{
  "author": "ckeller@fusioncybersecurity.us",
  "cat": "New Code Atypical Path",
  "detect": {
    "event": {
      "FILE_PATH": "C:\\Windows\\Temp\\3A22930E-7933-4932-A06B-DA4B7DB2FB1F\\MpRecovery.exe",
      "HASH": "317f4ff99ea5501b6d80229c9bda4d459eb942536b4e05021abf8b167295bc71",
      "PROCESS_ID": 17988
    },
    "routing": {
      "arch": 2,
      "did": "",
      "event_id": "2d8d37fa-23c2-4e14-8524-ae07f703fa37",
      "event_time": 1774468113361,
      "event_type": "NEW_DOCUMENT",
      "ext_ip": "23.128.32.10",
      "hostname": "desktop-3nfb237",
      "iid": "b2cd59fc-d09d-49e0-a9f2-1fd79ee9c175",
      "int_ip": "192.168.50.40",
      "latency": 6932,
      "moduleid": 2,
      "oid": "d3541070-8b0e-4663-8a6a-aa0727aacd36",
      "parent": "9727bc761f07cc5e5c90b93a69c43c07",
      "plat": 268435456,
      "sid": "ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136",
      "tags": [
        "fusion-soc-alert",
        "fusion-soc-case",
        "fusion-soc-pulled",
        "fusion-soc-triage",
        "fusionsoc-critical",
        "fusionsoc-high",
        "fusionsoc-investigated",
        "qucikbooks",
        "windows",
        "yara_detection_memory"
      ],
      "this": "2e1ce33db2e54cf757ee4ab469c43c17"
    }
  },
  "detect_id": "b739f384-e76c-4401-b68c-50ff69c43c18",
  "gen_time": 1774468120293,
  "link": "https://app.limacharlie.io/orgs/d3541070-8b0e-4663-8a6a-aa0727aacd36/sensors/ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136/timeline?time=1774468113\u0026selected=2e1ce33db2e54cf757ee4ab469c43c17",
  "namespace": "general",
  "routing": {
    "arch": 2,
    "did": "",
    "event_id": "2d8d37fa-23c2-4e14-8524-ae07f703fa37",
    "event_time": 1774468113361,
    "event_type": "NEW_DOCUMENT",
    "ext_ip": "23.128.32.10",
    "hostname": "desktop-3nfb237",
    "iid": "b2cd59fc-d09d-49e0-a9f2-1fd79ee9c175",
    "int_ip": "192.168.50.40",
    "latency": 6932,
    "moduleid": 2,
    "oid": "d3541070-8b0e-4663-8a6a-aa0727aacd36",
    "parent": "9727bc761f07cc5e5c90b93a69c43c07",
    "plat": 268435456,
    "sid": "ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136",
    "tags": [
      "fusion-soc-alert",
      "fusion-soc-case",
      "fusion-soc-pulled",
      "fusion-soc-triage",
      "fusionsoc-critical",
      "fusionsoc-high",
      "fusionsoc-investigated",
      "qucikbooks",
      "windows",
      "yara_detection_memory"
    ],
    "this": "2e1ce33db2e54cf757ee4ab469c43c17"
  },
  "source": "d3541070-8b0e-4663-8a6a-aa0727aacd36.b2cd59fc-d09d-49e0-a9f2-1fd79ee9c175.ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136.10000000.2",
  "source_rule": "general.NEW FILE WRITE BYTES SAMPLE GRAB",
  "ts": 1774468120000
}

{
  "virustotal": {
    "malicious": false,
    "provider": "virustotal",
    "reputation": 0,
    "stats": {
      "confirmed-timeout": 0,
      "failure": 0,
      "harmless": 0,
      "malicious": 0,
      "suspicious": 0,
      "timeout": 0,
      "type-unsupported": 4,
      "undetected": 72
    }
  }
}

{
  "confidence": 0.633,
  "false_positive_reason": null,
  "investigation_questions": [],
  "ioc_analysis": "",
  "iocs_extracted": [],
  "mitre_techniques": [],
  "recommended_actions": [
    "Manual analyst review required \u2014 AI models (majority)",
    "Manual review required"
  ],
  "risk_score": 23,
  "severity": "high",
  "summary": "**Vote: MAJORITY (2/3 -\u003e FALSE POSITIVE)**\n\n### \ud83e\udd16 qwen3.5:4b Analysis (Secondary + RAG)\n**Verdict:** false_positive | **Confidence:** 0.95\nThis detection is a false positive because MpRecovery.exe is a legitimate Microsoft Defender process that operates in the Windows Temp directory during scanning operations. The process tree shows it spawning MpSigStub.exe with standard signatures stubbing commands, which is consistent with normal antivirus behavior.\n\n**IOC Analysis:** MpRecovery.exe is a known Microsoft Defender recovery process that runs from C:\\Windows\\Temp\\ during scans. The child process MpSigStub.exe executing signature stubbing commands confirms this is legitimate Windows Defender activity rather than malware execution.\n\n---\n\n### \ud83e\udd16 deepseek-r1:8b Analysis (Secondary + RAG)\n**Verdict:** false_positive | **Confidence:** 0.95\nThe detection event is likely a false positive as the file and process are associated with legitimate Microsoft security services, specifically Windows Defender components, and no malicious activity was detected in the investigation.\n\n**IOC Analysis:** The FILE_PATH C:\\Windows\\Temp\\3A22930E-7933-4932-A06B-DA4B7DB2FB1F\\MpRecovery.exe and its child process MpSigStub.exe are commonly used by Microsoft security tools for legitimate system operations. The hash provided does not match known malware signatures, and the process tree shows no suspicious behavior. The location in C:\\Windows\\Temp is typical for temporary files used by system processes, and the user context (NT AUTHORITY\\SYSTEM) is consistent with system-level operations.",
  "verdict": "false_positive",
  "voting": {
    "auto_action": "manual_review",
    "mode": "majority",
    "total_models": 3,
    "vote_summary": [
      "gemini-cli: true_positive (medium, 0% confidence)",
      "qwen3.5:4b +RAG: false_positive (informational, 95% confidence)",
      "deepseek-r1:8b +RAG: false_positive (low, 95% confidence)"
    ],
    "votes": [
      {
        "confidence": 0.0,
        "model": "gemini-cli",
        "verdict": "true_positive"
      },
      {
        "confidence": 0.95,
        "had_rag": true,
        "model": "qwen3.5:4b",
        "verdict": "false_positive"
      },
      {
        "confidence": 0.95,
        "had_rag": true,
        "model": "deepseek-r1:8b",
        "verdict": "false_positive"
      }
    ],
    "winning_count": 2,
    "winning_verdict": "false_positive"
  }
}