Incident #1478 - XDR Test Manager

HIGH 'Protection Against Security Measures Bypass Techniques - 1940197314' along with 5 other issues

RESOLVED SECURITY TESTING ID: #1478 | Created: 2026-01-13 16:30:24

Alerts

Hosts

Files

Network

Incident Overview

'Protection Against Security Measures Bypass Techniques - 1940197314' along with 5 other issues generated by XDR Agent detected on host dwshin involving user dwshin

Alert Count 6

Modified 2026-01-13 16:58

Assigned To Unassigned

Sources XDR Agent

Alert Categories

Malware

Affected Hosts & Users

Hosts (1)

Users (1)

dwshin

MITRE ATT&CK Mapping

Tactics (2)

TA0005 - Defense Evasion TA0002 - Execution

Techniques (4)

T1059 - Command and Scripting Interpreter T1140 - Deobfuscate/Decode Files or Information T1218.010 - System Binary Proxy Execution: Regsvr32 T1059.001 - Command and Scripting Interpreter: PowerShell

Related Alerts 6

ID	Severity	Name	Host	Action	Time
32003	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-13 16:58
32001	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-13 16:55
31999	HIGH	Bypass Attempt - 911079455	dwshin	Prevented (Blocked)	01-13 16:51
31994	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-13 16:44
31948	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-13 16:37
31945	HIGH	Protection Against Security Measures Bypass Techniques - 1940197314	dwshin	Prevented (Blocked)	01-13 16:30

File Artifacts 13

File Name	Path	SHA256	Signature	Verdict	Actions
MegaGenerator.exe	-	`117c0c81c476b45223bd5e35ddb52be50ec8462c71227445050e38f2a830aa52`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
UltimateXdrGenerator.exe	-	`64affb2786b4cf64498dd4ddccee413981902611a07d1b38045ec03fa1397504`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
powershell.exe	-	`0ff6f2c94bc7e2833a5f7e16de1622e5dba70396f31c7d5f56381870317e8c46`	SIGNATURE_SIGNED	UNKNOWN	VT
regsvr32.exe	-	`f379c637eb2250f0cdae05918035a37f3fdf89d6b2ad897da235c5f603fe2a1e`	SIGNATURE_SIGNED	UNKNOWN	VT
cmd.exe	-	`64afc6db3aad1289533662e2d79e27dd55c7dcdb8cd918b08e145ad82ad5acb4`	SIGNATURE_SIGNED	UNKNOWN	VT
conhost.exe	-	`6651a3beb0df1e66363a950c37dc9305f185d161fb03761e172ccfa0a4ab4f89`	SIGNATURE_SIGNED	UNKNOWN	VT
ARP.EXE	-	`a1c6fed72b64ce1acf5f5157ea38202ab8bfa2deef6677b5d1b95eb088de0fa7`	SIGNATURE_SIGNED	UNKNOWN	VT
rundll32.exe	-	`4193f529bff2729769d82cb83ee206d2af16c59208d6dc5cd8b54cd9c6703a11`	SIGNATURE_SIGNED	UNKNOWN	VT
sc.exe	-	`a452bfcb6000d03942ddfaddcda5a7eb121447ed99b1ba090446b4a989f1f7ae`	SIGNATURE_SIGNED	UNKNOWN	VT
bitsadmin.exe	-	`5ceec3064d495f73aad77facf9d0b05a89b3a137fc86ba1b43c14b3ca3bd3e11`	SIGNATURE_SIGNED	UNKNOWN	VT
reg.exe	-	`ef37663b44ac66920c6f33694deea01acb78ae3f3012884819373fa04c3eb5f0`	SIGNATURE_SIGNED	UNKNOWN	VT
chcp.com	-	`8d75e783f327f899a42927fc2927f0e3d1ec62c4ca1dc88de04dd67de9ae555d`	SIGNATURE_SIGNED	UNKNOWN	VT
calc.exe	-	`81bd48985fa1753e9e2158a7cf969141edddbd050e976801bb477e24a2a06b2a`	SIGNATURE_SIGNED	UNKNOWN	VT

Network Artifacts 0

No network artifacts found for this incident

Process Artifacts 6

Process	Command Line	Parent Process	User
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
MegaGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\MegaGenerator\bin\publish\MegaGenerator.exe" ...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin

Registry Artifacts 0

No registry artifacts found for this incident

Analyst Verdict

Classification

Risk Level

HIGH

Resolution Notes

Auto resolved by XdrTestManager (alerts: 5)

Recommended Actions

Isolate affected endpoints
Investigate all related alerts
Document findings

Summary

Alerts

Hosts

Files

Network

Alert Categories

Malware

Timeline

01-13 16:58:21

Incident Modified

Status or details updated

01-13 16:58:21

Incident Resolved

resolved security testing

01-13 16:58:13

Suspicious Process Creation

medium - Prevented (Blocked)

01-13 16:55:01

WildFire Malware

medium - Prevented (Blocked)

01-13 16:51:01

Bypass Attempt - 911079455

high - Prevented (Blocked)

01-13 16:44:02

Suspicious Process Creation

medium - Prevented (Blocked)

01-13 16:37:04

Suspicious Process Creation

medium - Prevented (Blocked)

01-13 16:30:24

Incident Created

#1478 - 'Protection Against Security Measures Bypass Techniques - 1940197314' along with 5 other issues

01-13 16:30:24

MegaGenerator.exe

Verdict: Unknown

01-13 16:30:24

UltimateXdrGenerator.exe

Verdict: Unknown

01-13 16:30:24

powershell.exe

Verdict: Unknown

01-13 16:30:24

regsvr32.exe

Verdict: Unknown

01-13 16:30:24

cmd.exe

Verdict: Unknown

01-13 16:30:24

conhost.exe

Verdict: Unknown

01-13 16:30:24

ARP.EXE

Verdict: Unknown

01-13 16:30:24

rundll32.exe

Verdict: Unknown

01-13 16:30:24

sc.exe

Verdict: Unknown

01-13 16:30:24

bitsadmin.exe

Verdict: Unknown

01-13 16:30:13

Protection Against Security Measures Bypass Techniques - 1940197314

high - Prevented (Blocked)