home dark icon
Cases Found 1 out of 1 result
Last Updated=Last 1M (Mar 5th 2025 - Apr 4th 2025)
Status!=Resolved
add ordelete filterssave filters
unstarred
Security
ID-1
Add case name
edit
tag
'Powershell Activity - 3990759154' along with 2 other alerts generated by XDR Agent and XDR BIOC detected on host ec2amaz-bfj43pj involving 2 users
edit
3 Issues
Sources:
XDR Agent source issue
XDR BIOC source issue
Assigned
unassigned
Unassigned
Assign to me
Status
status new
Open for 9 days
Case bymitre3 Tactics and 3 Techniques
0
Reconnaissance
curved line
0
Resource Development
curved line
0
Initial Access
curved line
1
Execution
curved line
0
Persistence
curved line
0
Privilege Escalation
curved line
1
Defense Evasion
curved line
1
Credential Access
curved line
0
Discovery
curved line
0
Lateral Movement
curved line
0
Collection
curved line
0
Command and Control
curved line
0
Exfiltration
curved line
0
Impact
Issues
3Total Issues
High1
Medium2
Issue Sources (2)
Automation
3 Issues didn't trigger any automation rules
To create an Automation rule, Go to Issues & Insights and choose an issue. Right-Click on the issue and choose 'Create an automation rule from issue'.
Artifacts (4)
cmd.exe (
0afb...9296
copy
)
WF
Benign
wildfire open modal
|VT Unknown
powershell.exe (
38f4...1033
copy
)
WF
Benign
wildfire open modal
|VT Unknown
explorer.exe (
26e8...4fec
copy
)
WF
Benign
wildfire open modal
|VT Unknown
conhost.exe (
91c5...773a
copy
)
WF
Benign
wildfire open modal
|VT Unknown
Assets (3)
host windows server
ec2amaz-bfj43pj
asset userec2amaz-bfj43pj\administrator
asset useradministrator
QUICK LAUNCHER
Open the quick launcher from the console navigation bar or use the shortcut.
⌘ CMD+⇧ Shift+X
Got it, don't show again