Incident #2086 - XDR Test Manager

HIGH 'Persistency - 1983659418' along with 7 other issues

RESOLVED OTHER ID: #2086 | Created: 2026-01-19 23:35:56

Alerts

Hosts

Files

Network

Incident Overview

'Persistency - 1983659418' along with 7 other issues generated by XDR Agent detected on host teahee involving user dokji

Alert Count 8

Modified 2026-01-20 00:30

Assigned To Unassigned

Sources XDR Agent

Alert Categories

Malware

Affected Hosts & Users

Hosts (1)

Users (1)

dokji

MITRE ATT&CK Mapping

Tactics (5)

TA0002 - Execution TA0005 - Defense Evasion TA0011 - Command and Control TA0003 - Persistence TA0004 - Privilege Escalation

Techniques (5)

T1059 - Command and Scripting Interpreter T1546.007 - Event Triggered Execution: Netsh Helper DLL T1140 - Deobfuscate/Decode Files or Information T1059.001 - Command and Scripting Interpreter: PowerShell T1132 - Data Encoding

Related Alerts 8

ID	Severity	Name	Host	Action	Time
40971	HIGH	Powershell Activity - 2243699650	teahee	Detected (Reported)	01-20 00:27
40970	HIGH	Powershell Activity - 2243699650	teahee	Prevented (Blocked)	01-20 00:27
40968	HIGH	Powershell Activity - 3083271452	teahee	Prevented (Blocked)	01-20 00:27
40969	HIGH	Powershell Activity - 3990759154	teahee	Prevented (Blocked)	01-20 00:27
40921	MEDIUM	WildFire Malware	teahee	Prevented (Blocked)	01-20 00:17
40919	MEDIUM	Suspicious Process Creation	teahee	Prevented (Blocked)	01-20 00:14
40842	MEDIUM	WildFire Malware	teahee	Prevented (Blocked)	01-19 23:37
40836	HIGH	Persistency - 1983659418	teahee	Prevented (Blocked)	01-19 23:35

File Artifacts 13

File Name	Path	SHA256	Signature	Verdict	Actions
MegaGenerator.exe	-	`e11e17aa538668963d62d7ba8fcb3e705b437f4a8e3e3333c2afc0c3552b2edf`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
UltimateXdrGenerator.exe	-	`af362370742931d534c21901f6b41bf8d034bf5d7e80a571d5eca6bc871ff499`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
python.exe	-	`fda7026477256845afab371e354c4d512896665f1761939cb5887d0a9dec257a`	SIGNATURE_SIGNED	UNKNOWN	VT
cmd.exe	-	`64afc6db3aad1289533662e2d79e27dd55c7dcdb8cd918b08e145ad82ad5acb4`	SIGNATURE_SIGNED	UNKNOWN	VT
conhost.exe	-	`6651a3beb0df1e66363a950c37dc9305f185d161fb03761e172ccfa0a4ab4f89`	SIGNATURE_SIGNED	UNKNOWN	VT
powershell.exe	-	`0ff6f2c94bc7e2833a5f7e16de1622e5dba70396f31c7d5f56381870317e8c46`	SIGNATURE_SIGNED	UNKNOWN	VT
net1.exe	-	`8489db35375d890314eb8f7cd9e0cbd3866475f4e252865f00f649b0a02fd757`	SIGNATURE_SIGNED	UNKNOWN	VT
net.exe	-	`bb3e638c8b5b6ef80847e364aeef2796cad25d3539cf9b41d3820fa48943e777`	SIGNATURE_SIGNED	UNKNOWN	VT
rundll32.exe	-	`4193f529bff2729769d82cb83ee206d2af16c59208d6dc5cd8b54cd9c6703a11`	SIGNATURE_SIGNED	UNKNOWN	VT
systeminfo.exe	-	`a220a85750588f5b231ff8cb106ba5409eaabb85e3dd7278a98fca907e171ed2`	SIGNATURE_SIGNED	UNKNOWN	VT
netsh.exe	-	`0fbb280ccb403e51bd9b798f5f1159981f6d575248aaea656fa7982b6f454e3e`	SIGNATURE_SIGNED	UNKNOWN	VT
at.exe	-	`16885037343ccdf6f1f2061fc769c27ec3333918a2d95c7d7b7d176818c056a0`	SIGNATURE_SIGNED	UNKNOWN	VT
reg.exe	-	`ef37663b44ac66920c6f33694deea01acb78ae3f3012884819373fa04c3eb5f0`	SIGNATURE_SIGNED	UNKNOWN	VT

Network Artifacts 0

No network artifacts found for this incident

Process Artifacts 8

Process	Command Line	Parent Process	User
cmd.exe	`C:\WINDOWS\SYSTEM32\cmd.exe /c ""C:\app\cortex-xdr-siem-test\xdr_incident_runner...`	-	dokji
cmd.exe	`C:\WINDOWS\SYSTEM32\cmd.exe /c ""C:\app\cortex-xdr-siem-test\xdr_incident_runner...`	-	dokji
cmd.exe	`C:\WINDOWS\SYSTEM32\cmd.exe /c ""C:\app\cortex-xdr-siem-test\xdr_incident_runner...`	-	dokji
cmd.exe	`C:\WINDOWS\SYSTEM32\cmd.exe /c ""C:\app\cortex-xdr-siem-test\xdr_incident_runner...`	-	dokji
UltimateXdrGenerator.exe	`"C:\app\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\Ultimate...`	-	dokji
python.exe	`"python" mega_incident_generator.py --fast --rounds 1`	-	dokji
MegaGenerator.exe	`"C:\app\cortex-xdr-siem-test\xdr_tools\MegaGenerator\bin\publish\MegaGenerator.e...`	-	dokji
cmd.exe	`C:\WINDOWS\SYSTEM32\cmd.exe /c ""C:\app\cortex-xdr-siem-test\xdr_incident_runner...`	-	dokji

Registry Artifacts 0

No registry artifacts found for this incident

Analyst Verdict

Classification

Risk Level

HIGH

Recommended Actions

Isolate affected endpoints
Investigate all related alerts
Document findings

Summary

Alerts

Hosts

Files

Network

Alert Categories

Malware

Timeline

01-20 00:30:04

Incident Modified

Status or details updated

01-20 00:30:04

Incident Resolved

resolved other

01-20 00:27:31

Powershell Activity - 2243699650

high - Detected (Reported)

01-20 00:27:30

Powershell Activity - 2243699650

high - Prevented (Blocked)

01-20 00:27:29

Powershell Activity - 3083271452

high - Prevented (Blocked)

01-20 00:27:29

Powershell Activity - 3990759154

high - Prevented (Blocked)

01-20 00:17:01

WildFire Malware

medium - Prevented (Blocked)

01-20 00:14:07

Suspicious Process Creation

medium - Prevented (Blocked)

01-19 23:37:02

WildFire Malware

medium - Prevented (Blocked)

01-19 23:35:56

Incident Created

#2086 - 'Persistency - 1983659418' along with 7 other issues

01-19 23:35:56

MegaGenerator.exe

Verdict: Unknown

01-19 23:35:56

UltimateXdrGenerator.exe

Verdict: Unknown

01-19 23:35:56

python.exe

Verdict: Unknown

01-19 23:35:56

cmd.exe

Verdict: Unknown

01-19 23:35:56

conhost.exe

Verdict: Unknown

01-19 23:35:56

powershell.exe

Verdict: Unknown

01-19 23:35:56

net1.exe

Verdict: Unknown

01-19 23:35:56

net.exe

Verdict: Unknown

01-19 23:35:56

rundll32.exe

Verdict: Unknown

01-19 23:35:56

systeminfo.exe

Verdict: Unknown

01-19 23:35:36

Persistency - 1983659418

high - Prevented (Blocked)