Incident #1336 - XDR Test Manager

HIGH 'Protection Against Security Measures Bypass Techniques - 1940197314' along with 4 other issues

RESOLVED SECURITY TESTING ID: #1336 | Created: 2026-01-12 00:42:36

Alerts

Hosts

Files

Network

Incident Overview

'Protection Against Security Measures Bypass Techniques - 1940197314' along with 4 other issues generated by XDR Agent detected on host dwshin involving user dwshin

Alert Count 5

Modified 2026-01-12 01:06

Assigned To Unassigned

Sources XDR Agent

Alert Categories

Malware

Affected Hosts & Users

Hosts (1)

Users (1)

dwshin

MITRE ATT&CK Mapping

Tactics (5)

TA0002 - Execution TA0005 - Defense Evasion TA0011 - Command and Control TA0003 - Persistence TA0004 - Privilege Escalation

Techniques (5)

T1059 - Command and Scripting Interpreter T1546.007 - Event Triggered Execution: Netsh Helper DLL T1140 - Deobfuscate/Decode Files or Information T1059.001 - Command and Scripting Interpreter: PowerShell T1102.002 - Web Service: Bidirectional Communication

Related Alerts 5

ID	Severity	Name	Host	Action	Time
29201	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-12 01:04
29200	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-12 00:57
29199	HIGH	Persistency - 1983659418	dwshin	Prevented (Blocked)	01-12 00:55
29125	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-12 00:43
29124	HIGH	Protection Against Security Measures Bypass Techniques - 1940197314	dwshin	Prevented (Blocked)	01-12 00:42

File Artifacts 21

File Name	Path	SHA256	Signature	Verdict	Actions
cmd.exe	-	`64afc6db3aad1289533662e2d79e27dd55c7dcdb8cd918b08e145ad82ad5acb4`	SIGNATURE_SIGNED	UNKNOWN	VT
conhost.exe	-	`6651a3beb0df1e66363a950c37dc9305f185d161fb03761e172ccfa0a4ab4f89`	SIGNATURE_SIGNED	UNKNOWN	VT
powershell.exe	-	`0ff6f2c94bc7e2833a5f7e16de1622e5dba70396f31c7d5f56381870317e8c46`	SIGNATURE_SIGNED	UNKNOWN	VT
UltimateXdrGenerator.exe	-	`64affb2786b4cf64498dd4ddccee413981902611a07d1b38045ec03fa1397504`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
python.exe	-	`fda7026477256845afab371e354c4d512896665f1761939cb5887d0a9dec257a`	SIGNATURE_SIGNED	UNKNOWN	VT
chcp.com	-	`8d75e783f327f899a42927fc2927f0e3d1ec62c4ca1dc88de04dd67de9ae555d`	SIGNATURE_SIGNED	UNKNOWN	VT
python.exe	-	`511a52421372762b0c566a8173cdfa45d9829bcf0e21ca33cdddc4b945735da9`	SIGNATURE_SIGNED	UNKNOWN	VT
certutil.exe	-	`5ee9dc956e9f67f33f2ca0776d7dce4bc0b6bf2cf5005bf2644f0b36accceaf4`	SIGNATURE_SIGNED	UNKNOWN	VT
timeout.exe	-	`106490870753d87d0c5a1b4fe83045a06518d415ec595bd1d0c30fe3ed4149c1`	SIGNATURE_SIGNED	UNKNOWN	VT
calc.exe	-	`81bd48985fa1753e9e2158a7cf969141edddbd050e976801bb477e24a2a06b2a`	SIGNATURE_SIGNED	UNKNOWN	VT
pcalua.exe	-	`3948168248cde1743f9c7efbf55e3c103a67413db690fc918ed9858c104a89d4`	SIGNATURE_SIGNED	UNKNOWN	VT
reg.exe	-	`ef37663b44ac66920c6f33694deea01acb78ae3f3012884819373fa04c3eb5f0`	SIGNATURE_SIGNED	UNKNOWN	VT
PresentationHost.exe	-	`0111d485351ef0deffd9403a0f8e123759a04a928fbd055b901de18164c4fa39`	SIGNATURE_SIGNED	UNKNOWN	VT
iexplore.exe	-	`531b2337aeb798032eab3f5e2d5530610987b27845a8b3201893a3d8d755fe3f`	SIGNATURE_SIGNED	UNKNOWN	VT
mshta.exe	-	`1f1aabe87e5e93a8fff769bf3614dd559c51c80fc045e11868f3843d9a004d1e`	SIGNATURE_SIGNED	UNKNOWN	VT
at.exe	-	`16885037343ccdf6f1f2061fc769c27ec3333918a2d95c7d7b7d176818c056a0`	SIGNATURE_SIGNED	UNKNOWN	VT
netsh.exe	-	`0fbb280ccb403e51bd9b798f5f1159981f6d575248aaea656fa7982b6f454e3e`	SIGNATURE_SIGNED	UNKNOWN	VT
whoami.exe	-	`23240ef9f8b0a9a324110b1c2331de31dc1b0e08f5359cb707e51a939af56cd3`	SIGNATURE_SIGNED	UNKNOWN	VT
ipconfig.exe	-	`ac7966280133df541509eb0676e4b2f994bac65e960c79415ccf9f12e17dac5c`	SIGNATURE_SIGNED	UNKNOWN	VT
net.exe	-	`bb3e638c8b5b6ef80847e364aeef2796cad25d3539cf9b41d3820fa48943e777`	SIGNATURE_SIGNED	UNKNOWN	VT
net1.exe	-	`8489db35375d890314eb8f7cd9e0cbd3866475f4e252865f00f649b0a02fd757`	SIGNATURE_SIGNED	UNKNOWN	VT

Network Artifacts 0

No network artifacts found for this incident

Process Artifacts 5

Process	Command Line	Parent Process	User
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_incident_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_incident_runner.bat...`	-	dwshin

Registry Artifacts 0

No registry artifacts found for this incident

Analyst Verdict

Classification

Risk Level

HIGH

Resolution Notes

Bulk resolved via XdrTestManager IncidentLive

Recommended Actions

Isolate affected endpoints
Investigate all related alerts
Document findings

Summary

Alerts

Hosts

Files

Network

Alert Categories

Malware

Timeline

01-12 01:06:53

Incident Modified

Status or details updated

01-12 01:06:53

Incident Resolved

resolved security testing

01-12 01:04:14

Suspicious Process Creation

medium - Prevented (Blocked)

01-12 00:57:03

File Drop - 3732557733

high - Prevented (Blocked)

01-12 00:55:35

Persistency - 1983659418

high - Prevented (Blocked)

01-12 00:43:03

File Drop - 2775215878

high - Prevented (Blocked)

01-12 00:42:36

Incident Created

#1336 - 'Protection Against Security Measures Bypass Techniques - 1940197314' along with 4 other issues

01-12 00:42:36

cmd.exe

Verdict: Unknown

01-12 00:42:36

conhost.exe

Verdict: Unknown

01-12 00:42:36

powershell.exe

Verdict: Unknown

01-12 00:42:36

UltimateXdrGenerator.exe

Verdict: Unknown

01-12 00:42:36

python.exe

Verdict: Unknown

01-12 00:42:36

chcp.com

Verdict: Unknown

01-12 00:42:36

python.exe

Verdict: Unknown

01-12 00:42:36

certutil.exe

Verdict: Unknown

01-12 00:42:36

timeout.exe

Verdict: Unknown

01-12 00:42:36

calc.exe

Verdict: Unknown

01-12 00:42:22

Protection Against Security Measures Bypass Techniques - 1940197314

high - Prevented (Blocked)