Incident #1369 - XDR Test Manager

HIGH 'Network Connection - 1971152322' along with 4 other issues

RESOLVED SECURITY TESTING ID: #1369 | Created: 2026-01-12 04:41:22

Alerts

Hosts

Files

Network

Incident Overview

'Network Connection - 1971152322' along with 4 other issues generated by XDR Agent detected on host dwshin involving user dwshin

Alert Count 5

Modified 2026-01-12 05:29

Assigned To Unassigned

Sources XDR Agent

Alert Categories

Malware

Affected Hosts & Users

Hosts (1)

Users (1)

dwshin

MITRE ATT&CK Mapping

Tactics (3)

TA0005 - Defense Evasion TA0011 - Command and Control TA0002 - Execution

Techniques (5)

T1059 - Command and Scripting Interpreter T1071.001 - Application Layer Protocol: Web Protocols T1140 - Deobfuscate/Decode Files or Information T1059.001 - Command and Scripting Interpreter: PowerShell T1218.007 - System Binary Proxy Execution: Msiexec

Related Alerts 5

ID	Severity	Name	Host	Action	Time
29673	HIGH	Protection Against Security Measures Bypass Techniques - 1940197314	dwshin	Prevented (Blocked)	01-12 05:28
29656	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-12 05:23
29564	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-12 05:02
29565	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-12 05:02
29534	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-12 04:41

File Artifacts 15

File Name	Path	SHA256	Signature	Verdict	Actions
cmd.exe	-	`64afc6db3aad1289533662e2d79e27dd55c7dcdb8cd918b08e145ad82ad5acb4`	SIGNATURE_SIGNED	UNKNOWN	VT
powershell.exe	-	`0ff6f2c94bc7e2833a5f7e16de1622e5dba70396f31c7d5f56381870317e8c46`	SIGNATURE_SIGNED	UNKNOWN	VT
conhost.exe	-	`6651a3beb0df1e66363a950c37dc9305f185d161fb03761e172ccfa0a4ab4f89`	SIGNATURE_SIGNED	UNKNOWN	VT
chcp.com	-	`8d75e783f327f899a42927fc2927f0e3d1ec62c4ca1dc88de04dd67de9ae555d`	SIGNATURE_SIGNED	UNKNOWN	VT
UltimateXdrGenerator.exe	-	`64affb2786b4cf64498dd4ddccee413981902611a07d1b38045ec03fa1397504`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
python.exe	-	`fda7026477256845afab371e354c4d512896665f1761939cb5887d0a9dec257a`	SIGNATURE_SIGNED	UNKNOWN	VT
schtasks.exe	-	`b96af3066f0b9de8a460f77baae006c5372a266be18c561daa7c7ae8635d399d`	SIGNATURE_SIGNED	UNKNOWN	VT
msiexec.exe	-	`677417ba3ad87f73cd95ad30423998c6089e7eef381b309a562cda1eb6fe178e`	SIGNATURE_SIGNED	UNKNOWN	VT
cscript.exe	-	`6b896080492b2f559c49c4e3fb8eba89d883b53ef2c974bd8939281e123f8715`	SIGNATURE_SIGNED	UNKNOWN	VT
vssadmin.exe	-	`ca35cb78f589520db0eaa2af0453dc472e6aa75709a6cb3053dc38f125024e50`	SIGNATURE_SIGNED	UNKNOWN	VT
certutil.exe	-	`5ee9dc956e9f67f33f2ca0776d7dce4bc0b6bf2cf5005bf2644f0b36accceaf4`	SIGNATURE_SIGNED	UNKNOWN	VT
NETSTAT.EXE	-	`09bca819ab371a2d4f62ca5114c1335c38fd196ae7956e2fc4d154bbe55c3f4c`	SIGNATURE_SIGNED	UNKNOWN	VT
tasklist.exe	-	`62800679c55682f2f5f38b3df9080d12480bea78b5b8476eace9df014f353b14`	SIGNATURE_SIGNED	UNKNOWN	VT
python.exe	-	`511a52421372762b0c566a8173cdfa45d9829bcf0e21ca33cdddc4b945735da9`	SIGNATURE_SIGNED	UNKNOWN	VT
cmstp.exe	-	`6069d2ac168e49a4283c57193e1bf158df4040e66ea634afac4339a1ee7ec557`	SIGNATURE_SIGNED	UNKNOWN	VT

Network Artifacts 0

No network artifacts found for this incident

Process Artifacts 5

Process	Command Line	Parent Process	User
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_incident_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
python.exe	`"C:\Users\andsi\AppData\Local\Python\pythoncore-3.14-64\python.exe" incident_g...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin

Registry Artifacts 0

No registry artifacts found for this incident

Analyst Verdict

Classification

Risk Level

HIGH

Resolution Notes

Auto resolved by XdrTestManager (alerts: 5)

Recommended Actions

Isolate affected endpoints
Investigate all related alerts
Document findings

Summary

Alerts

Hosts

Files

Network

Alert Categories

Malware

Timeline

01-12 05:29:25

Incident Modified

Status or details updated

01-12 05:29:25

Incident Resolved

resolved security testing

01-12 05:28:05

Protection Against Security Measures Bypass Techniques - 1940197314

high - Prevented (Blocked)

01-12 05:23:13

Network Connection - 1971152322

high - Prevented (Blocked)

01-12 05:02:05

Suspicious Process Creation

medium - Prevented (Blocked)

01-12 05:02:04

Network Connection - 1971152322

high - Prevented (Blocked)

01-12 04:41:22

Incident Created

#1369 - 'Network Connection - 1971152322' along with 4 other issues

01-12 04:41:22

cmd.exe

Verdict: Unknown

01-12 04:41:22

powershell.exe

Verdict: Unknown

01-12 04:41:22

conhost.exe

Verdict: Unknown

01-12 04:41:22

chcp.com

Verdict: Unknown

01-12 04:41:22

UltimateXdrGenerator.exe

Verdict: Unknown

01-12 04:41:22

python.exe

Verdict: Unknown

01-12 04:41:22

schtasks.exe

Verdict: Unknown

01-12 04:41:22

msiexec.exe

Verdict: Unknown

01-12 04:41:22

cscript.exe

Verdict: Unknown

01-12 04:41:22

vssadmin.exe

Verdict: Unknown

01-12 04:41:15

Suspicious Process Creation

medium - Prevented (Blocked)