abnormal Behavior in Users Devices
hi security guys
I am facing strange behaviors on Microsoft EDR that show in timeline Windows Defender Advanced Threat ProtectionSenseIR.exe is using fake accounts which are not exist in Microsoft Active directory and Azure Active Directory
Is considering a normal behavior, hacked or Windows Defender Advanced Threat Protection zero day vulnerable.
the below sample from timeline that related with fake account.
Event TimeMachine IdComputer NameAction TypeFile NameFolder PathSha1Sha256MD5Process Command LineAccount DomainAccount NameAccount SidLogo IdProcess IdProcess Creation TimeProcess Token ElevationRegistry KeyRegistry Value NameRegistry Value DataRemote UrlRemote Computer NameRemote IPRemote PortLocal IPLocal PortFile Origin UrlFile Origin IPInitiating Process SHA1Initiating Process SHA256Initiating Process File NameInitiating Process Folder PathInitiating Process IdInitiating Process Command LineInitiating Process Creation TimeInitiating Process Integrity LevelInitiating Process Token ElevationInitiating Process Parent IdInitiating Process Parent File NameInitiating Process Parent Creation TimeInitiating Process MD5Initiating Process Account DomainInitiating Process Account NameInitiating Process Account SidInitiating Process Logon IdReport IdAdditional FieldsApp Guard Container IdProtocolLogon TypeProcess Integrity LevelRegistry Value TypePrevious Registry Value NamePrevious Registry Value DataPrevious Registry KeyFile Origin Referrer UrlSensitivity LabelSensitivity Sub LabelIs Endpoint Dlp AppliedIs Azure Info Protection AppliedAlert IdsCategoriesSeveritiesIs MarkedData Type2024-04-19T12:22:10.9876595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1InboundRdpConnection LITCfake accountS-1-5-21-3977750084-2905094788-454684165-926103861 7c04ec2377e32b3c742f581f6c5437464dd2cf23247PKBT60B6DT25B34CP74B5889Ap10F1B3S72B4D4D95B5B25B54560B8powershell.exeC:WindowsSystem32WindowsPowerShellv1.08332powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -Command “& {$OutputEncoding = [Console]::OutputEncoding =[System.Text.Encoding]::UTF8;$scriptFileStream = [System.IO.File]::Open(‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::Read);$calculatedHash = Microsoft.PowerShell.Utility Get-FileHash ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Algorithm SHA256; if (!( $calculatedHash.Hash -eq ‘575497143631ed5cd604e7a1e8666187bd6acf421ad685273e559c0013179789’)) { exit 323;}; Start-Transcript -Path ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionTempPSScriptOutputsPSScript_Transcript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.txt’; . ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Id 3f884218-6a5a-4d02-8032-32ed7f90339a -Descriptor eyJEZXRlY3Rpb25LZXlzIjpbIk1va2h0YXIuU2hvc2hhbiJdLCJDb250ZW50IjoiZXdvZ0lDSlRaWEpwWVd4cGVtVmtUbXhTWldOdmNtUWlPaUFpU0dkQlNVRkNORUZJWjBGQlFVRkJRVUZCUVVGQlJGVTFUWHBqUVVGblFVRkJaMEZCUVVGblFVZEJRemNyY3pONU9UUXZZVUZSVVVGQlVVRkJRVUZCUVVGUlFVdEJRVUZCUVVGQlVVRkJRVUZHUVVFd1FVTmlWRGRNWW5SWVduUjVNbTlPUmtnek1FcGhNRlZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUWtGQlFVRkJRVUZCUVVGQlFVRkJRVU5CUVVGQlJHZEJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZVVVVKMlFVZHpRV0ZCUWpCQlIwVkJZMmRCZFVGR1RVRmhRVUoyUVVoTlFXRkJRbWhCUnpSQlFVRkNjMEZIYTBGa1FVSnFRVWQzUVdGUlFqQkJSMDFCVEdkQ2MwRkhPRUZaZDBKb1FVZDNRVlJSUW5aQlIzTkJZVUZDTUVGSFJVRmpaMEYxUVVaTlFXRkJRblpCU0UxQllVRkNhRUZITkVGUlFVSnpRVWRyUVdSQlFtcEJRelJCWWtGQ2RrRkhUVUZaVVVKelFVVXdRV0ozUW5KQlIyZEJaRUZDYUVGSVNVRk1aMEpVUVVkblFXSjNRbnBCUjJkQldWRkNkVUZCUVVGVVVVSjJRVWR6UVdGQlFqQkJSMFZCWTJkQlowRkdUVUZoUVVKMlFVaE5RV0ZCUW1oQlJ6UkJRVUZCUVVGblFVRkNkMEZCUVVGRlEwRkJRVWhCUVVGQllrRkNjRUZJVVVGWmQwSlRaRzQ0V0dOcVZVWTFSVzVIT0hadWFFUlFSUzh2ZEdOQ2FtUXlNMjFHVlc5QlJ6UkJaRkZDYzBGSGQwRkxVVUZCUVVFOVBTSXNDaUFnSWxOdlpuUjNZWEpsUlhoamJIVnphVzl1VEdsemRFWnZja1JsY0d4dmVXMWxiblFpT2lCYlhRcDkiLCJFbnRpdHlQYXRoIjoiIiwiRW50aXR5VHlwZSI6NiwiTHVyZURlcGxveW1lbnRDb250ZXh0Ijp7IkV4cGlyYXRpb25VdGMiOiIyMDI0LTA0LTIyVDEyOjE2OjQ1LjQ0NTE3NzVaIiwiSWQiOiJhZjlkNWY2YS1jNjZhLTRmYmMtOTkwZS00MzMwYmI4ZTZjODQiLCJDb3JyZWxhdGlvbklkIjpudWxsfSwiRmlsZUF0dHJpYnV0ZXMiOjAsIlVzZXJSaWQiOjkyNjEwMzg2MX0=}”2024-04-19T12:21:13.582SystemDefault7192SenseIR.exe2024-04-19T12:21:11.307NT AUTHORITYsystemS-1-5-18 1.65E+09 T1021.001 (bolster) Techniques2024-04-19T12:22:10.9876595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1WindowsDomainAccountLogonSuccess LITCfake accountS-1-5-21-3977750084-2905094788-454684165-926103861 7c04ec2377e32b3c742f581f6c5437464dd2cf23247PKBT60B6DT25B34CP74B5889Ap10F1B3S72B4D4D95B5B25B54560B8powershell.exeC:WindowsSystem32WindowsPowerShellv1.08332powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -Command “& {$OutputEncoding = [Console]::OutputEncoding =[System.Text.Encoding]::UTF8;$scriptFileStream = [System.IO.File]::Open(‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::Read);$calculatedHash = Microsoft.PowerShell.Utility Get-FileHash ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Algorithm SHA256; if (!( $calculatedHash.Hash -eq ‘575497143631ed5cd604e7a1e8666187bd6acf421ad685273e559c0013179789’)) { exit 323;}; Start-Transcript -Path ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionTempPSScriptOutputsPSScript_Transcript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.txt’; . ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Id 3f884218-6a5a-4d02-8032-32ed7f90339a -Descriptor eyJEZXRlY3Rpb25LZXlzIjpbIk1va2h0YXIuU2hvc2hhbiJdLCJDb250ZW50IjoiZXdvZ0lDSlRaWEpwWVd4cGVtVmtUbXhTWldOdmNtUWlPaUFpU0dkQlNVRkNORUZJWjBGQlFVRkJRVUZCUVVGQlJGVTFUWHBqUVVGblFVRkJaMEZCUVVGblFVZEJRemNyY3pONU9UUXZZVUZSVVVGQlVVRkJRVUZCUVVGUlFVdEJRVUZCUVVGQlVVRkJRVUZHUVVFd1FVTmlWRGRNWW5SWVduUjVNbTlPUmtnek1FcGhNRlZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUWtGQlFVRkJRVUZCUVVGQlFVRkJRVU5CUVVGQlJHZEJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZVVVVKMlFVZHpRV0ZCUWpCQlIwVkJZMmRCZFVGR1RVRmhRVUoyUVVoTlFXRkJRbWhCUnpSQlFVRkNjMEZIYTBGa1FVSnFRVWQzUVdGUlFqQkJSMDFCVEdkQ2MwRkhPRUZaZDBKb1FVZDNRVlJSUW5aQlIzTkJZVUZDTUVGSFJVRmpaMEYxUVVaTlFXRkJRblpCU0UxQllVRkNhRUZITkVGUlFVSnpRVWRyUVdSQlFtcEJRelJCWWtGQ2RrRkhUVUZaVVVKelFVVXdRV0ozUW5KQlIyZEJaRUZDYUVGSVNVRk1aMEpVUVVkblFXSjNRbnBCUjJkQldWRkNkVUZCUVVGVVVVSjJRVWR6UVdGQlFqQkJSMFZCWTJkQlowRkdUVUZoUVVKMlFVaE5RV0ZCUW1oQlJ6UkJRVUZCUVVGblFVRkNkMEZCUVVGRlEwRkJRVWhCUVVGQllrRkNjRUZJVVVGWmQwSlRaRzQ0V0dOcVZVWTFSVzVIT0hadWFFUlFSUzh2ZEdOQ2FtUXlNMjFHVlc5QlJ6UkJaRkZDYzBGSGQwRkxVVUZCUVVFOVBTSXNDaUFnSWxOdlpuUjNZWEpsUlhoamJIVnphVzl1VEdsemRFWnZja1JsY0d4dmVXMWxiblFpT2lCYlhRcDkiLCJFbnRpdHlQYXRoIjoiIiwiRW50aXR5VHlwZSI6NiwiTHVyZURlcGxveW1lbnRDb250ZXh0Ijp7IkV4cGlyYXRpb25VdGMiOiIyMDI0LTA0LTIyVDEyOjE2OjQ1LjQ0NTE3NzVaIiwiSWQiOiJhZjlkNWY2YS1jNjZhLTRmYmMtOTkwZS00MzMwYmI4ZTZjODQiLCJDb3JyZWxhdGlvbklkIjpudWxsfSwiRmlsZUF0dHJpYnV0ZXMiOjAsIlVzZXJSaWQiOjkyNjEwMzg2MX0=}”2024-04-19T12:21:13.582SystemDefault7192SenseIR.exe2024-04-19T12:21:11.307NT AUTHORITYsystemS-1-5-18 9.09E+08 T1078.002 (bolster) Techniques2024-04-19T12:22:10.9876595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1LogonSuccess LITCfake accountS-1-5-21-3977750084-2905094788-454684165-926103861 7c04ec2377e32b3c742f581f6c5437464dd2cf23247PKBT60B6DT25B34CP74B5889Ap10F1B3S72B4D4D95B5B25B54560B8powershell.exeC:WindowsSystem32WindowsPowerShellv1.08332powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -Command “& {$OutputEncoding = [Console]::OutputEncoding =[System.Text.Encoding]::UTF8;$scriptFileStream = [System.IO.File]::Open(‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::Read);$calculatedHash = Microsoft.PowerShell.Utility Get-FileHash ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Algorithm SHA256; if (!( $calculatedHash.Hash -eq ‘575497143631ed5cd604e7a1e8666187bd6acf421ad685273e559c0013179789’)) { exit 323;}; Start-Transcript -Path ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionTempPSScriptOutputsPSScript_Transcript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.txt’; . ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Id 3f884218-6a5a-4d02-8032-32ed7f90339a -Descriptor eyJEZXRlY3Rpb25LZXlzIjpbIk1va2h0YXIuU2hvc2hhbiJdLCJDb250ZW50IjoiZXdvZ0lDSlRaWEpwWVd4cGVtVmtUbXhTWldOdmNtUWlPaUFpU0dkQlNVRkNORUZJWjBGQlFVRkJRVUZCUVVGQlJGVTFUWHBqUVVGblFVRkJaMEZCUVVGblFVZEJRemNyY3pONU9UUXZZVUZSVVVGQlVVRkJRVUZCUVVGUlFVdEJRVUZCUVVGQlVVRkJRVUZHUVVFd1FVTmlWRGRNWW5SWVduUjVNbTlPUmtnek1FcGhNRlZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUWtGQlFVRkJRVUZCUVVGQlFVRkJRVU5CUVVGQlJHZEJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZVVVVKMlFVZHpRV0ZCUWpCQlIwVkJZMmRCZFVGR1RVRmhRVUoyUVVoTlFXRkJRbWhCUnpSQlFVRkNjMEZIYTBGa1FVSnFRVWQzUVdGUlFqQkJSMDFCVEdkQ2MwRkhPRUZaZDBKb1FVZDNRVlJSUW5aQlIzTkJZVUZDTUVGSFJVRmpaMEYxUVVaTlFXRkJRblpCU0UxQllVRkNhRUZITkVGUlFVSnpRVWRyUVdSQlFtcEJRelJCWWtGQ2RrRkhUVUZaVVVKelFVVXdRV0ozUW5KQlIyZEJaRUZDYUVGSVNVRk1aMEpVUVVkblFXSjNRbnBCUjJkQldWRkNkVUZCUVVGVVVVSjJRVWR6UVdGQlFqQkJSMFZCWTJkQlowRkdUVUZoUVVKMlFVaE5RV0ZCUW1oQlJ6UkJRVUZCUVVGblFVRkNkMEZCUVVGRlEwRkJRVWhCUVVGQllrRkNjRUZJVVVGWmQwSlRaRzQ0V0dOcVZVWTFSVzVIT0hadWFFUlFSUzh2ZEdOQ2FtUXlNMjFHVlc5QlJ6UkJaRkZDYzBGSGQwRkxVVUZCUVVFOVBTSXNDaUFnSWxOdlpuUjNZWEpsUlhoamJIVnphVzl1VEdsemRFWnZja1JsY0d4dmVXMWxiblFpT2lCYlhRcDkiLCJFbnRpdHlQYXRoIjoiIiwiRW50aXR5VHlwZSI6NiwiTHVyZURlcGxveW1lbnRDb250ZXh0Ijp7IkV4cGlyYXRpb25VdGMiOiIyMDI0LTA0LTIyVDEyOjE2OjQ1LjQ0NTE3NzVaIiwiSWQiOiJhZjlkNWY2YS1jNjZhLTRmYmMtOTkwZS00MzMwYmI4ZTZjODQiLCJDb3JyZWxhdGlvbklkIjpudWxsfSwiRmlsZUF0dHJpYnV0ZXMiOjAsIlVzZXJSaWQiOjkyNjEwMzg2MX0=}”2024-04-19T12:21:13.582SystemStandard7192DeviceHarddiskVolume3Program FilesWindows Defender Advanced Threat ProtectionSenseIR.exe2024-04-19T12:21:11.307nt authoritysystemS-1-5-18 28953{“IsLocalLogon”:false} CachedRemoteInteractive Events2024-04-19T12:22:10.9876595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1WindowsDomainAccountLogonSuccess LITCfake accountS-1-5-21-3977750084-2905094788-454684165-926103861 7c04ec2377e32b3c742f581f6c5437464dd2cf23247PKBT60B6DT25B34CP74B5889Ap10F1B3S72B4D4D95B5B25B54560B8powershell.exeC:WindowsSystem32WindowsPowerShellv1.08332powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -Command “& {$OutputEncoding = [Console]::OutputEncoding =[System.Text.Encoding]::UTF8;$scriptFileStream = [System.IO.File]::Open(‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::Read);$calculatedHash = Microsoft.PowerShell.Utility Get-FileHash ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Algorithm SHA256; if (!( $calculatedHash.Hash -eq ‘575497143631ed5cd604e7a1e8666187bd6acf421ad685273e559c0013179789’)) { exit 323;}; Start-Transcript -Path ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionTempPSScriptOutputsPSScript_Transcript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.txt’; . ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Id 3f884218-6a5a-4d02-8032-32ed7f90339a -Descriptor eyJEZXRlY3Rpb25LZXlzIjpbIk1va2h0YXIuU2hvc2hhbiJdLCJDb250ZW50IjoiZXdvZ0lDSlRaWEpwWVd4cGVtVmtUbXhTWldOdmNtUWlPaUFpU0dkQlNVRkNORUZJWjBGQlFVRkJRVUZCUVVGQlJGVTFUWHBqUVVGblFVRkJaMEZCUVVGblFVZEJRemNyY3pONU9UUXZZVUZSVVVGQlVVRkJRVUZCUVVGUlFVdEJRVUZCUVVGQlVVRkJRVUZHUVVFd1FVTmlWRGRNWW5SWVduUjVNbTlPUmtnek1FcGhNRlZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUWtGQlFVRkJRVUZCUVVGQlFVRkJRVU5CUVVGQlJHZEJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZVVVVKMlFVZHpRV0ZCUWpCQlIwVkJZMmRCZFVGR1RVRmhRVUoyUVVoTlFXRkJRbWhCUnpSQlFVRkNjMEZIYTBGa1FVSnFRVWQzUVdGUlFqQkJSMDFCVEdkQ2MwRkhPRUZaZDBKb1FVZDNRVlJSUW5aQlIzTkJZVUZDTUVGSFJVRmpaMEYxUVVaTlFXRkJRblpCU0UxQllVRkNhRUZITkVGUlFVSnpRVWRyUVdSQlFtcEJRelJCWWtGQ2RrRkhUVUZaVVVKelFVVXdRV0ozUW5KQlIyZEJaRUZDYUVGSVNVRk1aMEpVUVVkblFXSjNRbnBCUjJkQldWRkNkVUZCUVVGVVVVSjJRVWR6UVdGQlFqQkJSMFZCWTJkQlowRkdUVUZoUVVKMlFVaE5RV0ZCUW1oQlJ6UkJRVUZCUVVGblFVRkNkMEZCUVVGRlEwRkJRVWhCUVVGQllrRkNjRUZJVVVGWmQwSlRaRzQ0V0dOcVZVWTFSVzVIT0hadWFFUlFSUzh2ZEdOQ2FtUXlNMjFHVlc5QlJ6UkJaRkZDYzBGSGQwRkxVVUZCUVVFOVBTSXNDaUFnSWxOdlpuUjNZWEpsUlhoamJIVnphVzl1VEdsemRFWnZja1JsY0d4dmVXMWxiblFpT2lCYlhRcDkiLCJFbnRpdHlQYXRoIjoiIiwiRW50aXR5VHlwZSI6NiwiTHVyZURlcGxveW1lbnRDb250ZXh0Ijp7IkV4cGlyYXRpb25VdGMiOiIyMDI0LTA0LTIyVDEyOjE2OjQ1LjQ0NTE3NzVaIiwiSWQiOiJhZjlkNWY2YS1jNjZhLTRmYmMtOTkwZS00MzMwYmI4ZTZjODQiLCJDb3JyZWxhdGlvbklkIjpudWxsfSwiRmlsZUF0dHJpYnV0ZXMiOjAsIlVzZXJSaWQiOjkyNjEwMzg2MX0=}”2024-04-19T12:21:13.582SystemDefault7192SenseIR.exe2024-04-19T12:21:11.307NT AUTHORITYsystemS-1-5-18 8.59E+08 T1078.002 (bolster) Techniques2024-04-19T12:22:10.9876595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1InboundRdpConnection LITCfake accountS-1-5-21-3977750084-2905094788-454684165-926103861 7c04ec2377e32b3c742f581f6c5437464dd2cf23247PKBT60B6DT25B34CP74B5889Ap10F1B3S72B4D4D95B5B25B54560B8powershell.exeC:WindowsSystem32WindowsPowerShellv1.08332powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -Command “& {$OutputEncoding = [Console]::OutputEncoding =[System.Text.Encoding]::UTF8;$scriptFileStream = [System.IO.File]::Open(‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::Read);$calculatedHash = Microsoft.PowerShell.Utility Get-FileHash ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Algorithm SHA256; if (!( $calculatedHash.Hash -eq ‘575497143631ed5cd604e7a1e8666187bd6acf421ad685273e559c0013179789’)) { exit 323;}; Start-Transcript -Path ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionTempPSScriptOutputsPSScript_Transcript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.txt’; . ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Id 3f884218-6a5a-4d02-8032-32ed7f90339a -Descriptor eyJEZXRlY3Rpb25LZXlzIjpbIk1va2h0YXIuU2hvc2hhbiJdLCJDb250ZW50IjoiZXdvZ0lDSlRaWEpwWVd4cGVtVmtUbXhTWldOdmNtUWlPaUFpU0dkQlNVRkNORUZJWjBGQlFVRkJRVUZCUVVGQlJGVTFUWHBqUVVGblFVRkJaMEZCUVVGblFVZEJRemNyY3pONU9UUXZZVUZSVVVGQlVVRkJRVUZCUVVGUlFVdEJRVUZCUVVGQlVVRkJRVUZHUVVFd1FVTmlWRGRNWW5SWVduUjVNbTlPUmtnek1FcGhNRlZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUWtGQlFVRkJRVUZCUVVGQlFVRkJRVU5CUVVGQlJHZEJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZVVVVKMlFVZHpRV0ZCUWpCQlIwVkJZMmRCZFVGR1RVRmhRVUoyUVVoTlFXRkJRbWhCUnpSQlFVRkNjMEZIYTBGa1FVSnFRVWQzUVdGUlFqQkJSMDFCVEdkQ2MwRkhPRUZaZDBKb1FVZDNRVlJSUW5aQlIzTkJZVUZDTUVGSFJVRmpaMEYxUVVaTlFXRkJRblpCU0UxQllVRkNhRUZITkVGUlFVSnpRVWRyUVdSQlFtcEJRelJCWWtGQ2RrRkhUVUZaVVVKelFVVXdRV0ozUW5KQlIyZEJaRUZDYUVGSVNVRk1aMEpVUVVkblFXSjNRbnBCUjJkQldWRkNkVUZCUVVGVVVVSjJRVWR6UVdGQlFqQkJSMFZCWTJkQlowRkdUVUZoUVVKMlFVaE5RV0ZCUW1oQlJ6UkJRVUZCUVVGblFVRkNkMEZCUVVGRlEwRkJRVWhCUVVGQllrRkNjRUZJVVVGWmQwSlRaRzQ0V0dOcVZVWTFSVzVIT0hadWFFUlFSUzh2ZEdOQ2FtUXlNMjFHVlc5QlJ6UkJaRkZDYzBGSGQwRkxVVUZCUVVFOVBTSXNDaUFnSWxOdlpuUjNZWEpsUlhoamJIVnphVzl1VEdsemRFWnZja1JsY0d4dmVXMWxiblFpT2lCYlhRcDkiLCJFbnRpdHlQYXRoIjoiIiwiRW50aXR5VHlwZSI6NiwiTHVyZURlcGxveW1lbnRDb250ZXh0Ijp7IkV4cGlyYXRpb25VdGMiOiIyMDI0LTA0LTIyVDEyOjE2OjQ1LjQ0NTE3NzVaIiwiSWQiOiJhZjlkNWY2YS1jNjZhLTRmYmMtOTkwZS00MzMwYmI4ZTZjODQiLCJDb3JyZWxhdGlvbklkIjpudWxsfSwiRmlsZUF0dHJpYnV0ZXMiOjAsIlVzZXJSaWQiOjkyNjEwMzg2MX0=}”2024-04-19T12:21:13.582SystemDefault7192SenseIR.exe2024-04-19T12:21:11.307NT AUTHORITYsystemS-1-5-18 8.45E+08 T1021.001 (bolster) Techniques2024-04-19T12:22:10.9876595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1LogonSuccess LITCfake accountS-1-5-21-3977750084-2905094788-454684165-926103861 7c04ec2377e32b3c742f581f6c5437464dd2cf23247PKBT60B6DT25B34CP74B5889Ap10F1B3S72B4D4D95B5B25B54560B8powershell.exeC:WindowsSystem32WindowsPowerShellv1.08332powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -Command “& {$OutputEncoding = [Console]::OutputEncoding =[System.Text.Encoding]::UTF8;$scriptFileStream = [System.IO.File]::Open(‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::Read);$calculatedHash = Microsoft.PowerShell.Utility Get-FileHash ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Algorithm SHA256; if (!( $calculatedHash.Hash -eq ‘575497143631ed5cd604e7a1e8666187bd6acf421ad685273e559c0013179789’)) { exit 323;}; Start-Transcript -Path ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionTempPSScriptOutputsPSScript_Transcript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.txt’; . ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Id 3f884218-6a5a-4d02-8032-32ed7f90339a -Descriptor eyJEZXRlY3Rpb25LZXlzIjpbIk1va2h0YXIuU2hvc2hhbiJdLCJDb250ZW50IjoiZXdvZ0lDSlRaWEpwWVd4cGVtVmtUbXhTWldOdmNtUWlPaUFpU0dkQlNVRkNORUZJWjBGQlFVRkJRVUZCUVVGQlJGVTFUWHBqUVVGblFVRkJaMEZCUVVGblFVZEJRemNyY3pONU9UUXZZVUZSVVVGQlVVRkJRVUZCUVVGUlFVdEJRVUZCUVVGQlVVRkJRVUZHUVVFd1FVTmlWRGRNWW5SWVduUjVNbTlPUmtnek1FcGhNRlZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUWtGQlFVRkJRVUZCUVVGQlFVRkJRVU5CUVVGQlJHZEJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZVVVVKMlFVZHpRV0ZCUWpCQlIwVkJZMmRCZFVGR1RVRmhRVUoyUVVoTlFXRkJRbWhCUnpSQlFVRkNjMEZIYTBGa1FVSnFRVWQzUVdGUlFqQkJSMDFCVEdkQ2MwRkhPRUZaZDBKb1FVZDNRVlJSUW5aQlIzTkJZVUZDTUVGSFJVRmpaMEYxUVVaTlFXRkJRblpCU0UxQllVRkNhRUZITkVGUlFVSnpRVWRyUVdSQlFtcEJRelJCWWtGQ2RrRkhUVUZaVVVKelFVVXdRV0ozUW5KQlIyZEJaRUZDYUVGSVNVRk1aMEpVUVVkblFXSjNRbnBCUjJkQldWRkNkVUZCUVVGVVVVSjJRVWR6UVdGQlFqQkJSMFZCWTJkQlowRkdUVUZoUVVKMlFVaE5RV0ZCUW1oQlJ6UkJRVUZCUVVGblFVRkNkMEZCUVVGRlEwRkJRVWhCUVVGQllrRkNjRUZJVVVGWmQwSlRaRzQ0V0dOcVZVWTFSVzVIT0hadWFFUlFSUzh2ZEdOQ2FtUXlNMjFHVlc5QlJ6UkJaRkZDYzBGSGQwRkxVVUZCUVVFOVBTSXNDaUFnSWxOdlpuUjNZWEpsUlhoamJIVnphVzl1VEdsemRFWnZja1JsY0d4dmVXMWxiblFpT2lCYlhRcDkiLCJFbnRpdHlQYXRoIjoiIiwiRW50aXR5VHlwZSI6NiwiTHVyZURlcGxveW1lbnRDb250ZXh0Ijp7IkV4cGlyYXRpb25VdGMiOiIyMDI0LTA0LTIyVDEyOjE2OjQ1LjQ0NTE3NzVaIiwiSWQiOiJhZjlkNWY2YS1jNjZhLTRmYmMtOTkwZS00MzMwYmI4ZTZjODQiLCJDb3JyZWxhdGlvbklkIjpudWxsfSwiRmlsZUF0dHJpYnV0ZXMiOjAsIlVzZXJSaWQiOjkyNjEwMzg2MX0=}”2024-04-19T12:21:13.582SystemStandard7192DeviceHarddiskVolume3Program FilesWindows Defender Advanced Threat ProtectionSenseIR.exe2024-04-19T12:21:11.307nt authoritysystemS-1-5-18 28952{“IsLocalLogon”:false} CachedRemoteInteractive Events2024-04-19T12:22:10.9876595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1LogonAttempted LITCfake account 7c04ec2377e32b3c742f581f6c5437464dd2cf23247PKBT60B6DT25B34CP74B5889Ap10F1B3S72B4D4D95B5B25B54560B8powershell.exeC:WindowsSystem32WindowsPowerShellv1.08332powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -Command “& {$OutputEncoding = [Console]::OutputEncoding =[System.Text.Encoding]::UTF8;$scriptFileStream = [System.IO.File]::Open(‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::Read);$calculatedHash = Microsoft.PowerShell.Utility Get-FileHash ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Algorithm SHA256; if (!( $calculatedHash.Hash -eq ‘575497143631ed5cd604e7a1e8666187bd6acf421ad685273e559c0013179789’)) { exit 323;}; Start-Transcript -Path ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionTempPSScriptOutputsPSScript_Transcript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.txt’; . ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Id 3f884218-6a5a-4d02-8032-32ed7f90339a -Descriptor eyJEZXRlY3Rpb25LZXlzIjpbIk1va2h0YXIuU2hvc2hhbiJdLCJDb250ZW50IjoiZXdvZ0lDSlRaWEpwWVd4cGVtVmtUbXhTWldOdmNtUWlPaUFpU0dkQlNVRkNORUZJWjBGQlFVRkJRVUZCUVVGQlJGVTFUWHBqUVVGblFVRkJaMEZCUVVGblFVZEJRemNyY3pONU9UUXZZVUZSVVVGQlVVRkJRVUZCUVVGUlFVdEJRVUZCUVVGQlVVRkJRVUZHUVVFd1FVTmlWRGRNWW5SWVduUjVNbTlPUmtnek1FcGhNRlZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUWtGQlFVRkJRVUZCUVVGQlFVRkJRVU5CUVVGQlJHZEJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZVVVVKMlFVZHpRV0ZCUWpCQlIwVkJZMmRCZFVGR1RVRmhRVUoyUVVoTlFXRkJRbWhCUnpSQlFVRkNjMEZIYTBGa1FVSnFRVWQzUVdGUlFqQkJSMDFCVEdkQ2MwRkhPRUZaZDBKb1FVZDNRVlJSUW5aQlIzTkJZVUZDTUVGSFJVRmpaMEYxUVVaTlFXRkJRblpCU0UxQllVRkNhRUZITkVGUlFVSnpRVWRyUVdSQlFtcEJRelJCWWtGQ2RrRkhUVUZaVVVKelFVVXdRV0ozUW5KQlIyZEJaRUZDYUVGSVNVRk1aMEpVUVVkblFXSjNRbnBCUjJkQldWRkNkVUZCUVVGVVVVSjJRVWR6UVdGQlFqQkJSMFZCWTJkQlowRkdUVUZoUVVKMlFVaE5RV0ZCUW1oQlJ6UkJRVUZCUVVGblFVRkNkMEZCUVVGRlEwRkJRVWhCUVVGQllrRkNjRUZJVVVGWmQwSlRaRzQ0V0dOcVZVWTFSVzVIT0hadWFFUlFSUzh2ZEdOQ2FtUXlNMjFHVlc5QlJ6UkJaRkZDYzBGSGQwRkxVVUZCUVVFOVBTSXNDaUFnSWxOdlpuUjNZWEpsUlhoamJIVnphVzl1VEdsemRFWnZja1JsY0d4dmVXMWxiblFpT2lCYlhRcDkiLCJFbnRpdHlQYXRoIjoiIiwiRW50aXR5VHlwZSI6NiwiTHVyZURlcGxveW1lbnRDb250ZXh0Ijp7IkV4cGlyYXRpb25VdGMiOiIyMDI0LTA0LTIyVDEyOjE2OjQ1LjQ0NTE3NzVaIiwiSWQiOiJhZjlkNWY2YS1jNjZhLTRmYmMtOTkwZS00MzMwYmI4ZTZjODQiLCJDb3JyZWxhdGlvbklkIjpudWxsfSwiRmlsZUF0dHJpYnV0ZXMiOjAsIlVzZXJSaWQiOjkyNjEwMzg2MX0=}”2024-04-19T12:21:13.582SystemDefault7192SenseIR.exe2024-04-19T12:21:11.307NT AUTHORITYsystemS-1-5-18 28951 Events2024-04-19T12:22:09.7286595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1InteractiveRemoteComponentInvocation LITCfake accountS-1-5-21-3977750084-2905094788-454684165-926103861 1.71E+09 T1078 (Friends)/T1021.001 (Friends)Techniques2024-04-19T12:22:09.7286595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1WindowsDomainAccountLogonSuccess LITCfake accountS-1-5-21-3977750084-2905094788-454684165-926103861 D398B9D68B555K9K6K041K8Pia8849D1A6B1AC463A75A4F57158Ba4D796A2414790FCD3694D8Ab9ED3A8942A9CBCD0B71691Alsass.exeC:WindowsSystem32824lsass.exe2024-04-18T08:04:00.305SystemDefault928wininit.exe2024-04-18T08:04:00.107NT AUTHORITYsystemS-1-5-18 9.6E+08 T1078.002 (bolster) Techniques2024-04-19T12:22:09.7286595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1LogonSuccess LITCfake accountS-1-5-21-3977750084-2905094788-454684165-926103861 D398B9D68B555K9K6K041K8Pia8849D1A6B1AC463A75A4F57158Ba4D796A2414790FCD3694D8Ab9ED3A8942A9CBCD0B71691Alsass.exeC:WindowsSystem32lsass.exe824lsass.exe2024-04-18T08:04:00.305SystemStandard928wininit.exe2024-04-18T08:04:00.107nt authoritysystemS-1-5-18 28934{“IsLocalLogon”:false} RemoteInteractive Events
thanks in advance
hi security guys I am facing strange behaviors on Microsoft EDR that show in timeline Windows Defender Advanced Threat ProtectionSenseIR.exe is using fake accounts which are not exist in Microsoft Active directory and Azure Active Directory Is considering a normal behavior, hacked or Windows Defender Advanced Threat Protection zero day vulnerable.the below sample from timeline that related with fake account.Event TimeMachine IdComputer NameAction TypeFile NameFolder PathSha1Sha256MD5Process Command LineAccount DomainAccount NameAccount SidLogo IdProcess IdProcess Creation TimeProcess Token ElevationRegistry KeyRegistry Value NameRegistry Value DataRemote UrlRemote Computer NameRemote IPRemote PortLocal IPLocal PortFile Origin UrlFile Origin IPInitiating Process SHA1Initiating Process SHA256Initiating Process File NameInitiating Process Folder PathInitiating Process IdInitiating Process Command LineInitiating Process Creation TimeInitiating Process Integrity LevelInitiating Process Token ElevationInitiating Process Parent IdInitiating Process Parent File NameInitiating Process Parent Creation TimeInitiating Process MD5Initiating Process Account DomainInitiating Process Account NameInitiating Process Account SidInitiating Process Logon IdReport IdAdditional FieldsApp Guard Container IdProtocolLogon TypeProcess Integrity LevelRegistry Value TypePrevious Registry Value NamePrevious Registry Value DataPrevious Registry KeyFile Origin Referrer UrlSensitivity LabelSensitivity Sub LabelIs Endpoint Dlp AppliedIs Azure Info Protection AppliedAlert IdsCategoriesSeveritiesIs MarkedData Type2024-04-19T12:22:10.9876595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1InboundRdpConnection LITCfake accountS-1-5-21-3977750084-2905094788-454684165-926103861 7c04ec2377e32b3c742f581f6c5437464dd2cf23247PKBT60B6DT25B34CP74B5889Ap10F1B3S72B4D4D95B5B25B54560B8powershell.exeC:WindowsSystem32WindowsPowerShellv1.08332powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -Command “& {$OutputEncoding = [Console]::OutputEncoding =[System.Text.Encoding]::UTF8;$scriptFileStream = [System.IO.File]::Open(‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::Read);$calculatedHash = Microsoft.PowerShell.Utility Get-FileHash ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Algorithm SHA256; if (!( $calculatedHash.Hash -eq ‘575497143631ed5cd604e7a1e8666187bd6acf421ad685273e559c0013179789’)) { exit 323;}; Start-Transcript -Path ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionTempPSScriptOutputsPSScript_Transcript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.txt’; . ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Id 3f884218-6a5a-4d02-8032-32ed7f90339a -Descriptor eyJEZXRlY3Rpb25LZXlzIjpbIk1va2h0YXIuU2hvc2hhbiJdLCJDb250ZW50IjoiZXdvZ0lDSlRaWEpwWVd4cGVtVmtUbXhTWldOdmNtUWlPaUFpU0dkQlNVRkNORUZJWjBGQlFVRkJRVUZCUVVGQlJGVTFUWHBqUVVGblFVRkJaMEZCUVVGblFVZEJRemNyY3pONU9UUXZZVUZSVVVGQlVVRkJRVUZCUVVGUlFVdEJRVUZCUVVGQlVVRkJRVUZHUVVFd1FVTmlWRGRNWW5SWVduUjVNbTlPUmtnek1FcGhNRlZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUWtGQlFVRkJRVUZCUVVGQlFVRkJRVU5CUVVGQlJHZEJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZVVVVKMlFVZHpRV0ZCUWpCQlIwVkJZMmRCZFVGR1RVRmhRVUoyUVVoTlFXRkJRbWhCUnpSQlFVRkNjMEZIYTBGa1FVSnFRVWQzUVdGUlFqQkJSMDFCVEdkQ2MwRkhPRUZaZDBKb1FVZDNRVlJSUW5aQlIzTkJZVUZDTUVGSFJVRmpaMEYxUVVaTlFXRkJRblpCU0UxQllVRkNhRUZITkVGUlFVSnpRVWRyUVdSQlFtcEJRelJCWWtGQ2RrRkhUVUZaVVVKelFVVXdRV0ozUW5KQlIyZEJaRUZDYUVGSVNVRk1aMEpVUVVkblFXSjNRbnBCUjJkQldWRkNkVUZCUVVGVVVVSjJRVWR6UVdGQlFqQkJSMFZCWTJkQlowRkdUVUZoUVVKMlFVaE5RV0ZCUW1oQlJ6UkJRVUZCUVVGblFVRkNkMEZCUVVGRlEwRkJRVWhCUVVGQllrRkNjRUZJVVVGWmQwSlRaRzQ0V0dOcVZVWTFSVzVIT0hadWFFUlFSUzh2ZEdOQ2FtUXlNMjFHVlc5QlJ6UkJaRkZDYzBGSGQwRkxVVUZCUVVFOVBTSXNDaUFnSWxOdlpuUjNZWEpsUlhoamJIVnphVzl1VEdsemRFWnZja1JsY0d4dmVXMWxiblFpT2lCYlhRcDkiLCJFbnRpdHlQYXRoIjoiIiwiRW50aXR5VHlwZSI6NiwiTHVyZURlcGxveW1lbnRDb250ZXh0Ijp7IkV4cGlyYXRpb25VdGMiOiIyMDI0LTA0LTIyVDEyOjE2OjQ1LjQ0NTE3NzVaIiwiSWQiOiJhZjlkNWY2YS1jNjZhLTRmYmMtOTkwZS00MzMwYmI4ZTZjODQiLCJDb3JyZWxhdGlvbklkIjpudWxsfSwiRmlsZUF0dHJpYnV0ZXMiOjAsIlVzZXJSaWQiOjkyNjEwMzg2MX0=}”2024-04-19T12:21:13.582SystemDefault7192SenseIR.exe2024-04-19T12:21:11.307NT AUTHORITYsystemS-1-5-18 1.65E+09 T1021.001 (bolster) Techniques2024-04-19T12:22:10.9876595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1WindowsDomainAccountLogonSuccess LITCfake accountS-1-5-21-3977750084-2905094788-454684165-926103861 7c04ec2377e32b3c742f581f6c5437464dd2cf23247PKBT60B6DT25B34CP74B5889Ap10F1B3S72B4D4D95B5B25B54560B8powershell.exeC:WindowsSystem32WindowsPowerShellv1.08332powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -Command “& {$OutputEncoding = [Console]::OutputEncoding =[System.Text.Encoding]::UTF8;$scriptFileStream = [System.IO.File]::Open(‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::Read);$calculatedHash = Microsoft.PowerShell.Utility Get-FileHash ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Algorithm SHA256; if (!( $calculatedHash.Hash -eq ‘575497143631ed5cd604e7a1e8666187bd6acf421ad685273e559c0013179789’)) { exit 323;}; Start-Transcript -Path ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionTempPSScriptOutputsPSScript_Transcript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.txt’; . ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Id 3f884218-6a5a-4d02-8032-32ed7f90339a -Descriptor eyJEZXRlY3Rpb25LZXlzIjpbIk1va2h0YXIuU2hvc2hhbiJdLCJDb250ZW50IjoiZXdvZ0lDSlRaWEpwWVd4cGVtVmtUbXhTWldOdmNtUWlPaUFpU0dkQlNVRkNORUZJWjBGQlFVRkJRVUZCUVVGQlJGVTFUWHBqUVVGblFVRkJaMEZCUVVGblFVZEJRemNyY3pONU9UUXZZVUZSVVVGQlVVRkJRVUZCUVVGUlFVdEJRVUZCUVVGQlVVRkJRVUZHUVVFd1FVTmlWRGRNWW5SWVduUjVNbTlPUmtnek1FcGhNRlZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUWtGQlFVRkJRVUZCUVVGQlFVRkJRVU5CUVVGQlJHZEJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZVVVVKMlFVZHpRV0ZCUWpCQlIwVkJZMmRCZFVGR1RVRmhRVUoyUVVoTlFXRkJRbWhCUnpSQlFVRkNjMEZIYTBGa1FVSnFRVWQzUVdGUlFqQkJSMDFCVEdkQ2MwRkhPRUZaZDBKb1FVZDNRVlJSUW5aQlIzTkJZVUZDTUVGSFJVRmpaMEYxUVVaTlFXRkJRblpCU0UxQllVRkNhRUZITkVGUlFVSnpRVWRyUVdSQlFtcEJRelJCWWtGQ2RrRkhUVUZaVVVKelFVVXdRV0ozUW5KQlIyZEJaRUZDYUVGSVNVRk1aMEpVUVVkblFXSjNRbnBCUjJkQldWRkNkVUZCUVVGVVVVSjJRVWR6UVdGQlFqQkJSMFZCWTJkQlowRkdUVUZoUVVKMlFVaE5RV0ZCUW1oQlJ6UkJRVUZCUVVGblFVRkNkMEZCUVVGRlEwRkJRVWhCUVVGQllrRkNjRUZJVVVGWmQwSlRaRzQ0V0dOcVZVWTFSVzVIT0hadWFFUlFSUzh2ZEdOQ2FtUXlNMjFHVlc5QlJ6UkJaRkZDYzBGSGQwRkxVVUZCUVVFOVBTSXNDaUFnSWxOdlpuUjNZWEpsUlhoamJIVnphVzl1VEdsemRFWnZja1JsY0d4dmVXMWxiblFpT2lCYlhRcDkiLCJFbnRpdHlQYXRoIjoiIiwiRW50aXR5VHlwZSI6NiwiTHVyZURlcGxveW1lbnRDb250ZXh0Ijp7IkV4cGlyYXRpb25VdGMiOiIyMDI0LTA0LTIyVDEyOjE2OjQ1LjQ0NTE3NzVaIiwiSWQiOiJhZjlkNWY2YS1jNjZhLTRmYmMtOTkwZS00MzMwYmI4ZTZjODQiLCJDb3JyZWxhdGlvbklkIjpudWxsfSwiRmlsZUF0dHJpYnV0ZXMiOjAsIlVzZXJSaWQiOjkyNjEwMzg2MX0=}”2024-04-19T12:21:13.582SystemDefault7192SenseIR.exe2024-04-19T12:21:11.307NT AUTHORITYsystemS-1-5-18 9.09E+08 T1078.002 (bolster) Techniques2024-04-19T12:22:10.9876595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1LogonSuccess LITCfake accountS-1-5-21-3977750084-2905094788-454684165-926103861 7c04ec2377e32b3c742f581f6c5437464dd2cf23247PKBT60B6DT25B34CP74B5889Ap10F1B3S72B4D4D95B5B25B54560B8powershell.exeC:WindowsSystem32WindowsPowerShellv1.08332powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -Command “& {$OutputEncoding = [Console]::OutputEncoding =[System.Text.Encoding]::UTF8;$scriptFileStream = [System.IO.File]::Open(‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::Read);$calculatedHash = Microsoft.PowerShell.Utility Get-FileHash ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Algorithm SHA256; if (!( $calculatedHash.Hash -eq ‘575497143631ed5cd604e7a1e8666187bd6acf421ad685273e559c0013179789’)) { exit 323;}; Start-Transcript -Path ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionTempPSScriptOutputsPSScript_Transcript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.txt’; . ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Id 3f884218-6a5a-4d02-8032-32ed7f90339a -Descriptor eyJEZXRlY3Rpb25LZXlzIjpbIk1va2h0YXIuU2hvc2hhbiJdLCJDb250ZW50IjoiZXdvZ0lDSlRaWEpwWVd4cGVtVmtUbXhTWldOdmNtUWlPaUFpU0dkQlNVRkNORUZJWjBGQlFVRkJRVUZCUVVGQlJGVTFUWHBqUVVGblFVRkJaMEZCUVVGblFVZEJRemNyY3pONU9UUXZZVUZSVVVGQlVVRkJRVUZCUVVGUlFVdEJRVUZCUVVGQlVVRkJRVUZHUVVFd1FVTmlWRGRNWW5SWVduUjVNbTlPUmtnek1FcGhNRlZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUWtGQlFVRkJRVUZCUVVGQlFVRkJRVU5CUVVGQlJHZEJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZVVVVKMlFVZHpRV0ZCUWpCQlIwVkJZMmRCZFVGR1RVRmhRVUoyUVVoTlFXRkJRbWhCUnpSQlFVRkNjMEZIYTBGa1FVSnFRVWQzUVdGUlFqQkJSMDFCVEdkQ2MwRkhPRUZaZDBKb1FVZDNRVlJSUW5aQlIzTkJZVUZDTUVGSFJVRmpaMEYxUVVaTlFXRkJRblpCU0UxQllVRkNhRUZITkVGUlFVSnpRVWRyUVdSQlFtcEJRelJCWWtGQ2RrRkhUVUZaVVVKelFVVXdRV0ozUW5KQlIyZEJaRUZDYUVGSVNVRk1aMEpVUVVkblFXSjNRbnBCUjJkQldWRkNkVUZCUVVGVVVVSjJRVWR6UVdGQlFqQkJSMFZCWTJkQlowRkdUVUZoUVVKMlFVaE5RV0ZCUW1oQlJ6UkJRVUZCUVVGblFVRkNkMEZCUVVGRlEwRkJRVWhCUVVGQllrRkNjRUZJVVVGWmQwSlRaRzQ0V0dOcVZVWTFSVzVIT0hadWFFUlFSUzh2ZEdOQ2FtUXlNMjFHVlc5QlJ6UkJaRkZDYzBGSGQwRkxVVUZCUVVFOVBTSXNDaUFnSWxOdlpuUjNZWEpsUlhoamJIVnphVzl1VEdsemRFWnZja1JsY0d4dmVXMWxiblFpT2lCYlhRcDkiLCJFbnRpdHlQYXRoIjoiIiwiRW50aXR5VHlwZSI6NiwiTHVyZURlcGxveW1lbnRDb250ZXh0Ijp7IkV4cGlyYXRpb25VdGMiOiIyMDI0LTA0LTIyVDEyOjE2OjQ1LjQ0NTE3NzVaIiwiSWQiOiJhZjlkNWY2YS1jNjZhLTRmYmMtOTkwZS00MzMwYmI4ZTZjODQiLCJDb3JyZWxhdGlvbklkIjpudWxsfSwiRmlsZUF0dHJpYnV0ZXMiOjAsIlVzZXJSaWQiOjkyNjEwMzg2MX0=}”2024-04-19T12:21:13.582SystemStandard7192DeviceHarddiskVolume3Program FilesWindows Defender Advanced Threat ProtectionSenseIR.exe2024-04-19T12:21:11.307nt authoritysystemS-1-5-18 28953{“IsLocalLogon”:false} CachedRemoteInteractive Events2024-04-19T12:22:10.9876595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1WindowsDomainAccountLogonSuccess LITCfake accountS-1-5-21-3977750084-2905094788-454684165-926103861 7c04ec2377e32b3c742f581f6c5437464dd2cf23247PKBT60B6DT25B34CP74B5889Ap10F1B3S72B4D4D95B5B25B54560B8powershell.exeC:WindowsSystem32WindowsPowerShellv1.08332powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -Command “& {$OutputEncoding = [Console]::OutputEncoding =[System.Text.Encoding]::UTF8;$scriptFileStream = [System.IO.File]::Open(‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::Read);$calculatedHash = Microsoft.PowerShell.Utility Get-FileHash ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Algorithm SHA256; if (!( $calculatedHash.Hash -eq ‘575497143631ed5cd604e7a1e8666187bd6acf421ad685273e559c0013179789’)) { exit 323;}; Start-Transcript -Path ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionTempPSScriptOutputsPSScript_Transcript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.txt’; . ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Id 3f884218-6a5a-4d02-8032-32ed7f90339a -Descriptor eyJEZXRlY3Rpb25LZXlzIjpbIk1va2h0YXIuU2hvc2hhbiJdLCJDb250ZW50IjoiZXdvZ0lDSlRaWEpwWVd4cGVtVmtUbXhTWldOdmNtUWlPaUFpU0dkQlNVRkNORUZJWjBGQlFVRkJRVUZCUVVGQlJGVTFUWHBqUVVGblFVRkJaMEZCUVVGblFVZEJRemNyY3pONU9UUXZZVUZSVVVGQlVVRkJRVUZCUVVGUlFVdEJRVUZCUVVGQlVVRkJRVUZHUVVFd1FVTmlWRGRNWW5SWVduUjVNbTlPUmtnek1FcGhNRlZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUWtGQlFVRkJRVUZCUVVGQlFVRkJRVU5CUVVGQlJHZEJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZVVVVKMlFVZHpRV0ZCUWpCQlIwVkJZMmRCZFVGR1RVRmhRVUoyUVVoTlFXRkJRbWhCUnpSQlFVRkNjMEZIYTBGa1FVSnFRVWQzUVdGUlFqQkJSMDFCVEdkQ2MwRkhPRUZaZDBKb1FVZDNRVlJSUW5aQlIzTkJZVUZDTUVGSFJVRmpaMEYxUVVaTlFXRkJRblpCU0UxQllVRkNhRUZITkVGUlFVSnpRVWRyUVdSQlFtcEJRelJCWWtGQ2RrRkhUVUZaVVVKelFVVXdRV0ozUW5KQlIyZEJaRUZDYUVGSVNVRk1aMEpVUVVkblFXSjNRbnBCUjJkQldWRkNkVUZCUVVGVVVVSjJRVWR6UVdGQlFqQkJSMFZCWTJkQlowRkdUVUZoUVVKMlFVaE5RV0ZCUW1oQlJ6UkJRVUZCUVVGblFVRkNkMEZCUVVGRlEwRkJRVWhCUVVGQllrRkNjRUZJVVVGWmQwSlRaRzQ0V0dOcVZVWTFSVzVIT0hadWFFUlFSUzh2ZEdOQ2FtUXlNMjFHVlc5QlJ6UkJaRkZDYzBGSGQwRkxVVUZCUVVFOVBTSXNDaUFnSWxOdlpuUjNZWEpsUlhoamJIVnphVzl1VEdsemRFWnZja1JsY0d4dmVXMWxiblFpT2lCYlhRcDkiLCJFbnRpdHlQYXRoIjoiIiwiRW50aXR5VHlwZSI6NiwiTHVyZURlcGxveW1lbnRDb250ZXh0Ijp7IkV4cGlyYXRpb25VdGMiOiIyMDI0LTA0LTIyVDEyOjE2OjQ1LjQ0NTE3NzVaIiwiSWQiOiJhZjlkNWY2YS1jNjZhLTRmYmMtOTkwZS00MzMwYmI4ZTZjODQiLCJDb3JyZWxhdGlvbklkIjpudWxsfSwiRmlsZUF0dHJpYnV0ZXMiOjAsIlVzZXJSaWQiOjkyNjEwMzg2MX0=}”2024-04-19T12:21:13.582SystemDefault7192SenseIR.exe2024-04-19T12:21:11.307NT AUTHORITYsystemS-1-5-18 8.59E+08 T1078.002 (bolster) Techniques2024-04-19T12:22:10.9876595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1InboundRdpConnection LITCfake accountS-1-5-21-3977750084-2905094788-454684165-926103861 7c04ec2377e32b3c742f581f6c5437464dd2cf23247PKBT60B6DT25B34CP74B5889Ap10F1B3S72B4D4D95B5B25B54560B8powershell.exeC:WindowsSystem32WindowsPowerShellv1.08332powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -Command “& {$OutputEncoding = [Console]::OutputEncoding =[System.Text.Encoding]::UTF8;$scriptFileStream = [System.IO.File]::Open(‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::Read);$calculatedHash = Microsoft.PowerShell.Utility Get-FileHash ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Algorithm SHA256; if (!( $calculatedHash.Hash -eq ‘575497143631ed5cd604e7a1e8666187bd6acf421ad685273e559c0013179789’)) { exit 323;}; Start-Transcript -Path ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionTempPSScriptOutputsPSScript_Transcript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.txt’; . ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Id 3f884218-6a5a-4d02-8032-32ed7f90339a -Descriptor eyJEZXRlY3Rpb25LZXlzIjpbIk1va2h0YXIuU2hvc2hhbiJdLCJDb250ZW50IjoiZXdvZ0lDSlRaWEpwWVd4cGVtVmtUbXhTWldOdmNtUWlPaUFpU0dkQlNVRkNORUZJWjBGQlFVRkJRVUZCUVVGQlJGVTFUWHBqUVVGblFVRkJaMEZCUVVGblFVZEJRemNyY3pONU9UUXZZVUZSVVVGQlVVRkJRVUZCUVVGUlFVdEJRVUZCUVVGQlVVRkJRVUZHUVVFd1FVTmlWRGRNWW5SWVduUjVNbTlPUmtnek1FcGhNRlZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUWtGQlFVRkJRVUZCUVVGQlFVRkJRVU5CUVVGQlJHZEJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZVVVVKMlFVZHpRV0ZCUWpCQlIwVkJZMmRCZFVGR1RVRmhRVUoyUVVoTlFXRkJRbWhCUnpSQlFVRkNjMEZIYTBGa1FVSnFRVWQzUVdGUlFqQkJSMDFCVEdkQ2MwRkhPRUZaZDBKb1FVZDNRVlJSUW5aQlIzTkJZVUZDTUVGSFJVRmpaMEYxUVVaTlFXRkJRblpCU0UxQllVRkNhRUZITkVGUlFVSnpRVWRyUVdSQlFtcEJRelJCWWtGQ2RrRkhUVUZaVVVKelFVVXdRV0ozUW5KQlIyZEJaRUZDYUVGSVNVRk1aMEpVUVVkblFXSjNRbnBCUjJkQldWRkNkVUZCUVVGVVVVSjJRVWR6UVdGQlFqQkJSMFZCWTJkQlowRkdUVUZoUVVKMlFVaE5RV0ZCUW1oQlJ6UkJRVUZCUVVGblFVRkNkMEZCUVVGRlEwRkJRVWhCUVVGQllrRkNjRUZJVVVGWmQwSlRaRzQ0V0dOcVZVWTFSVzVIT0hadWFFUlFSUzh2ZEdOQ2FtUXlNMjFHVlc5QlJ6UkJaRkZDYzBGSGQwRkxVVUZCUVVFOVBTSXNDaUFnSWxOdlpuUjNZWEpsUlhoamJIVnphVzl1VEdsemRFWnZja1JsY0d4dmVXMWxiblFpT2lCYlhRcDkiLCJFbnRpdHlQYXRoIjoiIiwiRW50aXR5VHlwZSI6NiwiTHVyZURlcGxveW1lbnRDb250ZXh0Ijp7IkV4cGlyYXRpb25VdGMiOiIyMDI0LTA0LTIyVDEyOjE2OjQ1LjQ0NTE3NzVaIiwiSWQiOiJhZjlkNWY2YS1jNjZhLTRmYmMtOTkwZS00MzMwYmI4ZTZjODQiLCJDb3JyZWxhdGlvbklkIjpudWxsfSwiRmlsZUF0dHJpYnV0ZXMiOjAsIlVzZXJSaWQiOjkyNjEwMzg2MX0=}”2024-04-19T12:21:13.582SystemDefault7192SenseIR.exe2024-04-19T12:21:11.307NT AUTHORITYsystemS-1-5-18 8.45E+08 T1021.001 (bolster) Techniques2024-04-19T12:22:10.9876595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1LogonSuccess LITCfake accountS-1-5-21-3977750084-2905094788-454684165-926103861 7c04ec2377e32b3c742f581f6c5437464dd2cf23247PKBT60B6DT25B34CP74B5889Ap10F1B3S72B4D4D95B5B25B54560B8powershell.exeC:WindowsSystem32WindowsPowerShellv1.08332powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -Command “& {$OutputEncoding = [Console]::OutputEncoding =[System.Text.Encoding]::UTF8;$scriptFileStream = [System.IO.File]::Open(‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::Read);$calculatedHash = Microsoft.PowerShell.Utility Get-FileHash ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Algorithm SHA256; if (!( $calculatedHash.Hash -eq ‘575497143631ed5cd604e7a1e8666187bd6acf421ad685273e559c0013179789’)) { exit 323;}; Start-Transcript -Path ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionTempPSScriptOutputsPSScript_Transcript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.txt’; . ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Id 3f884218-6a5a-4d02-8032-32ed7f90339a -Descriptor eyJEZXRlY3Rpb25LZXlzIjpbIk1va2h0YXIuU2hvc2hhbiJdLCJDb250ZW50IjoiZXdvZ0lDSlRaWEpwWVd4cGVtVmtUbXhTWldOdmNtUWlPaUFpU0dkQlNVRkNORUZJWjBGQlFVRkJRVUZCUVVGQlJGVTFUWHBqUVVGblFVRkJaMEZCUVVGblFVZEJRemNyY3pONU9UUXZZVUZSVVVGQlVVRkJRVUZCUVVGUlFVdEJRVUZCUVVGQlVVRkJRVUZHUVVFd1FVTmlWRGRNWW5SWVduUjVNbTlPUmtnek1FcGhNRlZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUWtGQlFVRkJRVUZCUVVGQlFVRkJRVU5CUVVGQlJHZEJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZVVVVKMlFVZHpRV0ZCUWpCQlIwVkJZMmRCZFVGR1RVRmhRVUoyUVVoTlFXRkJRbWhCUnpSQlFVRkNjMEZIYTBGa1FVSnFRVWQzUVdGUlFqQkJSMDFCVEdkQ2MwRkhPRUZaZDBKb1FVZDNRVlJSUW5aQlIzTkJZVUZDTUVGSFJVRmpaMEYxUVVaTlFXRkJRblpCU0UxQllVRkNhRUZITkVGUlFVSnpRVWRyUVdSQlFtcEJRelJCWWtGQ2RrRkhUVUZaVVVKelFVVXdRV0ozUW5KQlIyZEJaRUZDYUVGSVNVRk1aMEpVUVVkblFXSjNRbnBCUjJkQldWRkNkVUZCUVVGVVVVSjJRVWR6UVdGQlFqQkJSMFZCWTJkQlowRkdUVUZoUVVKMlFVaE5RV0ZCUW1oQlJ6UkJRVUZCUVVGblFVRkNkMEZCUVVGRlEwRkJRVWhCUVVGQllrRkNjRUZJVVVGWmQwSlRaRzQ0V0dOcVZVWTFSVzVIT0hadWFFUlFSUzh2ZEdOQ2FtUXlNMjFHVlc5QlJ6UkJaRkZDYzBGSGQwRkxVVUZCUVVFOVBTSXNDaUFnSWxOdlpuUjNZWEpsUlhoamJIVnphVzl1VEdsemRFWnZja1JsY0d4dmVXMWxiblFpT2lCYlhRcDkiLCJFbnRpdHlQYXRoIjoiIiwiRW50aXR5VHlwZSI6NiwiTHVyZURlcGxveW1lbnRDb250ZXh0Ijp7IkV4cGlyYXRpb25VdGMiOiIyMDI0LTA0LTIyVDEyOjE2OjQ1LjQ0NTE3NzVaIiwiSWQiOiJhZjlkNWY2YS1jNjZhLTRmYmMtOTkwZS00MzMwYmI4ZTZjODQiLCJDb3JyZWxhdGlvbklkIjpudWxsfSwiRmlsZUF0dHJpYnV0ZXMiOjAsIlVzZXJSaWQiOjkyNjEwMzg2MX0=}”2024-04-19T12:21:13.582SystemStandard7192DeviceHarddiskVolume3Program FilesWindows Defender Advanced Threat ProtectionSenseIR.exe2024-04-19T12:21:11.307nt authoritysystemS-1-5-18 28952{“IsLocalLogon”:false} CachedRemoteInteractive Events2024-04-19T12:22:10.9876595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1LogonAttempted LITCfake account 7c04ec2377e32b3c742f581f6c5437464dd2cf23247PKBT60B6DT25B34CP74B5889Ap10F1B3S72B4D4D95B5B25B54560B8powershell.exeC:WindowsSystem32WindowsPowerShellv1.08332powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -Command “& {$OutputEncoding = [Console]::OutputEncoding =[System.Text.Encoding]::UTF8;$scriptFileStream = [System.IO.File]::Open(‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::Read);$calculatedHash = Microsoft.PowerShell.Utility Get-FileHash ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Algorithm SHA256; if (!( $calculatedHash.Hash -eq ‘575497143631ed5cd604e7a1e8666187bd6acf421ad685273e559c0013179789’)) { exit 323;}; Start-Transcript -Path ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionTempPSScriptOutputsPSScript_Transcript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.txt’; . ‘C:ProgramDataMicrosoftWindows Defender Advanced Threat ProtectionDownloadsPSScript_{70971E03-A55E-4EC2-BC9B-A8F0173A83C3}.ps1’ -Id 3f884218-6a5a-4d02-8032-32ed7f90339a -Descriptor eyJEZXRlY3Rpb25LZXlzIjpbIk1va2h0YXIuU2hvc2hhbiJdLCJDb250ZW50IjoiZXdvZ0lDSlRaWEpwWVd4cGVtVmtUbXhTWldOdmNtUWlPaUFpU0dkQlNVRkNORUZJWjBGQlFVRkJRVUZCUVVGQlJGVTFUWHBqUVVGblFVRkJaMEZCUVVGblFVZEJRemNyY3pONU9UUXZZVUZSVVVGQlVVRkJRVUZCUVVGUlFVdEJRVUZCUVVGQlVVRkJRVUZHUVVFd1FVTmlWRGRNWW5SWVduUjVNbTlPUmtnek1FcGhNRlZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUWtGQlFVRkJRVUZCUVVGQlFVRkJRVU5CUVVGQlJHZEJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZCUVVGQlFVRkJRVUZVVVVKMlFVZHpRV0ZCUWpCQlIwVkJZMmRCZFVGR1RVRmhRVUoyUVVoTlFXRkJRbWhCUnpSQlFVRkNjMEZIYTBGa1FVSnFRVWQzUVdGUlFqQkJSMDFCVEdkQ2MwRkhPRUZaZDBKb1FVZDNRVlJSUW5aQlIzTkJZVUZDTUVGSFJVRmpaMEYxUVVaTlFXRkJRblpCU0UxQllVRkNhRUZITkVGUlFVSnpRVWRyUVdSQlFtcEJRelJCWWtGQ2RrRkhUVUZaVVVKelFVVXdRV0ozUW5KQlIyZEJaRUZDYUVGSVNVRk1aMEpVUVVkblFXSjNRbnBCUjJkQldWRkNkVUZCUVVGVVVVSjJRVWR6UVdGQlFqQkJSMFZCWTJkQlowRkdUVUZoUVVKMlFVaE5RV0ZCUW1oQlJ6UkJRVUZCUVVGblFVRkNkMEZCUVVGRlEwRkJRVWhCUVVGQllrRkNjRUZJVVVGWmQwSlRaRzQ0V0dOcVZVWTFSVzVIT0hadWFFUlFSUzh2ZEdOQ2FtUXlNMjFHVlc5QlJ6UkJaRkZDYzBGSGQwRkxVVUZCUVVFOVBTSXNDaUFnSWxOdlpuUjNZWEpsUlhoamJIVnphVzl1VEdsemRFWnZja1JsY0d4dmVXMWxiblFpT2lCYlhRcDkiLCJFbnRpdHlQYXRoIjoiIiwiRW50aXR5VHlwZSI6NiwiTHVyZURlcGxveW1lbnRDb250ZXh0Ijp7IkV4cGlyYXRpb25VdGMiOiIyMDI0LTA0LTIyVDEyOjE2OjQ1LjQ0NTE3NzVaIiwiSWQiOiJhZjlkNWY2YS1jNjZhLTRmYmMtOTkwZS00MzMwYmI4ZTZjODQiLCJDb3JyZWxhdGlvbklkIjpudWxsfSwiRmlsZUF0dHJpYnV0ZXMiOjAsIlVzZXJSaWQiOjkyNjEwMzg2MX0=}”2024-04-19T12:21:13.582SystemDefault7192SenseIR.exe2024-04-19T12:21:11.307NT AUTHORITYsystemS-1-5-18 28951 Events2024-04-19T12:22:09.7286595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1InteractiveRemoteComponentInvocation LITCfake accountS-1-5-21-3977750084-2905094788-454684165-926103861 1.71E+09 T1078 (Friends)/T1021.001 (Friends)Techniques2024-04-19T12:22:09.7286595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1WindowsDomainAccountLogonSuccess LITCfake accountS-1-5-21-3977750084-2905094788-454684165-926103861 D398B9D68B555K9K6K041K8Pia8849D1A6B1AC463A75A4F57158Ba4D796A2414790FCD3694D8Ab9ED3A8942A9CBCD0B71691Alsass.exeC:WindowsSystem32824lsass.exe2024-04-18T08:04:00.305SystemDefault928wininit.exe2024-04-18T08:04:00.107NT AUTHORITYsystemS-1-5-18 9.6E+08 T1078.002 (bolster) Techniques2024-04-19T12:22:09.7286595e6522d8db8d92425250a4fe68dd7ce1fc1dbPC1LogonSuccess LITCfake accountS-1-5-21-3977750084-2905094788-454684165-926103861 D398B9D68B555K9K6K041K8Pia8849D1A6B1AC463A75A4F57158Ba4D796A2414790FCD3694D8Ab9ED3A8942A9CBCD0B71691Alsass.exeC:WindowsSystem32lsass.exe824lsass.exe2024-04-18T08:04:00.305SystemStandard928wininit.exe2024-04-18T08:04:00.107nt authoritysystemS-1-5-18 28934{“IsLocalLogon”:false} RemoteInteractive Eventsthanks in advance Read More