返回案件詳情
案件中心 / LayerC 詳情 / 證據檢視
證據概況
Evidence OverviewCase ID：wazuh-192-168-168-19-1788366664419
主機DESKTOP-VI07398
攻擊者未提供
時間範圍2026/09/03 00:32:44 ~ 2026/09/03 00:32:29
證據總覽
20總證據
已驗證
2
待確認
18
資料來源
2
已驗證 10%待確認 90%
證據關聯摘要
主機
1 DESKTOP-VI07398
攻擊者 IP
1 未提供
目的 IP
192.168.168.19, 未提供
主要程序
System
Session
tdv2YqABETJ8ibgTjgPL
| 時間 | 證據 ID | 來源 | 事件摘要 | 嚴重性 | 證據權重分數 | 關聯實體 | 狀態 | |
|---|---|---|---|---|---|---|---|---|
| 2026/09/03 00:32:44 | exercise:BADUSB_S… | Wazuh Alert | 授權演練步驟：列舉目前執行程序 | 高 | 78% | 未提供 DESKTOP-VI07398 | 已收錄 | |
| 2026/09/03 00:32:38 | exercise:BADUSB_S… | Wazuh Alert | 授權演練步驟：蒐集主機與作業系統資訊 | 高 | 78% | 未提供 DESKTOP-VI07398 | 已收錄 | |
| 2026/09/03 00:32:29 | edr-wazuh:uNv3YqA… | Wazuh Alert | Sysmon detected Calculator launched by PowerShell (PowerShell（T1059.001）: PowerShell). | 低 | 32% | 192.168.168.19 DESKTOP-VI07398 | 已收錄 | |
| 2026/09/03 00:32:29 | edr-wazuh:t9v3YqA… | Wazuh Alert | Integrity checksum changed. 檔案：demo-complete.json | 低 | 32% | 192.168.168.19 DESKTOP-VI07398 | 已收錄 | |
| 2026/09/03 00:31:58 | edr-wazuh:tdv2YqA… | Wazuh Alert | File integrity monitoring detected discovery.json creation or modification following user, system, network, and process discovery activity. | 低 | 32% | 192.168.168.19 DESKTOP-VI07398 | 已收錄 | |
| 2026/09/03 00:31:57 | edr-wazuh:tNv2YqA… | Wazuh Alert | PowerShell queried IPv4 addresses and network interface settings (系統網路設定探索（T1016）: System Network Configuration Discovery). | 低 | 32% | 192.168.168.19 DESKTOP-VI07398 | 已收錄 | |
| 2026/09/03 00:31:39 | edr-wazuh:stv2YqA… | Wazuh Alert | File integrity monitoring detected a JSON or status file change in a monitored directory. | 低 | 32% | 192.168.168.19 DESKTOP-VI07398 | 已收錄 | |
| 2026/09/03 00:31:16 | edr-wazuh:sdv1YqA… | Wazuh Alert | External input device activity was followed by a Sysmon-observed PowerShell process on the same host (新增硬體裝置（T1200） to PowerShell（T1059.001）). | 低 | 32% | 192.168.168.19 DESKTOP-VI07398 | 已收錄 | |
| 2026/09/03 00:31:04 | edr-wazuh:sNv1YqA… | Wazuh Alert | External input device VID_0483/PID_5750 detected (新增硬體裝置（T1200）: Hardware Additions). | 低 | 32% | 192.168.168.19 DESKTOP-VI07398 | 已收錄 |