{
  "author": "turbo-threads-api",
  "cat": "fusionsoc-t1547-boot-logon-autostart-execution",
  "detect": {
    "event": {
      "BASE_ADDRESS": 140698254573568,
      "COMMAND_LINE": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2532,i,16437018709446164582,13479308760150138726,524288 --field-trial-handle=2520,i,15455767776571028346,3029988080483744235,262144 --variations-seed-version --pseudonymization-salt-handle=2528,i,9594784161433607848,14298218502826883265,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2776 /prefetch:13",
      "FILE_IS_SIGNED": 1,
      "FILE_PATH": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
      "HASH": "b4ea52196967c69a61c114c9934950f511f26bded473107e1b6c37cd8a22bf9e",
      "MEMORY_USAGE": 20885504,
      "PARENT": {
        "BASE_ADDRESS": 140698254573568,
        "COMMAND_LINE": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --flag-switches-begin --flag-switches-end --no-startup-window",
        "FILE_IS_SIGNED": 1,
        "FILE_PATH": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
        "HASH": "b4ea52196967c69a61c114c9934950f511f26bded473107e1b6c37cd8a22bf9e",
        "MEMORY_USAGE": 142729216,
        "PARENT_ATOM": "5c05f4a5d9eb0399ef10e8e46a13dedf",
        "PARENT_PROCESS_ID": 79044,
        "PROCESS_ID": 89400,
        "THIS_ATOM": "bf886ef8fd509755f2a54d6f6a141720",
        "THREADS": 61,
        "TIMESTAMP": 1779701535983,
        "USER_NAME": "DESKTOP-ATSEPSK\\Joy Howell"
      },
      "PARENT_PROCESS_ID": 89400,
      "PROCESS_ID": 65488,
      "THREADS": 9,
      "USER_NAME": "DESKTOP-ATSEPSK\\Joy Howell"
    },
    "routing": {
      "arch": 2,
      "did": "",
      "event_id": "d87b08cb-1c15-468d-86d3-7dacbde3ba22",
      "event_time": 1779701536465,
      "event_type": "NEW_PROCESS",
      "ext_ip": "23.128.32.10",
      "hostname": "desktop-atsepsk",
      "iid": "b2cd59fc-d09d-49e0-a9f2-1fd79ee9c175",
      "int_ip": "192.168.50.200",
      "latency": 612,
      "moduleid": 2,
      "oid": "d3541070-8b0e-4663-8a6a-aa0727aacd36",
      "parent": "bf886ef8fd509755f2a54d6f6a141720",
      "plat": 268435456,
      "sid": "8f3a47be-5629-4c66-921d-17c39ed07e87",
      "tags": [
        "fusion-soc-alert",
        "fusion-soc-case",
        "fusion-soc-pulled",
        "fusion-soc-triage",
        "fusionsoc-critical",
        "fusionsoc-high",
        "fusionsoc-investigated",
        "joys",
        "windows"
      ],
      "this": "181a471fb61ab4588d948dd46a141720"
    }
  },
  "detect_id": "21bf8c7c-fd31-4493-a2a5-0a676a141721",
  "gen_time": 1779701537079,
  "link": "https://app.limacharlie.io/orgs/d3541070-8b0e-4663-8a6a-aa0727aacd36/sensors/8f3a47be-5629-4c66-921d-17c39ed07e87/timeline?time=1779701536\u0026selected=181a471fb61ab4588d948dd46a141720",
  "namespace": "general",
  "routing": {
    "arch": 2,
    "did": "",
    "event_id": "d87b08cb-1c15-468d-86d3-7dacbde3ba22",
    "event_time": 1779701536465,
    "event_type": "NEW_PROCESS",
    "ext_ip": "23.128.32.10",
    "hostname": "desktop-atsepsk",
    "iid": "b2cd59fc-d09d-49e0-a9f2-1fd79ee9c175",
    "int_ip": "192.168.50.200",
    "latency": 612,
    "moduleid": 2,
    "oid": "d3541070-8b0e-4663-8a6a-aa0727aacd36",
    "parent": "bf886ef8fd509755f2a54d6f6a141720",
    "plat": 268435456,
    "sid": "8f3a47be-5629-4c66-921d-17c39ed07e87",
    "tags": [
      "fusion-soc-alert",
      "fusion-soc-case",
      "fusion-soc-pulled",
      "fusion-soc-triage",
      "fusionsoc-critical",
      "fusionsoc-high",
      "fusionsoc-investigated",
      "joys",
      "windows"
    ],
    "this": "181a471fb61ab4588d948dd46a141720"
  },
  "rule_tags": [
    "attack.t1547",
    "attack.persistence"
  ],
  "source": "d3541070-8b0e-4663-8a6a-aa0727aacd36.b2cd59fc-d09d-49e0-a9f2-1fd79ee9c175.8f3a47be-5629-4c66-921d-17c39ed07e87.10000000.2",
  "source_rule": "general.fusionsoc-t1547-boot-logon-autostart-execution",
  "ts": 1779701537000
}

{
  "virustotal": {
    "malicious": false,
    "provider": "virustotal",
    "reputation": 0,
    "stats": {
      "confirmed-timeout": 0,
      "failure": 0,
      "harmless": 0,
      "malicious": 0,
      "suspicious": 0,
      "timeout": 0,
      "type-unsupported": 4,
      "undetected": 71
    }
  }
}

{
  "confidence": 0.567,
  "false_positive_reason": null,
  "investigation_questions": [],
  "ioc_analysis": "",
  "iocs_extracted": [],
  "mitre_techniques": [],
  "recommended_actions": [
    "Manual analyst review required \u2014 AI models (majority)",
    "Manual review required"
  ],
  "risk_score": 37,
  "severity": "high",
  "summary": "**Vote: MAJORITY (2/3 -\u003e FALSE POSITIVE)**\n\n### \ud83e\udd16 qwen3.5:4b Analysis (Secondary + RAG)\n**Verdict:** false_positive | **Confidence:** 0.8\nThe detected process is Microsoft Edge (msedge.exe), which is a legitimate application running from its expected directory. The process tree shows that the parent process is also Edge, indicating normal operation.\n\n**IOC Analysis:** The file path and hash match known, legitimate Microsoft Edge binaries. No suspicious activity was observed in the process tree.\n\n---\n\n### \ud83e\udd16 deepseek-r1:16b Analysis (Secondary + RAG)\n**Verdict:** false_positive | **Confidence:** 0.9\nThe detection event involves the Microsoft Edge executable (msedge.exe) running from its legitimate installation directory. The file is signed by Microsoft, and the process is part of normal Edge operations, likely related to background services or updates. Historical data shows similar events have been marked as false positives.\n\n**IOC Analysis:** FILE_PATH is located in C:\\Program Files (x86)\\Microsoft\\Edge\\Application, which is a known legitimate location for Microsoft software. The file is signed (FILE_IS_SIGNED=1), and the hash matches a known Microsoft-signed binary. The process is running under a user account and is part of normal Edge operations, such as background services or updates.\n\n---\n\n### \ud83e\udd16 gemma3:4b Analysis (Secondary)\nFailed or timed out.",
  "verdict": "false_positive",
  "voting": {
    "auto_action": "manual_review",
    "mode": "majority",
    "total_models": 3,
    "vote_summary": [
      "qwen3.5:35b: true_positive (medium, 0% confidence)",
      "qwen3.5:4b +RAG: false_positive (low, 80% confidence)",
      "deepseek-r1:16b +RAG: false_positive (medium, 90% confidence)"
    ],
    "votes": [
      {
        "confidence": 0.0,
        "model": "qwen3.5:35b",
        "verdict": "true_positive"
      },
      {
        "confidence": 0.8,
        "had_rag": true,
        "model": "qwen3.5:4b",
        "verdict": "false_positive"
      },
      {
        "confidence": 0.9,
        "had_rag": true,
        "model": "deepseek-r1:16b",
        "verdict": "false_positive"
      }
    ],
    "winning_count": 2,
    "winning_verdict": "false_positive"
  }
}