8401191cd245285f5345c%7C0%7C0%7C638001109710345383%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=FyEjRS5qOd2SkJELlueibuxLFMYNjL7fz8EbuOAvFwg%3D&reserved=0'; $Process.StartInfo.UseShellExecute = $true; $Process.Start() | Out-Null; \" ", - "processCreationTime": "2022-09-30T05:06:43.3390523Z", - "parentProcessId": 7116, - "parentProcessCreationTime": "2022-09-30T05:06:43.3100364Z", - "accountName": "hetfield", - "userSid": "S-1-5-21-2300221942-1987151257-321556088-1104" - }, - { - "entityType": "File", - "evidenceCreationTime": "2022-09-30T05:36:50.2133333Z", - "verdict": "Suspicious", - "remediationStatus": "None", - "sha1": "6cbce4a295c163791b60fc23d285e6d84f28ee4c", - "sha256": "de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c", - "fileName": "powershell.exe", - "filePath": "" - }, - { - "entityType": "User", - "evidenceCreationTime": "2022-09-30T05:36:50.2133333Z", - "verdict": "Suspicious", - "remediationStatus": "None", - "accountName": "hetfield", - "domainName": "metal.m365dpoc", - "userSid": "S-1-5-21-2300221942-1987151257-321556088-1104", - "aadUserId": "e848b07a-87af-4448-9979-09f0b809c8d4", - "userPrincipalName": "daftpunk" - }, - { - "entityType": "Url", - "evidenceCreationTime": "2022-09-30T05:36:50.2133333Z", - "verdict": "Suspicious", - "remediationStatus": "None", - "url": "http://gcajebahdi.corporatelogon.xyz/ab/jnkmbkkdnlgedc" - } - ] - } \ No newline at end of file +example_log: "{\n \"alertId\": \"da638001130101730338_582949328\",\n \"providerAlertId\"\ + : \"da638001130101730338_582949328\",\n \"incidentId\": 486,\n \"serviceSource\"\ + : \"MicrosoftDefenderForEndpoint\",\n \"creationTime\": \"2022-09-30T05:36:50.1732198Z\"\ + ,\n \"lastUpdatedTime\": \"2022-11-19T01:35:42.7033333Z\",\n \"resolvedTime\"\ + : \"2022-10-01T01:36:00.5066667Z\",\n \"firstActivity\": \"2022-09-30T05:06:43.8196597Z\"\ + ,\n \"lastActivity\": \"2022-09-30T05:06:43.8196597Z\",\n \"title\": \"Suspicious\ + \ URL clicked\",\n \"description\": \"A user opened a potentially malicious URL.\ + \ This alert was triggered based on a Microsoft Defender for Office 365 alert.\"\ + ,\n \"category\": \"InitialAccess\",\n \"status\": \"Resolved\",\n \"severity\"\ + : \"High\",\n \"investigationId\": null,\n \"investigationState\": \"UnsupportedAlertType\"\ + ,\n \"classification\": \"TruePositive\",\n \"determination\": \"SecurityTesting\"\ + ,\n \"detectionSource\": \"MTP\",\n \"detectorId\": \"359b36eb-337c-4f1c-b280-8c5e08f9c4a0\"\ + ,\n \"assignedTo\": \"msftadmin@metal.m365dpoc.com\",\n \"actorName\": null,\n\ + \ \"threatFamilyName\": null,\n \"mitreTechniques\": [\n \"T1566.002\"\n ],\n\ + \ \"devices\": [\n {\n \"mdatpDeviceId\": \"c7e147cb0eb3534a4dcea5acb8e61c933713b145\"\ + ,\n \"aadDeviceId\": null,\n \"deviceDnsName\": \"metal-win10v.metal.m365dpoc.com\"\ + ,\n \"osPlatform\": \"Windows10\",\n \"version\": \"1809\",\n \"\ + osProcessor\": \"x64\",\n \"osBuild\": 17763,\n \"healthStatus\": \"Active\"\ + ,\n \"riskScore\": \"High\",\n \"rbacGroupName\": \"Full Auto Clients\"\ + ,\n \"firstSeen\": \"2022-08-08T08:51:02.455Z\",\n \"tags\": [\n \ + \ \"Full auto\"\n ],\n \"defenderAvStatus\": \"Updated\",\n \"\ + onboardingStatus\": \"Onboarded\",\n \"vmMetadata\": {\n \"vmId\": \"\ + 17881b39-b03f-4a2c-9b56-078be1330bd0\",\n \"cloudProvider\": \"Unknown\"\ + ,\n \"resourceId\": \"/subscriptions/29e73d07-8740-4164-a257-592a19a7b77c/resourceGroups/MSDXV2/providers/Microsoft.Compute/virtualMachines/MSDXV2-Win10V\"\ + ,\n \"subscriptionId\": \"29e73d07-8740-4164-a257-592a19a7b77c\"\n },\n\ + \ \"loggedOnUsers\": [\n {\n \"accountName\": \"hetfield\"\ + ,\n \"domainName\": \"MSDXV2\"\n }\n ]\n }\n ],\n \"entities\"\ + : [\n {\n \"entityType\": \"Process\",\n \"evidenceCreationTime\":\ + \ \"2022-09-30T05:36:50.2133333Z\",\n \"verdict\": \"Suspicious\",\n \"\ + remediationStatus\": \"None\",\n \"sha1\": \"6cbce4a295c163791b60fc23d285e6d84f28ee4c\"\ + ,\n \"sha256\": \"de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c\"\ + ,\n \"fileName\": \"powershell.exe\",\n \"filePath\": \"\",\n \"\ + processId\": 7068,\n \"processCommandLine\": \"powershell.exe -command \\\"\ + \ $Process = New-Object\ + \ System.Diagnostics.Process; \ + \ $Process.StartInfo.FileName = 'https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fgcajebahdi.corporatelogon.xyz%2Fab%2Fjnkmbkkdnlgedc&data=05%7C01%7Chetfield%40metal.m365dpoc.com%7Cca409616a82145bd6a5f08daa2a10255%7C1a49212958c8401191cd245285f5345c%7C0%7C0%7C638001109710345383%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=FyEjRS5qOd2SkJELlueibuxLFMYNjL7fz8EbuOAvFwg%3D&reserved=0';\ + \ $Process.StartInfo.UseShellExecute\ + \ = $true; $Process.Start()\ + \ | Out-Null; \\\" \ + \ \",\n \"processCreationTime\"\ + : \"2022-09-30T05:06:43.3390523Z\",\n \"parentProcessId\": 7116,\n \"\ + parentProcessCreationTime\": \"2022-09-30T05:06:43.3100364Z\",\n \"accountName\"\ + : \"hetfield\",\n \"userSid\": \"S-1-5-21-2300221942-1987151257-321556088-1104\"\ + \n },\n {\n \"entityType\": \"File\",\n \"evidenceCreationTime\"\ + : \"2022-09-30T05:36:50.2133333Z\",\n \"verdict\": \"Suspicious\",\n \"\ + remediationStatus\": \"None\",\n \"sha1\": \"6cbce4a295c163791b60fc23d285e6d84f28ee4c\"\ + ,\n \"sha256\": \"de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c\"\ + ,\n \"fileName\": \"powershell.exe\",\n \"filePath\": \"\"\n },\n \ + \ {\n \"entityType\": \"User\",\n \"evidenceCreationTime\": \"2022-09-30T05:36:50.2133333Z\"\ + ,\n \"verdict\": \"Suspicious\",\n \"remediationStatus\": \"None\",\n\ + \ \"accountName\": \"hetfield\",\n \"domainName\": \"metal.m365dpoc\"\ + ,\n \"userSid\": \"S-1-5-21-2300221942-1987151257-321556088-1104\",\n \ + \ \"aadUserId\": \"e848b07a-87af-4448-9979-09f0b809c8d4\",\n \"userPrincipalName\"\ + : \"daftpunk\"\n },\n {\n \"entityType\": \"Url\",\n \"evidenceCreationTime\"\ + : \"2022-09-30T05:36:50.2133333Z\",\n \"verdict\": \"Suspicious\",\n \"\ + remediationStatus\": \"None\",\n \"url\": \"http://gcajebahdi.corporatelogon.xyz/ab/jnkmbkkdnlgedc\"\ + \n }\n ]\n}" diff --git a/data_sources/ms_defender_atp_alerts.yml b/data_sources/ms_defender_atp_alerts.yml index 4013990413..92d4452143 100644 --- a/data_sources/ms_defender_atp_alerts.yml +++ b/data_sources/ms_defender_atp_alerts.yml @@ -9,7 +9,7 @@ sourcetype: ms:defender:atp:alerts supported_TA: - name: Splunk Add-on for Microsoft Security url: https://splunkbase.splunk.com/app/6207 - version: 2.4.0 + version: 2.4.1 fields: - column - accountName @@ -121,302 +121,152 @@ fields: - user - user_name - _time -example_log: | - { - "id": "da47dc5671-e560-4229-984b-457564996b31_1", - "incidentId": 989, - "investigationId": null, - "assignedTo": null, - "severity": "High", - "status": "New", - "classification": null, - "determination": null, - "investigationState": "UnsupportedAlertType", - "detectionSource": "WindowsDefenderAtp", - "detectorId": "9c3a70ec-e18a-4f92-865a-530f73130b7c", - "category": "LateralMovement", - "threatFamilyName": null, - "title": "Ongoing hands-on-keyboard attack via Impacket toolkit", - "description": "Suspicious execution of a command via Impacket was observed on this device. This tool connects to other hosts to explore network shares and execute commands. Attackers might be attempting to move laterally across the network using this tool. This usage of Impacket has often been observed in hands-on-keyboard attacks, where ransomware and other payloads are installed on target devices.", - "alertCreationTime": "2023-01-24T05:33:37.3245808Z", - "firstEventTime": "2023-01-24T05:31:07.5276179Z", - "lastEventTime": "2023-01-24T13:02:50.7831636Z", - "lastUpdateTime": "2023-01-24T13:07:13.3233333Z", - "resolvedTime": null, - "machineId": "302293d9f276eae65553e5042156bce93cbc7148", - "computerDnsName": "diytestmachine", - "rbacGroupName": "UnassignedGroup", - "aadTenantId": "1a492129-58c8-4011-91cd-245285f5345c", - "threatName": null, - "mitreTechniques": [ - "T1021.002", - "T1047", - "T1059.003" - ], - "relatedUser": { - "userName": "User1", - "domainName": "DIYTESTMACHINE" - }, - "loggedOnUsers": [ - { - "accountName": "administrator1", - "domainName": "DIYTESTMACHINE" - } - ], - "comments": [], - "evidence": [ - { - "entityType": "Process", - "evidenceCreationTime": "2023-01-24T05:45:51.6833333Z", - "sha1": "3ea7cc066317ac45f963c2227c4c7c50aa16eb7c", - "sha256": "2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3", - "fileName": "WmiPrvSE.exe", - "filePath": "C:\\Windows\\System32\\wbem", - "processId": 4476, - "processCommandLine": "wmiprvse.exe -secured -Embedding", - "processCreationTime": "2023-01-24T05:43:32.4631151Z", - "parentProcessId": 896, - "parentProcessCreationTime": "2023-01-24T04:44:17.1940386Z", - "parentProcessFileName": "svchost.exe", - "parentProcessFilePath": "C:\\Windows\\System32", - "ipAddress": null, - "url": null, - "registryKey": null, - "registryHive": null, - "registryValueType": null, - "registryValue": null, - "registryValueName": null, - "accountName": "NETWORK SERVICE", - "domainName": "NT AUTHORITY", - "userSid": "S-1-5-20", - "aadUserId": null, - "userPrincipalName": null, - "detectionStatus": "Detected" - }, - { - "entityType": "User", - "evidenceCreationTime": "2023-01-24T05:33:37.4166667Z", - "sha1": null, - "sha256": null, - "fileName": null, - "filePath": null, - "processId": null, - "processCommandLine": null, - "processCreationTime": null, - "parentProcessId": null, - "parentProcessCreationTime": null, - "parentProcessFileName": null, - "parentProcessFilePath": null, - "ipAddress": null, - "url": null, - "registryKey": null, - "registryHive": null, - "registryValueType": null, - "registryValue": null, - "registryValueName": null, - "accountName": "User1", - "domainName": "DIYTESTMACHINE", - "userSid": "S-1-5-21-4215714199-1288013905-3478400915-1002", - "aadUserId": null, - "userPrincipalName": null, - "detectionStatus": null - }, - { - "entityType": "Process", - "evidenceCreationTime": "2023-01-24T05:33:37.4166667Z", - "sha1": "3ea7cc066317ac45f963c2227c4c7c50aa16eb7c", - "sha256": "2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3", - "fileName": "WmiPrvSE.exe", - "filePath": "C:\\Windows\\System32\\wbem", - "processId": 7824, - "processCommandLine": "wmiprvse.exe -secured -Embedding", - "processCreationTime": "2023-01-24T05:30:50.8649791Z", - "parentProcessId": 896, - "parentProcessCreationTime": "2023-01-24T04:44:17.1940386Z", - "parentProcessFileName": "svchost.exe", - "parentProcessFilePath": "C:\\Windows\\System32", - "ipAddress": null, - "url": null, - "registryKey": null, - "registryHive": null, - "registryValueType": null, - "registryValue": null, - "registryValueName": null, - "accountName": "NETWORK SERVICE", - "domainName": "NT AUTHORITY", - "userSid": "S-1-5-20", - "aadUserId": null, - "userPrincipalName": null, - "detectionStatus": "Detected" - }, - { - "entityType": "Process", - "evidenceCreationTime": "2023-01-24T13:07:13.2233333Z", - "sha1": "f1efb0fddc156e4c61c5f78a54700e4e7984d55d", - "sha256": "b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450", - "fileName": "cmd.exe", - "filePath": "C:\\Windows\\System32", - "processId": 5500, - "processCommandLine": "cmd.exe /Q /c powershell -NoProfile -ExecutionPolicy Bypass -File \"C:\\Users\\administrator1\\Desktop\\SharedFolder\\payload.ps1\" 1> \\\\127.0.0.1\\SharedFolder\\__1674565222.7012053 2>&1", - "processCreationTime": "2023-01-24T13:02:50.4661885Z", - "parentProcessId": 756, - "parentProcessCreationTime": "2023-01-24T13:00:35.0107475Z", - "parentProcessFileName": "WmiPrvSE.exe", - "parentProcessFilePath": "C:\\Windows\\System32\\wbem", - "ipAddress": null, - "url": null, - "registryKey": null, - "registryHive": null, - "registryValueType": null, - "registryValue": null, - "registryValueName": null, - "accountName": "User1", - "domainName": "DIYTESTMACHINE", - "userSid": "S-1-5-21-4215714199-1288013905-3478400915-1002", - "aadUserId": null, - "userPrincipalName": null, - "detectionStatus": "Detected" - }, - { - "entityType": "Process", - "evidenceCreationTime": "2023-01-24T05:33:37.4166667Z", - "sha1": "f1efb0fddc156e4c61c5f78a54700e4e7984d55d", - "sha256": "b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450", - "fileName": "cmd.exe", - "filePath": "C:\\Windows\\System32", - "processId": 8964, - "processCommandLine": "cmd.exe /Q /c powershell -NoProfile -ExecutionPolicy Bypass -File \"C:\\Users\\administrator1\\Desktop\\SharedFolder\\payload.ps1\" 1> \\\\127.0.0.1\\SharedFolder\\__1674538248.357367 2>&1", - "processCreationTime": "2023-01-24T05:31:04.0743902Z", - "parentProcessId": 7824, - "parentProcessCreationTime": "2023-01-24T05:30:50.8649791Z", - "parentProcessFileName": "WmiPrvSE.exe", - "parentProcessFilePath": "C:\\Windows\\System32\\wbem", - "ipAddress": null, - "url": null, - "registryKey": null, - "registryHive": null, - "registryValueType": null, - "registryValue": null, - "registryValueName": null, - "accountName": "User1", - "domainName": "DIYTESTMACHINE", - "userSid": "S-1-5-21-4215714199-1288013905-3478400915-1002", - "aadUserId": null, - "userPrincipalName": null, - "detectionStatus": "Detected" - }, - { - "entityType": "Process", - "evidenceCreationTime": "2023-01-24T05:39:47.1733333Z", - "sha1": "f1efb0fddc156e4c61c5f78a54700e4e7984d55d", - "sha256": "b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450", - "fileName": "cmd.exe", - "filePath": "C:\\Windows\\System32", - "processId": 884, - "processCommandLine": "cmd.exe /Q /c powershell -NoProfile -ExecutionPolicy Bypass -File \"C:\\Users\\administrator1\\Desktop\\SharedFolder\\payload.ps1\" 1> \\\\127.0.0.1\\SharedFolder\\__1674538583.8648584 2>&1", - "processCreationTime": "2023-01-24T05:36:38.826505Z", - "parentProcessId": 7736, - "parentProcessCreationTime": "2023-01-24T05:36:26.0524655Z", - "parentProcessFileName": "WmiPrvSE.exe", - "parentProcessFilePath": "C:\\Windows\\System32\\wbem", - "ipAddress": null, - "url": null, - "registryKey": null, - "registryHive": null, - "registryValueType": null, - "registryValue": null, - "registryValueName": null, - "accountName": "User1", - "domainName": "DIYTESTMACHINE", - "userSid": "S-1-5-21-4215714199-1288013905-3478400915-1002", - "aadUserId": null, - "userPrincipalName": null, - "detectionStatus": "Detected" - }, - { - "entityType": "Process", - "evidenceCreationTime": "2023-01-24T13:07:13.2233333Z", - "sha1": "3ea7cc066317ac45f963c2227c4c7c50aa16eb7c", - "sha256": "2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3", - "fileName": "WmiPrvSE.exe", - "filePath": "C:\\Windows\\System32\\wbem", - "processId": 756, - "processCommandLine": "wmiprvse.exe -secured -Embedding", - "processCreationTime": "2023-01-24T13:00:35.0107475Z", - "parentProcessId": 908, - "parentProcessCreationTime": "2023-01-24T08:20:44.6877667Z", - "parentProcessFileName": "svchost.exe", - "parentProcessFilePath": "C:\\Windows\\System32", - "ipAddress": null, - "url": null, - "registryKey": null, - "registryHive": null, - "registryValueType": null, - "registryValue": null, - "registryValueName": null, - "accountName": "NETWORK SERVICE", - "domainName": "NT AUTHORITY", - "userSid": "S-1-5-20", - "aadUserId": null, - "userPrincipalName": null, - "detectionStatus": "Detected" - }, - { - "entityType": "Process", - "evidenceCreationTime": "2023-01-24T05:45:51.6833333Z", - "sha1": "f1efb0fddc156e4c61c5f78a54700e4e7984d55d", - "sha256": "b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450", - "fileName": "cmd.exe", - "filePath": "C:\\Windows\\System32", - "processId": 1140, - "processCommandLine": "cmd.exe /Q /c powershell -NoProfile -ExecutionPolicy Bypass -File \"C:\\Users\\administrator1\\Desktop\\SharedFolder\\payload.ps1\" 1> \\\\127.0.0.1\\SharedFolder\\__1674538878.1586335 2>&1", - "processCreationTime": "2023-01-24T05:43:49.9375398Z", - "parentProcessId": 4476, - "parentProcessCreationTime": "2023-01-24T05:43:32.4631151Z", - "parentProcessFileName": "WmiPrvSE.exe", - "parentProcessFilePath": "C:\\Windows\\System32\\wbem", - "ipAddress": null, - "url": null, - "registryKey": null, - "registryHive": null, - "registryValueType": null, - "registryValue": null, - "registryValueName": null, - "accountName": "User1", - "domainName": "DIYTESTMACHINE", - "userSid": "S-1-5-21-4215714199-1288013905-3478400915-1002", - "aadUserId": null, - "userPrincipalName": null, - "detectionStatus": "Detected" - }, - { - "entityType": "Process", - "evidenceCreationTime": "2023-01-24T05:39:47.1733333Z", - "sha1": "3ea7cc066317ac45f963c2227c4c7c50aa16eb7c", - "sha256": "2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3", - "fileName": "WmiPrvSE.exe", - "filePath": "C:\\Windows\\System32\\wbem", - "processId": 7736, - "processCommandLine": "wmiprvse.exe -secured -Embedding", - "processCreationTime": "2023-01-24T05:36:26.0524655Z", - "parentProcessId": 896, - "parentProcessCreationTime": "2023-01-24T04:44:17.1940386Z", - "parentProcessFileName": "svchost.exe", - "parentProcessFilePath": "C:\\Windows\\System32", - "ipAddress": null, - "url": null, - "registryKey": null, - "registryHive": null, - "registryValueType": null, - "registryValue": null, - "registryValueName": null, - "accountName": "NETWORK SERVICE", - "domainName": "NT AUTHORITY", - "userSid": "S-1-5-20", - "aadUserId": null, - "userPrincipalName": null, - "detectionStatus": "Detected" - } - ], - "domains": [] - } \ No newline at end of file +example_log: "{\n\"id\": \"da47dc5671-e560-4229-984b-457564996b31_1\",\n\"incidentId\"\ + : 989,\n\"investigationId\": null,\n\"assignedTo\": null,\n\"severity\": \"High\"\ + ,\n\"status\": \"New\",\n\"classification\": null,\n\"determination\": null,\n\"\ + investigationState\": \"UnsupportedAlertType\",\n\"detectionSource\": \"WindowsDefenderAtp\"\ + ,\n\"detectorId\": \"9c3a70ec-e18a-4f92-865a-530f73130b7c\",\n\"category\": \"LateralMovement\"\ + ,\n\"threatFamilyName\": null,\n\"title\": \"Ongoing hands-on-keyboard attack via\ + \ Impacket toolkit\",\n\"description\": \"Suspicious execution of a command via\ + \ Impacket was observed on this device. This tool connects to other hosts to explore\ + \ network shares and execute commands. Attackers might be attempting to move laterally\ + \ across the network using this tool. This usage of Impacket has often been observed\ + \ in hands-on-keyboard attacks, where ransomware and other payloads are installed\ + \ on target devices.\",\n\"alertCreationTime\": \"2023-01-24T05:33:37.3245808Z\"\ + ,\n\"firstEventTime\": \"2023-01-24T05:31:07.5276179Z\",\n\"lastEventTime\": \"\ + 2023-01-24T13:02:50.7831636Z\",\n\"lastUpdateTime\": \"2023-01-24T13:07:13.3233333Z\"\ + ,\n\"resolvedTime\": null,\n\"machineId\": \"302293d9f276eae65553e5042156bce93cbc7148\"\ + ,\n\"computerDnsName\": \"diytestmachine\",\n\"rbacGroupName\": \"UnassignedGroup\"\ + ,\n\"aadTenantId\": \"1a492129-58c8-4011-91cd-245285f5345c\",\n\"threatName\": null,\n\ + \"mitreTechniques\": [\n \"T1021.002\",\n \"T1047\",\n \"T1059.003\"\n],\n\"\ + relatedUser\": {\n \"userName\": \"User1\",\n \"domainName\": \"DIYTESTMACHINE\"\ + \n},\n\"loggedOnUsers\": [\n {\n \"accountName\": \"administrator1\",\n \"\ + domainName\": \"DIYTESTMACHINE\"\n }\n],\n\"comments\": [],\n\"evidence\": [\n\ + \ {\n \"entityType\": \"Process\",\n \"evidenceCreationTime\": \"2023-01-24T05:45:51.6833333Z\"\ + ,\n \"sha1\": \"3ea7cc066317ac45f963c2227c4c7c50aa16eb7c\",\n \"sha256\":\ + \ \"2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3\",\n \"\ + fileName\": \"WmiPrvSE.exe\",\n \"filePath\": \"C:\\\\Windows\\\\System32\\\\\ + wbem\",\n \"processId\": 4476,\n \"processCommandLine\": \"wmiprvse.exe -secured\ + \ -Embedding\",\n \"processCreationTime\": \"2023-01-24T05:43:32.4631151Z\",\n\ + \ \"parentProcessId\": 896,\n \"parentProcessCreationTime\": \"2023-01-24T04:44:17.1940386Z\"\ + ,\n \"parentProcessFileName\": \"svchost.exe\",\n \"parentProcessFilePath\"\ + : \"C:\\\\Windows\\\\System32\",\n \"ipAddress\": null,\n \"url\": null,\n\ + \ \"registryKey\": null,\n \"registryHive\": null,\n \"registryValueType\"\ + : null,\n \"registryValue\": null,\n \"registryValueName\": null,\n \"\ + accountName\": \"NETWORK SERVICE\",\n \"domainName\": \"NT AUTHORITY\",\n \ + \ \"userSid\": \"S-1-5-20\",\n \"aadUserId\": null,\n \"userPrincipalName\"\ + : null,\n \"detectionStatus\": \"Detected\"\n },\n {\n \"entityType\": \"\ + User\",\n \"evidenceCreationTime\": \"2023-01-24T05:33:37.4166667Z\",\n \"\ + sha1\": null,\n \"sha256\": null,\n \"fileName\": null,\n \"filePath\"\ + : null,\n \"processId\": null,\n \"processCommandLine\": null,\n \"processCreationTime\"\ + : null,\n \"parentProcessId\": null,\n \"parentProcessCreationTime\": null,\n\ + \ \"parentProcessFileName\": null,\n \"parentProcessFilePath\": null,\n \ + \ \"ipAddress\": null,\n \"url\": null,\n \"registryKey\": null,\n \"\ + registryHive\": null,\n \"registryValueType\": null,\n \"registryValue\":\ + \ null,\n \"registryValueName\": null,\n \"accountName\": \"User1\",\n \ + \ \"domainName\": \"DIYTESTMACHINE\",\n \"userSid\": \"S-1-5-21-4215714199-1288013905-3478400915-1002\"\ + ,\n \"aadUserId\": null,\n \"userPrincipalName\": null,\n \"detectionStatus\"\ + : null\n },\n {\n \"entityType\": \"Process\",\n \"evidenceCreationTime\"\ + : \"2023-01-24T05:33:37.4166667Z\",\n \"sha1\": \"3ea7cc066317ac45f963c2227c4c7c50aa16eb7c\"\ + ,\n \"sha256\": \"2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3\"\ + ,\n \"fileName\": \"WmiPrvSE.exe\",\n \"filePath\": \"C:\\\\Windows\\\\System32\\\ + \\wbem\",\n \"processId\": 7824,\n \"processCommandLine\": \"wmiprvse.exe\ + \ -secured -Embedding\",\n \"processCreationTime\": \"2023-01-24T05:30:50.8649791Z\"\ + ,\n \"parentProcessId\": 896,\n \"parentProcessCreationTime\": \"2023-01-24T04:44:17.1940386Z\"\ + ,\n \"parentProcessFileName\": \"svchost.exe\",\n \"parentProcessFilePath\"\ + : \"C:\\\\Windows\\\\System32\",\n \"ipAddress\": null,\n \"url\": null,\n\ + \ \"registryKey\": null,\n \"registryHive\": null,\n \"registryValueType\"\ + : null,\n \"registryValue\": null,\n \"registryValueName\": null,\n \"\ + accountName\": \"NETWORK SERVICE\",\n \"domainName\": \"NT AUTHORITY\",\n \ + \ \"userSid\": \"S-1-5-20\",\n \"aadUserId\": null,\n \"userPrincipalName\"\ + : null,\n \"detectionStatus\": \"Detected\"\n },\n {\n \"entityType\": \"\ + Process\",\n \"evidenceCreationTime\": \"2023-01-24T13:07:13.2233333Z\",\n \ + \ \"sha1\": \"f1efb0fddc156e4c61c5f78a54700e4e7984d55d\",\n \"sha256\": \"b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450\"\ + ,\n \"fileName\": \"cmd.exe\",\n \"filePath\": \"C:\\\\Windows\\\\System32\"\ + ,\n \"processId\": 5500,\n \"processCommandLine\": \"cmd.exe /Q /c powershell\ + \ -NoProfile -ExecutionPolicy Bypass -File \\\"C:\\\\Users\\\\administrator1\\\\\ + Desktop\\\\SharedFolder\\\\payload.ps1\\\" 1> \\\\\\\\127.0.0.1\\\\SharedFolder\\\ + \\__1674565222.7012053 2>&1\",\n \"processCreationTime\": \"2023-01-24T13:02:50.4661885Z\"\ + ,\n \"parentProcessId\": 756,\n \"parentProcessCreationTime\": \"2023-01-24T13:00:35.0107475Z\"\ + ,\n \"parentProcessFileName\": \"WmiPrvSE.exe\",\n \"parentProcessFilePath\"\ + : \"C:\\\\Windows\\\\System32\\\\wbem\",\n \"ipAddress\": null,\n \"url\"\ + : null,\n \"registryKey\": null,\n \"registryHive\": null,\n \"registryValueType\"\ + : null,\n \"registryValue\": null,\n \"registryValueName\": null,\n \"\ + accountName\": \"User1\",\n \"domainName\": \"DIYTESTMACHINE\",\n \"userSid\"\ + : \"S-1-5-21-4215714199-1288013905-3478400915-1002\",\n \"aadUserId\": null,\n\ + \ \"userPrincipalName\": null,\n \"detectionStatus\": \"Detected\"\n },\n\ + \ {\n \"entityType\": \"Process\",\n \"evidenceCreationTime\": \"2023-01-24T05:33:37.4166667Z\"\ + ,\n \"sha1\": \"f1efb0fddc156e4c61c5f78a54700e4e7984d55d\",\n \"sha256\":\ + \ \"b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450\",\n \"\ + fileName\": \"cmd.exe\",\n \"filePath\": \"C:\\\\Windows\\\\System32\",\n \ + \ \"processId\": 8964,\n \"processCommandLine\": \"cmd.exe /Q /c powershell -NoProfile\ + \ -ExecutionPolicy Bypass -File \\\"C:\\\\Users\\\\administrator1\\\\Desktop\\\\\ + SharedFolder\\\\payload.ps1\\\" 1> \\\\\\\\127.0.0.1\\\\SharedFolder\\\\__1674538248.357367\ + \ 2>&1\",\n \"processCreationTime\": \"2023-01-24T05:31:04.0743902Z\",\n \"\ + parentProcessId\": 7824,\n \"parentProcessCreationTime\": \"2023-01-24T05:30:50.8649791Z\"\ + ,\n \"parentProcessFileName\": \"WmiPrvSE.exe\",\n \"parentProcessFilePath\"\ + : \"C:\\\\Windows\\\\System32\\\\wbem\",\n \"ipAddress\": null,\n \"url\"\ + : null,\n \"registryKey\": null,\n \"registryHive\": null,\n \"registryValueType\"\ + : null,\n \"registryValue\": null,\n \"registryValueName\": null,\n \"\ + accountName\": \"User1\",\n \"domainName\": \"DIYTESTMACHINE\",\n \"userSid\"\ + : \"S-1-5-21-4215714199-1288013905-3478400915-1002\",\n \"aadUserId\": null,\n\ + \ \"userPrincipalName\": null,\n \"detectionStatus\": \"Detected\"\n },\n\ + \ {\n \"entityType\": \"Process\",\n \"evidenceCreationTime\": \"2023-01-24T05:39:47.1733333Z\"\ + ,\n \"sha1\": \"f1efb0fddc156e4c61c5f78a54700e4e7984d55d\",\n \"sha256\":\ + \ \"b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450\",\n \"\ + fileName\": \"cmd.exe\",\n \"filePath\": \"C:\\\\Windows\\\\System32\",\n \ + \ \"processId\": 884,\n \"processCommandLine\": \"cmd.exe /Q /c powershell -NoProfile\ + \ -ExecutionPolicy Bypass -File \\\"C:\\\\Users\\\\administrator1\\\\Desktop\\\\\ + SharedFolder\\\\payload.ps1\\\" 1> \\\\\\\\127.0.0.1\\\\SharedFolder\\\\__1674538583.8648584\ + \ 2>&1\",\n \"processCreationTime\": \"2023-01-24T05:36:38.826505Z\",\n \"\ + parentProcessId\": 7736,\n \"parentProcessCreationTime\": \"2023-01-24T05:36:26.0524655Z\"\ + ,\n \"parentProcessFileName\": \"WmiPrvSE.exe\",\n \"parentProcessFilePath\"\ + : \"C:\\\\Windows\\\\System32\\\\wbem\",\n \"ipAddress\": null,\n \"url\"\ + : null,\n \"registryKey\": null,\n \"registryHive\": null,\n \"registryValueType\"\ + : null,\n \"registryValue\": null,\n \"registryValueName\": null,\n \"\ + accountName\": \"User1\",\n \"domainName\": \"DIYTESTMACHINE\",\n \"userSid\"\ + : \"S-1-5-21-4215714199-1288013905-3478400915-1002\",\n \"aadUserId\": null,\n\ + \ \"userPrincipalName\": null,\n \"detectionStatus\": \"Detected\"\n },\n\ + \ {\n \"entityType\": \"Process\",\n \"evidenceCreationTime\": \"2023-01-24T13:07:13.2233333Z\"\ + ,\n \"sha1\": \"3ea7cc066317ac45f963c2227c4c7c50aa16eb7c\",\n \"sha256\":\ + \ \"2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3\",\n \"\ + fileName\": \"WmiPrvSE.exe\",\n \"filePath\": \"C:\\\\Windows\\\\System32\\\\\ + wbem\",\n \"processId\": 756,\n \"processCommandLine\": \"wmiprvse.exe -secured\ + \ -Embedding\",\n \"processCreationTime\": \"2023-01-24T13:00:35.0107475Z\",\n\ + \ \"parentProcessId\": 908,\n \"parentProcessCreationTime\": \"2023-01-24T08:20:44.6877667Z\"\ + ,\n \"parentProcessFileName\": \"svchost.exe\",\n \"parentProcessFilePath\"\ + : \"C:\\\\Windows\\\\System32\",\n \"ipAddress\": null,\n \"url\": null,\n\ + \ \"registryKey\": null,\n \"registryHive\": null,\n \"registryValueType\"\ + : null,\n \"registryValue\": null,\n \"registryValueName\": null,\n \"\ + accountName\": \"NETWORK SERVICE\",\n \"domainName\": \"NT AUTHORITY\",\n \ + \ \"userSid\": \"S-1-5-20\",\n \"aadUserId\": null,\n \"userPrincipalName\"\ + : null,\n \"detectionStatus\": \"Detected\"\n },\n {\n \"entityType\": \"\ + Process\",\n \"evidenceCreationTime\": \"2023-01-24T05:45:51.6833333Z\",\n \ + \ \"sha1\": \"f1efb0fddc156e4c61c5f78a54700e4e7984d55d\",\n \"sha256\": \"b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450\"\ + ,\n \"fileName\": \"cmd.exe\",\n \"filePath\": \"C:\\\\Windows\\\\System32\"\ + ,\n \"processId\": 1140,\n \"processCommandLine\": \"cmd.exe /Q /c powershell\ + \ -NoProfile -ExecutionPolicy Bypass -File \\\"C:\\\\Users\\\\administrator1\\\\\ + Desktop\\\\SharedFolder\\\\payload.ps1\\\" 1> \\\\\\\\127.0.0.1\\\\SharedFolder\\\ + \\__1674538878.1586335 2>&1\",\n \"processCreationTime\": \"2023-01-24T05:43:49.9375398Z\"\ + ,\n \"parentProcessId\": 4476,\n \"parentProcessCreationTime\": \"2023-01-24T05:43:32.4631151Z\"\ + ,\n \"parentProcessFileName\": \"WmiPrvSE.exe\",\n \"parentProcessFilePath\"\ + : \"C:\\\\Windows\\\\System32\\\\wbem\",\n \"ipAddress\": null,\n \"url\"\ + : null,\n \"registryKey\": null,\n \"registryHive\": null,\n \"registryValueType\"\ + : null,\n \"registryValue\": null,\n \"registryValueName\": null,\n \"\ + accountName\": \"User1\",\n \"domainName\": \"DIYTESTMACHINE\",\n \"userSid\"\ + : \"S-1-5-21-4215714199-1288013905-3478400915-1002\",\n \"aadUserId\": null,\n\ + \ \"userPrincipalName\": null,\n \"detectionStatus\": \"Detected\"\n },\n\ + \ {\n \"entityType\": \"Process\",\n \"evidenceCreationTime\": \"2023-01-24T05:39:47.1733333Z\"\ + ,\n \"sha1\": \"3ea7cc066317ac45f963c2227c4c7c50aa16eb7c\",\n \"sha256\":\ + \ \"2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3\",\n \"\ + fileName\": \"WmiPrvSE.exe\",\n \"filePath\": \"C:\\\\Windows\\\\System32\\\\\ + wbem\",\n \"processId\": 7736,\n \"processCommandLine\": \"wmiprvse.exe -secured\ + \ -Embedding\",\n \"processCreationTime\": \"2023-01-24T05:36:26.0524655Z\",\n\ + \ \"parentProcessId\": 896,\n \"parentProcessCreationTime\": \"2023-01-24T04:44:17.1940386Z\"\ + ,\n \"parentProcessFileName\": \"svchost.exe\",\n \"parentProcessFilePath\"\ + : \"C:\\\\Windows\\\\System32\",\n \"ipAddress\": null,\n \"url\": null,\n\ + \ \"registryKey\": null,\n \"registryHive\": null,\n \"registryValueType\"\ + : null,\n \"registryValue\": null,\n \"registryValueName\": null,\n \"\ + accountName\": \"NETWORK SERVICE\",\n \"domainName\": \"NT AUTHORITY\",\n \ + \ \"userSid\": \"S-1-5-20\",\n \"aadUserId\": null,\n \"userPrincipalName\"\ + : null,\n \"detectionStatus\": \"Detected\"\n }\n],\n\"domains\": []\n}"