Alert Details - DeFender X

Alert Information High

Alert ID: ind:b4ebfd0a1e2447bcb45b3b72c5794e0e:4396474280-10512-307728
Composite ID: 84393bf974fd44bda943a25a6a7bc27f:ind:b4ebfd0a1e2447bcb45b3b72c5794e0e:4396474280-10512-307728
설명: A process has written a kernel driver to disk that CrowdStrike analysts have deemed vulnerable. Attackers can use vulnerable drivers to gain privileged access to a system. Review the process tree and file details.
호스트: DWSHIN
상태: new
생성 시간: 2025-12-09 11:43:05
업데이트 시간: 2025-12-09 12:42:05

MITRE ATT&CK

Tactic: Defense Evasion
Technique: Disable or Modify Tools

Command Line

"C:\Users\andsi\AppData\Local\Temp\is-PKKGE.tmp\unlocker-setup.tmp" /SL5="$140AB4,1689069,139776,C:\Users\andsi\Downloads\unlocker-setup.exe" /SPAWNWND=$1A0746 /NOTIFYWND=$F0A7C

Raw JSON Data

{"id":"ind:b4ebfd0a1e2447bcb45b3b72c5794e0e:4396474280-10512-307728","composite_id":"84393bf974fd44bda943a25a6a7bc27f:ind:b4ebfd0a1e2447bcb45b3b72c5794e0e:4396474280-10512-307728","agent_id":"b4ebfd0a1e2447bcb45b3b72c5794e0e","cid":"84393bf974fd44bda943a25a6a7bc27f","description":"A process has written a kernel driver to disk that CrowdStrike analysts have deemed vulnerable. Attackers can use vulnerable drivers to gain privileged access to a system. Review the process tree and file details.","severity":70,"severity_name":"High","confidence":80,"tactic":"Defense Evasion","tactic_id":"TA0005","technique":"Disable or Modify Tools","technique_id":"T1562.001","cmdline":"\u0022C:\\Users\\andsi\\AppData\\Local\\Temp\\is-PKKGE.tmp\\unlocker-setup.tmp\u0022 /SL5=\u0022$140AB4,1689069,139776,C:\\Users\\andsi\\Downloads\\unlocker-setup.exe\u0022 /SPAWNWND=$1A0746 /NOTIFYWND=$F0A7C ","filename":"unlocker-setup.tmp","filepath":"\\Device\\HarddiskVolume3\\Users\\andsi\\AppData\\Local\\Temp\\is-PKKGE.tmp\\unlocker-setup.tmp","sha256":"2efdffd1cf3adab21ff760f009d8893d8c4cbcf63b2c3bfcc1139457c9cd430b","status":"new","type":"ldt","created_timestamp":"2025-12-09T02:43:05.972882091Z","updated_timestamp":"2025-12-09T03:42:05.979918311Z","device":{"device_id":"b4ebfd0a1e2447bcb45b3b72c5794e0e","cid":"84393bf974fd44bda943a25a6a7bc27f","agent_version":"7.29.20108.0","hostname":"DWSHIN","local_ip":"26.26.26.1","external_ip":"211.198.135.5","mac_address":"00-ff-15-bf-2c-c0","platform_name":"Windows","os_version":"Windows 11"},"aggregate_id":"aggind:b4ebfd0a1e2447bcb45b3b72c5794e0e:4295699970","CreatedAt":"2025-12-09T11:43:05.9728821+09:00","UpdatedAt":"2025-12-09T12:42:05.9799183+09:00"}