ExD Hit Found (Endpoint Security)

Prev Next
CEF:0|trellix|hx|9.9.0|ExD Hit Found|ExD Hit Found|10|rt=Feb 05 2019 17:01:56 UTC dvchost=trellix-01cb28
categoryDeviceGroup=/IDS categoryDeviceType=Exploit Detection categoryObject=/Host cs1Label=Host Agent Cert Hash
cs1=uP1q4KNadwaber6XLK6BZU dst=10.61.154.186 dmac=00-50-56-01-cb-25 dhost=WIN11b1f2d1fea1 dntdom=WORKGROUP
deviceCustomDate1Label=Agent Last Audit deviceCustomDate1=Feb 05 2019 17:01:52 UTC cs2Label=Trellix Agent
Version cs2=29.7.0 cs5Label=Target GMT Offset cs5=PT0H cs6Label=Target OS cs6=Windows 10 Enterprise 17763
externalId=2 start=Feb 05 2019 17:00:22 UTC categoryOutcome=/Success categorySignificance=/Compromise
categoryBehavior=/Found cs7Label=Resolution cs7=BLOCK cs8Label=Alert Types cs8=xplt,blk act=Detection ExD Hit
msg=Host WIN11b1f2d1fea1 ExD compromise alert categoryTupleDescription=ExD found a compromise indication.
cs4Label=Process Name cs4=chrome.exe categoryTechnique=Exploit