Incident #191 - XDR Test Manager

HIGH 'Credential Gathering Protection - 3380811775' along with 7 other issues

RESOLVED SECURITY TESTING ID: #191 | Created: 2026-01-02 22:54:11

Alerts

Hosts

Files

Network

Incident Overview

'Credential Gathering Protection - 3380811775' along with 7 other issues generated by XDR Agent detected on host dwshin involving user dwshin

Alert Count 8

Modified 2026-01-02 23:30

Assigned To Unassigned

Sources XDR Agent

Alert Categories

Malware

Affected Hosts & Users

Hosts (1)

Users (1)

dwshin

MITRE ATT&CK Mapping

Tactics (6)

TA0003 - Persistence TA0002 - Execution TA0005 - Defense Evasion TA0004 - Privilege Escalation TA0006 - Credential Access TA0008 - Lateral Movement

Techniques (7)

T1059 - Command and Scripting Interpreter T1098 - Account Manipulation T1552 - Unsecured Credentials T1140 - Deobfuscate/Decode Files or Information T1059.001 - Command and Scripting Interpreter: PowerShell T1550 - Use Alternate Authentication Material T1207 - Rogue Domain Controller

Related Alerts 8

ID	Severity	Name	Host	Action	Time
3018	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-02 23:29
3014	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-02 23:22
3010	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-02 23:20
3009	HIGH	Credential Gathering Protection - 3380811775	dwshin	Detected (Reported)	01-02 23:15
3008	HIGH	Credential Gathering Protection - 510630382	dwshin	Prevented (Blocked)	01-02 23:15
3002	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-02 23:08
2996	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-02 23:01
2992	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-02 22:54

File Artifacts 10

File Name	Path	SHA256	Signature	Verdict	Actions
MegaGenerator.exe	-	`117c0c81c476b45223bd5e35ddb52be50ec8462c71227445050e38f2a830aa52`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
UltimateXdrGenerator.exe	-	`64affb2786b4cf64498dd4ddccee413981902611a07d1b38045ec03fa1397504`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
powershell.exe	-	`0ff6f2c94bc7e2833a5f7e16de1622e5dba70396f31c7d5f56381870317e8c46`	SIGNATURE_SIGNED	UNKNOWN	VT
regsvr32.exe	-	`f379c637eb2250f0cdae05918035a37f3fdf89d6b2ad897da235c5f603fe2a1e`	SIGNATURE_SIGNED	UNKNOWN	VT
cmd.exe	-	`64afc6db3aad1289533662e2d79e27dd55c7dcdb8cd918b08e145ad82ad5acb4`	SIGNATURE_SIGNED	UNKNOWN	VT
conhost.exe	-	`6651a3beb0df1e66363a950c37dc9305f185d161fb03761e172ccfa0a4ab4f89`	SIGNATURE_SIGNED	UNKNOWN	VT
ftp.exe	-	`42f18d21d381f6eb0ad4eb9d057de87a98dc16f2a8eae3386dc2f08892ab23b3`	SIGNATURE_SIGNED	UNKNOWN	VT
Notepad.exe	-	`3d5b56ec5cbe064e10b9525ef74359a4e6b83a9c3341f5fbaac629bce80b6817`	SIGNATURE_SIGNED	UNKNOWN	VT
net1.exe	-	`8489db35375d890314eb8f7cd9e0cbd3866475f4e252865f00f649b0a02fd757`	SIGNATURE_SIGNED	UNKNOWN	VT
net.exe	-	`bb3e638c8b5b6ef80847e364aeef2796cad25d3539cf9b41d3820fa48943e777`	SIGNATURE_SIGNED	UNKNOWN	VT

Network Artifacts 0

No network artifacts found for this incident

Process Artifacts 8

Process	Command Line	Parent Process	User
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
MegaGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\MegaGenerator\bin\publish\MegaGenerator.exe" ...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin

Registry Artifacts 0

No registry artifacts found for this incident

Analyst Verdict

Classification

Risk Level

HIGH

Recommended Actions

Isolate affected endpoints
Investigate all related alerts
Document findings

Summary

Alerts

Hosts

Files

Network

Alert Categories

Malware

Timeline

01-02 23:30:05

Incident Modified

Status or details updated

01-02 23:30:05

Incident Resolved

resolved security testing

01-02 23:29:21

Suspicious Process Creation

medium - Prevented (Blocked)

01-02 23:22:04

Suspicious Process Creation

medium - Prevented (Blocked)

01-02 23:20:01

WildFire Malware

medium - Prevented (Blocked)

01-02 23:15:13

Credential Gathering Protection - 3380811775

high - Detected (Reported)

01-02 23:15:11

Credential Gathering Protection - 510630382

high - Prevented (Blocked)

01-02 23:08:03

Suspicious Process Creation

medium - Prevented (Blocked)

01-02 23:01:11

Suspicious Process Creation

medium - Prevented (Blocked)

01-02 22:54:11

Incident Created

#191 - 'Credential Gathering Protection - 3380811775' along with 7 other issues

01-02 22:54:11

MegaGenerator.exe

Verdict: Unknown

01-02 22:54:11

UltimateXdrGenerator.exe

Verdict: Unknown

01-02 22:54:11

powershell.exe

Verdict: Unknown

01-02 22:54:11

regsvr32.exe

Verdict: Unknown

01-02 22:54:11

cmd.exe

Verdict: Unknown

01-02 22:54:11

conhost.exe

Verdict: Unknown

01-02 22:54:11

ftp.exe

Verdict: Unknown

01-02 22:54:11

Notepad.exe

Verdict: Unknown

01-02 22:54:11

net1.exe

Verdict: Unknown

01-02 22:54:11

net.exe

Verdict: Unknown

01-02 22:54:05

Suspicious Process Creation

medium - Prevented (Blocked)