SmartVision (Network Security on Central Management)

CEF:0|Trellix|CMS|9.0.0.916210|SE|smartvision-base-event|0 rt=Jun 29 2020
08:13:34 UTC externalId=12 cs1Label=name cs1=ATSVC Add Job: cmd.exe /C with
redirect proto=tcp src=xxx.xxx.x.x dst=xxx.xxx.x.x spt=43520 dpt=445
dvchost=abc.mrl.trellix.com dvc=xx.x.x.xx sev=1 msg=ATSVC Add Job: cmd.exe /C
with redirect with id:12 detected .
CEF:0|Trellix|CMS|9.0.0.916210|SE|smartvision-base-event|0 rt=Jun 29 2020
08:13:35 UTC externalId=14 cs1Label=name cs1=ATSVC Start Job proto=tcp
src=xxx.xxx.x.x dst=xxx.xxx.x.x spt=43520 dpt=445 dvchost=abc.mrl.trellix.com
dvc=xx.x.x.xx sev=1 msg=ATSVC Start Job with id:14 detected .
CEF:0|Trellix|CMS|9.0.0.916210|SE|smartvision-base-event|0 rt=Jun 29 2020
08:13:35 UTC externalId=11 cs1Label=name cs1=SMB Create Request: Delete file
in Windows temp direcory proto=tcp src=xxx.xxx.x.x dst=xxx.xxx.x.x spt=43520
dpt=445 dvchost=abc.mrl.trellix.com dvc=xx.x.x.xx sev=1 msg=SMB Create
Request: Delete file in Windows temp direcory with id:11 detected .
CEF:0|Trellix|CMS|9.0.0.916210|SE|smartvision-base-event|0 rt=Jun 29 2020
08:13:34 UTC externalId=13 cs1Label=name cs1=SMB Create Request: File in
Windows temp direcory proto=tcp src=xxx.xxx.x.x dst=xxx.xxx.x.x spt=43520
dpt=445 dvchost=abc.mrl.trellix.com dvc=xx.x.x.xx sev=1 msg=SMB Create
Request: File in Windows temp direcory with id:13 detected .
CEF:0|Trellix|CMS|9.0.0.916210|SE|smartvision-base-event|0 rt=Jun 29 2020
08:13:35 UTC externalId=15 cs1Label=name cs1=ATSVC Delete Job proto=tcp
src=xxx.xxx.x.x dst=xxx.xxx.x.x spt=43520 dpt=445 dvchost=abc.mrl.trellix.com
dvc=xx.x.x.xx sev=1 msg=ATSVC Delete Job with id:15 detected .
CEF:0|Trellix|CMS|9.0.0.916210|WA|smartvision-event|5|rt=Jun 29 2020 08:13:34
UTC externalId=7 act=notified cn2Lablel=signatureId cn2=91500000
cfp1Label=signatureRevision cfp1=5 devicePayloadId=5985dbd8-5066-4e04-b560-
3f05c93506d6 cnt=5 cs1=Suspicious Remote Scheduled Task Activity
cs1Label=name cat=T1053 / Remote Execution msg=Suspicious Remote Scheduled
Task Activity src=xxx.xxx.x.x dst=xxx.xxx.x.x spt=43520 dpt=445
cs4=https://abc.mrl.trellix.com/notification_url?uuid\=5985dbd8-5066-4e04-
b560-3f05c93506d6 cs4Lablel=link .