Data Source: MS Defender ATP Alerts

  1{
  2"id": "da47dc5671-e560-4229-984b-457564996b31_1",
  3"incidentId": 989,
  4"investigationId": null,
  5"assignedTo": null,
  6"severity": "High",
  7"status": "New",
  8"classification": null,
  9"determination": null,
 10"investigationState": "UnsupportedAlertType",
 11"detectionSource": "WindowsDefenderAtp",
 12"detectorId": "9c3a70ec-e18a-4f92-865a-530f73130b7c",
 13"category": "LateralMovement",
 14"threatFamilyName": null,
 15"title": "Ongoing hands-on-keyboard attack via Impacket toolkit",
 16"description": "Suspicious execution of a command via Impacket was observed on this device. This tool connects to other hosts to explore network shares and execute commands. Attackers might be attempting to move laterally across the network using this tool. This usage of Impacket has often been observed in hands-on-keyboard attacks, where ransomware and other payloads are installed on target devices.",
 17"alertCreationTime": "2023-01-24T05:33:37.3245808Z",
 18"firstEventTime": "2023-01-24T05:31:07.5276179Z",
 19"lastEventTime": "2023-01-24T13:02:50.7831636Z",
 20"lastUpdateTime": "2023-01-24T13:07:13.3233333Z",
 21"resolvedTime": null,
 22"machineId": "302293d9f276eae65553e5042156bce93cbc7148",
 23"computerDnsName": "diytestmachine",
 24"rbacGroupName": "UnassignedGroup",
 25"aadTenantId": "1a492129-58c8-4011-91cd-245285f5345c",
 26"threatName": null,
 27"mitreTechniques": [
 28  "T1021.002",
 29  "T1047",
 30  "T1059.003"
 31],
 32"relatedUser": {
 33  "userName": "User1",
 34  "domainName": "DIYTESTMACHINE"
 35},
 36"loggedOnUsers": [
 37  {
 38    "accountName": "administrator1",
 39    "domainName": "DIYTESTMACHINE"
 40  }
 41],
 42"comments": [],
 43"evidence": [
 44  {
 45    "entityType": "Process",
 46    "evidenceCreationTime": "2023-01-24T05:45:51.6833333Z",
 47    "sha1": "3ea7cc066317ac45f963c2227c4c7c50aa16eb7c",
 48    "sha256": "2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3",
 49    "fileName": "WmiPrvSE.exe",
 50    "filePath": "C:\\Windows\\System32\\wbem",
 51    "processId": 4476,
 52    "processCommandLine": "wmiprvse.exe -secured -Embedding",
 53    "processCreationTime": "2023-01-24T05:43:32.4631151Z",
 54    "parentProcessId": 896,
 55    "parentProcessCreationTime": "2023-01-24T04:44:17.1940386Z",
 56    "parentProcessFileName": "svchost.exe",
 57    "parentProcessFilePath": "C:\\Windows\\System32",
 58    "ipAddress": null,
 59    "url": null,
 60    "registryKey": null,
 61    "registryHive": null,
 62    "registryValueType": null,
 63    "registryValue": null,
 64    "registryValueName": null,
 65    "accountName": "NETWORK SERVICE",
 66    "domainName": "NT AUTHORITY",
 67    "userSid": "S-1-5-20",
 68    "aadUserId": null,
 69    "userPrincipalName": null,
 70    "detectionStatus": "Detected"
 71  },
 72  {
 73    "entityType": "User",
 74    "evidenceCreationTime": "2023-01-24T05:33:37.4166667Z",
 75    "sha1": null,
 76    "sha256": null,
 77    "fileName": null,
 78    "filePath": null,
 79    "processId": null,
 80    "processCommandLine": null,
 81    "processCreationTime": null,
 82    "parentProcessId": null,
 83    "parentProcessCreationTime": null,
 84    "parentProcessFileName": null,
 85    "parentProcessFilePath": null,
 86    "ipAddress": null,
 87    "url": null,
 88    "registryKey": null,
 89    "registryHive": null,
 90    "registryValueType": null,
 91    "registryValue": null,
 92    "registryValueName": null,
 93    "accountName": "User1",
 94    "domainName": "DIYTESTMACHINE",
 95    "userSid": "S-1-5-21-4215714199-1288013905-3478400915-1002",
 96    "aadUserId": null,
 97    "userPrincipalName": null,
 98    "detectionStatus": null
 99  },
100  {
101    "entityType": "Process",
102    "evidenceCreationTime": "2023-01-24T05:33:37.4166667Z",
103    "sha1": "3ea7cc066317ac45f963c2227c4c7c50aa16eb7c",
104    "sha256": "2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3",
105    "fileName": "WmiPrvSE.exe",
106    "filePath": "C:\\Windows\\System32\\wbem",
107    "processId": 7824,
108    "processCommandLine": "wmiprvse.exe -secured -Embedding",
109    "processCreationTime": "2023-01-24T05:30:50.8649791Z",
110    "parentProcessId": 896,
111    "parentProcessCreationTime": "2023-01-24T04:44:17.1940386Z",
112    "parentProcessFileName": "svchost.exe",
113    "parentProcessFilePath": "C:\\Windows\\System32",
114    "ipAddress": null,
115    "url": null,
116    "registryKey": null,
117    "registryHive": null,
118    "registryValueType": null,
119    "registryValue": null,
120    "registryValueName": null,
121    "accountName": "NETWORK SERVICE",
122    "domainName": "NT AUTHORITY",
123    "userSid": "S-1-5-20",
124    "aadUserId": null,
125    "userPrincipalName": null,
126    "detectionStatus": "Detected"
127  },
128  {
129    "entityType": "Process",
130    "evidenceCreationTime": "2023-01-24T13:07:13.2233333Z",
131    "sha1": "f1efb0fddc156e4c61c5f78a54700e4e7984d55d",
132    "sha256": "b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450",
133    "fileName": "cmd.exe",
134    "filePath": "C:\\Windows\\System32",
135    "processId": 5500,
136    "processCommandLine": "cmd.exe /Q /c powershell -NoProfile -ExecutionPolicy Bypass -File \"C:\\Users\\administrator1\\Desktop\\SharedFolder\\payload.ps1\" 1> \\\\127.0.0.1\\SharedFolder\\__1674565222.7012053 2>&1",
137    "processCreationTime": "2023-01-24T13:02:50.4661885Z",
138    "parentProcessId": 756,
139    "parentProcessCreationTime": "2023-01-24T13:00:35.0107475Z",
140    "parentProcessFileName": "WmiPrvSE.exe",
141    "parentProcessFilePath": "C:\\Windows\\System32\\wbem",
142    "ipAddress": null,
143    "url": null,
144    "registryKey": null,
145    "registryHive": null,
146    "registryValueType": null,
147    "registryValue": null,
148    "registryValueName": null,
149    "accountName": "User1",
150    "domainName": "DIYTESTMACHINE",
151    "userSid": "S-1-5-21-4215714199-1288013905-3478400915-1002",
152    "aadUserId": null,
153    "userPrincipalName": null,
154    "detectionStatus": "Detected"
155  },
156  {
157    "entityType": "Process",
158    "evidenceCreationTime": "2023-01-24T05:33:37.4166667Z",
159    "sha1": "f1efb0fddc156e4c61c5f78a54700e4e7984d55d",
160    "sha256": "b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450",
161    "fileName": "cmd.exe",
162    "filePath": "C:\\Windows\\System32",
163    "processId": 8964,
164    "processCommandLine": "cmd.exe /Q /c powershell -NoProfile -ExecutionPolicy Bypass -File \"C:\\Users\\administrator1\\Desktop\\SharedFolder\\payload.ps1\" 1> \\\\127.0.0.1\\SharedFolder\\__1674538248.357367 2>&1",
165    "processCreationTime": "2023-01-24T05:31:04.0743902Z",
166    "parentProcessId": 7824,
167    "parentProcessCreationTime": "2023-01-24T05:30:50.8649791Z",
168    "parentProcessFileName": "WmiPrvSE.exe",
169    "parentProcessFilePath": "C:\\Windows\\System32\\wbem",
170    "ipAddress": null,
171    "url": null,
172    "registryKey": null,
173    "registryHive": null,
174    "registryValueType": null,
175    "registryValue": null,
176    "registryValueName": null,
177    "accountName": "User1",
178    "domainName": "DIYTESTMACHINE",
179    "userSid": "S-1-5-21-4215714199-1288013905-3478400915-1002",
180    "aadUserId": null,
181    "userPrincipalName": null,
182    "detectionStatus": "Detected"
183  },
184  {
185    "entityType": "Process",
186    "evidenceCreationTime": "2023-01-24T05:39:47.1733333Z",
187    "sha1": "f1efb0fddc156e4c61c5f78a54700e4e7984d55d",
188    "sha256": "b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450",
189    "fileName": "cmd.exe",
190    "filePath": "C:\\Windows\\System32",
191    "processId": 884,
192    "processCommandLine": "cmd.exe /Q /c powershell -NoProfile -ExecutionPolicy Bypass -File \"C:\\Users\\administrator1\\Desktop\\SharedFolder\\payload.ps1\" 1> \\\\127.0.0.1\\SharedFolder\\__1674538583.8648584 2>&1",
193    "processCreationTime": "2023-01-24T05:36:38.826505Z",
194    "parentProcessId": 7736,
195    "parentProcessCreationTime": "2023-01-24T05:36:26.0524655Z",
196    "parentProcessFileName": "WmiPrvSE.exe",
197    "parentProcessFilePath": "C:\\Windows\\System32\\wbem",
198    "ipAddress": null,
199    "url": null,
200    "registryKey": null,
201    "registryHive": null,
202    "registryValueType": null,
203    "registryValue": null,
204    "registryValueName": null,
205    "accountName": "User1",
206    "domainName": "DIYTESTMACHINE",
207    "userSid": "S-1-5-21-4215714199-1288013905-3478400915-1002",
208    "aadUserId": null,
209    "userPrincipalName": null,
210    "detectionStatus": "Detected"
211  },
212  {
213    "entityType": "Process",
214    "evidenceCreationTime": "2023-01-24T13:07:13.2233333Z",
215    "sha1": "3ea7cc066317ac45f963c2227c4c7c50aa16eb7c",
216    "sha256": "2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3",
217    "fileName": "WmiPrvSE.exe",
218    "filePath": "C:\\Windows\\System32\\wbem",
219    "processId": 756,
220    "processCommandLine": "wmiprvse.exe -secured -Embedding",
221    "processCreationTime": "2023-01-24T13:00:35.0107475Z",
222    "parentProcessId": 908,
223    "parentProcessCreationTime": "2023-01-24T08:20:44.6877667Z",
224    "parentProcessFileName": "svchost.exe",
225    "parentProcessFilePath": "C:\\Windows\\System32",
226    "ipAddress": null,
227    "url": null,
228    "registryKey": null,
229    "registryHive": null,
230    "registryValueType": null,
231    "registryValue": null,
232    "registryValueName": null,
233    "accountName": "NETWORK SERVICE",
234    "domainName": "NT AUTHORITY",
235    "userSid": "S-1-5-20",
236    "aadUserId": null,
237    "userPrincipalName": null,
238    "detectionStatus": "Detected"
239  },
240  {
241    "entityType": "Process",
242    "evidenceCreationTime": "2023-01-24T05:45:51.6833333Z",
243    "sha1": "f1efb0fddc156e4c61c5f78a54700e4e7984d55d",
244    "sha256": "b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450",
245    "fileName": "cmd.exe",
246    "filePath": "C:\\Windows\\System32",
247    "processId": 1140,
248    "processCommandLine": "cmd.exe /Q /c powershell -NoProfile -ExecutionPolicy Bypass -File \"C:\\Users\\administrator1\\Desktop\\SharedFolder\\payload.ps1\" 1> \\\\127.0.0.1\\SharedFolder\\__1674538878.1586335 2>&1",
249    "processCreationTime": "2023-01-24T05:43:49.9375398Z",
250    "parentProcessId": 4476,
251    "parentProcessCreationTime": "2023-01-24T05:43:32.4631151Z",
252    "parentProcessFileName": "WmiPrvSE.exe",
253    "parentProcessFilePath": "C:\\Windows\\System32\\wbem",
254    "ipAddress": null,
255    "url": null,
256    "registryKey": null,
257    "registryHive": null,
258    "registryValueType": null,
259    "registryValue": null,
260    "registryValueName": null,
261    "accountName": "User1",
262    "domainName": "DIYTESTMACHINE",
263    "userSid": "S-1-5-21-4215714199-1288013905-3478400915-1002",
264    "aadUserId": null,
265    "userPrincipalName": null,
266    "detectionStatus": "Detected"
267  },
268  {
269    "entityType": "Process",
270    "evidenceCreationTime": "2023-01-24T05:39:47.1733333Z",
271    "sha1": "3ea7cc066317ac45f963c2227c4c7c50aa16eb7c",
272    "sha256": "2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3",
273    "fileName": "WmiPrvSE.exe",
274    "filePath": "C:\\Windows\\System32\\wbem",
275    "processId": 7736,
276    "processCommandLine": "wmiprvse.exe -secured -Embedding",
277    "processCreationTime": "2023-01-24T05:36:26.0524655Z",
278    "parentProcessId": 896,
279    "parentProcessCreationTime": "2023-01-24T04:44:17.1940386Z",
280    "parentProcessFileName": "svchost.exe",
281    "parentProcessFilePath": "C:\\Windows\\System32",
282    "ipAddress": null,
283    "url": null,
284    "registryKey": null,
285    "registryHive": null,
286    "registryValueType": null,
287    "registryValue": null,
288    "registryValueName": null,
289    "accountName": "NETWORK SERVICE",
290    "domainName": "NT AUTHORITY",
291    "userSid": "S-1-5-20",
292    "aadUserId": null,
293    "userPrincipalName": null,
294    "detectionStatus": "Detected"
295  }
296],
297"domains": []
298}