JSON notification examples per infection type

Note

By default, the occurred time uses the yyyy-mm-ddTHH:mm:ssZ format for JSON notifications. As of release 8.0.0, the time format shown in the alert notifications is configurable using the fenotify preferences json normalize-occurred-time enable CLI command. Use the no form of the command to use the legacy format for occurred time.

CONTENT_LENGTH = 1198
CONTENT_TYPE = application/json
DOCUMENT_ROOT = /var/www
GATEWAY_INTERFACE = CGI/1.1
HTTP_ACCEPT = */*
HTTP_ALERT_CHECKSUM = 9f6a9919319b30ae634a664946e76046
HTTP_APPLIANCE_ID = 002590874A14
HTTP_CUSTOMER_ID = 007
HTTP_CUSTOMER_NAME = 'JG'
HTTP_EVENT_ID = 1386
HTTP_EVENT_SIZE = 1198
HTTP_EVENT_TYPE = malware-object
HTTP_EXPECT = 100-continue
HTTP_HOST = xxx.xxx.xxx.xxx
HTTP_USER_AGENT = curl/7.29.0
PATH = /usr/local/bin:/usr/bin:/bin
QUERY_STRING =
REMOTE_ADDR = xxx.xxx.xxx.xxx
REMOTE_PORT = 33054
REQUEST_METHOD = POST
REQUEST_URI = /fenotify/sink.pl
SCRIPT_FILENAME = /var/www/fenotify/sink.pl
SCRIPT_NAME = /fenotify/sink.pl
SERVER_ADDR = xxx.xxx.xxx.xxx
SERVER_ADMIN = webmaster@localhost
SERVER_NAME = xxx.xxx.xxx.xxx
SERVER_PORT = 80
SERVER_PROTOCOL = HTTP/1.1
SERVER_SIGNATURE = <address>Apache/2.2.22 (Ubuntu) Server at xxx.xxx.xxx.xxx Port 80</address>
SERVER_SOFTWARE = Apache/2.2.22 (Ubuntu)
Wrote new event to /var/www/fenotify/nossl/noauth/no_user/xxx.xxx.xxx.xxx/Tuesday-25-April-2017/
xxx.xxx.xxx.xxx_malware-event_1493105036_87782.html

malware-callback (Nerwork Security on Central Management)

{
  "alert": {
    "ack": "no", 
    "action": "notified", 
    "alert-url": "https://abc.mrl.trellix.com/event_stream/events_for_bot?ev_id=70252", 
    "appliance-id": "00:0B:AB:DC:86:AD", 
    "dst": {
      "ip": "xxx.xx.x.xx", 
      "mac": "00:50:56:be:42:a6", 
      "port": "8080"
    }, 
    "explanation": {
      "analysis": "content", 
      "cnc-services": {
        "cnc-service": {
          "address": "172.17.7.52", 
          "channel": "GET http://colville.com/Gallery/Winterfest/2.jpg HTTP/1.1::~~User-Agent: Mozilla/4.0 
(compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; #1atEW5tuNDl0kt579c9.BMWUS)
::~~Host: Colville.com::~~Pragma: no-cache::~~::~~", 
          "host": "Colville.com", 
          "port": "8080", 
          "protocol": "tcp", 
          "sid": "33351211", 
          "sname": "Trojan.APT.PingBed", 
          "type": "CncSigMatch", 
          "url": "hxxp://colville.com/Gallery/Winterfest/2.jpg"
        }
      }, 
      "malware-detected": {
        "malware": {
          "name": "Trojan.APT.PingBed", 
          "sid": "33351211", 
          "stype": "bot-command"
        }
      }, 
      "protocol": "tcp"
    }, 
    "id": "70252", 
    "interface": {
      "interface": "pether9", 
      "label": "D1"
    }, 
    "name": "malware-callback", 
    "occurred": "2020-06-29T07:00:34Z", 
    "product": "Web MPS", 
    "root-infection": "139", 
    "sc-version": "1030.312", 
    "sensor": "Honeybee", 
    "sensor-ip": "xx.x.x.xxx", 
    "severity": "crit", 
    "src": {
      "ip": "xxx.xx.x.xx", 
      "mac": "00:0c:29:ec:df:a4", 
      "port": "55689", 
      "vlan": "0"
    }, 
    "uuid": "cc348b62-c628-4c82-8c26-93b8df823cec", 
    "version": "9.0.0.916248"
  }, 
  "appliance": "abc.mrl.trellix.com", 
  "appliance-id": "0C:C4:7A:90:D3:B6", 
  "msg": "normal", 
  "product": "CMS", 
  "version": "9.0.0.916210"
}

malware-callback (Network Security)

{
  "product": "Web MPS", 
  "appliance-id": "002590847FB8", 
  "appliance": "abc.mrl.trellix.com", 
  "alert": {
    "src": {
      "ip": "xxx.xxx.xx.xx", 
      "vlan": "0"
    }, 
    "uuid": "f66dff23-a983-4648-b1ad-a4e7478dbf44", 
    "dst": {
      "ip": "xxx.xx.xxx.xxx"
    }, 
    "ack": "no", 
    "explanation": {
      "malware-detected": {
        "malware": {
          "name": "Trojan.Koceg"
        }
      }, 
      "protocol": "tcp"
    }, 
    "alert-url": "https://abc.mrl.trellix.com/event_stream/events_for_bot?ev_id=51", 
    "occurred": "2020-10-16T13:25:53Z", 
    "name": "malware-callback", 
    "action": "notified", 
    "attack-time": "2020-10-16T13:25:53Z", 
    "sc-version": "1073.120", 
    "id": "51", 
    "severity": "crit"
  }, 
  "version": "9.0.2.924861", 
  "msg": "concise"
}

malware-object (Network Security on Central Management)

{
  "product": "CMS", 
  "appliance-id": "0C:C4:7A:90:D3:B6", 
  "appliance": "abc.mrl.trellix.com", 
  "alert": {
    "src": {
      "ip": "xx.x.x.xxx", 
      "mac": "bc:30:5b:d1:0a:93", 
      "vlan": "0", 
      "proxy": "xxx.xxx.xxx.xxx", 
      "port": "47158"
    }, 
    "product": "Web MPS", 
    "name": "malware-object", 
    "dst": {
      "ip": "xxx.xxx.xxx.xxx", 
      "mac": "00:0e:0c:b9:b5:2e", 
      "port": "80"
    }, 
    "ack": "no", 
    "severity": "majr", 
    "explanation": {
      "malware-detected": {
        "malware": {
          "http-header": "GET /new/new7.exe HTTP/1.1\r\nAccept: */*\r\nUA-CPU: x86\r\nAccept-Encoding: gzip, 
deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; 
.NET CLR 3.0.04506.30)\r\nHost: www.wopxs.com\r\nVia: 1.1 Mimiron:3128 (squid/2.6.STABLE21), 1.0 Bottom-Dell 
(squid/3.1.8)\r\nX-Forwarded-For: 10.5.6.242, unknown\r\nCache-Control: max-age=259200\r\nConnection: keep-alive
\r\n\r\n HTTP/1.0 200 OK\r\nContent-Length: 24391\r\nContent-Type: application/octet-stream\r\nLast-Modified:
 Thu, 12 Feb 2009 10:19:06 GMT\r\nAccept-Ranges: bytes\r\nETag: \"089be55fb8cc91:321\"\r\nServer: 
Microsoft-IIS/6.0\r\nX-Powered-By: ASP.NET\r\nDate: Mon, 23 Feb 2009 12:55:43 GMT\r\nX-Cache: MISS from perf3
\r\nX-Cache-Lookup: MISS from perf3:3128\r\nVia: 1.0 perf3:3128 (squid/2.6.STABLE21)\r\nConnection: keep-alive", 
          "submitted-at": "2020-06-22T10:26:29Z", 
          "name": "Malware.Binary", 
          "downloaded-at": "2020-06-22T10:26:29Z", 
          "md5sum": "ef0130d76576bf27c15f3d99b4ca4aa5", 
          "executed-at": "2020-06-22T10:26:31Z", 
          "sha256": "c79b3748d5bd71154748a469cee4d7e1d5c3fb747e0e4651a2a21001c042dc0b", 
          "type": "exe", 
          "original": "new7.exe", 
          "stype": "known-md5sum"
        }
      }, 
      "protocol": "", 
      "analysis": "binary"
    }, 
    "alert-url": "https://abc.mrl.trellix.com/event_stream/events_for_bot?ma_id=8032", 
    "appliance-id": "00:0B:AB:DD:C0:CD", 
    "root-infection": "153", 
    "occurred": "2020-06-22T10:26:31Z", 
    "version": "9.0.0.916248", 
    "action": "notified", 
    "sensor-ip": "xx.x.x.xxx", 
    "sc-version": "1028.304", 
    "sensor": "Minato", 
    "id": "8032", 
    "uuid": "f56aa0ea-d085-4b7f-a919-bb41ef348a2c"
  }, 
  "version": "9.0.0.916210", 
  "msg": "normal"
}

malware-object (File Protect)

{
  "product": "File MPS", 
  "appliance-id": "0CC47AA8FFA6", 
  "appliance": "FX-32-142.eng.trellix.com", 
  "alert": {
    "src": {
      "url": "hxxp://xyz.fe.info/malware"
    }, 
    "uuid": "48e9ef71-9002-4cb4-bc5b-aa67c1271148", 
    "alert-url": "https://10.128.44.110/fmps/fanalysis?ma_id=58&lms_iden=0CC47AA8FFA6", 
    "ack": "no", 
    "explanation": {
      "malware-detected": {
        "malware": {
          "profile": "winxp-sp2-rp", 
          "submitted-at": "2020-06-26T16:42:50Z", 
          "name": "Trellix-TestEvent-SIG", 
          "downloaded-at": "2020-06-26T16:42:52Z", 
          "md5sum": "d41d8cd98f00b204e9800998ecf8427e", 
          "executed-at": "2020-06-26T16:42:52Z", 
          "application": "explorer"
        }
      }, 
      "cnc-services": {
        "cnc-service": [
          {
            "sname": "Trellix-TestEvent-SIG", 
            "protocol": "tcp", 
            "address": "127.0.0.100", 
            "type": "NetworkAnomaly", 
            "port": "201", 
            "channel": "cncs 2 channel fields"
          }, 
          {
            "sname": "Trellix-TestEvent-SIG", 
            "protocol": "tcp", 
            "address": "Trellix-TestEvent.example.com", 
            "type": "NetworkAnomaly", 
            "port": "200", 
            "channel": "Trellix-TestEvent Channel 1"
          }
        ]
      }, 
      "protocol": "tcp", 
      "service": "Trellix-TestEvent EA Service", 
      "analysis": "binary"
    }, 
    "occurred": "2020-06-26T16:42:50Z", 
    "name": "malware-object", 
    "action": "notified", 
    "sc-version": "1028.188", 
    "id": "58", 
    "severity": "majr"
  }, 
  "version": "9.0.0.916210", 
  "msg": "normal"
}

malware-object (File Protect on Central Management)

{
  "product": "CMS", 
  "appliance-id": "00:0C:29:D8:66:BB", 
  "appliance": "cmsdenali.eng.trellix.com", 
  "alert": {
    "src": {
      "url": "hxxp://xyz.fe.info/malware"
    }, 
    "product": "File MPS", 
    "name": "malware-object", 
    "alert-url": "https://cmsdenali.eng.trellix.com/fmps/fanalysis?ma_id=49", 
    "ack": "no", 
    "severity": "majr", 
    "explanation": {
      "malware-detected": {
        "malware": {
          "profile": "winxp-sp2-rp", 
          "submitted-at": "2020-06-26T16:43:49Z", 
          "name": "Trellix-TestEvent-SIG", 
          "downloaded-at": "2020-06-26T16:43:51Z", 
          "md5sum": "d41d8cd98f00b204e9800998ecf8427e", 
          "executed-at": "2020-06-26T16:43:51Z", 
          "application": "explorer", 
          "sid": "1234", 
          "stype": "generated-content"
        }
      }, 
      "cnc-services": {
        "cnc-service": [
          {
            "sname": "Trellix-TestEvent-SIG", 
            "protocol": "tcp", 
            "address": "127.0.0.100", 
            "type": "NetworkAnomaly", 
            "port": "201", 
            "channel": "cncs 2 channel fields"
          }, 
          {
            "sname": "Trellix-TestEvent-SIG", 
            "protocol": "tcp", 
            "sid": "1234", 
            "address": "Trellix-TestEvent.example.com", 
            "type": "VmsigMatch", 
            "port": "200", 
            "channel": "Trellix-TestEvent Channel 1"
          }, 
          {
            "sname": "Trellix-TestEvent-SIG", 
            "protocol": "tcp", 
            "address": "Trellix-TestEvent.example.com", 
            "type": "NetworkAnomaly", 
            "port": "200", 
            "channel": "Trellix-TestEvent Channel 1"
          }
        ]
      }, 
      "protocol": "tcp", 
      "service": "Trellix-TestEvent EA Service", 
      "analysis": "binary"
    }, 
    "appliance-id": "0C:C4:7A:A8:FF:A6", 
    "root-infection": "69", 
    "occurred": "2020-06-26T16:43:49Z", 
    "version": "9.0.0.916210", 
    "action": "notified", 
    "sensor-ip": "xx.xxx.xx.xxx", 
    "sc-version": "107.104", 
    "sensor": "FX-xx-xxx", 
    "id": "49", 
    "uuid": "fdf88a53-6527-4acd-91ca-e0de168ada57"
  }, 
  "version": "9.0.0.916210", 
  "msg": "normal"
}

malware-object (Malware Analysis)

 {
   "product": "MAS",
   "appliance-id": "0CC47A15B14E",
   "appliance": "AX-xx.eng.trellix.com",
   "alert": {
     "src": {
       "url": "/data/ma/share/source/pdf_7336661"
     },
     "uuid": "50002eb0-65bd-4521-8d1f-cd1e418229d9",
     "alert-url": "https://172.17.60.25/malware_analysis/analyses?maid=213135&lms_iden=0CC47A15B14E",
     "ack": "no",
     "explanation": {
       "malware-detected": {
         "malware": {
           "submitted-at": "2020-07-03T10:12:00Z",
           "name": "Exploit.Kit.Blackhole",
           "sha512": "34a583807b124ac52829118436c38a23270ca020f56cf74a7fc309bb17d44dee2e7b253707430bcc8fd7d5e6
487a403f2248001194c44341ffcbb567ee1d348d",
           "md5sum": "8d9cb7acf4d0abe7033aec9617b82369",
           "executed-at": "2020-07-03T10:13:51Z",
           "sha1": "d63cacc11c55d1567aae9bff8ec964c3b170c1c9",
           "sha256": "1f1407017248125abd633a7f67e41c2359ab7e112c26c446323575a1e9b4018d",
           "type": "pdf"
         }
       },
       "analysis": "none"
     },
     "occurred": "2020-07-03T10:13:51Z",
     "name": "malware-object",
     "action": "notified",
     "sc-version": "1032.168",
     "id": "213135",
     "severity": "majr"
  },
   "version": "9.0.0.916210",
   "msg": "concise"
 }

malware-object (Malware Analysis on Central Management)

{
  "product": "CMS", 
  "appliance-id": "00:25:90:86:7E:EE", 
  "appliance": "fifa.exqa.com", 
  "alert": {
    "src": {
      "url": "pdf_6745886"
    }, 
    "product": "MAS", 
    "name": "malware-object", 
    "alert-url": "https://fifa.exqa.com/malware_analysis/analyses?maid=38032", 
    "ack": "no", 
    "severity": "majr", 
    "explanation": {
      "malware-detected": {
        "malware": {
          "submitted-at": "2020-07-03T08:48:46Z", 
          "name": "Malware.Binary.pdf", 
          "md5sum": "80266d71f1ac3b71404ddab4e83a61be", 
          "executed-at": "2020-07-03T08:50:47Z", 
          "sha256": "c09a27c25daf3c4dec4fc641642252be899b01ac27909bf109e10206c4de03ef", 
          "type": "pdf"
        }
      }, 
      "analysis": "none"
    }, 
    "appliance-id": "AC:1F:6B:1C:35:42", 
    "root-infection": "621", 
    "occurred": "2020-07-03T08:50:47Z", 
    "version": "9.0.0.916210", 
    "action": "notified", 
    "sensor-ip": "xx.xxx.xx.xxx", 
    "sc-version": "1028.210", 
    "sensor": "AX-32-132", 
    "id": "38032", 
    "uuid": "d97ed4e0-772e-4372-b961-f5974942f76c"
  }, 
  "version": "9.0.0.916210", 
  "msg": "concise"
}

malware-object (Network Security)

{
  "product": "Web MPS", 
  "appliance-id": "002590847FB8", 
  "appliance": "abc.mrl.trellix.com", 
  "alert": {
    "src": {
      "mac": "92:73:75:00:00:35", 
      "ip": "xxx.xxx.xxx.xxx", 
      "host": "xxx-xxx-xxx-xxx.rev.home.ne.jp", 
      "vlan": "0", 
      "port": "1176"
    }, 
    "uuid": "ca14d466-350f-4573-b012-af4d30580e4a", 
    "dst": {
      "ip": "xxx.xxx.xxx.xxx", 
      "mac": "00:19:d1:fd:a2:52", 
      "port": "80"
    }, 
    "ack": "no", 
    "explanation": {
      "malware-detected": {
        "malware": {
          "submitted-at": "2020-10-16T10:32:44Z", 
          "name": "FE_Backdoor_Win_Generic_16", 
          "md5sum": "d9388ec6417ce93eed6a28aa2734348e", 
          "executed-at": "2020-10-16T10:35:36Z", 
          "sha256": "0bb6ee5cbe389ed02bb7ccbad01c6698bcb08f06b2ef5895abe657014b66685d", 
          "type": "exe"
        }
      }, 
      "protocol": "tcp", 
      "analysis": "none"
    }, 
    "alert-url": "https://abc.mrl.trellix.com/event_stream/events_for_bot?ma_id=15", 
    "occurred": "2020-10-16T10:35:36Z", 
    "name": "malware-object", 
    "action": "notified", 
    "attack-time": "2020-10-16T10:31:23Z", 
    "sc-version": "1073.116", 
    "id": "15", 
    "severity": "majr"
  }, 
  "version": "9.0.2.924861", 
  "msg": "concise"
}

malware-object (Email Security)

{
"product": "Email MPS", 
"appliance-id": "AC1F6B72041C", 
"appliance": "abc-123.mrl.trellix.com", 
"alert": {
"src": {
"url": "/d6f7f671-605e-44ce-be1e-20021eb47089", 
"domain": "tesoro.com", 
"smtp-mail-from": "sample@tesoro.com"
}, 
"uuid": "d6f7f671-605e-44ce-be1e-20021eb47089", 
"dst": {
"smtp-to": "samples@tesoro.com"
}, 
"ack": "no", 
"explanation": {
"malware-detected": {
"malware": {
"submitted-at": "2020-10-17T09:49:23Z", 
"name": "Malware.Binary", 
"sha512": "cf4494867af7711a7e04700c4fe3ea904dbbc4c3aa6aa0cfa3b968f19c83468c0006a02f68bfd8f399389b555155cf642db
343227e10bbfab8a97de7fca11391", 
"md5sum": "309152c4ecd2990accffa75a53568f86", 
"executed-at": "2020-10-17T09:49:24Z", 
"sha1": "5a83b64b5ca2922ab1d5b1357bbff4679324e2c0", 
"sha256": "05aa4dacb2f3ceebd02cbf68b64cb35b950d582ebb1af7375429b2d3c31b3332", 
"type": "one"
}
}, 
"analysis": "none"
}, 
"alert-url": "https://abc-123.mrl.trellix.com/emps/eanalysis?e_id=1", 
"occurred": "2020-10-17T09:49:24Z", 
"name": "malware-object", 
"action": "blocked", 
"attack-time": "2020-10-17T09:49:22Z", 
"sc-version": "xxxx.xxx", 
"id": "1", 
"severity": "majr"
}, 
"version": "9.0.2.924983", 
"msg": "concise"
}

malware-object (Email Security on Central Management)

{
  "product": "CMS", 
  "appliance-id": "00:25:90:87:4E:64", 
  "appliance": "Transformer.mrl.trellix.com", 
  "alert": {
    "src": {
      "url": "/c0f34207-7bf1-4359-ab8f-5f51bd4715c5", 
      "domain": "tesoro.com", 
      "smtp-mail-from": "brownie@tesoro.com"
    }, 
    "product": "Email MPS", 
    "name": "malware-object", 
    "dst": {
      "smtp-to": "brownie@tesoro.com"
    }, 
    "ack": "no", 
    "severity": "majr", 
    "explanation": {
      "malware-detected": {
        "malware": {
          "submitted-at": "2020-06-26T11:22:07Z", 
          "name": "Downloader.Upatre", 
          "md5sum": "40633ac4b136663880d2262a14a1d5f2", 
          "executed-at": "2020-06-26T11:24:04Z", 
          "sha256": "3d6a06292d742657eb15c59cdee71c43b65b05d9b31490c14de91fc2c786ffff", 
          "type": "exe"
        }
      }, 
      "analysis": "none"
    }, 
    "alert-url": "https://Transformer.mrl.trellix.com/emps/eanalysis?e_id=1252", 
    "appliance-id": "AC:1F:6B:18:BB:D6", 
    "root-infection": "475", 
    "occurred": "2020-06-26T11:24:04Z", 
    "version": "9.0.0.916210", 
    "action": "blocked", 
    "sensor-ip": "xx.x.x.xxx", 
    "sc-version": "1028.180", 
    "sensor": "xxx-xxx", 
    "id": "2480", 
    "uuid": "c0f34207-7bf1-4359-ab8f-5f51bd4715c5"
  }, 
  "version": "9.0.0.916090", 
  "msg": "concise"
}

web-infection (Network Security)

{
  "product": "Web MPS", 
  "appliance-id": "002590847FB8", 
  "appliance": "abc.mrl.trellix.com", 
  "alert": {
    "src": {
      "ip": "xxx.xxx.xxx.xxx", 
      "host": "119-168-188-108.rev.home.ne.jp", 
      "vlan": "0"
    }, 
    "uuid": "9038f862-a4aa-466e-9096-d72b2d6efd67", 
    "dst": {
      "ip": "xx.xxx.xxx.xxx"
    }, 
    "ack": "no", 
    "explanation": {
      "malware-detected": {
        "malware": {
          "submitted-at": "2020-10-16T10:32:44Z", 
          "name": "Malware.Binary.url"
        }
      }
    }, 
    "alert-url": "https://abc.mrl.trellix.com/event_stream/events_for_bot?inc_id=3885", 
    "occurred": "2020-10-16T10:34:41Z", 
    "name": "web-infection", 
    "action": "notified", 
    "attack-time": "2020-10-16T10:31:24Z", 
    "sc-version": "1073.116", 
    "id": "3885", 
    "severity": "majr"
  }, 
  "version": "9.0.2.924861", 
  "msg": "concise"
}

web-infection (Network Security on Central Management)

{
  "product": "CMS", 
  "appliance-id": "0C:C4:7A:90:D3:B6", 
  "appliance": "abc.mrl.trellix.com", 
  "alert": {
    "src": {
      "ip": "xx.xxx.xxx.xx", 
      "vlan": "0"
    }, 
    "product": "Web MPS", 
    "name": "web-infection", 
    "dst": {
      "ip": "xx.xxx.xxx.xxx"
    }, 
    "ack": "no", 
    "severity": "majr", 
    "explanation": {
      "malware-detected": {
        "malware": {
          "name": "Trojan.Ramnit"
        }
      }
    }, 
    "alert-url": "https://abc.mrl.trellix.com/event_stream/events_for_bot?inc_id=178", 
    "appliance-id": "00:0B:AB:DC:86:AD", 
    "root-infection": "62", 
    "occurred": "2020-07-01T06:09:09Z", 
    "version": "9.0.0.916248", 
    "action": "notified", 
    "sensor-ip": "xx.x.x.xxx", 
    "sc-version": "1031.160", 
    "sensor": "Honeybee", 
    "id": "178", 
    "uuid": "dcaf230a-2138-4d8f-af0d-d8e9abfa7515"
  }, 
  "version": "9.0.0.916210", 
  "msg": "concise"
}

infection-match (Network Security on Central Management)

{
  "alert": {
    "ack": "no", 
    "action": "notified", 
    "alert-url": "https://abc.mrl.trellix.com/event_stream/events_for_bot?ev_id=70222", 
    "appliance-id": "00:0B:AB:DD:C0:CD", 
    "class": "IPS", 
    "dst": {
      "ip": "xxx.xxx.xxx.xxx", 
      "mac": "00:50:56:e5:3f:c5", 
      "port": "80"
    }, 
    "explanation": {
      "analysis": "content", 
      "cnc-services": {
        "cnc-service": {
          "address": "xxx.xxx.xxx.xxx", 
          "channel": "GET http://yy8311.com/?/goods_list/14_25_0 HTTP/1.1::~~Host:
 yy8311.com::~~\\343\\311\\207/\\370\\251\\267\\257\\336\\276\\372\\342\\3537\\270\\224\\347^
{\\373\\356xd_\\3234=\\307\\274\\245k\\370\\342\\307\\302\\277\\350\\246\\362\\252]\\367\\237\\236\\347\\234\\331\\
251\\317}x\\357F\\377s\\375\\271\\207\\227\\276\\355\\353`\\352\\303k\\363\\357\\227\\372\\360z\\361\\305{\\\\\\
245\\231y\\264\\236[\\270\\330\\261O\\370\\337\\243\\237\\216\\247\\374d\\227\\350\\303\\321G\\227\\327\\237\\354
\\375\\364\\256p7\\320y\\343\\336{\\350g\\256\\211\t\\276x\\355a\\210%\\324k\\267\\256\\374\\343\\275\\363\\235\\
273\\361\\306_\\272\\356\\273\\356\\213\\256\\341\\257M?~\\355\\257\\377\\365\\307\\257}\\370\\207ox\\356\\332\\
217\\274c\\340\\373x\\333\\\\{\\366|\\356Z\\341_\\323h\\362\\372\\333~\\347x8?t\\355|\\341\\316m_\\316O\\374\\343
\\355d0\\312\\\\\\276\\375\\306\\325G\\342\\232A\\302\\265\\233\\257_{\\366O=\\376\\234\\374\\301\\207\\357\\374Q
\\337\\351\\325}\\364G/\\261UG+;\\355\\377po\\\\\\377\\302G/v\\264\\244^\\313\\254\\377\\367p\\301\\267\\337\\
276u\\353\\207\\306\\205\\216\\217p\\325\\274\\316\\363\\205\\267np\\352\\356\\377\\245;\\257]=\\372|\\371\\320
\\213\\333={~\\341\\332\\327/\\377yN\\303\\360\\243\\302\\310\\213\\220\\237\\273V|\\373x|[\\236\\257_\\276\\270
\\\\\\373S/]c\\203^\\322]\\275\\346/|i\\341c}[\\345\\317\\217\\337\\253\\334\\301\\375\\253\\357\\331\\3536\
t7Z_`c\\346\\373\\367\\357\\336\\3048\\362\\364\\356\\261\\353\\317]{r\\227=\\345\\225\\356;_\\365\\321\\235\\
367\\224\\227\\336\\273\\373\\352u7\\307=\\261\\366\\363\\336~\\355\\262\\365\\341o.\\233\\352\\331\\372\\3345W
\\350\\2626\\3222>\\2724\\347w_\\233\\363\\351\\213s>X\\235\\362)\\253c\\307\\273\\267Q>\\355\\216\\355z\\312k\\
356^\\335\\362%O\\264\\312?\\345E\\272\\225O]\\220\\362\\221)\\227\\271\\366\\365\\247\\372\\321-\\377\\271\\253\\
373\\377\\355\\325\\335a4\\254\\210\\217\\375q8\\367C\\327\\264[WO{g\\317\\376wx*\\214\\337\\375;?\\312\\345\\
334~\\203?\\336{\\373\\225{\\227?\\317\\317][\\277p\\355\\317^{\\346\\205g\\370\\377g\\307{~\\344\\316\\355\\
373_y\\326\\237\\206\\307\\277\\277\\271|\\303\\207\\366\\347\\357\\274}\\367\\336\\263\\373\\214\\233\\267\\
271o\\376\\245ka\\272\\366\\303\\327\\236\\231\\236\\271\\366\\305k\\376\\335\\323/iz\\216\\357\\375\\302\\243
\\327\\224\\275\\360\\350\\304<\\373\\314gk\\206?\\207\\260\\304?q\\357\\207\\277\\372\\222W\\367\\304\\352\r\\
210\\247\\335\\221U\\270n\\223\\274I\\341\\263\\317\\214D1\\305\\203L\\36631\\327f\\274x\\220\\237\\232\\364\\
372L\\242\n\\237\\256\\241\\360\\347\\357\\274y\\3654\t\\205\\207m\\372\\361\\241\\323\\370o\\317\\313\\242\r\\
322\\374\\237\\374\\365\\356\\235\\267\\372\\315[W}\\266\\314\\365{_}\\365+w\\356\\335\\341\\352\\247\\257\\360\\
322\\377_\\273\\320y\\300\\342\\222\\353k\\2159\\311~]\\320\\205\\327\\313\\277\\204\\245\\376\\373<\\246\\375\\
263N\\237\\333?\\341\\363\\373\\250\\377\\362\\317\\366\\2378\\255\\321\\257\\205\\347\\3018\\313^\\316\\260\\
356}]\\363\\377:\\2579\\371\\337\\3566h~\\277\"\\270\\215\\3124\\315\\227_~U\\374\\375\\341\\336y\\364\\330/?\\
315\\376v<\\370\\325\\3076X{\\360\\312\\217l\\227\\371\\361\\303\\207?\\367c\\312\\273\\372QW?+<z\\311\\345z\\333
\\361yn\\365?>\\377\\304\\247x,O\\374\\244=\\270\\363\\217\\255\\320\\247\\336\\377\\361\\340\\275>\\357\\2117?\\
334\\217\\236\\377\\303'\\365\\251\\237\\267>x\\357\\334\\366y_\\366y{t\\211?\\372\\321>\\332\\374}\\373\\356\\
237W>\\355%\\377\\345\\237\\377\\362\\317\\377K\\377Y\\226\\271-\\374\\377\\303\\363<\\216G\\342|\\313\\221\\353
\\331\\302\\276\\357i\\356i\\351U\\313\\271\\231\\227\\372\\340\\275\\353\\341\\221\\232\\307\\351\t\\3639\\247\\
236\\2174\\353\\361\\347\\270pn\\326P\\352\\326Z\\344gs[\\327y\\212\\333\\272N!\\371\\237=\\351b9\\360\\227\\237\\
224\\243\\225\\264\\236=\\3244\\3417\\326%\\366u^\\327\\340\\205g+G(k\\312\\215\\303\\332\\333R\\372\\370\\247\\
354G\\214e>\\247\\264\\226e?\\227\\336\\333\\326\\372\\224C\\212\\265NG\\330c\\236\\370\\234\\276\\326\\\\B\\210
\\374\\255\\2442O\\3532mm\\357gO};\\326\\330\\246e\\236\\353\\363\\272\\254[^\\342\\260\\330s(\\313\\372\\222jbM
\\256\\224OZV\\000d>\\270\\352\\263\\366\\363\\344\\232b\\235\\266%\\225\\225", 
          "host": "yy8311.com", 
          "port": "80", 
          "protocol": "tcp", 
          "sid": "84400123", 
          "sname": "Worm.Ramnit", 
          "type": "SignatureMatch", 
          "url": "hxxp://yy8311.com/?/goods_list/14_25_0"
        }
      }, 
      "malware-detected": {
        "malware": {
          "name": "Worm.Ramnit", 
          "sid": "84400123", 
          "stype": "bot-command"
        }
      }, 
      "protocol": "tcp"
    }, 
    "id": "70222", 
    "interface": {
      "interface": "pether3", 
      "label": "A1"
    }, 
    "name": "infection-match", 
    "occurred": "2020-06-28T11:10:28Z", 
    "product": "Web MPS", 
    "root-infection": "135", 
    "sc-version": "1030.272", 
    "sensor": "Minato", 
    "sensor-ip": "xx.x.x.xxx", 
    "severity": "minr", 
    "src": {
      "ip": "xxx.xxx.xxx.xxx", 
      "mac": "6a:c0:02:9a:9b:7d", 
      "port": "1058", 
      "vlan": "0"
    }, 
    "uuid": "a6c647de-776d-46b8-a08a-d357d51f5655", 
    "version": "9.0.0.916432"
  }, 
  "appliance": "abc.mrl.trellix.com", 
  "appliance-id": "0C:C4:7A:90:D3:B6", 
  "msg": "normal", 
  "product": "CMS", 
  "version": "9.0.0.916210"
}

infection-match (Network Security)

{
  "product": "Web MPS", 
  "appliance-id": "002590847FB8", 
  "appliance": "abc.mrl.trellix.com", 
  "alert": {
    "src": {
      "ip": "xxx.xxx.xxx.xxx", 
      "host": "xxx-xxx-xxx-xxx.rev.home.ne.jp", 
      "vlan": "0"
    }, 
    "uuid": "9dab4f9a-d022-4a4b-8aba-03e76bbc49f5", 
    "dst": {
      "ip": "xxx.xxx.xxx.xxx"
    }, 
    "ack": "no", 
    "explanation": {
      "malware-detected": {
        "malware": {
          "name": "Local.Infection"
        }
      }
    }, 
    "alert-url": "https://abc.mrl.trellix.com/event_stream/events_for_bot?ev_id=13", 
    "occurred": "2020-10-16T10:31:22Z", 
    "name": "infection-match", 
    "action": "notified", 
    "attack-time": "2020-10-16T10:31:22Z", 
    "sc-version": "1073.116", 
    "id": "13", 
    "severity": "minr"
  }, 
  "version": "9.0.2.924861", 
  "msg": "concise"
}

domain-match (Network Security on Central Management)

{
  "alert": {
    "ack": "no", 
    "action": "notified", 
    "alert-url": "https://abc.mrl.trellix.com/event_stream/events_for_bot?ev_id=70223", 
    "appliance-id": "00:0B:AB:DD:C0:CD", 
    "class": "IPS", 
    "dst": {
      "mac": "00:50:56:e5:3f:c5"
    }, 
    "explanation": {
      "analysis": "content", 
      "cnc-services": {
        "cnc-service": {
          "address": "fget-career.com", 
          "port": "53", 
          "protocol": "udp", 
          "sid": "80461038", 
          "sname": "Trojan.Ramnit.SNK.DNS", 
          "type": "CncSigMatch"
        }
      }, 
      "malware-detected": {
        "malware": {
          "name": "Trojan.Ramnit.SNK.DNS", 
          "sid": "80461038", 
          "stype": "blacklist"
        }
      }, 
      "protocol": "udp"
    }, 
    "id": "70223", 
    "interface": {
      "interface": "pether3", 
      "label": "A1"
    }, 
    "name": "domain-match", 
    "occurred": "2020-06-28T11:10:33Z", 
    "product": "Web MPS", 
    "root-infection": "136", 
    "sc-version": "1030.272", 
    "sensor": "Minato", 
    "sensor-ip": "xx.x.x.xxx", 
    "severity": "minr", 
    "src": {
      "ip": "xxx.xxx.xxx.xxx", 
      "mac": "6a:c0:02:9a:9b:7d", 
      "port": "1070", 
      "vlan": "0"
    }, 
    "uuid": "c1aacf68-1793-40f1-8c6f-9c3bb0b4e697", 
    "version": "9.0.0.916432"
  }, 
  "appliance": "abc.mrl.trellix.com", 
  "appliance-id": "0C:C4:7A:90:D3:B6", 
  "msg": "normal", 
  "product": "CMS", 
  "version": "9.0.0.916210"
}

domain-match (Network Security)

{
  "product": "Web MPS", 
  "appliance-id": "002590847FB8", 
  "appliance": "abc.mrl.trellix.com", 
  "alert": {
    "src": {
      "ip": "xxx.xxx.xxx.xxx", 
      "host": "xxx-xxx-xxx-xxx.rev.home.ne.jp", 
      "vlan": "0"
    }, 
    "uuid": "3dcdd294-91d5-4a88-bb9f-fc0bbb4b1870", 
    "alert-url": "https://abc.mrl.trellix.com/event_stream/events_for_bot?ev_id=15", 
    "ack": "no", 
    "explanation": {
      "malware-detected": {
        "malware": {
          "name": "Trojan.Win32.Dogrobot.gen.E"
        }
      }
    }, 
    "occurred": "2020-10-16T10:31:23Z", 
    "name": "domain-match", 
    "action": "notified", 
    "attack-time": "2020-10-16T10:31:23Z", 
    "sc-version": "1073.116", 
    "id": "15", 
    "severity": "minr"
  }, 
  "version": "9.0.2.924861", 
  "msg": "concise"
}

ips-event (Network Security)

{
    "msg": "normal",
    "alert": {
        "vlan": "0",
        "occurred": "2020-06-26T13:30:17Z",
        "ack": "no",
        "class": "IPS",
        "name": "ips-event",
        "action": "notified",
        "id": 12,
        "uuid": "c7a524fc-5623-4d7e-b758-c13153e8c6eb",
        "severity": "crit",
        "dst": {
            "ip": "xxx.xx.x.xxx",
            "port": 1043,
            "mac": "00:0c:29:b2:fb:4f"
        },
        "alert-url": "https://abc.mrl.trellix.com/notification_url/ips_events?ev_id=12",
        "src": {
            "ip": "xxx.xx.x.xx",
            "port": 80,
            "mac": "00:17:a4:aa:f4:93"
        },
        "explanation": {
            "ips-detected": {
                "mvx-status": "N/A",
                "sig-id": "85302399",
                "cve-id": "",
                "attack-mode": "client",
                "action-taken": "N/A",
                "match-count": 1,
                "sig-revision": "12",
                "sig-name": "Microsoft Internet Explorer XML Processing Memory Corruption"
            }
        },
        "interface": {
            "interface": "pether3",
            "mode": "tap",
            "label": "A1"
        }
    },
    "appliance-id": "000BABDDC0CD",
    "product": "Web MPS",
    "appliance": "abc.mrl.trellix.com",
    "version": "9.0.0.916432"
}

ips-event (Network Security on Central Management)

{
    "product": "CMS",
    "msg": "normal",
    "appliance": "abc.mrl.trellix.com",
    "alert": {
        "occurred": "2020-06-29T08:36:01Z",
        "class": "IPS",
        "alert-url": "https://abc.mrl.trellix.com/notification_url/ips_events?ev_id=15",
        "name": "ips-event",
        "sensor": "Mentos",
        "action": "notified",
        "ack": "no",
        "appliance-id": "00:0B:AB:F3:A9:D7",
        "id": 15,
        "uuid": "10ec9ea8-1d21-4762-b9c2-6b40b9c76755",
        "version": "9.0.0.916432",
        "src": {
            "mac": "00:1b:78:75:79:68",
            "ip": "xxx.xx.x.x",
            "port": 80
        },
        "product": "Web MPS",
        "severity": "crit",
        "interface": {
            "interface": "pether3",
            "label": "A1",
            "mode": "tap"
        },
        "vlan": "0",
        "dst": {
            "mac": "00:0c:29:5e:e3:6c",
            "ip": "xxx.xx.x.xx",
            "port": 33501
        },
        "explanation": {
            "ips-detected": {
                "sig-revision": "8",
                "sig-id": "85311119",
                "action-taken": "N/A",
                "cve-id": "",
                "sig-name": "Potential Heap Spray Memory Allocation",
                "attack-mode": "client",
                "match-count": 1,
                "mvx-status": "N/A"
            }
        }
    },
    "appliance-id": "AC:1F:6B:12:3E:2C",
    "version": "9.0.0.916210"
}

riskware-callback (Network Security on Central Management)

{
    "msg": "normal",
    "version": "9.0.0.916210",
    "product": "CMS",
    "appliance": "abc.mrl.trellix.com",
    "appliance-id": "AC:1F:6B:12:3E:2C",
    "alert": {
        "dst": {
            "mac": "00:01:6c:a9:2f:27",
            "ip": "xxx.xx.xxx.x",
            "port": 80
        },
        "severity": "minr",
        "occurred": "2020-06-29T07:49:43Z",
        "class": "RISKWARE",
        "id": 380,
        "root-infection": 380,
        "src": {
            "port": 1072,
            "vlan": 0,
            "mac": "00:20:18:11:01:43",
            "ip": "xx.x.x.xx"
        },
        "uuid": "36e8bce0-1f70-44bf-ae14-90c7946422d7",
        "action": "notified",
        "name": "riskware-callback",
        "ack": "no",
        "alert-url": "https://abc.mrl.trellix.com/detection/objects?uuid=36e8bce0-1f70-44bf-ae14-90c7946422d7",
        "version": "9.0.0.916432",
        "product": "Web MPS",
        "explanation": {
            "malware-detected": {
                "malware": {
                    "name": "Adware.MultiPlug",
                    "malicious": "no",
                    "url": "http://49939.northstar.api.socdn.com/installer/ad0d8641-dff0-11e3-8a58-80c16e6f498c/12932238/config",
                    "executed-at": "2020-06-29T07:49:43Z"
                }
            },
            "cnc-services": {
                "cnc-service": {
                    "port": 80,
                    "address": "49939.northstar.api.socdn.com",
                    "protocol": "tcp",
                    "channel": "GET /installer/ad0d8641-dff0-11e3-8a58-80c16e6f498c/12932238/config HTTP/1.1::~~Accept-Language: en-XX::~~User-Agent: 
DownloadMR/1.2.4+ (MSIE 8.0; Windows NT 5.1 SP3; DB=ie; 9bf59659-7f5b-02eb-8c69-ce6a8ca6b231; m=wXuH; u=admin; aurora)::~~Host:
 49939.northstar.api.socdn.com::~~Connection: Keep-Alive::~~::~~",
                    "location": "US/CA/Milpitas"
                }
            }
        },
        "sensor": "Mentos"
    }
}

riskware-infection (Network Security on Central Management)

{
    "msg": "normal",
    "version": "9.0.0.916210",
    "product": "CMS",
    "appliance": "abc.mrl.trellix.com",
    "appliance-id": "AC:1F:6B:12:3E:2C",
    "alert": {
        "dst": {
            "mac": "a0:d3:c1:f1:4a:7d",
            "ip": "xx.xx.xx.xx",
            "port": 80
        },
        "severity": "minr",
        "occurred": "2020-06-29T08:07:58Z",
        "class": "RISKWARE",
        "id": 24,
        "root-infection": 24,
        "src": {
            "port": 50748,
            "vlan": 0,
            "mac": "00:50:56:b4:67:9b",
            "ip": "xx.xxx.xxx.xxx"
        },
        "uuid": "8c6004a0-97ed-4e81-aa96-26ebf9baec61",
        "action": "notified",
        "name": "riskware-infection",
        "ack": "no",
        "alert-url": "https://abc.mrl.trellix.com/detection/objects?uuid=8c6004a0-97ed-4e81-aa96-26ebf9baec61",
        "version": "9.0.0.916432",
        "product": "Web MPS",
        "explanation": {
            "malware-detected": {
                "malware": {
                    "name": "PUP.Generic.MVX",
                    "malicious": "no",
                    "url": "xxx.xx.x.x/~kjohnson/CVE-2014-8439/Exploit.html",
                    "executed-at": "2020-06-29T08:07:58Z"
                }
            }
        },
        "sensor": "Mentos"
    }
}

riskware-object (Network Security on Central Management)

{
    "msg": "normal",
    "version": "9.0.0.916210",
    "product": "CMS",
    "appliance": "abc.mrl.trellix.com",
    "appliance-id": "AC:1F:6B:12:3E:2C",
    "alert": {
        "dst": {
            "mac": "00:0c:29:b8:8e:a1",
            "ip": "xxx.xx.xx.xxx",
            "port": 80
        },
        "severity": "minr",
        "occurred": "2020-06-29T07:54:27Z",
        "class": "RISKWARE",
        "id": 83,
        "root-infection": 2,
        "src": {
            "port": 37420,
            "vlan": 0,
            "mac": "00:50:56:c0:00:08",
            "ip": "xxx.xx.xx.x"
        },
        "uuid": "2b48c503-bb98-4990-bb16-86f7a0268d6e",
        "action": "notified",
        "name": "riskware-object",
        "ack": "no",
        "alert-url": "https://abc.mrl.trellix.com/detection/objects?uuid=2b48c503-bb98-4990-bb16-86f7a0268d6e",
        "version": "9.0.0.916432",
        "product": "Web MPS",
        "explanation": {
            "malware-detected": {
                "malware": {
                    "name": "FE_Adware_Searchbar",
                    "malicious": "no",
                    "type": "dll",
                    "sha256": "4b2155811cf0953d447df316472da01b093c55a7b3f2b9dc8d88c3e5a4484cd0",
                    "url": "xxx.xx.xx.xxx/my_dir/dll_4b2155811cf0953d447df316472da01b093c55a7b3f2b9dc8d88c3e5a4484cd0",
                    "original": "dll_4b2155811cf0953d447df316472da01b093c55a7b3f2b9dc8d88c3e5a4484cd0",
                    "executed-at": "2020-06-29T07:54:27Z",
                    "md5sum": "30dbe64027e570ada595c1e7b89664db",
                    "submitted-at": "2020-06-29T07:51:34Z",
                    "profile": "win7x64-sp1m",
                    "http-header": "GET /my_dir/dll_4b2155811cf0953d447df316472da01b093c55a7b3f2b9dc8d88c3e5a4484cd0 
HTTP/1.1::~~Host: xxx.xx.xx.xxx::~~Connection: keep-alive::~~Upgrade-Insecure-Requests: 1::~~User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko)
 Chrome/61.0.3163.79 Safari/537.36::~~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8::~~DNT: 1::~~Referer: http://172.16.82.146/my_dir/::~~Accept-Encoding: 
gzip, deflate::~~Accept-Language: en-US,en;q=0.8,ur;q=0.6,ht;q=0.4::~~HTTP/1.1 200 OK::~~Date: Tue, 16 Jan 2018 10:24:58 GMT::~~Server: Apache/2.4.7 
(Ubuntu)::~~Last-Modified: Tue, 16 Jan 2018 10:13:27 GMT::~~ETag: \"21400-562e1fb50822b\"::~~Accept-Ranges: bytes::~~Content-Length: 136192::~~Keep-Alive: timeout=5, max=99::~~Connection: Keep-Alive::~~"
                }
            }
        },
        "sensor": "Mentos"
    }
}

riskware-callback (Network Security)

{
    "msg": "normal",
    "product": "Web MPS",
    "appliance": "abc.mrl.trellix.com",
    "appliance-id": "002590847FB8",
    "version": "9.0.2.924861",
    "alert": {
        "occurred": "2020-10-16T13:30:50Z",
        "explanation": {
            "malware-detected": {
                "malware": {
                    "name": "Adware.Crossrider",
                    "malicious": "no",
                    "url": "http://stats.statsmyapp.com/apps.gif?action=uninstall&browser=ie&browserver=10&ver=1_34_2_13&bic=&app=
52258&appver=0&verifier=&srcid=0&subid=0&zdata=0&xpiver=0&crxver=0&default=ie&chver=25&ffver=13&iever=10&installtime=1444697300&curtime=1444697300&lifetime=0&procstarttime=1444697299&rnd=1444697315",
                    "executed-at": "2020-10-16T13:30:50Z"
                }
            },
            "cnc-services": {
                "cnc-service": {
                    "port": 80,
                    "protocol": "tcp",
                    "address": "stats.statsmyapp.com",
                    "location": "CN/Guangzhou",
                    "channel": "GET /apps.gif?action=uninstall&browser=ie&browserver=10&ver=1_34_2_13&bic=&app=52258&appver=0&verifier=&srcid=
0&subid=0&zdata=0&xpiver=0&crxver=0&default=ie&chver=25&ffver=13&iever=10&installtime=1444697300&curtime=1444697300&lifetime=0&procstarttime=1444697299&rnd=1444697315 
HTTP/1.1::~~Host: stats.statsmyapp.com::~~Connection: Keep-Alive::~~Cache-Control: no-cache::~~X-Forwarded-For: 213.59.14.20::~~::~~"
                }
            }
        },
        "attack-time": "2020-10-16T13:30:50Z",
        "class": "RISKWARE",
        "root-infection": 58,
        "action": "notified",
        "dst": {
            "ip": "xx.xxx.xxx.xx",
            "port": 80,
            "mac": "00:01:6c:a9:2f:27"
        },
        "severity": "minr",
        "name": "riskware-callback",
        "id": 58,
        "uuid": "1a7b87a8-4bcb-4baf-b37a-8c1deccd731f",
        "ack": "no",
        "alert-url": "https://Almak.mrl.trellix.com/detection/objects?uuid=1a7b87a8-4bcb-4baf-b37a-8c1deccd731f",
        "src": {
            "ip": "xxx.xx.xx.xx",
            "vlan": 89,
            "port": 49198,
            "mac": "00:20:18:11:01:65"
        }
    }
}

riskware-infection (Network Security)

{
    "msg": "normal",
    "product": "Web MPS",
    "appliance": "abc.mrl.trellix.com",
    "appliance-id": "002590847FB8",
    "version": "9.0.2.924861",
    "alert": {
        "occurred": "2020-10-16T13:37:52Z",
        "explanation": {
            "malware-detected": {
                "malware": {
                    "name": "PUP.Generic.MVX",
                    "malicious": "no",
                    "url": "www.hulu.com/",
                    "executed-at": "2020-10-16T13:37:52Z"
                }
            }
        },
        "attack-time": "2020-10-16T13:31:35Z",
        "class": "RISKWARE",
        "root-infection": 3918,
        "action": "notified",
        "dst": {
            "ip": "xx.x.x.x",
            "port": 8080,
            "mac": "00:01:6c:a9:2f:27"
        },
        "severity": "minr",
        "name": "riskware-infection",
        "id": 3918,
        "uuid": "071b62f3-d9f3-43fa-a4b8-3726850ff6c0",
        "ack": "no",
        "alert-url": "https://abc.mrl.trellix.com/detection/objects?uuid=071b62f3-d9f3-43fa-a4b8-3726850ff6c0",
        "src": {
            "ip": "xx.x.x.xx",
            "vlan": 0,
            "port": 49205,
            "mac": "00:20:18:11:01:65"
        }
    }
}

riskware-object (Network Security)

{
    "msg": "normal",
    "product": "Web MPS",
    "appliance": "abc.mrl.trellix.com",
    "appliance-id": "002590847FB8",
    "version": "9.0.2.924861",
    "alert": {
        "occurred": "2020-10-16T13:35:31Z",
        "explanation": {
            "malware-detected": {
                "malware": {
                    "profile": "win7x64-sp1",
                    "sha512": "3d1f257bd7916dd755765241bfa6897654d1259f66bf0206d8f707e40900ba094b9949c118657dd9f34b06e0cb9bc45b0af24c3f5dd592b3ab0f8b26da6b933f",
                    "name": "FE_Adware_Searchbar",
                    "type": "dll",
                    "malicious": "no",
                    "url": "xxx.xx.xx.xxx/my_dir/dll_4b2155811cf0953d447df316472da01b093c55a7b3f2b9dc8d88c3e5a4484cd0",
                    "original": "dll_4b2155811cf0953d447df316472da01b093c55a7b3f2b9dc8d88c3e5a4484cd0",
                    "md5sum": "30dbe64027e570ada595c1e7b89664db",
                    "submitted-at": "2020-10-16T13:32:28Z",
                    "sha1": "80b2d887a9566879e28888864056204fddbc08b9",
                    "executed-at": "2020-10-16T13:35:31Z",
                    "sha256": "4b2155811cf0953d447df316472da01b093c55a7b3f2b9dc8d88c3e5a4484cd0",
                    "http-header": "GET /my_dir/dll_4b2155811cf0953d447df316472da01b093c55a7b3f2b9dc8d88c3e5a4484cd0 HTTP/1.1::~~Host: xxx.xx.xx.xxx::~~Connection: keep-alive::~~Upgrade-Insecure-Requests: 1::~~User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 
(KHTML, like Gecko) Chrome/xx.x.xxxx.xx Safari/537.36::~~Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8::~~DNT: 1::~~Referer: 
http://172.16.82.146/my_dir/::~~Accept-Encoding: gzip, deflate::~~Accept-Language: en-US,en;q=0.8,ur;q=0.6,ht;q=0.4::~~HTTP/1.1 200 OK::~~Date: Tue, 16 Jan 2018 10:24:58 GMT::~~Server: Apache/2.4.7 (Ubuntu)::~~Last-Modified: Tue, 16 Jan 2018 10:13:27 GMT::~~ETag: \"21400-562e1fb50822b\"::~~Accept-Ranges: bytes::~~Content-Length: 136192::~~Keep-Alive: timeout=5, max=99::~~Connection: Keep-Alive::~~"
                }
            }
        },
        "attack-time": "2020-10-16T13:31:06Z",
        "class": "RISKWARE",
        "root-infection": 18,
        "action": "notified",
        "dst": {
            "ip": "xxx.xx.xx.xxx",
            "port": 80,
            "mac": "00:0c:29:b8:8e:a1"
        },
        "severity": "minr",
        "name": "riskware-object",
        "id": 18,
        "uuid": "073fb208-51d2-429d-930a-27aff4829af7",
        "ack": "no",
        "alert-url": "https://abc.mrl.trellix.com/detection/objects?uuid=073fb208-51d2-429d-930a-27aff4829af7",
        "src": {
            "ip": "xxx.xx.xx.x",
            "vlan": 0,
            "port": 37420,
            "mac": "00:50:56:c0:00:08"
        }
    }
}

riskware-object (Email Security)

{
"alert": {
"occurred": "2020-10-17T10:07:49Z",
"attack-time": "2020-10-17T10:06:09Z",
"uuid": "d7ada227-2acb-4afa-9ef0-3046c3a4274a",
"src": {
"domain": "tesoro.com",
"smtp-mail-from": "sample@tesoro.com"
},
"class": "RISKWARE",
"id": 2,
"root-infection": 2,
"action": "blocked",
"dst": {
"smtp-to": "samples@tesoro.com"
},
"name": "riskware-object",
"severity": "minr",
"alert-url": "https://panadol-115.mrl.trellix.com/detection/objects?uuid=d7ada227-2acb-4afa-9ef0-3046c3a4274a",
"ack": "no",
"explanation": {
"malware-detected": {
"malware": {
"name": "fe_ml_heuristic",
"original": "f215dba2f3b6ad9d870ad2e9e7f1894b",
"submitted-at": "2020-10-17T10:06:09Z",
"malicious": "no",
"type": "exe",
"url": "f215dba2f3b6ad9d870ad2e9e7f1894b",
"md5sum": "f215dba2f3b6ad9d870ad2e9e7f1894b",
"sha1": "1d7b082a4dba27f9fa66050149616f3f17abdd1f",
"sha256": "4260bd012e1adab856a19d9e79774cab7b0df01b04aaf489b78ab54ce369713a",
"sha512": "7347ea20984a45f4be7e7a0f8418b436743477ae69c699300a9f4446db50bb28904d0a43be83122bd592045431803cab8f81e125883baef7ce1882e9150284aa",
"profile": "win7x64-sp1m",
"executed-at": "2020-10-17T10:07:49Z"
}
},
"cnc-services": {
"cnc-service": {
"port": 80,
"protocol": "tcp",
"address": "f215dba2f3b6ad9d870ad2e9e7f1894b",
"channel": "GET / HTTP/1.1::~~Host: www.yklbtrnklnbkjrnbjyrbnjka.com::~~Cache-Control: no-cache::~~::~~GET / HTTP/1.1::~~Host: www.yklbtrnklnbkjrnbjyrbnjka.com::~~Cache-Control: no-cache::~~::~~"
}
}
},
"smtp-message": {
"subject": "riskware",
"id": "e7213430-6667-2f02-6e00-8a908bd606ea@tesoro.com",
"date": "Sat, 17 Oct 2020 15:05:38 +0500",
"queue-id": "4CCzDM4DpRz1spXD",
"protocol": "attachment",
"last-malware": "fe_ml_heuristic",
"smtp-header": "Received: from [xx.xx.xxx.xx] (unknown [xx.xx.xxx.xx])\n\tby abc.123.mrl.trellix.com (Postfix)
 with ESMTP id 4CCzDM4DpRz1spXD\n\tfor <samples@tesoro.com>; 
Sat, 17 Oct 2020 10:05:39 +0000 (UTC)\nTo: samples@tesoro.com\nFrom: 
sample <sample@tesoro.com>\nSubject: riskware\nMessage-ID: <e7213430-6667-2f02-6e00-8a908bd606ea@tesoro.com>\nDate: Sat, 17 Oct 2020 15:05:38 +0500\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) 
Gecko/20100101\n Thunderbird/68.10.0\nMIME-Version: 1.0\nContent-Type: multipart/mixed;\n boundary=\"------------7136209E6542A12570EA0632\"\nContent-Language: en-US\n\n"
},
"interface": {
"interface": "pether3",
"mode": "block-email"
}
},
"appliance-id": "AC1F6B72041C",
"msg": "normal",
"product": "Email MPS",
"appliance": "abc.123.mrl.trellix.com",
"version": "9.0.2.924983"					
}

riskware-object (Email Security on Central Management)

{
    "msg": "normal",
    "product": "CMS",
    "appliance": "abc.mrl.trellix.com",
    "appliance-id": "00:25:90:87:4E:64",
    "version": "9.0.0.916090",
    "alert": {
        "uuid": "3a523bed-b7d4-4d80-b236-f0cd3b1b811e",
        "occurred": "2020-06-26T12:30:41Z",
        "dst": {
            "smtp-to": "brownie@tesoro.com"
        },
        "product": "Email MPS",
        "class": "RISKWARE",
        "id": 2483,
        "root-infection": 478,
        "action": "blocked",
        "severity": "minr",
        "name": "riskware-object",
        "ack": "no",
        "sensor": "xxx-xxx",
        "explanation": {
            "malware-detected": {
                "malware": {
                    "sha256": "4f11443a2fa6c714d3e33597f0d08de4e11a6a2fdb7de2e4a01addd5977665c5",
                    "name": "CustomPolicy.MVX.65003.ExecutableDeliveredByEmail.",
                    "url": "Microsoft_Corporation.dll",
                    "malicious": "no",
                    "original": "Microsoft_Corporation.dll",
                    "type": "dll",
                    "md5sum": "41a0d67ba3833d230f1229ff058be057",
                    "profile": "win7x64-sp1m",
                    "submitted-at": "2020-06-26T12:28:19Z",
                    "executed-at": "2020-06-26T12:30:41Z"
                }
            }
        },
        "alert-url": "https://abc.mrl.trellix.com/detection/objects?uuid=3a523bed-b7d4-4d80-b236-f0cd3b1b811e",
        "version": "9.0.0.916210",
        "src": {
            "domain": "tesoro.com",
            "smtp-mail-from": "brownie@tesoro.com"
        },
        "smtp-message": {
            "smtp-header": "Received: from lap-0119.ebryx.local (unknown [xx.xx.xxx.xxx])\n\tby xxx-xxx.mrl.trellix.com (Postfix) 
with ESMTP id 49tbkz29X6zDSKX7\n\tfor <brownie@tesoro.com>; Fri, 26 Jun 2020 17:28:08 +0500 (PKT)\nTo: brownie@tesoro.com\nX-title-changed: 
Not Scanned\nFrom: brownie <brownie@tesoro.com>\nSubject: Riskware Object\nMessage-ID: <3b670a25-15b6-134f-02b3-d5745ab7722f@tesoro.com>\nDate: 
Fri, 26 Jun 2020 17:27:59 +0500\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) 
Gecko/20100101\n Thunderbird/68.8.0\nMIME-Version: 1.0\nContent-Type: multipart/mixed;\n boundary=\"------------1D9AAF1B5F308EA5C2B7FB2A\"\nContent-Language: en-US\n\n",
            "id": "3b670a25-15b6-134f-02b3-d5745ab7722f@tesoro.com",
            "queue-id": "49tbkz29X6zDSKX7",
            "date": "Fri, 26 Jun 2020 17:27:59 +0500",
            "protocol": "attachment",
            "last-malware": "CustomPolicy.MVX.65003.ExecutableDeliveredByEmail.",
            "subject": "Riskware Object"
        },
        "interface": {
            "interface": "pether3",
            "mode": "block-email"
        }
    }
}

indicator-presence (Endpoint Security)

{
    "msg": "normal",
    "product": "HX",
    "alert": {
        "_id": 35,
        "host": {
            "hostname": "random_925_13",
            "ip": "::1",
            "containment_state": "normal",
            "os": "Mac OS X",
            "agent_id": "029FFC1489600237718B14",
            "agent_version": "24.0.1"
        },
        "resolution": "ALERT",
        "event_id": 22711,
        "condition": {
            "_id": "KTJc8+cso4CIbODVBFDShw==",
            "enabled": true,
            "tests": [
                {
                    "operator": "ends-with",
                    "token": "fileWriteEvent/filePath",
                    "type": "text",
                    "value": "\\temp"
                },
                {
                    "operator": "equal",
                    "token": "fileWriteEvent/md5",
                    "type": "md5",
                    "value": "aae466492bb90812d0ff1a7158885a6c",
                    "negate": true
                },
                {
                    "operator": "contains",
                    "token": "fileWriteEvent/filePath",
                    "type": "text",
                    "value": "janitor_21days",
                    "negate": true
                },
                {
                    "operator": "equal",
                    "token": "fileWriteEvent/fileName",
                    "type": "text",
                    "value": "process.dll"
                },
                {
                    "operator": "equal",
                    "token": "fileWriteEvent/md5",
                    "type": "md5",
                    "value": "84b904fa12c1a5528bf5730d5e6a5e8b",
                    "negate": true
                },
                {
                    "operator": "equal",
                    "token": "fileWriteEvent/md5",
                    "type": "md5",
                    "value": "09b130ebf4f2356efe383e1956f4a7bc",
                    "negate": true
                },
                {
                    "operator": "equal",
                    "token": "fileWriteEvent/md5",
                    "type": "md5",
                    "value": "d7350452606c57b16c3d4f92a9d949fa",
                    "negate": true
                }
            ]
        },
        "event_at": "2017-03-15T18:47:41.205+00:00",
        "matched_at": "2017-03-15T18:47:41.205+00:00",
        "reported_at": "2017-03-15T18:47:41.205+00:00",
        "source": "IOC",
        "matched_source_alerts": null,
        "event_type": "fileWriteEvent",
        "event_values": {
            "fileWriteEvent/timestamp": "2011-11-19T01:22:45.726Z",
            "fileWriteEvent/drive": "C",
            "fileWriteEvent/id": 316951377,
            "fileWriteEvent/closed": 1,
            "fileWriteEvent/pid": 28102,
            "fileWriteEvent/filePath": "Program Files\\Internet Explorer",
            "fileWriteEvent/fileName": "a.exe",
            "fileWriteEvent/lowestFileOffsetSeen": 40,
            "fileWriteEvent/textAtLowestOffset": "",
            "fileWriteEvent/dataAtLowestOffset": "",
            "fileWriteEvent/process": "csrss.exe",
            "fileWriteEvent/md5": "232bbd00d62f84d63152db286b1e59f8",
            "fileWriteEvent/writes": 64,
            "fileWriteEvent/size": 1839,
            "fileWriteEvent/fileExtension": "",
            "fileWriteEvent/fullPath": "C:\\windows\\system32\\s.dll",
            "fileWriteEvent/numBytesSeenWritten": 55
        },
        "uuid": "c81db400-5324-43a8-b0b9-c952d9103000"
    },
    "version": "3.5.0.615648",
    "appliance-id": "870000000000",
    "appliance": "yi-callisto1"
}

indicator-executed (Endpoint Security)

{
    "msg": "normal",
    "product": "HX",
    "alert": {
        "_id": 32,
        "host": {
            "hostname": "random_925_10",
            "ip": "10.78.198.100",
            "containment_state": "normal",
            "os": "Mac OS X",
            "agent_id": "DD333E1489600237717B11",
            "agent_version": "22.0.1"
        },
        "resolution": "ALERT",
        "event_id": 11424,
        "condition": {
            "_id": "RvTjvvDZtyRXCmz+40L_YQ==",
            "enabled": true,
            "tests": [
                {
                    "operator": "equal",
                    "token": "regKeyEvent/valueName",
                    "type": "text",
                    "value": "javaupdater"
                },
                {
                    "operator": "contains",
                    "token": "regKeyEvent/path",
                    "type": "text",
                    "value": "currentversion\\run"
                }
            ]
        },
        "event_at": "2017-03-15T18:42:44.014+00:00",
        "matched_at": "2017-03-15T18:42:44.014+00:00",
        "reported_at": "2017-03-15T18:42:44.014+00:00",
        "source": "IOC",
        "matched_source_alerts": null,
        "event_type": "regKeyEvent",
        "event_values": {
            "regKeyEvent/path": "System",
            "regKeyEvent/value": "25",
            "regKeyEvent/hive": "HKEY_CURRENT_USER",
            "regKeyEvent/keyPath": "XX",
            "regKeyEvent/eventType": "None",
            "regKeyEvent/timestamp": "2017-03-15T18:42:44.014Z",
            "regKeyEvent/valueType": "DWORD",
            "regKeyEvent/valueName": "Logon",
            "regKeyEvent/id": "20",
            "regKeyEvent/text": "25",
            "regKeyEvent/process": "explorer.exe",
            "regKeyEvent/pid": "10000"
        },
        "uuid": "5e732338-b5a1-495b-bbd4-81c504019e40"
    },
    "version": "3.5.0.615648",
    "appliance-id": "870000000000",
    "appliance": "yi-callisto1"
}

exploit-blocked (Endpoint Security)

{
    "msg": "normal",
    "appliance": "yi-callisto3",
    "product": "HX",
    "alert": {
        "uuid": "4b337f9c-ec05-4240-82a7-bb5c33475af0",
        "condition": null,
        "_id": 6424,
        "event_type": null,
        "host": {
            "hostname": "random_359_12",
            "os": "Windows XP SP2",
            "ip": "10.95.112.58",
            "agent_id": "E7E6C61489344714203B13",
            "agent_version": "12.0.1",
            "containment_state": "normal"
        },
        "resolution": "BLOCK",
        "event_values": null,
        "event_at": "2017-03-15T18:18:25.501+00:00",
        "matched_at": "2017-03-15T18:18:25.501+00:00",
        "source": "EXD",
        "analysis_details": [
            {
                "detail_type": "analysis",
                "analysis": {
                    "mode": "malware",
                    "ftype": "unknown type",
                    "rules_version": "1.34",
                    "engine_version": "2.0.0.91",
                    "whitelist_version": "0.20"
                }
            },
            {
                "detail_type": "os",
                "os": {
                    "name": "windows",
                    "version": "6.1.7601",
                    "sp": "1"
                }
            },
            {
                "EXPLOITED_PROCESS": {
                    "pid": "1088",
                    "processinfo": {
                        "pid": "1088",
                        "imagepath": "C:\\Users\\Administrator.W7EN86-0\\Desktop\\DropTools\\iexplore.exe",
                        "md5sum": "407cd767ac09047f8573066858cc871e"
                    }
                },
                "detail_type": "EXPLOITED_PROCESS"
            },
            {
                "detail_time": "2017-03-15T18:18:25.501Z",
                "detail_type": "exploitcode",
                "exploitcode": {
                    "timestamp": "131340755055010000",
                    "processinfo": {
                        "pid": "1088",
                        "imagepath": "C:\\Users\\Administrator.W7EN86-0\\Desktop\\DropTools\\iexplore.exe",
                        "md5sum": "407cd767ac09047f8573066858cc871e"
                    },
                    "analysis-id": "31"
                }
            },
            {
                "detail_type": "OS-CORRELATION",
                "OS-CORRELATION": {
                    "MESSAGE": "Exploit Shellcode launching a process",
                    "analysis-id": "31"
                }
            },
            {
                "detail_time": "2017-03-15T18:18:25.501Z",
                "detail_type": "action",
                "action": {
                    "analysis-id": "31",
                    "mode": "terminate",
                    "timestamp": "131340755055010000",
                    "result": "success",
                    "processinfo": {
                        "pid": "1088",
                        "imagepath": "C:\\Users\\Administrator.W7EN86-0\\Desktop\\DropTools\\iexplore.exe",
                        "md5sum": "407cd767ac09047f8573066858cc871e"
                    }
                }
            },
            {
                "detail_time": "2017-03-15T18:18:25.501Z",
                "detail_type": "process",
                "process": {
                    "value": "C:\\Users\\Administrator.W7EN86-0\\Desktop\\DropTools\\iexplore.exe",
                    "ppid": "2376",
                    "mode": "terminated",
                    "analysis-id": "32",
                    "eventid": "65382",
                    "pid": "1088",
                    "parentname": "N/A",
                    "cmdline": "iexplore.exe  --fileevent",
                    "timestamp": "131340755055010000"
                }
            },
            {
                "analysis_result": {
                    "is_malicious": "no",
                    "is_blocked": "yes",
                    "_CONTENTS": "\nExploit Shellcode launching a process\n"
                },
                "detail_type": "analysis_result"
            }
        ],
        "matched_source_alerts": null,
        "reported_at": "2017-03-15T18:18:25.502+00:00",
        "event_id": null
    },
    "appliance-id": "860AD5C199E0",
    "version": "3.5.0.614932"
}

exploit-detected (Endpoint Security)

{
    "msg": "normal",
    "product": "HX",
    "alert": {
        "_id": 8,
        "host": {
            "hostname": "random_925_9",
            "ip": "c497:a2e4:1c74:80c5:c00b:ff8a:359d:b7ab",
            "containment_state": "normal",
            "os": "Mac OS X",
            "agent_id": "CF29E91489600237716B10",
            "agent_version": "11.0.1"
        },
        "resolution": "ALERT",
        "event_id": null,
        "condition": null,
        "event_at": "2017-03-15T17:51:18.943+00:00",
        "matched_at": "2017-03-15T17:51:18.943+00:00",
        "reported_at": "2017-03-15T17:51:18.947+00:00",
        "source": "EXD",
        "matched_source_alerts": null,
        "event_type": null,
        "event_values": {
            "earliest_detection_time": "2017-03-15T17:51:18Z",
            "analysis_details": [
                {
                    "detail_type": "analysis",
                    "analysis": {
                        "whitelist_version": "0.20",
                        "mode": "malware",
                        "rules_version": "1.34",
                        "ftype": "unknown type",
                        "engine_version": "2.0.0.91"
                    }
                },
                {
                    "os": {
                        "version": "6.1.7601",
                        "name": "windows",
                        "sp": "1"
                    },
                    "detail_type": "os"
                },
                {
                    "EXPLOITED_PROCESS": {
                        "pid": "612",
                        "processinfo": {
                            "pid": "612",
                            "imagepath": "C:\\Users\\Administrator.W7EN86-0\\Desktop\\DropTools\\iexplore.exe",
                            "md5sum": "407cd767ac09047f8573066858cc871e"
                        }
                    },
                    "detail_type": "EXPLOITED_PROCESS"
                },
                {
                    "detail_type": "heapspraying",
                    "heapspraying": {
                        "timestamp": "131340738789430000",
                        "processinfo": {
                            "pid": "612",
                            "imagepath": "C:\\Users\\Administrator.W7EN86-0\\Desktop\\DropTools\\iexplore.exe",
                            "md5sum": "407cd767ac09047f8573066858cc871e"
                        },
                        "analysis-id": "5"
                    },
                    "detail_time": "2017-03-15T17:51:18.943Z"
                },
                {
                    "detail_type": "OS-CORRELATION",
                    "OS-CORRELATION": {
                        "MESSAGE": "Heap spray pattern detected",
                        "analysis-id": "5"
                    }
                },
                {
                    "detail_type": "heapspraying",
                    "heapspraying": {
                        "timestamp": "131340738789430000",
                        "processinfo": {
                            "pid": "612",
                            "imagepath": "C:\\Users\\Administrator.W7EN86-0\\Desktop\\DropTools\\iexplore.exe",
                            "md5sum": "407cd767ac09047f8573066858cc871e"
                        },
                        "analysis-id": "6"
                    },
                    "detail_time": "2017-03-15T17:51:18.943Z"
                },
                {
                    "detail_type": "heapspraying",
                    "heapspraying": {
                        "timestamp": "131340738789430000",
                        "processinfo": {
                            "pid": "612",
                            "imagepath": "C:\\Users\\Administrator.W7EN86-0\\Desktop\\DropTools\\iexplore.exe",
                            "md5sum": "407cd767ac09047f8573066858cc871e"
                        },
                        "analysis-id": "7"
                    },
                    "detail_time": "2017-03-15T17:51:18.943Z"
                },
                {
                    "detail_type": "heapspraying",
                    "heapspraying": {
                        "timestamp": "131340738789430000",
                        "processinfo": {
                            "pid": "612",
                            "imagepath": "C:\\Users\\Administrator.W7EN86-0\\Desktop\\DropTools\\iexplore.exe",
                            "md5sum": "407cd767ac09047f8573066858cc871e"
                        },
                        "analysis-id": "8"
                    },
                    "detail_time": "2017-03-15T17:51:18.943Z"
                },
                {
                    "detail_type": "heapspraying",
                    "heapspraying": {
                        "timestamp": "131340738789430000",
                        "processinfo": {
                            "pid": "612",
                            "imagepath": "C:\\Users\\Administrator.W7EN86-0\\Desktop\\DropTools\\iexplore.exe",
                            "md5sum": "407cd767ac09047f8573066858cc871e"
                        },
                        "analysis-id": "9"
                    },
                    "detail_time": "2017-03-15T17:51:18.943Z"
                },
                {
                    "detail_type": "heapspraying",
                    "heapspraying": {
                        "timestamp": "131340738789430000",
                        "processinfo": {
                            "pid": "612",
                            "imagepath": "C:\\Users\\Administrator.W7EN86-0\\Desktop\\DropTools\\iexplore.exe",
                            "md5sum": "407cd767ac09047f8573066858cc871e"
                        },
                        "analysis-id": "10"
                    },
                    "detail_time": "2017-03-15T17:51:18.943Z"
                },
                {
                    "detail_type": "heapspraying",
                    "heapspraying": {
                        "timestamp": "131340738789430000",
                        "processinfo": {
                            "pid": "612",
                            "imagepath": "C:\\Users\\Administrator.W7EN86-0\\Desktop\\DropTools\\iexplore.exe",
                            "md5sum": "407cd767ac09047f8573066858cc871e"
                        },
                        "analysis-id": "11"
                    },
                    "detail_time": "2017-03-15T17:51:18.943Z"
                },
                {
                    "detail_type": "heapspraying",
                    "heapspraying": {
                        "timestamp": "131340738789430000",
                        "processinfo": {
                            "pid": "612",
                            "imagepath": "C:\\Users\\Administrator.W7EN86-0\\Desktop\\DropTools\\iexplore.exe",
                            "md5sum": "407cd767ac09047f8573066858cc871e"
                        },
                        "analysis-id": "12"
                    },
                    "detail_time": "2017-03-15T17:51:18.943Z"
                },
                {
                    "detail_type": "heapspraying",
                    "heapspraying": {
                        "timestamp": "131340738789430000",
                        "processinfo": {
                            "pid": "612",
                            "imagepath": "C:\\Users\\Administrator.W7EN86-0\\Desktop\\DropTools\\iexplore.exe",
                            "md5sum": "407cd767ac09047f8573066858cc871e"
                        },
                        "analysis-id": "13"
                    },
                    "detail_time": "2017-03-15T17:51:18.943Z"
                },
                {
                    "detail_type": "heapspraying",
                    "heapspraying": {
                        "timestamp": "131340738789430000",
                        "processinfo": {
                            "pid": "612",
                            "imagepath": "C:\\Users\\Administrator.W7EN86-0\\Desktop\\DropTools\\iexplore.exe",
                            "md5sum": "407cd767ac09047f8573066858cc871e"
                        },
                        "analysis-id": "14"
                    },
                    "detail_time": "2017-03-15T17:51:18.943Z"
                },
                {
                    "detail_type": "process",
                    "detail_time": "2017-03-15T17:51:18.943Z",
                    "process": {
                        "value": "C:\\Users\\Administrator.W7EN86-0\\Desktop\\DropTools\\iexplore.exe",
                        "pid": "612",
                        "parentname": "N/A",
                        "ppid": "2376",
                        "cmdline": "iexplore.exe  --patternspray",
                        "mode": "terminated",
                        "timestamp": "131340738789430000",
                        "eventid": "42332",
                        "analysis-id": "15"
                    }
                },
                {
                    "detail_type": "analysis_result",
                    "analysis_result": {
                        "is_malicious": "no",
                        "is_blocked": "no",
                        "_CONTENTS": "\nHeap spray pattern detected\n"
                    }
                }
            ],
            "process_id": "612",
            "messages": [
                "Heap spray pattern detected"
            ],
            "process_name": "iexplore.exe"
        },
        "uuid": "fbafb320-4da3-4441-ba50-6bb1e81e117a"
    },
    "version": "3.5.0.615648",
    "appliance-id": "870000000000",
    "appliance": "yi-callisto1"
}

SmartVision (Network Security)

{
    "appliance": "abc.mrl.trellix.com",
    "msg": "normal",
    "product": "Web MPS",
    "alert": {
        "explanation": {
            "events": [
                {
                    "src_ip": "xxx.xxx.x.x",
                    "src_port": 43520,
                    "id": 1,
                    "occurred": "2020-06-26T12:42:07Z",
                    "protocol": "tcp",
                    "name": "SMB Create Request: Delete file in Windows temp direcory",
                    "dst_ip": "xxx.xxx.x.x",
                    "sequence": 0,
                    "dst_port": 445,
                    "details": {
                        "user": "DomainAdmin",
                        "domain": "internal",
                        "payload": "AAAAvP5TTUJAAAEAAAAAAAsAfwAAAAAAAAAAAAsAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAA
AAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////94AAAARAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUAAAMQAAAARAA
AAAQAAAAAAAAAAQAMAAUAAAAAAAAABQAAAFwAQQB0ADEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxP5TTUJAAAEAAAAAAAsAfwAAAA
AAAAAAAAwAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////
94AAAATAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUAAAMQAAAATAAAAAMAAAAAAAAAAAABAM1jAAAOAAAAAAAAAA4AAABcAFwAMQA5AD
IALgAxADYAOAAuADAALgAyAAAAAQAAAAEAAAAAAABw/lNNQkAAAQAAAAAAAwB/AAAAAAAAAAAADQAAAAAAAAAAAAAAAAAAAAUAAAAABAAAA
AAAAAAAAAAAAAAAAAAAAAkAAABIACgAXABcADEAOQAyAC4AMQA2ADgALgAwAC4AMgBcAEEARABNAEkATgAkAAAAAJr+U01CQAABAAAAAAAFA
H8AAAAAAAAAAAAOAAAAAAAAAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAOQAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAA
AAABAAAAAQAAAEAAAAB4ACIAAAAAAAAAAABUAGUAbQBwAFwAVgBiAG8AWABTAFkAVABLAC4AdABtAHAAAAAAaf5TTUJAAAEAAAAAABAAfwAA
AAAAAAAAAA8AAAAAAAAAAAAAAAUAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAApAAEF//8AAAAAAAAAAAAAAAAAAAAAAAARAAAAAAAAAAUAAAD/////
AAAAAHH+U01CQAACAAAAAAAIAH8AAAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAMQBQANvVAQAAAAAAAAAAA
BEAAAAAAAAABQAAAP////8AAAAAAAAAAAAAAAAAAAAAMAAAAFj+U01CQAABAAAAAAAGAH8AAAAAAAAAAAASAAAAAAAAAAAAAAAFAA
AABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAARAAAAAAAAAAUAAAD/////AAAARP5TTUJAAAEAAAAAAAQAfwAAAAAAAAAA
ABMAAAAAAAAAAAAAAAUAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAcP5TTUJAAAEAAAAAAAMAfwAAAAAAAAAAABQAAA
AAAAAAAAAAAAAAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAJAAAASAAoAFwAXAAxADkAMgAuADEANgA4AC4AMAAuADIAXABBAEQAT
QBJAE4AJAAAAACa/lNNQkAAAQAAAAAABQB/AAAAAAAAAAAAFQAAAAAAAAAAAAAACQAAAAUAAAAABAAAAAAAAAAAAAAAAAAAAAAAADkAA
AACAAAAAAAAAAAAAAAAAAAAAAAAAAAAARAAAAAABwAAAAEAAABAEAAAeAAiAAAAAAAAAAAAVABlAG0AcABcAFYAYgBvAFgAUwBZAFQAS
wAuAHQAbQBwAAAAAFj+U01CQAABAAAAAAAGAH8AAAAAAAAAAAAWAAAAAAAAAAAAAAAJAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAG
AAAAAAAAAAVAAAAAAAAAAkAAAD/////AAAARP5TTUJAAAEAAAAAAAQAfwAAAAAAAAAAABcAAAAAAAAAAAAAAAkAAAAFAAAAAAQAAAAAA
AAAAAAAAAAAAAAAAAAEAAAAAAAARP5TTUJAAAEAAAAAAAQAfwAAAAAAAAAAABgAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAA
AAAAAAAAAAEAAAAAAAARP5TTUJAAAEAAAAAAAIAfwAAAAAAAAAAABkAAAAAAAAAAAAAAAAAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAA"
                    }
                },
                {
                    "src_ip": "xxx.xxx.x.x",
                    "src_port": 43520,
                    "id": 2,
                    "occurred": "2020-06-26T12:42:06Z",
                    "protocol": "tcp",
                    "name": "SMB Create Request: File in Windows temp direcory",
                    "dst_ip": "xxx.xxx.x.x",
                    "sequence": 1,
                    "dst_port": 445,
                    "details": {
                        "payload": "AAAARf9TTUJyAAAAAAAACAAAAAAAAAAAAAAAAP//AAAAAAAAACIAAk5UIExNIDAuMTIAAlNNQi
AyLjAwMgACU01CIDIuPz8/AAAAAGr+U01CQAABAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAJAADAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIQAgADAAAAov5TTUJAAAEAAAAAAAEAAAAAAAAAAAAAAAIAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZAAABAAAAAAAAAABYAEoAAAAAAAAAAABgSAYGKwYBBQUCoD4wPKAOMAwGCisGAQQBg
jcCAgqiKgQoTlRMTVNTUAABAAAABRKIoAgACAAgAAAAAAAAAAAAAABpbnRlcm5hbAAAAgL+U01CQAABAAAAAAABAH8AAAAAAAAAAAADAAAAAA
AAAAAAAAAAAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGQAAAQAAAAAAAAAAWACqAQAAAAAAAAAAoYIBpjCCAaKiggGeBIIBmk5UTE1TU1A
AAwAAABgAGABmAAAAHAEcAX4AAAAQABAAQAAAABYAFgBQAAAAAAAAAGYAAAAAAAAAmgEAAAUSiKBpAG4AdABlAHIAbgBhAGwARABvAG0AYQBp
AG4AQQBkAG0AaQBuAPLt8HbvIEyZRelJ9uma1X5xZVhHR2NEWSz9KP37VTJPskSPL9wI6XwBAQAAAAAAADUmfQXubNABcWVYR0djRFkAAAAAA
QAQAFMARQBSAFYARQBSADAAMQACABAASQBOAFQARQBSAE4AQQBMAAMAOgBTAGUAcgB2AGUAcgAwADEALgBpAG4AdABlAHIAbgBhAGwALgBlA
HgAYQBtAHAAbABlAC4AYwBvAG0ABAAoAGkAbgB0AGUAcgBuAGEAbAAuAGUAeABhAG0AcABsAGUALgBjAG8AbQAFACgAaQBuAHQAZQByAG4A
YQBsAC4AZQB4AGEAbQBwAGwAZQAuAGMAbwBtAAcACAA1Jn0F7mzQAQkAGgBjAGkAZgBzAC8AUwBFAFIAVgBFAFIAMAAxAAAAAAAAAAAAAAAA
bP5TTUJAAAEAAAAAAAMAfwAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAJAAAASAAkAFwAXAAxADkAM
gAuADEANgA4AC4AMAAuADIAXABJAFAAQwAkAAAAAIL+U01CQAABAAAAAAAFAH8AAAAAAAAAAAAFAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAA
AAAAAAAAAAAAAAAAAOQAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAIAAAAABAAAAAQAAAEAAAAB4AAoAAAAAAAAAAABhAHQAcwB2AGMAAAAA8
P5TTUJAAAEAAAAAAAsAfwAAAAAAAAAAAAYAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////
94AAAAeAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUACwMQAAAAeAAoAAEAAAC4ELgQAAAAAAEAAAAAAAEAggb3H1EK6DAHbXQL6M7piwEAAAAEX
YiK6xzJEZ/oCAArEEhgAgAAAAoCAAB/NQEATlRMTVNTUAABAAAANZKI4AgACAAgAAAAAAAAAAAAAABpbnRlcm5hbAAAAjb+U01CQAABAAAAAAAJAH8AA
AAAAAAAAAAHAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAMQBwAMYBAAAAAAAAAAAAAA0AAAAAAAAAAQAAAP////
8AAAAAAAAAAAAAAAAAAAAABQAQAxAAAADGAaoBAQAAACAgICAKAgAAfzUBAE5UTE1TU1AAAwAAABgAGABmAAAAHAEcAX4AAAAQABAAQAAAABYA
FgBQAAAAAAAAAGYAAAAQABAAmgEAADWSiOBpAG4AdABlAHIAbgBhAGwARABvAG0AYQBpAG4AQQBkAG0AaQBuAAwKqszBZGSiGvni4CQBW6NaYkkzR
nd4c74Zr5pLDXZaV6b/5he8jngBAQAAAAAAALCHfwXubNABWmJJM0Z3eHMAAAAAAQAQAFMARQBSAFYARQBSADAAMQACABAASQBOAFQARQBSAE4A
QQBMAAMAOgBTAGUAcgB2AGUAcgAwADEALgBpAG4AdABlAHIAbgBhAGwALgBlAHgAYQBtAHAAbABlAC4AYwBvAG0ABAAoAGkAbgB0AGUAcgBuAGEA
bAAuAGUAeABhAG0AcABsAGUALgBjAG8AbQAFACgAaQBuAHQAZQByAG4AYQBsAC4AZQB4AGEAbQBwAGwAZQAuAGMAbwBtAAcACACwh38F7mzQAQkA
GgBjAGkAZgBzAC8AUwBFAFIAVgBFAFIAMAAxAAAAAAAAAAAA8xksF+4Whuy7iByx9MrbsgAAAUD+U01CQAABAAAAAAALAH8AAAAAAEABAAAIAAAA
AAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAOQAAABfAEQANAAAAAAAAAAEAAAD/////eAAAAMQAAAAAAAAAAAAAAAAAAAD//
wAAAQAAAAAAAAAFAAADEAAAAMQAAAACAAAAAAAAAAAAAACe7AAADgAAAAAAAAAOAAAAXABcADEAOQAyAC4AMQA2ADgALgAwAC4AMgAAAAAAAAAAAAAAAAD//
9OAAAAyAAAAAAAAADIAAAAlAGMAbQBkAC4AZQB4AGUAIAAvAEMAQwAgAGQAaQByACAAPgAgACUAUwBZAFMAVABFAE0AUgBPAE8AVAAlAFwAVA
BlAG0AcABcAFYAYgBvAFgAUwBZAFQASwAuAHQAbQBwAAAAAAAAAP5TTUJAAAEAAAAAAAsAfwAAAAAAAAAAAAkAAAAAAAAAAAAAAAEAAAAFAAA
AAAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////94AAAAeAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUADgMQ
AAAAeAAoAAMAAAC4ELgQAAAAAAEAAAABAAEASVnThsmDREC0JNs2MjH9DAEAAAAEXYiK6xzJEZ/oCAArEEhgAgAAAAoCAACANQEATlRMTVNTU
AABAAAANZKI4AgACAAgAAAAAAAAAAAAAABpbnRlcm5hbAAAAjb+U01CQAABAAAAAAAJAH8AAAAAAAAAAAAKAAAAAAAAAAAAAAABAAAABQAAAAA
EAAAAAAAAAAAAAAAAAAAAAAAAMQBwAMYBAAAAAAAAAAAAAA0AAAAAAAAAAQAAAP////8AAAAAAAAAAAAAAAAAAAAABQAQAxAAAADGAaoBAwAAACA
gICAKAgAAgDUBAE5UTE1TU1AAAwAAABgAGABmAAAAHAEcAX4AAAAQABAAQAAAABYAFgBQAAAAAAAAAGYAAAAQABAAmgEAADWSiOBpAG4AdABlAHIA
bgBhAGwARABvAG0AYQBpAG4AQQBkAG0AaQBuAMLXchCJAEVSPMhOS3AixSZGdE1BUzU2UWP/56/PPwyauaR35hP7XxoBAQAAAAAAACvpgQXubNAB
RnRNQVM1NlEAAAAAAQAQAFMARQBSAFYARQBSADAAMQACABAASQBOAFQARQBSAE4AQQBMAAMAOgBTAGUAcgB2AGUAcgAwADEALgBpAG4AdABlAHIA
bgBhAGwALgBlAHgAYQBtAHAAbABlAC4AYwBvAG0ABAAoAGkAbgB0AGUAcgBuAGEAbAAuAGUAeABhAG0AcABsAGUALgBjAG8AbQAFACgAaQBuAHQA
ZQByAG4AYQBsAC4AZQB4AGEAbQBwAGwAZQAuAGMAbwBtAAcACAAr6YEF7mzQAQkAGgBjAGkAZgBzAC8AUwBFAFIAVgBFAFIAMAAxAAAAAAAAAAAA
xyAfxnKLZvLHS0nMtadWcA==",
                        "tree": "\\\\192.168.0.2\\IPC$",
                        "user": "DomainAdmin",
                        "domain": "internal"
                    }
                },
                {
                    "src_ip": "xxx.xxx.x.x",
                    "src_port": 43520,
                    "id": 3,
                    "occurred": "2020-06-26T12:42:07Z",
                    "protocol": "tcp",
                    "name": "ATSVC Start Job",
                    "dst_ip": "xxx.xxx.x.x",
                    "sequence": 2,
                    "dst_port": 445,
                    "details": {
                        "user": "DomainAdmin",
                        "domain": "internal",
                        "payload": "AAAAvP5TTUJAAAEAAAAAAAsAfwAAAAAAAAAAAAsAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAA
AAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////94AAAARAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUAAAMQAAAARAAAAAQ
AAAAAAAAAAQAMAAUAAAAAAAAABQAAAFwAQQB0ADEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxP5TTUJAAAEAAAAAAAsAfwAAAAAAAAA
AAAwAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////94AAAATAAAAAAAAAAAAAA
AAAAAAP//AAABAAAAAAAAAAUAAAMQAAAATAAAAAMAAAAAAAAAAAABAM1jAAAOAAAAAAAAAA4AAABcAFwAMQA5ADIALgAxADYAOAAuADAALgA
yAAAAAQAAAAEAAAAAAABw/lNNQkAAAQAAAAAAAwB/AAAAAAAAAAAADQAAAAAAAAAAAAAAAAAAAAUAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAk
AAABIACgAXABcADEAOQAyAC4AMQA2ADgALgAwAC4AMgBcAEEARABNAEkATgAkAAAAAJr+U01CQAABAAAAAAAFAH8AAAAAAAAAAAAOAAAAAAA
AAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAOQAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAQAAAEAAAAB4ACI
AAAAAAAAAAABUAGUAbQBwAFwAVgBiAG8AWABTAFkAVABLAC4AdABtAHAAAAAAaf5TTUJAAAEAAAAAABAAfwAAAAAAAAAAAA8AAAAAAAAAAAA
AAAUAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAApAAEF//8AAAAAAAAAAAAAAAAAAAAAAAARAAAAAAAAAAUAAAD/////AAAAAHH+U01CQAAC
AAAAAAAIAH8AAAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAMQBQANvVAQAAAAAAAAAAABEAAAAAAAAAB
QAAAP////8AAAAAAAAAAAAAAAAAAAAAMAAAAFj+U01CQAABAAAAAAAGAH8AAAAAAAAAAAASAAAAAAAAAAAAAAAFAAAABQAAAAAEAAAAAAAAAA
AAAAAAAAAAAAAAGAAAAAAAAAARAAAAAAAAAAUAAAD/////AAAARP5TTUJAAAEAAAAAAAQAfwAAAAAAAAAAABMAAAAAAAAAAAAAAAUAAAAFAAA
AAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAcP5TTUJAAAEAAAAAAAMAfwAAAAAAAAAAABQAAAAAAAAAAAAAAAAAAAAFAAAAAAQAAAAAAAAA
AAAAAAAAAAAAAAAJAAAASAAoAFwAXAAxADkAMgAuADEANgA4AC4AMAAuADIAXABBAEQATQBJAE4AJAAAAACa/lNNQkAAAQAAAAAABQB/
AAAAAAAAAAAAFQAAAAAAAAAAAAAACQAAAAUAAAAABAAAAAAAAAAAAAAAAAAAAAAAADkAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAARAAAAAAB
wAAAAEAAABAEAAAeAAiAAAAAAAAAAAAVABlAG0AcABcAFYAYgBvAFgAUwBZAFQASwAuAHQAbQBwAAAAAFj+U01CQAABAAAAAAAGAH8AAAAAAA
AAAAAWAAAAAAAAAAAAAAAJAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAVAAAAAAAAAAkAAAD/////AAAARP5TTUJAAAEAAAA
AAAQAfwAAAAAAAAAAABcAAAAAAAAAAAAAAAkAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAARP5TTUJAAAEAAAAAAAQAfwAAAAAA
AAAAABgAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAARP5TTUJAAAEAAAAAAAIAfwAAAAAAAAAAABkAAAAAA
AAAAAAAAAAAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAA"
                    }
                },
                {
                    "src_ip": "xxx.xxx.x.x",
                    "src_port": 43520,
                    "id": 4,
                    "occurred": "2020-06-26T12:42:07Z",
                    "protocol": "tcp",
                    "name": "ATSVC Delete Job",
                    "dst_ip": "xxx.xxx.x.x",
                    "sequence": 3,
                    "dst_port": 445,
                    "details": {
                        "user": "DomainAdmin",
                        "domain": "internal",
                        "payload": "AAAAvP5TTUJAAAEAAAAAAAsAfwAAAAAAAAAAAAsAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAA
AAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////94AAAARAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUAAAMQAAAARAAAAAQAA
AAAAAAAAQAMAAUAAAAAAAAABQAAAFwAQQB0ADEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxP5TTUJAAAEAAAAAAAsAfwAAAAAAAAAAAA
wAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////94AAAATAAAAAAAAAAAAAAAAAAAAP
//AAABAAAAAAAAAAUAAAMQAAAATAAAAAMAAAAAAAAAAAABAM1jAAAOAAAAAAAAAA4AAABcAFwAMQA5ADIALgAxADYAOAAuADAALgAyAAAAAQAAAA
EAAAAAAABw/lNNQkAAAQAAAAAAAwB/AAAAAAAAAAAADQAAAAAAAAAAAAAAAAAAAAUAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAkAAABIACgAXABc
ADEAOQAyAC4AMQA2ADgALgAwAC4AMgBcAEEARABNAEkATgAkAAAAAJr+U01CQAABAAAAAAAFAH8AAAAAAAAAAAAOAAAAAAAAAAAAAAAFAAAABQ
AAAAAEAAAAAAAAAAAAAAAAAAAAAAAAOQAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAQAAAEAAAAB4ACIAAAAAAAAAAABUAGUA
bQBwAFwAVgBiAG8AWABTAFkAVABLAC4AdABtAHAAAAAAaf5TTUJAAAEAAAAAABAAfwAAAAAAAAAAAA8AAAAAAAAAAAAAAAUAAAAFAAAAAAQ
AAAAAAAAAAAAAAAAAAAAAAAApAAEF//8AAAAAAAAAAAAAAAAAAAAAAAARAAAAAAAAAAUAAAD/////AAAAAHH+U01CQAACAAAAAAAIAH8AAAAAAA
AAAAAQAAAAAAAAAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAMQBQANvVAQAAAAAAAAAAABEAAAAAAAAABQAAAP////
8AAAAAAAAAAAAAAAAAAAAAMAAAAFj+U01CQAABAAAAAAAGAH8AAAAAAAAAAAASAAAAAAAAAAAAAAAFAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAA
AAAAGAAAAAAAAAARAAAAAAAAAAUAAAD/////AAAARP5TTUJAAAEAAAAAAAQAfwAAAAAAAAAAABMAAAAAAAAAAAAAAAUAAAAFAAAAAAQAAAAAAA
AAAAAAAAAAAAAAAAAEAAAAAAAAcP5TTUJAAAEAAAAAAAMAfwAAAAAAAAAAABQAAAAAAAAAAAAAAAAAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAA
AAAJAAAASAAoAFwAXAAxADkAMgAuADEANgA4AC4AMAAuADIAXABBAEQATQBJAE4AJAAAAACa/lNNQkAAAQAAAAAABQB/AAAAAAAAAAAAFQAAAA
AAAAAAAAAACQAAAAUAAAAABAAAAAAAAAAAAAAAAAAAAAAAADkAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAARAAAAAABwAAAAEAAABAEAAAeAA
iAAAAAAAAAAAAVABlAG0AcABcAFYAYgBvAFgAUwBZAFQASwAuAHQAbQBwAAAAAFj+U01CQAABAAAAAAAGAH8AAAAAAAAAAAAWAAAAAAAAAAAAAAA
JAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAVAAAAAAAAAAkAAAD/////AAAARP5TTUJAAAEAAAAAAAQAfwAAAAAAAAAAABcAAAA
AAAAAAAAAAAkAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAARP5TTUJAAAEAAAAAAAQAfwAAAAAAAAAAABgAAAAAAAAAAAAAAAEAAAA
FAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAARP5TTUJAAAEAAAAAAAIAfwAAAAAAAAAAABkAAAAAAAAAAAAAAAAAAAAFAAAAAAQAAAAAAAA
AAAAAAAAAAAAAAAAEAAAA"
                    }
                },
                {
                    "src_ip": "xxx.xxx.x.x",
                    "src_port": 43520,
                    "id": 5,
                    "occurred": "2020-06-26T12:42:06Z",
                    "protocol": "tcp",
                    "name": "ATSVC Add Job: cmd.exe /C with redirect",
                    "dst_ip": "xxx.xxx.x.x",
                    "sequence": 4,
                    "dst_port": 445,
                    "details": {
                        "payload": "AAAARf9TTUJyAAAAAAAACAAAAAAAAAAAAAAAAP//AAAAAAAAACIAAk5UIExNIDAuMTIAAlNNQiA
yLjAwMgACU01CIDIuPz8/AAAAAGr+U01CQAABAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAJAADAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIQAgADAAAAov5TTUJAAAEAAAAAAAEAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZAAABAAAAAAAAAABYAEoAAAAAAAAAAABgSAYGKwYBBQUCoD4wPKAOMAwGCisGAQQBgjcCAgqi
KgQoTlRMTVNTUAABAAAABRKIoAgACAAgAAAAAAAAAAAAAABpbnRlcm5hbAAAAgL+U01CQAABAAAAAAABAH8AAAAAAAAAAAADAAAAAAAAAAAAAAA
AAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAGQAAAQAAAAAAAAAAWACqAQAAAAAAAAAAoYIBpjCCAaKiggGeBIIBmk5UTE1TU1AAAwAAABgAGA
BmAAAAHAEcAX4AAAAQABAAQAAAABYAFgBQAAAAAAAAAGYAAAAAAAAAmgEAAAUSiKBpAG4AdABlAHIAbgBhAGwARABvAG0AYQBpAG4AQQBkAG0A
aQBuAPLt8HbvIEyZRelJ9uma1X5xZVhHR2NEWSz9KP37VTJPskSPL9wI6XwBAQAAAAAAADUmfQXubNABcWVYR0djRFkAAAAAAQAQAFMARQBSAF
YARQBSADAAMQACABAASQBOAFQARQBSAE4AQQBMAAMAOgBTAGUAcgB2AGUAcgAwADEALgBpAG4AdABlAHIAbgBhAGwALgBlAHgAYQBtAHAAbABl
AC4AYwBvAG0ABAAoAGkAbgB0AGUAcgBuAGEAbAAuAGUAeABhAG0AcABsAGUALgBjAG8AbQAFACgAaQBuAHQAZQByAG4AYQBsAC4AZQB4AGEAbQ
BwAGwAZQAuAGMAbwBtAAcACAA1Jn0F7mzQAQkAGgBjAGkAZgBzAC8AUwBFAFIAVgBFAFIAMAAxAAAAAAAAAAAAAAAAbP5TTUJAAAEAAAAAAAMA
fwAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAJAAAASAAkAFwAXAAxADkAMgAuADEANgA4AC4AMAAu
ADIAXABJAFAAQwAkAAAAAIL+U01CQAABAAAAAAAFAH8AAAAAAAAAAAAFAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAA
OQAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAIAAAAABAAAAAQAAAEAAAAB4AAoAAAAAAAAAAABhAHQAcwB2AGMAAAAA8P5TTUJAAAEAAAAAAA
sAfwAAAAAAAAAAAAYAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////
94AAAAeAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUACwMQAAAAeAAoAAEAAAC4ELgQAAAAAAEAAAAAAAEAggb3H1EK6DAHbXQL6M7piwE
AAAAEXYiK6xzJEZ/oCAArEEhgAgAAAAoCAAB/NQEATlRMTVNTUAABAAAANZKI4AgACAAgAAAAAAAAAAAAAABpbnRlcm5hbAAAAjb+U01CQAA
BAAAAAAAJAH8AAAAAAAAAAAAHAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAMQBwAMYBAAAAAAAAAAAAAA0AAAAAAAAAA
QAAAP////8AAAAAAAAAAAAAAAAAAAAABQAQAxAAAADGAaoBAQAAACAgICAKAgAAfzUBAE5UTE1TU1AAAwAAABgAGABmAAAAHAEcAX4AAAAQ
ABAAQAAAABYAFgBQAAAAAAAAAGYAAAAQABAAmgEAADWSiOBpAG4AdABlAHIAbgBhAGwARABvAG0AYQBpAG4AQQBkAG0AaQBuAAwKqszBZGSi
Gvni4CQBW6NaYkkzRnd4c74Zr5pLDXZaV6b/5he8jngBAQAAAAAAALCHfwXubNABWmJJM0Z3eHMAAAAAAQAQAFMARQBSAFYARQBSADAAMQAC
ABAASQBOAFQARQBSAE4AQQBMAAMAOgBTAGUAcgB2AGUAcgAwADEALgBpAG4AdABlAHIAbgBhAGwALgBlAHgAYQBtAHAAbABlAC4AYwBvAG0
ABAAoAGkAbgB0AGUAcgBuAGEAbAAuAGUAeABhAG0AcABsAGUALgBjAG8AbQAFACgAaQBuAHQAZQByAG4AYQBsAC4AZQB4AGEAbQBwAGwAZQ
AuAGMAbwBtAAcACACwh38F7mzQAQkAGgBjAGkAZgBzAC8AUwBFAFIAVgBFAFIAMAAxAAAAAAAAAAAA8xksF+4Whuy7iByx9MrbsgAAAUD+U01CQ
AABAAAAAAALAH8AAAAAAEABAAAIAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAOQAAABfAEQANAAAAAAAAAAEAAAD/////
eAAAAMQAAAAAAAAAAAAAAAAAAAD//wAAAQAAAAAAAAAFAAADEAAAAMQAAAACAAAAAAAAAAAAAACe7AAADgAAAAAAAAAOAAAAXABcADEAOQAyAC4
AMQA2ADgALgAwAC4AMgAAAAAAAAAAAAAAAAD//9OAAAAyAAAAAAAAADIAAAAlAGMAbQBkAC4AZQB4AGUAIAAvAEMAQwAgAGQAaQByACAAPgAgA
CUAUwBZAFMAVABFAE0AUgBPAE8AVAAlAFwAVABlAG0AcABcAFYAYgBvAFgAUwBZAFQASwAuAHQAbQBwAAAAAAAAAP5TTUJAAAEAAAAAAAsAfw
AAAAAAAAAAAAkAAAAAAAAAAAAAAAEAAAAFAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAA5AAAAF8ARAA0AAAAAAAAAAQAAAP////
94AAAAeAAAAAAAAAAAAAAAAAAAAP//AAABAAAAAAAAAAUADgMQAAAAeAAoAAMAAAC4ELgQAAAAAAEAAAABAAEASVnThsmDREC0JNs2MjH9DA
EAAAAEXYiK6xzJEZ/oCAArEEhgAgAAAAoCAACANQEATlRMTVNTUAABAAAANZKI4AgACAAgAAAAAAAAAAAAAABpbnRlcm5hbAAAAjb+U01CQAA
BAAAAAAAJAH8AAAAAAAAAAAAKAAAAAAAAAAAAAAABAAAABQAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAMQBwAMYBAAAAAAAAAAAAAA0AAAAAAAAAA
QAAAP////8AAAAAAAAAAAAAAAAAAAAABQAQAxAAAADGAaoBAwAAACAgICAKAgAAgDUBAE5UTE1TU1AAAwAAABgAGABmAAAAHAEcAX4AAAAQABA
AQAAAABYAFgBQAAAAAAAAAGYAAAAQABAAmgEAADWSiOBpAG4AdABlAHIAbgBhAGwARABvAG0AYQBpAG4AQQBkAG0AaQBuAMLXchCJAEVSPMhO
S3AixSZGdE1BUzU2UWP/56/PPwyauaR35hP7XxoBAQAAAAAAACvpgQXubNABRnRNQVM1NlEAAAAAAQAQAFMARQBSAFYARQBSADAAMQACABAA
SQBOAFQARQBSAE4AQQBMAAMAOgBTAGUAcgB2AGUAcgAwADEALgBpAG4AdABlAHIAbgBhAGwALgBlAHgAYQBtAHAAbABlAC4AYwBvAG0ABAA
oAGkAbgB0AGUAcgBuAGEAbAAuAGUAeABhAG0AcABsAGUALgBjAG8AbQAFACgAaQBuAHQAZQByAG4AYQBsAC4AZQB4AGEAbQBwAGwAZQAu
AGMAbwBtAAcACAAr6YEF7mzQAQkAGgBjAGkAZgBzAC8AUwBFAFIAVgBFAFIAMAAxAAAAAAAAAAAAxyAfxnKLZvLHS0nMtadWcA==",
                        "tree": "\\\\192.168.0.2\\IPC$",
                        "user": "DomainAdmin",
                        "domain": "internal"
                    }
                }
            ]
        },
        "alert-url": "https://abc.mrl.trellix.com/notification_url?uuid=20281250-7c27-4cce-a410-2f04e1002c6e",
        "src": {
            "ip": "xxx.xxx.x.x",
            "port": 43520
        },
        "signature_id": 91500000,
        "occurred": "2020-06-26T12:42:06Z",
        "id": 1,
        "class": "SmartVision",
        "protocol": "tcp",
        "name": "smartvision-event",
        "action": "notified",
        "uuid": "20281250-7c27-4cce-a410-2f04e1002c6e",
        "description": "Suspicious Remote Scheduled Task Activity",
        "severity": "majr",
        "count": 5,
        "dst": {
            "ip": "xxx.xxx.x.x",
            "port": 445
        },
        "category": "T1053 / Remote Execution"
    },
    "appliance-id": "000BABDDC0CD",
    "version": "9.0.0.916432"
}