MEDIUM Suspicious Process Creation
Prevented (Blocked)
ID: #472
|
Detected: 2026-01-01 08:06:07
|
Malware
Alert Overview
Suspicious process creation detected
Unclassified
XDR Agent
New
DS:PANW/XDR Agent
DOM:Security
Host Information
BOOK-R0BE6S1NC3
BOOK-R0BE6S1NC3\ubuntu
00:72:ee:3e:51:84
Process Information
Process Execution
Actor Process (Executor)
| Process Name | python.exe |
|---|---|
| Path | C:\Users\ubuntu\scoop\apps\python\3.13.2\python.exe |
| PID | 18100 |
| SHA256 |
7d96a4ed35d6e596cd9dd8933feafc66349cc21f75be3b15c89fd336e50140c1
VT
|
| MD5 | 5b4a9fba45e770366c5a8f973f6c6ab1 |
| Signature | Python Software Foundation Signed |
"C:\app\cortex-xdr-siem-test\.venv\Scripts\python.exe" incident_generator.py --category credential Action Process (Target)
| Process Name | cmd.exe |
|---|---|
| SHA256 |
64afc6db3aad1289533662e2d79e27dd55c7dcdb8cd918b08e145ad82ad5acb4
VT
|
| Signature | Microsoft Windows Signed |
C:\windows\system32\cmd.exe /c "powershell -c "sekurlsa::logonpasswords""Parent Process (Causality)
| Process Name | cmd.exe |
|---|---|
| Path | C:\Windows\System32\cmd.exe |
| SHA256 |
64afc6db3aad1289533662e2d79e27dd55c7dcdb8cd918b08e145ad82ad5acb4
VT
|
| MD5 | 6d109a3a00f210c1ab89c3b08399ed48 |
C:\windows\SYSTEM32\cmd.exe /c ""C:\app\cortex-xdr-siem-test\xdr_incident_runner.bat""Severity Analysis
MEDIUM
Review and assess impact
Summary
Events
1
IP Addresses
1
Tags
2
File Artifacts
Yes
Network Artifacts
No
Registry Artifacts
No
Analyst Verdict