{ "msg": "normal", "version": "9.0.0.916210", "product": "CMS", "appliance": "abc.mrl.trellix.com", "appliance-id": "AC1F6B123E2C", "alert": { "occurred": "2020-06-29T08:13:34Z", "count": 5, "class": "SmartVision", "category": "T1053 / Remote Execution", "id": 7, "version": "9.0.0.916432", "protocol": "tcp", "product": "Web MPS", "sensor": "Mentos", "name": "smartvision-event", "src": { "ip": "xxx.xxx.x.x", "port": 43520 }, "uuid": "5985dbd8-5066-4e04-b560-3f05c93506d6", "action": "notified", "description": "Suspicious Remote Scheduled Task Activity", "severity": "majr", "dst": { "ip": "xxx.xxx.x.x", "port": 445 }, "signature_id": 91500000, "alert-url": "https://abc.mrl.trellix.com/notification_url?uuid=5985dbd8-5066-4e04-b560-3f05c93506d6", "explanation": { "events": [ { "id": 11, "name": "SMB Create Request: Delete file in Windows temp direcory", "src_ip": "xxx.xxx.x.x", "dst_port": 445, "sequence": 0, "occurred": "2020-06-29T08:13:35Z", "src_port": 43520, "dst_ip": "xxx.xxx.x.x", "protocol": "tcp", "details": { "user": "DomainAdmin", "domain": "internal", "payload": "AAAAvP5TTUJAAAEAAAAAAAsAfwAAAAAAAAAAAAsAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAA AAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////94AAAARAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUAAAMQAAAARA AAAAQAAAAAAAAAAQAMAAUAAAAAAAAABQAAAFwAQQB0ADEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxP5TTUJAAAEAAAAAAAsAfwAAA AAAAAAAAAwAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP//// 94AAAATAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUAAAMQAAAATAAAAAMAAAAAAAAAAAABAM1jAAAOAAAAAAAAAA4AAABcAFwAMQA5ADI ALgAxADYAOAAuADAALgAyAAAAAQAAAAEAAAAAAABw/lNNQkAAAQAAAAAAAwB/AAAAAAAAAAAADQAAAAAAAAAAAAAAAAAAAAUAAAAABAAAAA AAAAAAAAAAAAAAAAAAAAkAAABIACgAXABcADEAOQAyAC4AMQA2ADgALgAwAC4AMgBcAEEARABNAEkATgAkAAAAAJr+U01CQAABAAAAAAA FAH8AAAAAAAAAAAAOAAAAAAAAAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAOQAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAQ AAAAAAAAABAAAAAQAAAEAAAAB4ACIAAAAAAAAAAABUAGUAbQBwAFwAVgBiAG8AWABTAFkAVABLAC4AdABtAHAAAAAAaf5TTUJAAAEAAAAAABAA fwAAAAAAAAAAAA8AAAAAAAAAAAAAAAUAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAApAAEF//8AAAAAAAAAAAAAAAAAAAAAAAARAAAAAAAAAA UAAAD/////AAAAAHH+U01CQAACAAAAAAAIAH8AAAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAMQBQANvV AQAAAAAAAAAAABEAAAAAAAAABQAAAP////8AAAAAAAAAAAAAAAAAAAAAMAAAAFj+U01CQAABAAAAAAAGAH8AAAAAAAAAAAASAAAAAAAAAAAAAAA FAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAARAAAAAAAAAAUAAAD/////AAAARP5TTUJAAAEAAAAAAAQAfwAAAAAAAAAAABM AAAAAAAAAAAAAAAUAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAcP5TTUJAAAEAAAAAAAMAfwAAAAAAAAAAABQAAAAAAAAAAAAAAAA AAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAJAAAASAAoAFwAXAAxADkAMgAuADEANgA4AC4AMAAuADIAXABBAEQATQBJAE4AJAAAAACa/lNNQkA AAQAAAAAABQB/AAAAAAAAAAAAFQAAAAAAAAAAAAAACQAAAAUAAAAABAAAAAAAAAAAAAAAAAAAAAAAADkAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAA AARAAAAAABwAAAAEAAABAEAAAeAAiAAAAAAAAAAAAVABlAG0AcABcAFYAYgBvAFgAUwBZAFQASwAuAHQAbQBwAAAAAFj+U01CQAABAAAAAAAGAH8A AAAAAAAAAAAWAAAAAAAAAAAAAAAJAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAVAAAAAAAAAAkAAAD/////AAAARP5TTUJAAAEA AAAAAAQAfwAAAAAAAAAAABcAAAAAAAAAAAAAAAkAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAARP5TTUJAAAEAAAAAAAQAfwAAAAAA AAAAABgAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAARP5TTUJAAAEAAAAAAAIAfwAAAAAAAAAAABkAAAAAAAAAA AAAAAAAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAA" } }, { "id": 12, "name": "ATSVC Add Job: cmd.exe /C with redirect", "src_ip": "xxx.xxx.x.x", "dst_port": 445, "sequence": 1, "occurred": "2020-06-29T08:13:34Z", "src_port": 43520, "dst_ip": "xxx.xxx.x.x", "protocol": "tcp", "details": { "payload": "AAAARf9TTUJyAAAAAAAACAAAAAAAAAAAAAAAAP//AAAAAAAAACIAAk5UIExNIDAuMTIAAl NNQiAyLjAwMgACU01CIDIuPz8/AAAAAGr+U01CQAABAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAJAADAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIQAgADAAAAov5TTUJAAAEAAAAAAAEAAAAAAAAAAAAAAAIAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZAAABAAAAAAAAAABYAEoAAAAAAAAAAABgSAYGKwYBBQUCoD4wPKAOMAwGCi sGAQQBgjcCAgqiKgQoTlRMTVNTUAABAAAABRKIoAgACAAgAAAAAAAAAAAAAABpbnRlcm5hbAAAAgL+U01CQAABAAAAAAABAH8AAAAAAAAAA AADAAAAAAAAAAAAAAAAAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGQAAAQAAAAAAAAAAWACqAQAAAAAAAAAAoYIBpjCCAaKiggGeBIIB mk5UTE1TU1AAAwAAABgAGABmAAAAHAEcAX4AAAAQABAAQAAAABYAFgBQAAAAAAAAAGYAAAAAAAAAmgEAAAUSiKBpAG4AdABlAHIAbgBhAGwA RABvAG0AYQBpAG4AQQBkAG0AaQBuAPLt8HbvIEyZRelJ9uma1X5xZVhHR2NEWSz9KP37VTJPskSPL9wI6XwBAQAAAAAAADUmfQXubNABcWVYR0 djRFkAAAAAAQAQAFMARQBSAFYARQBSADAAMQACABAASQBOAFQARQBSAE4AQQBMAAMAOgBTAGUAcgB2AGUAcgAwADEALgBpAG4AdABlAHIAbgBh AGwALgBlAHgAYQBtAHAAbABlAC4AYwBvAG0ABAAoAGkAbgB0AGUAcgBuAGEAbAAuAGUAeABhAG0AcABsAGUALgBjAG8AbQAFACgAaQBuAHQAZQB yAG4AYQBsAC4AZQB4AGEAbQBwAGwAZQAuAGMAbwBtAAcACAA1Jn0F7mzQAQkAGgBjAGkAZgBzAC8AUwBFAFIAVgBFAFIAMAAxAAAAAAAAAAAAAAAA bP5TTUJAAAEAAAAAAAMAfwAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAJAAAASAAkAFwAXAAxADkAMgA uADEANgA4AC4AMAAuADIAXABJAFAAQwAkAAAAAIL+U01CQAABAAAAAAAFAH8AAAAAAAAAAAAFAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAA AAAAAAAAAAAAAOQAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAIAAAAABAAAAAQAAAEAAAAB4AAoAAAAAAAAAAABhAHQAcwB2AGMAAAAA8P5TTUJ AAAEAAAAAAAsAfwAAAAAAAAAAAAYAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP//// 94AAAAeAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUACwMQAAAAeAAoAAEAAAC4ELgQAAAAAAEAAAAAAAEAggb3H1EK6DAHbXQL6M7piwE AAAAEXYiK6xzJEZ/oCAArEEhgAgAAAAoCAAB/NQEATlRMTVNTUAABAAAANZKI4AgACAAgAAAAAAAAAAAAAABpbnRlcm5hbAAAAjb+U01CQAAB AAAAAAAJAH8AAAAAAAAAAAAHAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAMQBwAMYBAAAAAAAAAAAAAA0AAAAAAAAAA QAAAP////8AAAAAAAAAAAAAAAAAAAAABQAQAxAAAADGAaoBAQAAACAgICAKAgAAfzUBAE5UTE1TU1AAAwAAABgAGABmAAAAHAEcAX4AAAAQABAA QAAAABYAFgBQAAAAAAAAAGYAAAAQABAAmgEAADWSiOBpAG4AdABlAHIAbgBhAGwARABvAG0AYQBpAG4AQQBkAG0AaQBuAAwKqszBZGSiGvni4C QBW6NaYkkzRnd4c74Zr5pLDXZaV6b/5he8jngBAQAAAAAAALCHfwXubNABWmJJM0Z3eHMAAAAAAQAQAFMARQBSAFYARQBSADAAMQACABAASQBOA FQARQBSAE4AQQBMAAMAOgBTAGUAcgB2AGUAcgAwADEALgBpAG4AdABlAHIAbgBhAGwALgBlAHgAYQBtAHAAbABlAC4AYwBvAG0ABAAoAGkAbgB0A GUAcgBuAGEAbAAuAGUAeABhAG0AcABsAGUALgBjAG8AbQAFACgAaQBuAHQAZQByAG4AYQBsAC4AZQB4AGEAbQBwAGwAZQAuAGMAbwBtAAcACAC wh38F7mzQAQkAGgBjAGkAZgBzAC8AUwBFAFIAVgBFAFIAMAAxAAAAAAAAAAAA8xksF+4Whuy7iByx9MrbsgAAAUD+U01CQAABAAAAAAALAH8AAAAAA EABAAAIAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAOQAAABfAEQANAAAAAAAAAAEAAAD/////eAAAAMQAAAAAAAAAAAAAAAAA AAD//wAAAQAAAAAAAAAFAAADEAAAAMQAAAACAAAAAAAAAAAAAACe7AAADgAAAAAAAAAOAAAAXABcADEAOQAyAC4AMQA2ADgALgAwAC4AMgAAAAAAAAA AAAAAAAD//9OAAAAyAAAAAAAAADIAAAAlAGMAbQBkAC4AZQB4AGUAIAAvAEMAQwAgAGQAaQByACAAPgAgACUAUwBZAFMAVABFAE0AUgBPAE8AVAAlA FwAVABlAG0AcABcAFYAYgBvAFgAUwBZAFQASwAuAHQAbQBwAAAAAAAAAP5TTUJAAAEAAAAAAAsAfwAAAAAAAAAAAAkAAAAAAAAAAAAAAAEAAAAFAAAA AAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////94AAAAeAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUADgMQAAAAeA AoAAMAAAC4ELgQAAAAAAEAAAABAAEASVnThsmDREC0JNs2MjH9DAEAAAAEXYiK6xzJEZ/oCAArEEhgAgAAAAoCAACANQEATlRMTVNTUAABAAAANZK I4AgACAAgAAAAAAAAAAAAAABpbnRlcm5hbAAAAjb+U01CQAABAAAAAAAJAH8AAAAAAAAAAAAKAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAA AAAAAAAAAAAAAMQBwAMYBAAAAAAAAAAAAAA0AAAAAAAAAAQAAAP////8AAAAAAAAAAAAAAAAAAAAABQAQAxAAAADGAaoBAwAAACAgICAKAgAAg DUBAE5UTE1TU1AAAwAAABgAGABmAAAAHAEcAX4AAAAQABAAQAAAABYAFgBQAAAAAAAAAGYAAAAQABAAmgEAADWSiOBpAG4AdABlAHIAbgBhAGw ARABvAG0AYQBpAG4AQQBkAG0AaQBuAMLXchCJAEVSPMhOS3AixSZGdE1BUzU2UWP/56/PPwyauaR35hP7XxoBAQAAAAAAACvpgQXubNABRn RNQVM1NlEAAAAAAQAQAFMARQBSAFYARQBSADAAMQACABAASQBOAFQARQBSAE4AQQBMAAMAOgBTAGUAcgB2AGUAcgAwADEALgBpAG4AdAB lAHIAbgBhAGwALgBlAHgAYQBtAHAAbABlAC4AYwBvAG0ABAAoAGkAbgB0AGUAcgBuAGEAbAAuAGUAeABhAG0AcABsAGUALgBjAG8AbQAFA CgAaQBuAHQAZQByAG4AYQBsAC4AZQB4AGEAbQBwAGwAZQAuAGMAbwBtAAcACAAr6YEF7mzQAQkAGgBjAGkAZgBzAC8AUwBFAFIAVgBFAFIAMAAx AAAAAAAAAAAAxyAfxnKLZvLHS0nMtadWcA==", "tree": "\\\\xxx.xxx.x.x\\IPC$", "user": "DomainAdmin", "domain": "internal" } }, { "id": 13, "name": "SMB Create Request: File in Windows temp direcory", "src_ip": "xxx.xxx.x.x", "dst_port": 445, "sequence": 2, "occurred": "2020-06-29T08:13:34Z", "src_port": 43520, "dst_ip": "xxx.xxx.x.x", "protocol": "tcp", "details": { "payload": "AAAARf9TTUJyAAAAAAAACAAAAAAAAAAAAAAAAP// AAAAAAAAACIAAk5UIExNIDAuMTIAAlNNQiAyLjAwMgACU01CIDIuPz8/AAAAAGr+U01CQAABAA AAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AJAADAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIQAgADAAAAov5TTUJAAAEAA AAAAAEAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZAA ABAAAAAAAAAABYAEoAAAAAAAAAAABgSAYGKwYBBQUCoD4wPKAOMAwGCisGAQQBgjcCAgqiKgQoTl RMTVNTUAABAAAABRKIoAgACAAgAAAAAAAAAAAAAABpbnRlcm5hbAAAAgL+U01CQAABAAAAAAAB AH8AAAAAAAAAAAADAAAAAAAAAAAAAAAAAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGQAAAQA AAAAAAAAAWACqAQAAAAAAAAAAoYIBpjCCAaKiggGeBIIBmk5UTE1TU1AAAwAAABgAGABmAAAAHA EcAX4AAAAQABAAQAAAABYAFgBQAAAAAAAAAGYAAAAAAAAAmgEAAAUSiKBpAG4AdABlAHIAbgBhA GwARABvAG0AYQBpAG4AQQBkAG0AaQBuAPLt8HbvIEyZRelJ9uma1X5xZVhHR2NEWSz9KP37VTJPs kSPL9wI6XwBAQAAAAAAADUmfQXubNABcWVYR0djRFkAAAAAAQAQAFMARQBSAFYARQBSADAAMQACAB AASQBOAFQARQBSAE4AQQBMAAMAOgBTAGUAcgB2AGUAcgAwADEALgBpAG4AdABlAHIAbgBhAGwALgBl AHgAYQBtAHAAbABlAC4AYwBvAG0ABAAoAGkAbgB0AGUAcgBuAGEAbAAuAGUAeABhAG0AcABsAGUALg BjAG8AbQAFACgAaQBuAHQAZQByAG4AYQBsAC4AZQB4AGEAbQBwAGwAZQAuAGMAbwBtAAcACAA1Jn0F 7mzQAQkAGgBjAGkAZgBzAC8AUwBFAFIAVgBFAFIAMAAxAAAAAAAAAAAAAAAAbP5TTUJAAAEAAAAAAAMA fwAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAJAAAASAAkAFwA XAAxADkAMgAuADEANgA4AC4AMAAuADIAXABJAFAAQwAkAAAAAIL+U01CQAABAAAAAAAFAH8AAAAAAAAA AAAFAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAOQAAAAIAAAAAAAAAAAAAAAAA AAAAAAAAAwAAAIAAAAABAAAAAQAAAEAAAAB4AAoAAAAAAAAAAABhAHQAcwB2AGMAAAAA8P5TTUJAAAEA AAAAAAsAfwAAAAAAAAAAAAYAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAA F8ARAA0AAAAAAAAAAQAAAP////94AAAAeAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUACwMQAAAA eAAoAAEAAAC4ELgQAAAAAAEAAAAAAAEAggb3H1EK6DAHbXQL6M7piwEAAAAEXYiK6xzJEZ/oCAArEEhgAgAAAAoCAAB/ NQEATlRMTVNTUAABAAAANZKI4AgACAAgAAAAAAAAAAAAAABpbnRlcm5hbAAAAjb+U01CQAABAAAAAAAJAH8AAAAAAAA AAAAHAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAMQBwAMYBAAAAAAAAAAAAAA0AAAAAAAAAAQAAAP//// 8AAAAAAAAAAAAAAAAAAAAABQAQAxAAAADGAaoBAQAAACAgICAKAgAAfzUBAE5UTE1TU1AAAwAAABgAGABmAAAAHAEcAX4AAAAQ ABAAQAAAABYAFgBQAAAAAAAAAGYAAAAQABAAmgEAADWSiOBpAG4AdABlAHIAbgBhAGwARABvAG0AYQBpAG4AQQBkAG0AaQBuAA wKqszBZGSiGvni4CQBW6NaYkkzRnd4c74Zr5pLDXZaV6b/5he8jngBAQAAAAAAALCHfwXubNABWmJJM0Z3eHMAAAAAAQAQAFMA RQBSAFYARQBSADAAMQACABAASQBOAFQARQBSAE4AQQBMAAMAOgBTAGUAcgB2AGUAcgAwADEALgBpAG4AdABlAHIAbgBhAGwALg BlAHgAYQBtAHAAbABlAC4AYwBvAG0ABAAoAGkAbgB0AGUAcgBuAGEAbAAuAGUAeABhAG0AcABsAGUALgBjAG8AbQAFACgAaQBu AHQAZQByAG4AYQBsAC4AZQB4AGEAbQBwAGwAZQAuAGMAbwBtAAcACACwh38F7mzQAQkAGgBjAGkAZgBzAC8AUwBFAFIAVgBFA FIAMAAxAAAAAAAAAAAA8xksF+4Whuy7iByx9MrbsgAAAUD+U01CQAABAAAAAAALAH8AAAAAAEABAAAIAAAAAAAAAAAAAAABAAA ABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAOQAAABfAEQANAAAAAAAAAAEAAAD/////eAAAAMQAAAAAAAAAAAAAAAAAAAD// wAAAQAAAAAAAAAFAAADEAAAAMQAAAACAAAAAAAAAAAAAACe7AAADgAAAAAAAAAOAAAAXABcADEAOQAyAC4AMQA2ADgALgAw AC4AMgAAAAAAAAAAAAAAAAD//9OAAAAyAAAAAAAAADIAAAAlAGMAbQBkAC4AZQB4AGUAIAAvAEMAQwAgAGQAaQByACAAPgA gACUAUwBZAFMAVABFAE0AUgBPAE8AVAAlAFwAVABlAG0AcABcAFYAYgBvAFgAUwBZAFQASwAuAHQAbQBwAAAAAAAAAP5TTUJ AAAEAAAAAAAsAfwAAAAAAAAAAAAkAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP//// 94AAAAeAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUADgMQAAAAeAAoAAMAAAC4ELgQAAAAAAEAAAABAAEASVnThsmDREC0JNs2MjH9DA EAAAAEXYiK6xzJEZ/oCAArEEhgAgAAAAoCAACANQEATlRMTVNTUAABAAAANZKI4AgACAAgAAAAAAAAAAAAAABpbnRlcm5hbAAAAjb+U01CQA ABAAAAAAAJAH8AAAAAAAAAAAAKAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAMQBwAMYBAAAAAAAAAAAAAA0AAAAAAA AAAQAAAP////8AAAAAAAAAAAAAAAAAAAAABQAQAxAAAADGAaoBAwAAACAgICAKAgAAgDUBAE5UTE1TU1AAAwAAABgAGABmAAAAHAEcAX4AAAA QABAAQAAAABYAFgBQAAAAAAAAAGYAAAAQABAAmgEAADWSiOBpAG4AdABlAHIAbgBhAGwARABvAG0AYQBpAG4AQQBkAG0AaQBuAMLXchCJAEVS PMhOS3AixSZGdE1BUzU2UWP/56/PPwyauaR35hP7XxoBAQAAAAAAACvpgQXubNABRnRNQVM1NlEAAAAAAQAQAFMARQBSAFYARQBSADAAMQACA BAASQBOAFQARQBSAE4AQQBMAAMAOgBTAGUAcgB2AGUAcgAwADEALgBpAG4AdABlAHIAbgBhAGwALgBlAHgAYQBtAHAAbABlAC4AYwBvAG0AB AAoAGkAbgB0AGUAcgBuAGEAbAAuAGUAeABhAG0AcABsAGUALgBjAG8AbQAFACgAaQBuAHQAZQByAG4AYQBsAC4AZQB4AGEAbQBwAGwAZQAuA GMAbwBtAAcACAAr6YEF7mzQAQkAGgBjAGkAZgBzAC8AUwBFAFIAVgBFAFIAMAAxAAAAAAAAAAAAxyAfxnKLZvLHS0nMtadWcA==", "tree": "\\\\192.168.0.2\\IPC$", "user": "DomainAdmin", "domain": "internal" } }, { "id": 14, "name": "ATSVC Start Job", "src_ip": "xxx.xxx.x.x", "dst_port": 445, "sequence": 3, "occurred": "2020-06-29T08:13:35Z", "src_port": 43520, "dst_ip": "xxx.xxx.x.x", "protocol": "tcp", "details": { "user": "DomainAdmin", "domain": "internal", "payload": "AAAAvP5TTUJAAAEAAAAAAAsAfwAAAAAAAAAAAAsAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAA AAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////94AAAARAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUAAAMQAAAARAAAAAQAAAAAAAAAAQA MAAUAAAAAAAAABQAAAFwAQQB0ADEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxP5TTUJAAAEAAAAAAAsAfwAAAAAAAAAAAAwAAAAAAAAAAAAAAA EAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////94AAAATAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUAA AMQAAAATAAAAAMAAAAAAAAAAAABAM1jAAAOAAAAAAAAAA4AAABcAFwAMQA5ADIALgAxADYAOAAuADAALgAyAAAAAQAAAAEAAAAAAABw/lNNQkAAAQAA AAAAAwB/AAAAAAAAAAAADQAAAAAAAAAAAAAAAAAAAAUAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAkAAABIACgAXABcADEAOQAyAC4AMQA2ADgALgAwAC4 AMgBcAEEARABNAEkATgAkAAAAAJr+U01CQAABAAAAAAAFAH8AAAAAAAAAAAAOAAAAAAAAAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAOQA AAAIAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAQAAAEAAAAB4ACIAAAAAAAAAAABUAGUAbQBwAFwAVgBiAG8AWABTAFkAVABLAC4AdABtAHA AAAAAaf5TTUJAAAEAAAAAABAAfwAAAAAAAAAAAA8AAAAAAAAAAAAAAAUAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAApAAEF//8AAAAAAAAAAAAAAAA AAAAAAAARAAAAAAAAAAUAAAD/////AAAAAHH+U01CQAACAAAAAAAIAH8AAAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAAAAAAAA AAAAAMQBQANvVAQAAAAAAAAAAABEAAAAAAAAABQAAAP////8AAAAAAAAAAAAAAAAAAAAAMAAAAFj+U01CQAABAAAAAAAGAH8AAAAAAAAAAAASAAAAAAA AAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAARAAAAAAAAAAUAAAD/////AAAARP5TTUJAAAEAAAAAAAQAfwAAAAAAAAAAABM AAAAAAAAAAAAAAAUAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAcP5TTUJAAAEAAAAAAAMAfwAAAAAAAAAAABQAAAAAAAAAAAAAAAAAAAA FAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAJAAAASAAoAFwAXAAxADkAMgAuADEANgA4AC4AMAAuADIAXABBAEQATQBJAE4AJAAAAACa/lNNQkAAAQAAAA AABQB /AAAAAAAAAAAAFQAAAAAAAAAAAAAACQAAAAUAAAAABAAAAAAAAAAAAAAAAAAAAAAAADkAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAARAAAAAABwAAAAE AAABAEAAAeAAiAAAAAAAAAAAAVABlAG0AcABcAFYAYgBvAFgAUwBZAFQASwAuAHQAbQBwAAAAAFj+U01CQAABAAAAAAAGAH8AAAAAAAAAAAAWAAAAAAA AAAAAAAAJAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAVAAAAAAAAAAkAAAD/////AAAARP5TTUJAAAEAAAAAAAQAfwAAAAAAAAAAABcA AAAAAAAAAAAAAAkAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAARP5TTUJAAAEAAAAAAAQAfwAAAAAAAAAAABgAAAAAAAAAAAAAAAEAAAAFA AAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAARP5TTUJAAAEAAAAAAAIAfwAAAAAAAAAAABkAAAAAAAAAAAAAAAAAAAAFAAAAAAQAAAAAAAAAAAAAA AAAAAAAAAAEAAAA" } }, { "id": 15, "name": "ATSVC Delete Job", "src_ip": "xxx.xxx.x.x", "dst_port": 445, "sequence": 4, "occurred": "2020-06-29T08:13:35Z", "src_port": 43520, "dst_ip": "xxx.xxx.x.x", "protocol": "tcp", "details": { "user": "DomainAdmin", "domain": "internal", "payload": "AAAAvP5TTUJAAAEAAAAAAAsAfwAAAAAAAAAAAAsAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAA AAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////94AAAARAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUAAAMQAAAARAAAAAQAAAA AAAAAAQAMAAUAAAAAAAAABQAAAFwAQQB0ADEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxP5TTUJAAAEAAAAAAAsAfwAAAAAAAAAAAAwAAAAA AAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////94AAAATAAAAAAAAAAAAAAAAAAAAP//AAABAA AAAAAAAAUAAAMQAAAATAAAAAMAAAAAAAAAAAABAM1jAAAOAAAAAAAAAA4AAABcAFwAMQA5ADIALgAxADYAOAAuADAALgAyAAAAAQAAAAEAAAAAAABw/ lNNQkAAAQAAAAAAAwB/AAAAAAAAAAAADQAAAAAAAAAAAAAAAAAAAAUAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAkAAABIACgAXABcADEAOQAyAC4AMQA 2ADgALgAwAC4AMgBcAEEARABNAEkATgAkAAAAAJr+U01CQAABAAAAAAAFAH8AAAAAAAAAAAAOAAAAAAAAAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAA AAAAAAAAAAAOQAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAQAAAEAAAAB4ACIAAAAAAAAAAABUAGUAbQBwAFwAVgBiAG8AWABTA FkAVABLAC4AdABtAHAAAAAAaf5TTUJAAAEAAAAAABAAfwAAAAAAAAAAAA8AAAAAAAAAAAAAAAUAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAApAAEF //8AAAAAAAAAAAAAAAAAAAAAAAARAAAAAAAAAAUAAAD/////AAAAAHH+U01CQAACAAAAAAAIAH8AAAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAABQAAAAAE AAAAAAAAAAAAAAAAAAAAAAAAMQBQANvVAQAAAAAAAAAAABEAAAAAAAAABQAAAP////8AAAAAAAAAAAAAAAAAAAAAMAAAAFj+U01CQAABAAAAAAAGAH8A AAAAAAAAAAASAAAAAAAAAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAARAAAAAAAAAAUAAAD/////AAAARP5TTUJAAAEAAAAA AAQAfwAAAAAAAAAAABMAAAAAAAAAAAAAAAUAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAcP5TTUJAAAEAAAAAAAMAfwAAAAAAAAAAABQA AAAAAAAAAAAAAAAAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAJAAAASAAoAFwAXAAxADkAMgAuADEANgA4AC4AMAAuADIAXABBAEQATQBJAE4AJAAA AACa/ lNNQkAAAQAAAAAABQB/AAAAAAAAAAAAFQAAAAAAAAAAAAAACQAAAAUAAAAABAAAAAAAAAAAAAAAAAAAAAAAADkAAAACAAAAAAAAAAAAAAAAAAAAAAAAA AAAARAAAAAABwAAAAEAAABAEAAAeAAiAAAAAAAAAAAAVABlAG0AcABcAFYAYgBvAFgAUwBZAFQASwAuAHQAbQBwAAAAAFj+U01CQAABAAAAAAAGAH8AA AAAAAAAAAAWAAAAAAAAAAAAAAAJAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAVAAAAAAAAAAkAAAD/////AAAARP5TTUJAAAEAAAAA AAQAfwAAAAAAAAAAABcAAAAAAAAAAAAAAAkAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAARP5TTUJAAAEAAAAAAAQAfwAAAAAAAAAAABgA AAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAARP5TTUJAAAEAAAAAAAIAfwAAAAAAAAAAABkAAAAAAAAAAAAAAAAAAAAFA AAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAA" } } ] } } }
{
"msg": "normal",
"version": "9.0.0.916210",
"product": "CMS",
"appliance": "abc.mrl.trellix.com",
"appliance-id": "AC1F6B123E2C",
"alert": {
"occurred": "2020-06-29T08:13:34Z",
"count": 5,
"class": "SmartVision",
"category": "T1053 / Remote Execution",
"id": 7,
"version": "9.0.0.916432",
"protocol": "tcp",
"product": "Web MPS",
"sensor": "Mentos",
"name": "smartvision-event",
"src": {
"ip": "xxx.xxx.x.x",
"port": 43520
},
"uuid": "5985dbd8-5066-4e04-b560-3f05c93506d6",
"action": "notified",
"description": "Suspicious Remote Scheduled Task Activity",
"severity": "majr",
"dst": {
"ip": "xxx.xxx.x.x",
"port": 445
},
"signature_id": 91500000,
"alert-url": "https://abc.mrl.trellix.com/notification_url?uuid=5985dbd8-5066-4e04-b560-3f05c93506d6",
"explanation": {
"events": [
{
"id": 11,
"name": "SMB Create Request: Delete file in Windows temp direcory",
"src_ip": "xxx.xxx.x.x",
"dst_port": 445,
"sequence": 0,
"occurred": "2020-06-29T08:13:35Z",
"src_port": 43520,
"dst_ip": "xxx.xxx.x.x",
"protocol": "tcp",
"details": {
"user": "DomainAdmin",
"domain": "internal",
"payload": "AAAAvP5TTUJAAAEAAAAAAAsAfwAAAAAAAAAAAAsAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAA
AAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////94AAAARAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUAAAMQAAAARA
AAAAQAAAAAAAAAAQAMAAUAAAAAAAAABQAAAFwAQQB0ADEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxP5TTUJAAAEAAAAAAAsAfwAAA
AAAAAAAAAwAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////
94AAAATAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUAAAMQAAAATAAAAAMAAAAAAAAAAAABAM1jAAAOAAAAAAAAAA4AAABcAFwAMQA5ADI
ALgAxADYAOAAuADAALgAyAAAAAQAAAAEAAAAAAABw/lNNQkAAAQAAAAAAAwB/AAAAAAAAAAAADQAAAAAAAAAAAAAAAAAAAAUAAAAABAAAAA
AAAAAAAAAAAAAAAAAAAAkAAABIACgAXABcADEAOQAyAC4AMQA2ADgALgAwAC4AMgBcAEEARABNAEkATgAkAAAAAJr+U01CQAABAAAAAAA
FAH8AAAAAAAAAAAAOAAAAAAAAAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAOQAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAQ
AAAAAAAAABAAAAAQAAAEAAAAB4ACIAAAAAAAAAAABUAGUAbQBwAFwAVgBiAG8AWABTAFkAVABLAC4AdABtAHAAAAAAaf5TTUJAAAEAAAAAABAA
fwAAAAAAAAAAAA8AAAAAAAAAAAAAAAUAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAApAAEF//8AAAAAAAAAAAAAAAAAAAAAAAARAAAAAAAAAA
UAAAD/////AAAAAHH+U01CQAACAAAAAAAIAH8AAAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAMQBQANvV
AQAAAAAAAAAAABEAAAAAAAAABQAAAP////8AAAAAAAAAAAAAAAAAAAAAMAAAAFj+U01CQAABAAAAAAAGAH8AAAAAAAAAAAASAAAAAAAAAAAAAAA
FAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAARAAAAAAAAAAUAAAD/////AAAARP5TTUJAAAEAAAAAAAQAfwAAAAAAAAAAABM
AAAAAAAAAAAAAAAUAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAcP5TTUJAAAEAAAAAAAMAfwAAAAAAAAAAABQAAAAAAAAAAAAAAAA
AAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAJAAAASAAoAFwAXAAxADkAMgAuADEANgA4AC4AMAAuADIAXABBAEQATQBJAE4AJAAAAACa/lNNQkA
AAQAAAAAABQB/AAAAAAAAAAAAFQAAAAAAAAAAAAAACQAAAAUAAAAABAAAAAAAAAAAAAAAAAAAAAAAADkAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAA
AARAAAAAABwAAAAEAAABAEAAAeAAiAAAAAAAAAAAAVABlAG0AcABcAFYAYgBvAFgAUwBZAFQASwAuAHQAbQBwAAAAAFj+U01CQAABAAAAAAAGAH8A
AAAAAAAAAAAWAAAAAAAAAAAAAAAJAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAVAAAAAAAAAAkAAAD/////AAAARP5TTUJAAAEA
AAAAAAQAfwAAAAAAAAAAABcAAAAAAAAAAAAAAAkAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAARP5TTUJAAAEAAAAAAAQAfwAAAAAA
AAAAABgAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAARP5TTUJAAAEAAAAAAAIAfwAAAAAAAAAAABkAAAAAAAAAA
AAAAAAAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAA"
}
},
{
"id": 12,
"name": "ATSVC Add Job: cmd.exe /C with redirect",
"src_ip": "xxx.xxx.x.x",
"dst_port": 445,
"sequence": 1,
"occurred": "2020-06-29T08:13:34Z",
"src_port": 43520,
"dst_ip": "xxx.xxx.x.x",
"protocol": "tcp",
"details": {
"payload": "AAAARf9TTUJyAAAAAAAACAAAAAAAAAAAAAAAAP//AAAAAAAAACIAAk5UIExNIDAuMTIAAl
NNQiAyLjAwMgACU01CIDIuPz8/AAAAAGr+U01CQAABAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAJAADAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIQAgADAAAAov5TTUJAAAEAAAAAAAEAAAAAAAAAAAAAAAIAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZAAABAAAAAAAAAABYAEoAAAAAAAAAAABgSAYGKwYBBQUCoD4wPKAOMAwGCi
sGAQQBgjcCAgqiKgQoTlRMTVNTUAABAAAABRKIoAgACAAgAAAAAAAAAAAAAABpbnRlcm5hbAAAAgL+U01CQAABAAAAAAABAH8AAAAAAAAAA
AADAAAAAAAAAAAAAAAAAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGQAAAQAAAAAAAAAAWACqAQAAAAAAAAAAoYIBpjCCAaKiggGeBIIB
mk5UTE1TU1AAAwAAABgAGABmAAAAHAEcAX4AAAAQABAAQAAAABYAFgBQAAAAAAAAAGYAAAAAAAAAmgEAAAUSiKBpAG4AdABlAHIAbgBhAGwA
RABvAG0AYQBpAG4AQQBkAG0AaQBuAPLt8HbvIEyZRelJ9uma1X5xZVhHR2NEWSz9KP37VTJPskSPL9wI6XwBAQAAAAAAADUmfQXubNABcWVYR0
djRFkAAAAAAQAQAFMARQBSAFYARQBSADAAMQACABAASQBOAFQARQBSAE4AQQBMAAMAOgBTAGUAcgB2AGUAcgAwADEALgBpAG4AdABlAHIAbgBh
AGwALgBlAHgAYQBtAHAAbABlAC4AYwBvAG0ABAAoAGkAbgB0AGUAcgBuAGEAbAAuAGUAeABhAG0AcABsAGUALgBjAG8AbQAFACgAaQBuAHQAZQB
yAG4AYQBsAC4AZQB4AGEAbQBwAGwAZQAuAGMAbwBtAAcACAA1Jn0F7mzQAQkAGgBjAGkAZgBzAC8AUwBFAFIAVgBFAFIAMAAxAAAAAAAAAAAAAAAA
bP5TTUJAAAEAAAAAAAMAfwAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAJAAAASAAkAFwAXAAxADkAMgA
uADEANgA4AC4AMAAuADIAXABJAFAAQwAkAAAAAIL+U01CQAABAAAAAAAFAH8AAAAAAAAAAAAFAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAA
AAAAAAAAAAAAAOQAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAIAAAAABAAAAAQAAAEAAAAB4AAoAAAAAAAAAAABhAHQAcwB2AGMAAAAA8P5TTUJ
AAAEAAAAAAAsAfwAAAAAAAAAAAAYAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////
94AAAAeAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUACwMQAAAAeAAoAAEAAAC4ELgQAAAAAAEAAAAAAAEAggb3H1EK6DAHbXQL6M7piwE
AAAAEXYiK6xzJEZ/oCAArEEhgAgAAAAoCAAB/NQEATlRMTVNTUAABAAAANZKI4AgACAAgAAAAAAAAAAAAAABpbnRlcm5hbAAAAjb+U01CQAAB
AAAAAAAJAH8AAAAAAAAAAAAHAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAMQBwAMYBAAAAAAAAAAAAAA0AAAAAAAAAA
QAAAP////8AAAAAAAAAAAAAAAAAAAAABQAQAxAAAADGAaoBAQAAACAgICAKAgAAfzUBAE5UTE1TU1AAAwAAABgAGABmAAAAHAEcAX4AAAAQABAA
QAAAABYAFgBQAAAAAAAAAGYAAAAQABAAmgEAADWSiOBpAG4AdABlAHIAbgBhAGwARABvAG0AYQBpAG4AQQBkAG0AaQBuAAwKqszBZGSiGvni4C
QBW6NaYkkzRnd4c74Zr5pLDXZaV6b/5he8jngBAQAAAAAAALCHfwXubNABWmJJM0Z3eHMAAAAAAQAQAFMARQBSAFYARQBSADAAMQACABAASQBOA
FQARQBSAE4AQQBMAAMAOgBTAGUAcgB2AGUAcgAwADEALgBpAG4AdABlAHIAbgBhAGwALgBlAHgAYQBtAHAAbABlAC4AYwBvAG0ABAAoAGkAbgB0A
GUAcgBuAGEAbAAuAGUAeABhAG0AcABsAGUALgBjAG8AbQAFACgAaQBuAHQAZQByAG4AYQBsAC4AZQB4AGEAbQBwAGwAZQAuAGMAbwBtAAcACAC
wh38F7mzQAQkAGgBjAGkAZgBzAC8AUwBFAFIAVgBFAFIAMAAxAAAAAAAAAAAA8xksF+4Whuy7iByx9MrbsgAAAUD+U01CQAABAAAAAAALAH8AAAAAA
EABAAAIAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAOQAAABfAEQANAAAAAAAAAAEAAAD/////eAAAAMQAAAAAAAAAAAAAAAAA
AAD//wAAAQAAAAAAAAAFAAADEAAAAMQAAAACAAAAAAAAAAAAAACe7AAADgAAAAAAAAAOAAAAXABcADEAOQAyAC4AMQA2ADgALgAwAC4AMgAAAAAAAAA
AAAAAAAD//9OAAAAyAAAAAAAAADIAAAAlAGMAbQBkAC4AZQB4AGUAIAAvAEMAQwAgAGQAaQByACAAPgAgACUAUwBZAFMAVABFAE0AUgBPAE8AVAAlA
FwAVABlAG0AcABcAFYAYgBvAFgAUwBZAFQASwAuAHQAbQBwAAAAAAAAAP5TTUJAAAEAAAAAAAsAfwAAAAAAAAAAAAkAAAAAAAAAAAAAAAEAAAAFAAAA
AAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////94AAAAeAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUADgMQAAAAeA
AoAAMAAAC4ELgQAAAAAAEAAAABAAEASVnThsmDREC0JNs2MjH9DAEAAAAEXYiK6xzJEZ/oCAArEEhgAgAAAAoCAACANQEATlRMTVNTUAABAAAANZK
I4AgACAAgAAAAAAAAAAAAAABpbnRlcm5hbAAAAjb+U01CQAABAAAAAAAJAH8AAAAAAAAAAAAKAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAA
AAAAAAAAAAAAAMQBwAMYBAAAAAAAAAAAAAA0AAAAAAAAAAQAAAP////8AAAAAAAAAAAAAAAAAAAAABQAQAxAAAADGAaoBAwAAACAgICAKAgAAg
DUBAE5UTE1TU1AAAwAAABgAGABmAAAAHAEcAX4AAAAQABAAQAAAABYAFgBQAAAAAAAAAGYAAAAQABAAmgEAADWSiOBpAG4AdABlAHIAbgBhAGw
ARABvAG0AYQBpAG4AQQBkAG0AaQBuAMLXchCJAEVSPMhOS3AixSZGdE1BUzU2UWP/56/PPwyauaR35hP7XxoBAQAAAAAAACvpgQXubNABRn
RNQVM1NlEAAAAAAQAQAFMARQBSAFYARQBSADAAMQACABAASQBOAFQARQBSAE4AQQBMAAMAOgBTAGUAcgB2AGUAcgAwADEALgBpAG4AdAB
lAHIAbgBhAGwALgBlAHgAYQBtAHAAbABlAC4AYwBvAG0ABAAoAGkAbgB0AGUAcgBuAGEAbAAuAGUAeABhAG0AcABsAGUALgBjAG8AbQAFA
CgAaQBuAHQAZQByAG4AYQBsAC4AZQB4AGEAbQBwAGwAZQAuAGMAbwBtAAcACAAr6YEF7mzQAQkAGgBjAGkAZgBzAC8AUwBFAFIAVgBFAFIAMAAx
AAAAAAAAAAAAxyAfxnKLZvLHS0nMtadWcA==",
"tree": "\\\\xxx.xxx.x.x\\IPC$",
"user": "DomainAdmin",
"domain": "internal"
}
},
{
"id": 13,
"name": "SMB Create Request: File in Windows temp direcory",
"src_ip": "xxx.xxx.x.x",
"dst_port": 445,
"sequence": 2,
"occurred": "2020-06-29T08:13:34Z",
"src_port": 43520,
"dst_ip": "xxx.xxx.x.x",
"protocol": "tcp",
"details": {
"payload": "AAAARf9TTUJyAAAAAAAACAAAAAAAAAAAAAAAAP//
AAAAAAAAACIAAk5UIExNIDAuMTIAAlNNQiAyLjAwMgACU01CIDIuPz8/AAAAAGr+U01CQAABAA
AAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AJAADAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIQAgADAAAAov5TTUJAAAEAA
AAAAAEAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZAA
ABAAAAAAAAAABYAEoAAAAAAAAAAABgSAYGKwYBBQUCoD4wPKAOMAwGCisGAQQBgjcCAgqiKgQoTl
RMTVNTUAABAAAABRKIoAgACAAgAAAAAAAAAAAAAABpbnRlcm5hbAAAAgL+U01CQAABAAAAAAAB
AH8AAAAAAAAAAAADAAAAAAAAAAAAAAAAAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGQAAAQA
AAAAAAAAAWACqAQAAAAAAAAAAoYIBpjCCAaKiggGeBIIBmk5UTE1TU1AAAwAAABgAGABmAAAAHA
EcAX4AAAAQABAAQAAAABYAFgBQAAAAAAAAAGYAAAAAAAAAmgEAAAUSiKBpAG4AdABlAHIAbgBhA
GwARABvAG0AYQBpAG4AQQBkAG0AaQBuAPLt8HbvIEyZRelJ9uma1X5xZVhHR2NEWSz9KP37VTJPs
kSPL9wI6XwBAQAAAAAAADUmfQXubNABcWVYR0djRFkAAAAAAQAQAFMARQBSAFYARQBSADAAMQACAB
AASQBOAFQARQBSAE4AQQBMAAMAOgBTAGUAcgB2AGUAcgAwADEALgBpAG4AdABlAHIAbgBhAGwALgBl
AHgAYQBtAHAAbABlAC4AYwBvAG0ABAAoAGkAbgB0AGUAcgBuAGEAbAAuAGUAeABhAG0AcABsAGUALg
BjAG8AbQAFACgAaQBuAHQAZQByAG4AYQBsAC4AZQB4AGEAbQBwAGwAZQAuAGMAbwBtAAcACAA1Jn0F
7mzQAQkAGgBjAGkAZgBzAC8AUwBFAFIAVgBFAFIAMAAxAAAAAAAAAAAAAAAAbP5TTUJAAAEAAAAAAAMA
fwAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAJAAAASAAkAFwA
XAAxADkAMgAuADEANgA4AC4AMAAuADIAXABJAFAAQwAkAAAAAIL+U01CQAABAAAAAAAFAH8AAAAAAAAA
AAAFAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAOQAAAAIAAAAAAAAAAAAAAAAA
AAAAAAAAAwAAAIAAAAABAAAAAQAAAEAAAAB4AAoAAAAAAAAAAABhAHQAcwB2AGMAAAAA8P5TTUJAAAEA
AAAAAAsAfwAAAAAAAAAAAAYAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAA
F8ARAA0AAAAAAAAAAQAAAP////94AAAAeAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUACwMQAAAA
eAAoAAEAAAC4ELgQAAAAAAEAAAAAAAEAggb3H1EK6DAHbXQL6M7piwEAAAAEXYiK6xzJEZ/oCAArEEhgAgAAAAoCAAB/
NQEATlRMTVNTUAABAAAANZKI4AgACAAgAAAAAAAAAAAAAABpbnRlcm5hbAAAAjb+U01CQAABAAAAAAAJAH8AAAAAAAA
AAAAHAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAMQBwAMYBAAAAAAAAAAAAAA0AAAAAAAAAAQAAAP////
8AAAAAAAAAAAAAAAAAAAAABQAQAxAAAADGAaoBAQAAACAgICAKAgAAfzUBAE5UTE1TU1AAAwAAABgAGABmAAAAHAEcAX4AAAAQ
ABAAQAAAABYAFgBQAAAAAAAAAGYAAAAQABAAmgEAADWSiOBpAG4AdABlAHIAbgBhAGwARABvAG0AYQBpAG4AQQBkAG0AaQBuAA
wKqszBZGSiGvni4CQBW6NaYkkzRnd4c74Zr5pLDXZaV6b/5he8jngBAQAAAAAAALCHfwXubNABWmJJM0Z3eHMAAAAAAQAQAFMA
RQBSAFYARQBSADAAMQACABAASQBOAFQARQBSAE4AQQBMAAMAOgBTAGUAcgB2AGUAcgAwADEALgBpAG4AdABlAHIAbgBhAGwALg
BlAHgAYQBtAHAAbABlAC4AYwBvAG0ABAAoAGkAbgB0AGUAcgBuAGEAbAAuAGUAeABhAG0AcABsAGUALgBjAG8AbQAFACgAaQBu
AHQAZQByAG4AYQBsAC4AZQB4AGEAbQBwAGwAZQAuAGMAbwBtAAcACACwh38F7mzQAQkAGgBjAGkAZgBzAC8AUwBFAFIAVgBFA
FIAMAAxAAAAAAAAAAAA8xksF+4Whuy7iByx9MrbsgAAAUD+U01CQAABAAAAAAALAH8AAAAAAEABAAAIAAAAAAAAAAAAAAABAAA
ABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAOQAAABfAEQANAAAAAAAAAAEAAAD/////eAAAAMQAAAAAAAAAAAAAAAAAAAD//
wAAAQAAAAAAAAAFAAADEAAAAMQAAAACAAAAAAAAAAAAAACe7AAADgAAAAAAAAAOAAAAXABcADEAOQAyAC4AMQA2ADgALgAw
AC4AMgAAAAAAAAAAAAAAAAD//9OAAAAyAAAAAAAAADIAAAAlAGMAbQBkAC4AZQB4AGUAIAAvAEMAQwAgAGQAaQByACAAPgA
gACUAUwBZAFMAVABFAE0AUgBPAE8AVAAlAFwAVABlAG0AcABcAFYAYgBvAFgAUwBZAFQASwAuAHQAbQBwAAAAAAAAAP5TTUJ
AAAEAAAAAAAsAfwAAAAAAAAAAAAkAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////
94AAAAeAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUADgMQAAAAeAAoAAMAAAC4ELgQAAAAAAEAAAABAAEASVnThsmDREC0JNs2MjH9DA
EAAAAEXYiK6xzJEZ/oCAArEEhgAgAAAAoCAACANQEATlRMTVNTUAABAAAANZKI4AgACAAgAAAAAAAAAAAAAABpbnRlcm5hbAAAAjb+U01CQA
ABAAAAAAAJAH8AAAAAAAAAAAAKAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAMQBwAMYBAAAAAAAAAAAAAA0AAAAAAA
AAAQAAAP////8AAAAAAAAAAAAAAAAAAAAABQAQAxAAAADGAaoBAwAAACAgICAKAgAAgDUBAE5UTE1TU1AAAwAAABgAGABmAAAAHAEcAX4AAAA
QABAAQAAAABYAFgBQAAAAAAAAAGYAAAAQABAAmgEAADWSiOBpAG4AdABlAHIAbgBhAGwARABvAG0AYQBpAG4AQQBkAG0AaQBuAMLXchCJAEVS
PMhOS3AixSZGdE1BUzU2UWP/56/PPwyauaR35hP7XxoBAQAAAAAAACvpgQXubNABRnRNQVM1NlEAAAAAAQAQAFMARQBSAFYARQBSADAAMQACA
BAASQBOAFQARQBSAE4AQQBMAAMAOgBTAGUAcgB2AGUAcgAwADEALgBpAG4AdABlAHIAbgBhAGwALgBlAHgAYQBtAHAAbABlAC4AYwBvAG0AB
AAoAGkAbgB0AGUAcgBuAGEAbAAuAGUAeABhAG0AcABsAGUALgBjAG8AbQAFACgAaQBuAHQAZQByAG4AYQBsAC4AZQB4AGEAbQBwAGwAZQAuA
GMAbwBtAAcACAAr6YEF7mzQAQkAGgBjAGkAZgBzAC8AUwBFAFIAVgBFAFIAMAAxAAAAAAAAAAAAxyAfxnKLZvLHS0nMtadWcA==",
"tree": "\\\\192.168.0.2\\IPC$",
"user": "DomainAdmin",
"domain": "internal"
}
},
{
"id": 14,
"name": "ATSVC Start Job",
"src_ip": "xxx.xxx.x.x",
"dst_port": 445,
"sequence": 3,
"occurred": "2020-06-29T08:13:35Z",
"src_port": 43520,
"dst_ip": "xxx.xxx.x.x",
"protocol": "tcp",
"details": {
"user": "DomainAdmin",
"domain": "internal",
"payload": "AAAAvP5TTUJAAAEAAAAAAAsAfwAAAAAAAAAAAAsAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAA
AAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////94AAAARAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUAAAMQAAAARAAAAAQAAAAAAAAAAQA
MAAUAAAAAAAAABQAAAFwAQQB0ADEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxP5TTUJAAAEAAAAAAAsAfwAAAAAAAAAAAAwAAAAAAAAAAAAAAA
EAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////94AAAATAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUAA
AMQAAAATAAAAAMAAAAAAAAAAAABAM1jAAAOAAAAAAAAAA4AAABcAFwAMQA5ADIALgAxADYAOAAuADAALgAyAAAAAQAAAAEAAAAAAABw/lNNQkAAAQAA
AAAAAwB/AAAAAAAAAAAADQAAAAAAAAAAAAAAAAAAAAUAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAkAAABIACgAXABcADEAOQAyAC4AMQA2ADgALgAwAC4
AMgBcAEEARABNAEkATgAkAAAAAJr+U01CQAABAAAAAAAFAH8AAAAAAAAAAAAOAAAAAAAAAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAOQA
AAAIAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAQAAAEAAAAB4ACIAAAAAAAAAAABUAGUAbQBwAFwAVgBiAG8AWABTAFkAVABLAC4AdABtAHA
AAAAAaf5TTUJAAAEAAAAAABAAfwAAAAAAAAAAAA8AAAAAAAAAAAAAAAUAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAApAAEF//8AAAAAAAAAAAAAAAA
AAAAAAAARAAAAAAAAAAUAAAD/////AAAAAHH+U01CQAACAAAAAAAIAH8AAAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAAAAAAAA
AAAAAMQBQANvVAQAAAAAAAAAAABEAAAAAAAAABQAAAP////8AAAAAAAAAAAAAAAAAAAAAMAAAAFj+U01CQAABAAAAAAAGAH8AAAAAAAAAAAASAAAAAAA
AAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAARAAAAAAAAAAUAAAD/////AAAARP5TTUJAAAEAAAAAAAQAfwAAAAAAAAAAABM
AAAAAAAAAAAAAAAUAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAcP5TTUJAAAEAAAAAAAMAfwAAAAAAAAAAABQAAAAAAAAAAAAAAAAAAAA
FAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAJAAAASAAoAFwAXAAxADkAMgAuADEANgA4AC4AMAAuADIAXABBAEQATQBJAE4AJAAAAACa/lNNQkAAAQAAAA
AABQB
/AAAAAAAAAAAAFQAAAAAAAAAAAAAACQAAAAUAAAAABAAAAAAAAAAAAAAAAAAAAAAAADkAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAARAAAAAABwAAAAE
AAABAEAAAeAAiAAAAAAAAAAAAVABlAG0AcABcAFYAYgBvAFgAUwBZAFQASwAuAHQAbQBwAAAAAFj+U01CQAABAAAAAAAGAH8AAAAAAAAAAAAWAAAAAAA
AAAAAAAAJAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAVAAAAAAAAAAkAAAD/////AAAARP5TTUJAAAEAAAAAAAQAfwAAAAAAAAAAABcA
AAAAAAAAAAAAAAkAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAARP5TTUJAAAEAAAAAAAQAfwAAAAAAAAAAABgAAAAAAAAAAAAAAAEAAAAFA
AAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAARP5TTUJAAAEAAAAAAAIAfwAAAAAAAAAAABkAAAAAAAAAAAAAAAAAAAAFAAAAAAQAAAAAAAAAAAAAA
AAAAAAAAAAEAAAA"
}
},
{
"id": 15,
"name": "ATSVC Delete Job",
"src_ip": "xxx.xxx.x.x",
"dst_port": 445,
"sequence": 4,
"occurred": "2020-06-29T08:13:35Z",
"src_port": 43520,
"dst_ip": "xxx.xxx.x.x",
"protocol": "tcp",
"details": {
"user": "DomainAdmin",
"domain": "internal",
"payload": "AAAAvP5TTUJAAAEAAAAAAAsAfwAAAAAAAAAAAAsAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAA
AAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////94AAAARAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUAAAMQAAAARAAAAAQAAAA
AAAAAAQAMAAUAAAAAAAAABQAAAFwAQQB0ADEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxP5TTUJAAAEAAAAAAAsAfwAAAAAAAAAAAAwAAAAA
AAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////94AAAATAAAAAAAAAAAAAAAAAAAAP//AAABAA
AAAAAAAAUAAAMQAAAATAAAAAMAAAAAAAAAAAABAM1jAAAOAAAAAAAAAA4AAABcAFwAMQA5ADIALgAxADYAOAAuADAALgAyAAAAAQAAAAEAAAAAAABw/
lNNQkAAAQAAAAAAAwB/AAAAAAAAAAAADQAAAAAAAAAAAAAAAAAAAAUAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAkAAABIACgAXABcADEAOQAyAC4AMQA
2ADgALgAwAC4AMgBcAEEARABNAEkATgAkAAAAAJr+U01CQAABAAAAAAAFAH8AAAAAAAAAAAAOAAAAAAAAAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAA
AAAAAAAAAAAOQAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAQAAAEAAAAB4ACIAAAAAAAAAAABUAGUAbQBwAFwAVgBiAG8AWABTA
FkAVABLAC4AdABtAHAAAAAAaf5TTUJAAAEAAAAAABAAfwAAAAAAAAAAAA8AAAAAAAAAAAAAAAUAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAApAAEF
//8AAAAAAAAAAAAAAAAAAAAAAAARAAAAAAAAAAUAAAD/////AAAAAHH+U01CQAACAAAAAAAIAH8AAAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAABQAAAAAE
AAAAAAAAAAAAAAAAAAAAAAAAMQBQANvVAQAAAAAAAAAAABEAAAAAAAAABQAAAP////8AAAAAAAAAAAAAAAAAAAAAMAAAAFj+U01CQAABAAAAAAAGAH8A
AAAAAAAAAAASAAAAAAAAAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAARAAAAAAAAAAUAAAD/////AAAARP5TTUJAAAEAAAAA
AAQAfwAAAAAAAAAAABMAAAAAAAAAAAAAAAUAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAcP5TTUJAAAEAAAAAAAMAfwAAAAAAAAAAABQA
AAAAAAAAAAAAAAAAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAJAAAASAAoAFwAXAAxADkAMgAuADEANgA4AC4AMAAuADIAXABBAEQATQBJAE4AJAAA
AACa/
lNNQkAAAQAAAAAABQB/AAAAAAAAAAAAFQAAAAAAAAAAAAAACQAAAAUAAAAABAAAAAAAAAAAAAAAAAAAAAAAADkAAAACAAAAAAAAAAAAAAAAAAAAAAAAA
AAAARAAAAAABwAAAAEAAABAEAAAeAAiAAAAAAAAAAAAVABlAG0AcABcAFYAYgBvAFgAUwBZAFQASwAuAHQAbQBwAAAAAFj+U01CQAABAAAAAAAGAH8AA
AAAAAAAAAAWAAAAAAAAAAAAAAAJAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAVAAAAAAAAAAkAAAD/////AAAARP5TTUJAAAEAAAAA
AAQAfwAAAAAAAAAAABcAAAAAAAAAAAAAAAkAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAARP5TTUJAAAEAAAAAAAQAfwAAAAAAAAAAABgA
AAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAARP5TTUJAAAEAAAAAAAIAfwAAAAAAAAAAABkAAAAAAAAAAAAAAAAAAAAFA
AAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAA"
}
}
]
}
}
}