Incident #2039 - XDR Test Manager

HIGH 'File Drop - 1815185192' along with 5 other issues

RESOLVED SECURITY TESTING ID: #2039 | Created: 2026-01-19 13:05:22

XDR Console

Alerts

Hosts

Files

Network

Incident Overview

'File Drop - 1815185192' along with 5 other issues generated by XDR Agent detected on host dwshin involving user dwshin

Alert Count 6

Modified 2026-01-19 13:16

Assigned To Unassigned

Sources XDR Agent

Alert Categories

Malware

Affected Hosts & Users

Hosts (1)

Users (1)

dwshin

MITRE ATT&CK Mapping

Tactics (3)

TA0005 - Defense Evasion TA0011 - Command and Control TA0002 - Execution

Techniques (5)

T1059 - Command and Scripting Interpreter T1218.005 - System Binary Proxy Execution: Mshta T1218 - System Binary Proxy Execution T1140 - Deobfuscate/Decode Files or Information T1102.002 - Web Service: Bidirectional Communication

Related Alerts 6

ID	Severity	Name	Host	Action	Time
40089	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	01-19 13:12
40087	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-19 13:12
40088	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	01-19 13:12
40086	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-19 13:11
40085	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-19 13:05
40084	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-19 13:05

File Artifacts 21

File Name	Path	SHA256	Signature	Verdict	Actions
powershell.exe	-	`0ff6f2c94bc7e2833a5f7e16de1622e5dba70396f31c7d5f56381870317e8c46`	SIGNATURE_SIGNED	UNKNOWN	VT
UltimateXdrGenerator.exe	-	`64affb2786b4cf64498dd4ddccee413981902611a07d1b38045ec03fa1397504`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
chcp.com	-	`8d75e783f327f899a42927fc2927f0e3d1ec62c4ca1dc88de04dd67de9ae555d`	SIGNATURE_SIGNED	UNKNOWN	VT
cmd.exe	-	`64afc6db3aad1289533662e2d79e27dd55c7dcdb8cd918b08e145ad82ad5acb4`	SIGNATURE_SIGNED	UNKNOWN	VT
conhost.exe	-	`6651a3beb0df1e66363a950c37dc9305f185d161fb03761e172ccfa0a4ab4f89`	SIGNATURE_SIGNED	UNKNOWN	VT
python.exe	-	`fda7026477256845afab371e354c4d512896665f1761939cb5887d0a9dec257a`	SIGNATURE_SIGNED	UNKNOWN	VT
whoami.exe	-	`23240ef9f8b0a9a324110b1c2331de31dc1b0e08f5359cb707e51a939af56cd3`	SIGNATURE_SIGNED	UNKNOWN	VT
python.exe	-	`511a52421372762b0c566a8173cdfa45d9829bcf0e21ca33cdddc4b945735da9`	SIGNATURE_SIGNED	UNKNOWN	VT
net1.exe	-	`8489db35375d890314eb8f7cd9e0cbd3866475f4e252865f00f649b0a02fd757`	SIGNATURE_SIGNED	UNKNOWN	VT
cmstp.exe	-	`6069d2ac168e49a4283c57193e1bf158df4040e66ea634afac4339a1ee7ec557`	SIGNATURE_SIGNED	UNKNOWN	VT
mshta.exe	-	`1f1aabe87e5e93a8fff769bf3614dd559c51c80fc045e11868f3843d9a004d1e`	SIGNATURE_SIGNED	UNKNOWN	VT
cmdkey.exe	-	`4125cd7966810cdfafb18157c276a88e6ac443c7c98d42593c70247045815028`	SIGNATURE_SIGNED	UNKNOWN	VT
bitsadmin.exe	-	`5ceec3064d495f73aad77facf9d0b05a89b3a137fc86ba1b43c14b3ca3bd3e11`	SIGNATURE_SIGNED	UNKNOWN	VT
sc.exe	-	`a452bfcb6000d03942ddfaddcda5a7eb121447ed99b1ba090446b4a989f1f7ae`	SIGNATURE_SIGNED	UNKNOWN	VT
certutil.exe	-	`5ee9dc956e9f67f33f2ca0776d7dce4bc0b6bf2cf5005bf2644f0b36accceaf4`	SIGNATURE_SIGNED	UNKNOWN	VT
cscript.exe	-	`6b896080492b2f559c49c4e3fb8eba89d883b53ef2c974bd8939281e123f8715`	SIGNATURE_SIGNED	UNKNOWN	VT
net.exe	-	`bb3e638c8b5b6ef80847e364aeef2796cad25d3539cf9b41d3820fa48943e777`	SIGNATURE_SIGNED	UNKNOWN	VT
forfiles.exe	-	`715b741d06464a7c5f3b67fec479806bf83543498e04e73b5a2e364bc07968b9`	SIGNATURE_SIGNED	UNKNOWN	VT
tasklist.exe	-	`62800679c55682f2f5f38b3df9080d12480bea78b5b8476eace9df014f353b14`	SIGNATURE_SIGNED	UNKNOWN	VT
schtasks.exe	-	`b96af3066f0b9de8a460f77baae006c5372a266be18c561daa7c7ae8635d399d`	SIGNATURE_SIGNED	UNKNOWN	VT
calc.exe	-	`81bd48985fa1753e9e2158a7cf969141edddbd050e976801bb477e24a2a06b2a`	SIGNATURE_SIGNED	UNKNOWN	VT

Network Artifacts 0

No network artifacts found for this incident

Process Artifacts 6

Process	Command Line	Parent Process	User
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_incident_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin

Registry Artifacts 0

No registry artifacts found for this incident

Analyst Verdict

Classification

Risk Level

HIGH

Resolution Notes

Auto resolved by XdrTestManager (alerts: 6)

Recommended Actions

Isolate affected endpoints
Investigate all related alerts
Document findings

Summary

Alerts

Hosts

Files

Network

Alert Categories

Malware

Timeline

01-19 13:16:08

Incident Modified

Status or details updated

01-19 13:16:08

Incident Resolved

resolved security testing

01-19 13:12:10

Staged Malware Activity - 2394207323

high - Prevented (Blocked)

01-19 13:12:10

Suspicious Process Creation

medium - Prevented (Blocked)

01-19 13:12:09

Script Activity - 3055004603

high - Prevented (Blocked)

01-19 13:11:12

Evasion Technique - 527483761

high - Prevented (Blocked)

01-19 13:05:22

Incident Created

#2039 - 'File Drop - 1815185192' along with 5 other issues

01-19 13:05:22

powershell.exe

Verdict: Unknown

01-19 13:05:22

UltimateXdrGenerator.exe

Verdict: Unknown

01-19 13:05:22

chcp.com

Verdict: Unknown

01-19 13:05:22

cmd.exe

Verdict: Unknown

01-19 13:05:22

conhost.exe

Verdict: Unknown

01-19 13:05:22

python.exe

Verdict: Unknown

01-19 13:05:22

whoami.exe

Verdict: Unknown

01-19 13:05:22

python.exe

Verdict: Unknown

01-19 13:05:22

net1.exe

Verdict: Unknown

01-19 13:05:22

cmstp.exe

Verdict: Unknown

01-19 13:05:04

File Drop - 1815185192

high - Prevented (Blocked)

01-19 13:05:03

File Drop - 3732557733

high - Prevented (Blocked)