{
  "author": "turbo-threads-api",
  "cat": "fusionsoc-t1547-boot-logon-autostart-execution",
  "detect": {
    "event": {
      "BASE_ADDRESS": 140695559340032,
      "COMMAND_LINE": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2252,i,11584118374322061563,17515597588466537940,262144 --field-trial-handle=2408,i,16348482333960350465,3233780439182764465,262144 --variations-seed-version --pseudonymization-salt-handle=2468,i,17580291602857589740,11825078043091548828,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2420 /prefetch:2",
      "FILE_IS_SIGNED": 1,
      "FILE_PATH": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
      "HASH": "47455576c6fb157a3a4ddd4ffa3a35d286cb2346d131d08bcaef873b15f5707b",
      "MEMORY_USAGE": 59375616,
      "PARENT": {
        "BASE_ADDRESS": 140695559340032,
        "COMMAND_LINE": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --flag-switches-begin --flag-switches-end --no-startup-window",
        "FILE_IS_SIGNED": 1,
        "FILE_PATH": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
        "HASH": "47455576c6fb157a3a4ddd4ffa3a35d286cb2346d131d08bcaef873b15f5707b",
        "MEMORY_USAGE": 8765440,
        "PARENT_ATOM": "0ea1c8346e08ee58829862166a0eb4e7",
        "PARENT_PROCESS_ID": 13512,
        "PROCESS_ID": 68852,
        "THIS_ATOM": "562a1648406fec4d386653956a0eed28",
        "THREADS": 4,
        "TIMESTAMP": 1779363111785,
        "USER_NAME": "DESKTOP-ATSEPSK\\Joy Howell"
      },
      "PARENT_PROCESS_ID": 68852,
      "PROCESS_ID": 68448,
      "THREADS": 14,
      "USER_NAME": "DESKTOP-ATSEPSK\\Joy Howell"
    },
    "routing": {
      "arch": 2,
      "did": "",
      "event_id": "35b2a421-bcc0-4b90-b8b8-a19417851a98",
      "event_time": 1779363112216,
      "event_type": "NEW_PROCESS",
      "ext_ip": "23.128.32.10",
      "hostname": "desktop-atsepsk",
      "iid": "b2cd59fc-d09d-49e0-a9f2-1fd79ee9c175",
      "int_ip": "192.168.50.200",
      "latency": 1309,
      "moduleid": 2,
      "oid": "d3541070-8b0e-4663-8a6a-aa0727aacd36",
      "parent": "562a1648406fec4d386653956a0eed28",
      "plat": 268435456,
      "sid": "8f3a47be-5629-4c66-921d-17c39ed07e87",
      "tags": [
        "fusion-soc-alert",
        "fusion-soc-case",
        "fusion-soc-pulled",
        "fusion-soc-triage",
        "fusionsoc-critical",
        "fusionsoc-high",
        "fusionsoc-investigated",
        "joys",
        "windows",
        "yara_detection_memory"
      ],
      "this": "23d3950705c01e4a837279916a0eed29"
    }
  },
  "detect_id": "2aa47826-bedf-4dfb-9cfe-bbe36a0eed29",
  "gen_time": 1779363113528,
  "link": "https://app.limacharlie.io/orgs/d3541070-8b0e-4663-8a6a-aa0727aacd36/sensors/8f3a47be-5629-4c66-921d-17c39ed07e87/timeline?time=1779363112\u0026selected=23d3950705c01e4a837279916a0eed29",
  "namespace": "general",
  "routing": {
    "arch": 2,
    "did": "",
    "event_id": "35b2a421-bcc0-4b90-b8b8-a19417851a98",
    "event_time": 1779363112216,
    "event_type": "NEW_PROCESS",
    "ext_ip": "23.128.32.10",
    "hostname": "desktop-atsepsk",
    "iid": "b2cd59fc-d09d-49e0-a9f2-1fd79ee9c175",
    "int_ip": "192.168.50.200",
    "latency": 1309,
    "moduleid": 2,
    "oid": "d3541070-8b0e-4663-8a6a-aa0727aacd36",
    "parent": "562a1648406fec4d386653956a0eed28",
    "plat": 268435456,
    "sid": "8f3a47be-5629-4c66-921d-17c39ed07e87",
    "tags": [
      "fusion-soc-alert",
      "fusion-soc-case",
      "fusion-soc-pulled",
      "fusion-soc-triage",
      "fusionsoc-critical",
      "fusionsoc-high",
      "fusionsoc-investigated",
      "joys",
      "windows",
      "yara_detection_memory"
    ],
    "this": "23d3950705c01e4a837279916a0eed29"
  },
  "rule_tags": [
    "attack.t1547",
    "attack.persistence"
  ],
  "source": "d3541070-8b0e-4663-8a6a-aa0727aacd36.b2cd59fc-d09d-49e0-a9f2-1fd79ee9c175.8f3a47be-5629-4c66-921d-17c39ed07e87.10000000.2",
  "source_rule": "general.fusionsoc-t1547-boot-logon-autostart-execution",
  "ts": 1779363114000
}

{
  "virustotal": {
    "malicious": false,
    "provider": "virustotal",
    "reputation": 0,
    "stats": {
      "confirmed-timeout": 0,
      "failure": 0,
      "harmless": 0,
      "malicious": 0,
      "suspicious": 0,
      "timeout": 0,
      "type-unsupported": 4,
      "undetected": 71
    }
  }
}

{
  "confidence": 0.617,
  "false_positive_reason": null,
  "investigation_questions": [],
  "ioc_analysis": "",
  "iocs_extracted": [],
  "mitre_techniques": [],
  "recommended_actions": [
    "Manual analyst review required \u2014 AI models (majority)",
    "Manual review required"
  ],
  "risk_score": 33,
  "severity": "high",
  "summary": "**Vote: MAJORITY (2/3 -\u003e FALSE POSITIVE)**\n\n### \ud83e\udd16 qwen3.5:4b Analysis (Secondary + RAG)\n**Verdict:** false_positive | **Confidence:** 0.95\nThe detected process is Microsoft Edge\u0027s GPU process, which is expected behavior.\n\n**IOC Analysis:** The file path and hash match legitimate Microsoft Edge binaries, and the process is signed.\n\n---\n\n### \ud83e\udd16 deepseek-r1:16b Analysis (Secondary + RAG)\n**Verdict:** false_positive | **Confidence:** 0.9\nThe detection event involves the Microsoft Edge executable (msedge.exe) running from its legitimate installation directory. The file is signed by Microsoft, and the process is part of normal Edge operations. Historical data shows similar events have been classified as false positives.\n\n**IOC Analysis:** FILE_PATH is located in C:\\Program Files (x86)\\Microsoft\\Edge, which is a known legitimate software directory. FILE_IS_SIGNED is 1, indicating the file is signed by Microsoft. The process is part of Microsoft Edge\u0027s GPU process, which is a normal operation.\n\n---\n\n### \ud83e\udd16 gemma3:4b Analysis (Secondary)\nFailed or timed out.",
  "verdict": "false_positive",
  "voting": {
    "auto_action": "manual_review",
    "mode": "majority",
    "total_models": 3,
    "vote_summary": [
      "qwen3.5:35b: true_positive (medium, 0% confidence)",
      "qwen3.5:4b +RAG: false_positive (low, 95% confidence)",
      "deepseek-r1:16b +RAG: false_positive (critical, 90% confidence)"
    ],
    "votes": [
      {
        "confidence": 0.0,
        "model": "qwen3.5:35b",
        "verdict": "true_positive"
      },
      {
        "confidence": 0.95,
        "had_rag": true,
        "model": "qwen3.5:4b",
        "verdict": "false_positive"
      },
      {
        "confidence": 0.9,
        "had_rag": true,
        "model": "deepseek-r1:16b",
        "verdict": "false_positive"
      }
    ],
    "winning_count": 2,
    "winning_verdict": "false_positive"
  }
}