←
Case #576
general.Sensitive Process Accessed
🏷️ Analyst Verdict Classification
FP by analyst🤖 AI Analysis
🔔 Detections (1)
Sensitive Process Accessed
medium
Rule: general.Sensitive Process Accessed
Hostname: desktop-3nfb237 · Sensor: ed8f7c3f-3a1a-49...
Event Type: SENSITIVE_PROCESS_ACCESS
Confidence: 0% · Verdict: true positive
Event Data:
EVENTS:
[{'event': {'BASE_ADDRESS': 140702525030400, 'COMMAND_LINE': 'C:\\WINDOWS\\system32\\lsass.exe', 'CREATION_TIME': 1773245868875, 'FILE_IS_SIGNED': 1, 'FILE_PATH': 'C:\\WINDOWS\\system32\\lsass.exe', 'HASH': '055a1226a769948a79ed0972bdee2d91937c4b521e0b9046f9b8ccc63d110115', 'MEMORY_USAGE': 19705856, 'PARENT': {'FILE_IS_SIGNED': 1, 'FILE_PATH': '\\Device\\HarddiskVolume3\\Windows\\System32\\wininit.exe', 'HASH': 'ba26910be549b8700c08fbe2f160952288864470a30dd35c3c6b7782f7dbf857', 'MEMORY_USAGE': 7323648, 'PARENT_PROCESS_ID': 720, 'PROCESS_ID': 840, 'THIS_ATOM': '58b1f2a11a942a48999a6fbd69b1964c', 'THREADS': 1, 'TIMESTAMP': 1773246028618, 'USER_NAME': 'NT AUTHORITY\\SYSTEM'}, 'PARENT_PROCESS_ID': 840, 'PROCESS_ID': 980, 'THREADS': 16, 'USER_NAME': 'NT AUTHORITY\\SYSTEM'}, 'routing': {'arch': 2, 'did': '', 'event_id': 'ccbf1dd2-90a4-4149-a4ff-4eec2c992a19', 'event_time': 1773246029212, 'event_type': 'EXISTING_PROCESS', 'ext_ip': '23.128.32.10', 'hostname': 'desktop-3nfb237', 'iid': 'b2cd59fc-d09d-49e0-a9f2-1fd79ee9c175', 'int_ip': '192.168.50.40', 'latency': 1260584843, 'moduleid': 2, 'oid': 'd3541070-8b0e-4663-8a6a-aa0727aacd36', 'parent': '58b1f2a11a942a48999a6fbd69b1964c', 'plat': 268435456, 'sid': 'ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136', 'tags': ['fusion-soc-alert', 'fusion-soc-case', 'fusion-soc-pulled', 'fusion-soc-triage', 'fusionsoc-critical', 'fusionsoc-high', 'fusionsoc-investigated', 'qucikbooks', 'windows'], 'this': 'b2fe617fb2365f162bc5846069b1964d'}}, {'event': {'ACCESS_FLAGS': 2097151, 'PARENT_PROCESS_ID': 14404, 'PROCESS_ID': 980, 'SOURCE': {'BASE_ADDRESS': 8847360, 'COMMAND_LINE': '"C:\\Program Files\\Dell\\SupportAssistAgent\\SRE\\SRE.exe" "en" "C:\\ProgramData\\Dell\\SupportAssist\\Agent\\Certificate\\SRE\\c64488ae-9e87-4370-ae3f-c87763d98f56.pfx" "127.0.0.1:10560" "14353ecf-d8a0-479d-a7cb-b846d1c121df" "false"', 'FILE_IS_SIGNED': 1, 'FILE_PATH': 'C:\\Program Files\\Dell\\SupportAssistAgent\\SRE\\SRE.exe', 'HASH': '4209038199a68a376fc84137887a18bbeb149f54ad610645f2d585c44a569f31', 'MEMORY_USAGE': 2113536, 'PARENT_ATOM': 'dc9dc13c395f9426efb5762e69c4d10e', 'PARENT_PROCESS_ID': 15104, 'PROCESS_ID': 14404, 'THIS_ATOM': '409619ceaae053692b3c62d269c4d184', 'THREADS': 1, 'TIMESTAMP': 1774506372343, 'USER_NAME': 'NT AUTHORITY\\SYSTEM'}, 'TARGET': {'BASE_ADDRESS': 140702525030400, 'COMMAND_LINE': 'C:\\WINDOWS\\system32\\lsass.exe', 'CREATION_TIME': 1773245868875, 'FILE_IS_SIGNED': 1, 'FILE_PATH': 'C:\\WINDOWS\\system32\\lsass.exe', 'HASH': '055a1226a769948a79ed0972bdee2d91937c4b521e0b9046f9b8ccc63d110115', 'MEMORY_USAGE': 19705856, 'PARENT_ATOM': '58b1f2a11a942a48999a6fbd69b1964c', 'PARENT_PROCESS_ID': 840, 'PROCESS_ID': 980, 'THIS_ATOM': 'b2fe617fb2365f162bc5846069b1964d', 'THREADS': 16, 'TIMESTAMP': 1773246029212, 'USER_NAME': 'NT AUTHORITY\\SYSTEM'}}, 'routing': {'arch': 2, 'did': '', 'event_id': 'dc3452e8-aa50-46dd-94b6-d90239887be8', 'event_time': 1774506613600, 'event_type': 'REMOTE_PROCESS_HANDLE', 'ext_ip': '23.128.32.10', 'hostname': 'desktop-3nfb237', 'iid': 'b2cd59fc-d09d-49e0-a9f2-1fd79ee9c175', 'int_ip': '192.168.50.40', 'latency': 455, 'moduleid': 2, 'oid': 'd3541070-8b0e-4663-8a6a-aa0727aacd36', 'parent': '409619ceaae053692b3c62d269c4d184', 'plat': 268435456, 'sid': 'ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136', 'tags': ['fusion-soc-alert', 'fusion-soc-case', 'fusion-soc-pulled', 'fusion-soc-triage', 'fusionsoc-critical', 'fusionsoc-high', 'fusionsoc-investigated', 'qucikbooks', 'windows'], 'target': 'b2fe617fb2365f162bc5846069b1964d', 'this': '48063a584692539cd31f203569c4d275'}}]
Analyst Declaration:
📄 Raw Detection JSON
{
"author": "ckeller@fusioncybersecurity.us",
"cat": "Sensitive Process Accessed",
"detect": {
"event": {
"EVENTS": [
{
"event": {
"BASE_ADDRESS": 140702525030400,
"COMMAND_LINE": "C:\\WINDOWS\\system32\\lsass.exe",
"CREATION_TIME": 1773245868875,
"FILE_IS_SIGNED": 1,
"FILE_PATH": "C:\\WINDOWS\\system32\\lsass.exe",
"HASH": "055a1226a769948a79ed0972bdee2d91937c4b521e0b9046f9b8ccc63d110115",
"MEMORY_USAGE": 19705856,
"PARENT": {
"FILE_IS_SIGNED": 1,
"FILE_PATH": "\\Device\\HarddiskVolume3\\Windows\\System32\\wininit.exe",
"HASH": "ba26910be549b8700c08fbe2f160952288864470a30dd35c3c6b7782f7dbf857",
"MEMORY_USAGE": 7323648,
"PARENT_PROCESS_ID": 720,
"PROCESS_ID": 840,
"THIS_ATOM": "58b1f2a11a942a48999a6fbd69b1964c",
"THREADS": 1,
"TIMESTAMP": 1773246028618,
"USER_NAME": "NT AUTHORITY\\SYSTEM"
},
"PARENT_PROCESS_ID": 840,
"PROCESS_ID": 980,
"THREADS": 16,
"USER_NAME": "NT AUTHORITY\\SYSTEM"
},
"routing": {
"arch": 2,
"did": "",
"event_id": "ccbf1dd2-90a4-4149-a4ff-4eec2c992a19",
"event_time": 1773246029212,
"event_type": "EXISTING_PROCESS",
"ext_ip": "23.128.32.10",
"hostname": "desktop-3nfb237",
"iid": "b2cd59fc-d09d-49e0-a9f2-1fd79ee9c175",
"int_ip": "192.168.50.40",
"latency": 1260584843,
"moduleid": 2,
"oid": "d3541070-8b0e-4663-8a6a-aa0727aacd36",
"parent": "58b1f2a11a942a48999a6fbd69b1964c",
"plat": 268435456,
"sid": "ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136",
"tags": [
"fusion-soc-alert",
"fusion-soc-case",
"fusion-soc-pulled",
"fusion-soc-triage",
"fusionsoc-critical",
"fusionsoc-high",
"fusionsoc-investigated",
"qucikbooks",
"windows"
],
"this": "b2fe617fb2365f162bc5846069b1964d"
}
},
{
"event": {
"ACCESS_FLAGS": 2097151,
"PARENT_PROCESS_ID": 14404,
"PROCESS_ID": 980,
"SOURCE": {
"BASE_ADDRESS": 8847360,
"COMMAND_LINE": "\"C:\\Program Files\\Dell\\SupportAssistAgent\\SRE\\SRE.exe\" \"en\" \"C:\\ProgramData\\Dell\\SupportAssist\\Agent\\Certificate\\SRE\\c64488ae-9e87-4370-ae3f-c87763d98f56.pfx\" \"127.0.0.1:10560\" \"14353ecf-d8a0-479d-a7cb-b846d1c121df\" \"false\"",
"FILE_IS_SIGNED": 1,
"FILE_PATH": "C:\\Program Files\\Dell\\SupportAssistAgent\\SRE\\SRE.exe",
"HASH": "4209038199a68a376fc84137887a18bbeb149f54ad610645f2d585c44a569f31",
"MEMORY_USAGE": 2113536,
"PARENT_ATOM": "dc9dc13c395f9426efb5762e69c4d10e",
"PARENT_PROCESS_ID": 15104,
"PROCESS_ID": 14404,
"THIS_ATOM": "409619ceaae053692b3c62d269c4d184",
"THREADS": 1,
"TIMESTAMP": 1774506372343,
"USER_NAME": "NT AUTHORITY\\SYSTEM"
},
"TARGET": {
"BASE_ADDRESS": 140702525030400,
"COMMAND_LINE": "C:\\WINDOWS\\system32\\lsass.exe",
"CREATION_TIME": 1773245868875,
"FILE_IS_SIGNED": 1,
"FILE_PATH": "C:\\WINDOWS\\system32\\lsass.exe",
"HASH": "055a1226a769948a79ed0972bdee2d91937c4b521e0b9046f9b8ccc63d110115",
"MEMORY_USAGE": 19705856,
"PARENT_ATOM": "58b1f2a11a942a48999a6fbd69b1964c",
"PARENT_PROCESS_ID": 840,
"PROCESS_ID": 980,
"THIS_ATOM": "b2fe617fb2365f162bc5846069b1964d",
"THREADS": 16,
"TIMESTAMP": 1773246029212,
"USER_NAME": "NT AUTHORITY\\SYSTEM"
}
},
"routing": {
"arch": 2,
"did": "",
"event_id": "dc3452e8-aa50-46dd-94b6-d90239887be8",
"event_time": 1774506613600,
"event_type": "REMOTE_PROCESS_HANDLE",
"ext_ip": "23.128.32.10",
"hostname": "desktop-3nfb237",
"iid": "b2cd59fc-d09d-49e0-a9f2-1fd79ee9c175",
"int_ip": "192.168.50.40",
"latency": 455,
"moduleid": 2,
"oid": "d3541070-8b0e-4663-8a6a-aa0727aacd36",
"parent": "409619ceaae053692b3c62d269c4d184",
"plat": 268435456,
"sid": "ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136",
"tags": [
"fusion-soc-alert",
"fusion-soc-case",
"fusion-soc-pulled",
"fusion-soc-triage",
"fusionsoc-critical",
"fusionsoc-high",
"fusionsoc-investigated",
"qucikbooks",
"windows"
],
"target": "b2fe617fb2365f162bc5846069b1964d",
"this": "48063a584692539cd31f203569c4d275"
}
}
]
},
"routing": {
"arch": 2,
"did": "",
"event_id": "457ac9ee-3381-4c44-9ad9-8db5ccbec522",
"event_time": 1774506613944,
"event_type": "SENSITIVE_PROCESS_ACCESS",
"ext_ip": "23.128.32.10",
"hostname": "desktop-3nfb237",
"iid": "b2cd59fc-d09d-49e0-a9f2-1fd79ee9c175",
"int_ip": "192.168.50.40",
"latency": 111,
"moduleid": 2,
"oid": "d3541070-8b0e-4663-8a6a-aa0727aacd36",
"parent": "409619ceaae053692b3c62d269c4d184",
"plat": 268435456,
"sid": "ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136",
"tags": [
"fusion-soc-alert",
"fusion-soc-case",
"fusion-soc-pulled",
"fusion-soc-triage",
"fusionsoc-critical",
"fusionsoc-high",
"fusionsoc-investigated",
"qucikbooks",
"windows"
],
"target": "b2fe617fb2365f162bc5846069b1964d",
"this": "1a89f45c39eaa7600a7e24e469c4d275"
}
},
"detect_id": "6c23e602-3219-4be0-b478-273769c4d276",
"gen_time": 1774506614055,
"link": "https://app.limacharlie.io/orgs/d3541070-8b0e-4663-8a6a-aa0727aacd36/sensors/ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136/timeline?time=1774506613\u0026selected=1a89f45c39eaa7600a7e24e469c4d275",
"namespace": "general",
"routing": {
"arch": 2,
"did": "",
"event_id": "457ac9ee-3381-4c44-9ad9-8db5ccbec522",
"event_time": 1774506613944,
"event_type": "SENSITIVE_PROCESS_ACCESS",
"ext_ip": "23.128.32.10",
"hostname": "desktop-3nfb237",
"iid": "b2cd59fc-d09d-49e0-a9f2-1fd79ee9c175",
"int_ip": "192.168.50.40",
"latency": 111,
"moduleid": 2,
"oid": "d3541070-8b0e-4663-8a6a-aa0727aacd36",
"parent": "409619ceaae053692b3c62d269c4d184",
"plat": 268435456,
"sid": "ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136",
"tags": [
"fusion-soc-alert",
"fusion-soc-case",
"fusion-soc-pulled",
"fusion-soc-triage",
"fusionsoc-critical",
"fusionsoc-high",
"fusionsoc-investigated",
"qucikbooks",
"windows"
],
"target": "b2fe617fb2365f162bc5846069b1964d",
"this": "1a89f45c39eaa7600a7e24e469c4d275"
},
"source": "d3541070-8b0e-4663-8a6a-aa0727aacd36.b2cd59fc-d09d-49e0-a9f2-1fd79ee9c175.ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136.10000000.2",
"source_rule": "general.Sensitive Process Accessed",
"ts": 1774506624000
}
🌍 Threat Intel JSON
{
"virustotal": [
{
"malicious": false,
"provider": "virustotal",
"reputation": 10,
"stats": {
"confirmed-timeout": 0,
"failure": 1,
"harmless": 0,
"malicious": 0,
"suspicious": 0,
"timeout": 0,
"type-unsupported": 4,
"undetected": 71
}
},
{
"malicious": false,
"provider": "virustotal",
"reputation": 0,
"stats": {
"confirmed-timeout": 0,
"failure": 0,
"harmless": 0,
"malicious": 0,
"suspicious": 0,
"timeout": 1,
"type-unsupported": 4,
"undetected": 71
}
},
{
"malicious": false,
"provider": "virustotal",
"reputation": 0,
"stats": {
"confirmed-timeout": 0,
"failure": 0,
"harmless": 0,
"malicious": 0,
"suspicious": 0,
"timeout": 0,
"type-unsupported": 4,
"undetected": 72
}
}
]
}
🤖 Triage JSON
{
"confidence": 0.0,
"error": "llm_unavailable",
"false_positive_reason": null,
"investigation_questions": [],
"iocs_extracted": [],
"mitre_techniques": [],
"recommended_actions": [
"Manual review required"
],
"risk_score": 50,
"severity": "medium",
"summary": "LLM analysis unavailable \u2014 all models failed. Manual review required.",
"verdict": "true_positive"
}
⚙️ Response Actions
| Action | Target | Status | Result | |
|---|---|---|---|---|
| tag | approved | — | ||
| recommended | pending | — | ||
| tag | executed | Tag applied | ||
| recommended | executed | General Activity Sweep: 0 events found | ||
| tag | executed | Tag applied | ||
| recommended | executed | General Activity Sweep: 0 events found | ||
| recommended | executed | General Activity Sweep: 0 events found | ||
| tag | executed | Tag applied | ||
| recommended | executed | General Activity Sweep: 0 events found | ||
| recommended | executed | General Activity Sweep: 0 events found |
📝 Add Note
💬 Notes (10)
🤖 FusionSOC AI
2026-03-26T16:58
🤖 FusionSOC AI
2026-03-26T16:56
🤖 FusionSOC AI
2026-03-26T16:56
🤖 FusionSOC AI
2026-03-26T16:23
🤖 FusionSOC AI
2026-03-26T16:23
🤖 FusionSOC AI
2026-03-26T16:23
🤖 FusionSOC AI
2026-03-26T15:02
🤖 FusionSOC AI
2026-03-26T15:02
🤖 FusionSOC AI
2026-03-26T14:19
🤖 FusionSOC AI
2026-03-26T14:19
📜 Timeline
2026-03-26T17:55:32
analyst
Status changed: triaging → closed
2026-03-26T17:55:27
analyst
Analyst classified as False Positive (FP)
2026-03-26T17:53:08
Analyst
Case queued for re-triage. 1 detection(s) reset to enriched pipeline.
2026-03-26T16:59:36
Analyst
Case queued for re-triage. 1 detection(s) reset to enriched pipeline.
2026-03-26T16:58:09
FusionSOC AI
Note by FusionSOC AI: ## 🗳️ Secondary Vote (RAG-Enhanced) **Vote:** UNANIMOUS (3/3 → FALSE POSITIVE) - dgx-122b: false_positive (informationa...
2026-03-26T16:56:46
FusionSOC AI
Status changed: investigating → investigating
2026-03-26T16:56:46
FusionSOC
Action recommended → executed: General Activity Sweep: 0 events found
2026-03-26T16:56:46
FusionSOC AI
Note by FusionSOC AI: ## 🔍 General Activity Sweep **Action:** Add to allowlist if rule is noisy **Sensor:** `ed8f7c3f-3a1a-49...` **Time Windo...
2026-03-26T16:56:46
FusionSOC
Response action queued: recommended on Add to allowlist if rule is noisy
2026-03-26T16:56:46
FusionSOC AI
Status changed: triaging → investigating
2026-03-26T16:56:46
FusionSOC
Action recommended → executed: General Activity Sweep: 0 events found
2026-03-26T16:56:46
FusionSOC AI
Note by FusionSOC AI: ## 🔍 General Activity Sweep **Action:** Mark as False Positive **Sensor:** `ed8f7c3f-3a1a-49...` **Time Window:** +/- 2 ...
2026-03-26T16:56:46
FusionSOC
Response action queued: recommended on Mark as False Positive
2026-03-26T16:56:46
FusionSOC
Action tag → executed: Tag applied
2026-03-26T16:56:46
FusionSOC
Response action queued: tag on ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136:fusionsoc-investigated
2026-03-26T16:45:21
Analyst
Case queued for re-triage. 1 detection(s) reset to enriched pipeline.
2026-03-26T16:23:18
FusionSOC AI
Note by FusionSOC AI: ## 🗳️ Secondary Vote (RAG-Enhanced) **Vote:** MAJORITY (1/1 → FALSE POSITIVE) - dgx-122b: false_positive (low, 95% conf...
2026-03-26T16:23:12
FusionSOC AI
Status changed: investigating → investigating
2026-03-26T16:23:12
FusionSOC
Action recommended → executed: General Activity Sweep: 0 events found
2026-03-26T16:23:12
FusionSOC AI
Note by FusionSOC AI: ## 🔍 General Activity Sweep **Action:** Add to allowlist if rule is noisy **Sensor:** `ed8f7c3f-3a1a-49...` **Time Windo...
2026-03-26T16:23:12
FusionSOC
Response action queued: recommended on Add to allowlist if rule is noisy
2026-03-26T16:23:12
FusionSOC AI
Status changed: triaging → investigating
2026-03-26T16:23:12
FusionSOC
Action recommended → executed: General Activity Sweep: 0 events found
2026-03-26T16:23:12
FusionSOC AI
Note by FusionSOC AI: ## 🔍 General Activity Sweep **Action:** Mark as false positive **Sensor:** `ed8f7c3f-3a1a-49...` **Time Window:** +/- 2 ...
2026-03-26T16:23:11
FusionSOC
Response action queued: recommended on Mark as false positive
2026-03-26T16:23:11
FusionSOC
Action tag → executed: Tag applied
2026-03-26T16:23:11
FusionSOC
Response action queued: tag on ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136:fusionsoc-investigated
2026-03-26T16:17:21
Analyst
Case queued for re-triage. 1 detection(s) reset to enriched pipeline.
2026-03-26T15:02:34
FusionSOC AI
Note by FusionSOC AI: ## 🗳️ Secondary Vote (RAG-Enhanced) **Vote:** MAJORITY (1/1 → TRUE POSITIVE) - dgx-122b: true_positive (medium, 0% conf...
2026-03-26T15:02:28
FusionSOC AI
Status changed: closed → investigating
2026-03-26T15:02:28
FusionSOC
Action recommended → executed: General Activity Sweep: 0 events found
2026-03-26T15:02:28
FusionSOC AI
Note by FusionSOC AI: ## 🔍 General Activity Sweep **Action:** Manual review required **Sensor:** `ed8f7c3f-3a1a-49...` **Time Window:** +/- 2 ...
2026-03-26T15:02:27
FusionSOC
Response action queued: recommended on Manual review required
2026-03-26T15:02:27
FusionSOC
Action tag → executed: Tag applied
2026-03-26T15:02:27
FusionSOC
Response action queued: tag on ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136:fusionsoc-investigated
2026-03-26T14:59:57
analyst
Status changed: triaging → closed
2026-03-26T14:59:54
analyst
Analyst classified as False Positive (FP)
2026-03-26T14:37:50
Analyst
Case queued for re-triage. 1 detection(s) reset to enriched pipeline.
2026-03-26T14:19:27
FusionSOC AI
Note by FusionSOC AI: ## 🗳️ Secondary Vote (RAG-Enhanced) **Vote:** MAJORITY (2/3 → FALSE POSITIVE) - dgx-122b: true_positive (medium, 0% con...
2026-03-26T14:19:04
FusionSOC
Response action queued: recommended on Manual review required
2026-03-26T14:19:04
FusionSOC
Response action queued: tag on ed8f7c3f-3a1a-493e-8fa4-35eb8c30b136:fusionsoc-investigated
2026-03-26T14:19:04
FusionSOC AI
Detection 6c23e602-3219-4be0-b478-273769c4d276 triaged as true_positive (medium severity, confidence: 0%)
2026-03-26T14:19:04
FusionSOC AI
Case created from detection: general.Sensitive Process Accessed