Incident #3635 - XDR Test Manager

HIGH 'Protection Against Security Measures Bypass Techniques - 1952317967' along with 10 other issues

RESOLVED SECURITY TESTING ID: #3635 | Created: 2026-02-08 13:32:23

Alerts

Hosts

Files

Network

Incident Overview

'Protection Against Security Measures Bypass Techniques - 1952317967' along with 10 other issues generated by XDR Agent detected on host dwshin involving user dwshin

Alert Count 11

Modified 2026-02-08 14:58

Assigned To Unassigned

Sources XDR Agent

Alert Categories

Malware

Affected Hosts & Users

Hosts (1)

Users (1)

dwshin

MITRE ATT&CK Mapping

Tactics (3)

TA0005 - Defense Evasion TA0011 - Command and Control TA0002 - Execution

Techniques (5)

T1059 - Command and Scripting Interpreter T1218.005 - System Binary Proxy Execution: Mshta T1140 - Deobfuscate/Decode Files or Information T1059.001 - Command and Scripting Interpreter: PowerShell T1102.002 - Web Service: Bidirectional Communication

Related Alerts 11

ID	Severity	Name	Host	Action	Time
80510	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	02-08 14:57
80508	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	02-08 14:56
80497	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	02-08 14:35
80498	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	02-08 14:35
80490	HIGH	Protection Against Security Measures Bypass Techniques - 1940197314	dwshin	Prevented (Blocked)	02-08 14:21
80482	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	02-08 14:07
80477	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	02-08 14:00
80478	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	02-08 14:00
80470	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	02-08 13:51
80466	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Prevented (Blocked)	02-08 13:46
80459	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	02-08 13:32

File Artifacts 21

File Name	Path	SHA256	Signature	Verdict	Actions
MegaGenerator.exe	-	`117c0c81c476b45223bd5e35ddb52be50ec8462c71227445050e38f2a830aa52`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
UltimateXdrGenerator.exe	-	`64affb2786b4cf64498dd4ddccee413981902611a07d1b38045ec03fa1397504`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
powershell.exe	-	`0ff6f2c94bc7e2833a5f7e16de1622e5dba70396f31c7d5f56381870317e8c46`	SIGNATURE_SIGNED	UNKNOWN	VT
cmd.exe	-	`64afc6db3aad1289533662e2d79e27dd55c7dcdb8cd918b08e145ad82ad5acb4`	SIGNATURE_SIGNED	UNKNOWN	VT
conhost.exe	-	`6651a3beb0df1e66363a950c37dc9305f185d161fb03761e172ccfa0a4ab4f89`	SIGNATURE_SIGNED	UNKNOWN	VT
cscript.exe	-	`6b896080492b2f559c49c4e3fb8eba89d883b53ef2c974bd8939281e123f8715`	SIGNATURE_SIGNED	UNKNOWN	VT
chcp.com	-	`8d75e783f327f899a42927fc2927f0e3d1ec62c4ca1dc88de04dd67de9ae555d`	SIGNATURE_SIGNED	UNKNOWN	VT
certutil.exe	-	`5ee9dc956e9f67f33f2ca0776d7dce4bc0b6bf2cf5005bf2644f0b36accceaf4`	SIGNATURE_SIGNED	UNKNOWN	VT
WINWORD.EXE	-	`45d9c7255d0384ee4958452ff07278e030e4be4554bddd5d7c5d9e447f37baa8`	SIGNATURE_SIGNED	UNKNOWN	VT
ai.exe	-	`22fcc5c06960173cbc7f6a50440e0d4702918a8aafffb96040c8f8e3a218941a`	SIGNATURE_SIGNED	UNKNOWN	VT
HOSTNAME.EXE	-	`8ff283fb7a282a9b2b30235016669dfe795665bcbb254fd17ac31fa9308d89d9`	SIGNATURE_SIGNED	UNKNOWN	VT
msiexec.exe	-	`677417ba3ad87f73cd95ad30423998c6089e7eef381b309a562cda1eb6fe178e`	SIGNATURE_SIGNED	UNKNOWN	VT
schtasks.exe	-	`b96af3066f0b9de8a460f77baae006c5372a266be18c561daa7c7ae8635d399d`	SIGNATURE_SIGNED	UNKNOWN	VT
mshta.exe	-	`1f1aabe87e5e93a8fff769bf3614dd559c51c80fc045e11868f3843d9a004d1e`	SIGNATURE_SIGNED	UNKNOWN	VT
tasklist.exe	-	`62800679c55682f2f5f38b3df9080d12480bea78b5b8476eace9df014f353b14`	SIGNATURE_SIGNED	UNKNOWN	VT
msconfig.exe	-	`03ad90335327756748643d4e7e5e3cd8630417b5dd7ffb6f8977014ab894d5d0`	SIGNATURE_SIGNED	UNKNOWN	VT
reg.exe	-	`ef37663b44ac66920c6f33694deea01acb78ae3f3012884819373fa04c3eb5f0`	SIGNATURE_SIGNED	UNKNOWN	VT
wermgr.exe	-	`c142d90a7a76a449ac0ffad77b4e87d0d44cbf7fb6975f57dbab1eb616157a6e`	SIGNATURE_SIGNED	UNKNOWN	VT
nltest.exe	-	`30a57ee3e29e7e7bbbd3504d1c285cea1115ec7d1d770e990d9fbf15bc7b5525`	SIGNATURE_SIGNED	UNKNOWN	VT
bitsadmin.exe	-	`5ceec3064d495f73aad77facf9d0b05a89b3a137fc86ba1b43c14b3ca3bd3e11`	SIGNATURE_SIGNED	UNKNOWN	VT
sc.exe	-	`a452bfcb6000d03942ddfaddcda5a7eb121447ed99b1ba090446b4a989f1f7ae`	SIGNATURE_SIGNED	UNKNOWN	VT

Network Artifacts 0

No network artifacts found for this incident

Process Artifacts 11

Process	Command Line	Parent Process	User
MegaGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\MegaGenerator\bin\publish\MegaGenerator.exe" ...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
MegaGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\MegaGenerator\bin\publish\MegaGenerator.exe" ...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin

Registry Artifacts 0

No registry artifacts found for this incident

Analyst Verdict

Classification

Risk Level

HIGH

Resolution Notes

Auto-resolved: Reconnaissance/Evasion activity. Tactics: TA0005 - Defense Evasion,TA0011 - Command and Control,TA0002 - Execution, Alerts: 11

Recommended Actions

Isolate affected endpoints
Investigate all related alerts
Document findings

Summary

Alerts

Hosts

Files

Network

Alert Categories

Malware

Timeline

02-08 14:58:40

Incident Modified

Status or details updated

02-08 14:58:40

Incident Resolved

resolved security testing

02-08 14:57:01

WildFire Malware

medium - Prevented (Blocked)

02-08 14:56:06

Suspicious Process Creation

medium - Prevented (Blocked)

02-08 14:35:11

Script Activity - 3055004603

high - Prevented (Blocked)

02-08 14:35:11

Staged Malware Activity - 2394207323

high - Prevented (Blocked)

02-08 14:21:28

Protection Against Security Measures Bypass Techniques - 1940197314

high - Prevented (Blocked)

02-08 14:07:08

Suspicious Process Creation

medium - Prevented (Blocked)

02-08 14:00:11

File Drop - 1815185192

high - Prevented (Blocked)

02-08 14:00:11

File Drop - 3732557733

high - Prevented (Blocked)

02-08 13:51:01

WildFire Malware

medium - Prevented (Blocked)

02-08 13:46:05

Protection Against Security Measures Bypass Techniques - 1952317967

high - Prevented (Blocked)

02-08 13:32:23

Incident Created

#3635 - 'Protection Against Security Measures Bypass Techniques - 1952317967' along with 10 other issues

02-08 13:32:23

MegaGenerator.exe

Verdict: Unknown

02-08 13:32:23

UltimateXdrGenerator.exe

Verdict: Unknown

02-08 13:32:23

powershell.exe

Verdict: Unknown

02-08 13:32:23

cmd.exe

Verdict: Unknown

02-08 13:32:23

conhost.exe

Verdict: Unknown

02-08 13:32:23

cscript.exe

Verdict: Unknown

02-08 13:32:23

chcp.com

Verdict: Unknown

02-08 13:32:23

certutil.exe

Verdict: Unknown

02-08 13:32:23

WINWORD.EXE

Verdict: Unknown

02-08 13:32:23

ai.exe

Verdict: Unknown

02-08 13:32:14

Suspicious Process Creation

medium - Prevented (Blocked)