Incident #1365 - XDR Test Manager

HIGH 'Persistency - 1983659418' along with 5 other issues

RESOLVED SECURITY TESTING ID: #1365 | Created: 2026-01-12 03:44:48

Alerts

Hosts

Files

Network

Incident Overview

'Persistency - 1983659418' along with 5 other issues generated by XDR Agent detected on host dwshin involving user dwshin

Alert Count 6

Modified 2026-01-12 04:23

Assigned To Unassigned

Sources XDR Agent

Alert Categories

Malware

Affected Hosts & Users

Hosts (1)

Users (1)

dwshin

MITRE ATT&CK Mapping

Tactics (6)

TA0002 - Execution TA0005 - Defense Evasion TA0011 - Command and Control TA0003 - Persistence TA0004 - Privilege Escalation TA0006 - Credential Access

Techniques (6)

T1059 - Command and Scripting Interpreter T1546.007 - Event Triggered Execution: Netsh Helper DLL T1003.002 - OS Credential Dumping: Security Account Manager T1140 - Deobfuscate/Decode Files or Information T1059.001 - Command and Scripting Interpreter: PowerShell T1102.002 - Web Service: Bidirectional Communication

Related Alerts 6

ID	Severity	Name	Host	Action	Time
29518	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-12 04:20
29519	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-12 04:20
29472	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-12 03:59
29471	HIGH	SYNC - Credential Gathering - 2237270456	dwshin	Prevented (Blocked)	01-12 03:57
29469	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-12 03:52
29465	HIGH	Persistency - 1983659418	dwshin	Prevented (Blocked)	01-12 03:44

File Artifacts 16

File Name	Path	SHA256	Signature	Verdict	Actions
cmd.exe	-	`64afc6db3aad1289533662e2d79e27dd55c7dcdb8cd918b08e145ad82ad5acb4`	SIGNATURE_SIGNED	UNKNOWN	VT
conhost.exe	-	`6651a3beb0df1e66363a950c37dc9305f185d161fb03761e172ccfa0a4ab4f89`	SIGNATURE_SIGNED	UNKNOWN	VT
UltimateXdrGenerator.exe	-	`64affb2786b4cf64498dd4ddccee413981902611a07d1b38045ec03fa1397504`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
powershell.exe	-	`0ff6f2c94bc7e2833a5f7e16de1622e5dba70396f31c7d5f56381870317e8c46`	SIGNATURE_SIGNED	UNKNOWN	VT
net1.exe	-	`8489db35375d890314eb8f7cd9e0cbd3866475f4e252865f00f649b0a02fd757`	SIGNATURE_SIGNED	UNKNOWN	VT
net.exe	-	`bb3e638c8b5b6ef80847e364aeef2796cad25d3539cf9b41d3820fa48943e777`	SIGNATURE_SIGNED	UNKNOWN	VT
certutil.exe	-	`5ee9dc956e9f67f33f2ca0776d7dce4bc0b6bf2cf5005bf2644f0b36accceaf4`	SIGNATURE_SIGNED	UNKNOWN	VT
python.exe	-	`fda7026477256845afab371e354c4d512896665f1761939cb5887d0a9dec257a`	SIGNATURE_SIGNED	UNKNOWN	VT
python.exe	-	`511a52421372762b0c566a8173cdfa45d9829bcf0e21ca33cdddc4b945735da9`	SIGNATURE_SIGNED	UNKNOWN	VT
schtasks.exe	-	`b96af3066f0b9de8a460f77baae006c5372a266be18c561daa7c7ae8635d399d`	SIGNATURE_SIGNED	UNKNOWN	VT
reg.exe	-	`ef37663b44ac66920c6f33694deea01acb78ae3f3012884819373fa04c3eb5f0`	SIGNATURE_SIGNED	UNKNOWN	VT
chcp.com	-	`8d75e783f327f899a42927fc2927f0e3d1ec62c4ca1dc88de04dd67de9ae555d`	SIGNATURE_SIGNED	UNKNOWN	VT
systeminfo.exe	-	`a220a85750588f5b231ff8cb106ba5409eaabb85e3dd7278a98fca907e171ed2`	SIGNATURE_SIGNED	UNKNOWN	VT
netsh.exe	-	`0fbb280ccb403e51bd9b798f5f1159981f6d575248aaea656fa7982b6f454e3e`	SIGNATURE_SIGNED	UNKNOWN	VT
timeout.exe	-	`106490870753d87d0c5a1b4fe83045a06518d415ec595bd1d0c30fe3ed4149c1`	SIGNATURE_SIGNED	UNKNOWN	VT
at.exe	-	`16885037343ccdf6f1f2061fc769c27ec3333918a2d95c7d7b7d176818c056a0`	SIGNATURE_SIGNED	UNKNOWN	VT

Network Artifacts 0

No network artifacts found for this incident

Process Artifacts 6

Process	Command Line	Parent Process	User
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_incident_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_incident_runner.bat...`	-	dwshin

Registry Artifacts 0

No registry artifacts found for this incident

Analyst Verdict

Classification

Risk Level

HIGH

Resolution Notes

Auto resolved by XdrTestManager (alerts: 6)

Recommended Actions

Isolate affected endpoints
Investigate all related alerts
Document findings

Summary

Alerts

Hosts

Files

Network

Alert Categories

Malware

Timeline

01-12 04:23:40

Incident Modified

Status or details updated

01-12 04:23:40

Incident Resolved

resolved security testing

01-12 04:20:13

File Drop - 1815185192

high - Prevented (Blocked)

01-12 04:20:12

File Drop - 3732557733

high - Prevented (Blocked)

01-12 03:59:10

Suspicious Process Creation

medium - Prevented (Blocked)

01-12 03:57:23

SYNC - Credential Gathering - 2237270456

high - Prevented (Blocked)

01-12 03:52:02

Powershell Activity - 3990759154

high - Prevented (Blocked)

01-12 03:44:48

Incident Created

#1365 - 'Persistency - 1983659418' along with 5 other issues

01-12 03:44:48

cmd.exe

Verdict: Unknown

01-12 03:44:48

conhost.exe

Verdict: Unknown

01-12 03:44:48

UltimateXdrGenerator.exe

Verdict: Unknown

01-12 03:44:48

powershell.exe

Verdict: Unknown

01-12 03:44:48

net1.exe

Verdict: Unknown

01-12 03:44:48

net.exe

Verdict: Unknown

01-12 03:44:48

certutil.exe

Verdict: Unknown

01-12 03:44:48

python.exe

Verdict: Unknown

01-12 03:44:48

python.exe

Verdict: Unknown

01-12 03:44:48

schtasks.exe

Verdict: Unknown

01-12 03:44:35

Persistency - 1983659418

high - Prevented (Blocked)