@cryptotaxi247 / CoPilot
Code Commits Issues Pulls Sessions CI/CD
main
main
ts 954 lines 25.4 KB
Raw
1 import type { Artifact, CollectResult, CommandResult, QuarantineResult } from "@/types/artifacts.d"
2
3 export const collectResult: CollectResult[] = [
4 {
5 Pid: 928,
6 Name: "svchost.exe",
7 Family: "IPv4",
8 Type: "TCP",
9 Status: "LISTEN",
10 "Laddr.IP": "0.0.0.0",
11 "Laddr.Port": 135,
12 "Raddr.IP": "0.0.0.0",
13 "Raddr.Port": 0,
14 Timestamp: "2023-11-07T16:32:23Z"
15 },
16 {
17 Pid: 4,
18 Name: "System",
19 Family: "IPv4",
20 Type: "TCP",
21 Status: "LISTEN",
22 "Laddr.IP": "192.168.200.3",
23 "Laddr.Port": 139,
24 "Raddr.IP": "0.0.0.0",
25 "Raddr.Port": 0,
26 Timestamp: "2023-11-07T16:32:31Z"
27 },
28 {
29 Pid: 344,
30 Name: "svchost.exe",
31 Family: "IPv4",
32 Type: "TCP",
33 Status: "LISTEN",
34 "Laddr.IP": "0.0.0.0",
35 "Laddr.Port": 3389,
36 "Raddr.IP": "0.0.0.0",
37 "Raddr.Port": 0,
38 Timestamp: "2023-11-07T16:32:28Z"
39 },
40 {
41 Pid: 540,
42 Name: "wininit.exe",
43 Family: "IPv4",
44 Type: "TCP",
45 Status: "LISTEN",
46 "Laddr.IP": "0.0.0.0",
47 "Laddr.Port": 49664,
48 "Raddr.IP": "0.0.0.0",
49 "Raddr.Port": 0,
50 Timestamp: "2023-11-07T16:32:23Z"
51 },
52 {
53 Name: "System",
54 PebBaseAddress: "0x0",
55 Pid: 4,
56 ImagePathName: null,
57 CommandLine: null,
58 CurrentDirectory: null,
59 Env: {}
60 },
61 {
62 Name: "Registry",
63 PebBaseAddress: "0x0",
64 Pid: 104,
65 ImagePathName: null,
66 CommandLine: null,
67 CurrentDirectory: null,
68 Env: {}
69 },
70 {
71 Name: "smss.exe",
72 PebBaseAddress: "0xc24b5b6000",
73 Pid: 304,
74 ImagePathName: null,
75 CommandLine: null,
76 CurrentDirectory: null,
77 Env: {}
78 },
79 {
80 Name: "csrss.exe",
81 PebBaseAddress: "0xa5397a7000",
82 Pid: 440,
83 ImagePathName: null,
84 CommandLine: null,
85 CurrentDirectory: null,
86 Env: {}
87 },
88 {
89 Name: "csrss.exe",
90 PebBaseAddress: "0x94c1180000",
91 Pid: 516,
92 ImagePathName: null,
93 CommandLine: null,
94 CurrentDirectory: null,
95 Env: {}
96 },
97 {
98 Name: "wininit.exe",
99 PebBaseAddress: "0xc37cb67000",
100 Pid: 540,
101 ImagePathName: null,
102 CommandLine: null,
103 CurrentDirectory: null,
104 Env: {}
105 },
106 {
107 Name: "winlogon.exe",
108 PebBaseAddress: "0xff437be000",
109 Pid: 580,
110 ImagePathName: "C:\\Windows\\system32\\winlogon.exe",
111 CommandLine: "winlogon.exe",
112 CurrentDirectory: "C:\\Windows\\system32\\",
113 Env: {
114 ALLUSERSPROFILE: "C:\\ProgramData",
115 CommonProgramFiles: "C:\\Program Files\\Common Files",
116 "CommonProgramFiles(x86)": "C:\\Program Files (x86)\\Common Files",
117 CommonProgramW6432: "C:\\Program Files\\Common Files",
118 COMPUTERNAME: "WIN-HFOU106TD7K",
119 ComSpec: "C:\\Windows\\system32\\cmd.exe",
120 DriverData: "C:\\Windows\\System32\\Drivers\\DriverData",
121 NUMBER_OF_PROCESSORS: "4",
122 OS: "Windows_NT",
123 Path: "C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Windows\\System32\\OpenSSH\\",
124 PATHEXT: ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC",
125 PROCESSOR_ARCHITECTURE: "AMD64",
126 PROCESSOR_IDENTIFIER: "Intel64 Family 6 Model 44 Stepping 2, GenuineIntel",
127 PROCESSOR_LEVEL: "6",
128 PROCESSOR_REVISION: "2c02",
129 ProgramData: "C:\\ProgramData",
130 ProgramFiles: "C:\\Program Files",
131 "ProgramFiles(x86)": "C:\\Program Files (x86)",
132 ProgramW6432: "C:\\Program Files",
133 PSModulePath:
134 "%ProgramFiles%\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules",
135 PUBLIC: "C:\\Users\\Public",
136 SystemDrive: "C:",
137 SystemRoot: "C:\\Windows",
138 TEMP: "C:\\Windows\\TEMP",
139 TMP: "C:\\Windows\\TEMP",
140 USERNAME: "SYSTEM",
141 USERPROFILE: "C:\\Windows\\system32\\config\\systemprofile",
142 windir: "C:\\Windows"
143 }
144 },
145 {
146 Name: "services.exe",
147 PebBaseAddress: "0xee24dc5000",
148 Pid: 660,
149 ImagePathName: null,
150 CommandLine: null,
151 CurrentDirectory: null,
152 Env: {}
153 },
154 {
155 Name: "lsass.exe",
156 PebBaseAddress: "0xc168a3a000",
157 Pid: 680,
158 ImagePathName: "C:\\Windows\\system32\\lsass.exe",
159 CommandLine: "C:\\Windows\\system32\\lsass.exe",
160 CurrentDirectory: "C:\\Windows\\system32\\",
161 Env: {
162 ALLUSERSPROFILE: "C:\\ProgramData",
163 CommonProgramFiles: "C:\\Program Files\\Common Files",
164 "CommonProgramFiles(x86)": "C:\\Program Files (x86)\\Common Files",
165 CommonProgramW6432: "C:\\Program Files\\Common Files",
166 COMPUTERNAME: "WIN-HFOU106TD7K",
167 ComSpec: "C:\\Windows\\system32\\cmd.exe",
168 DriverData: "C:\\Windows\\System32\\Drivers\\DriverData",
169 NUMBER_OF_PROCESSORS: "4",
170 OS: "Windows_NT",
171 Path: "C:\\Windows\\System32",
172 PATHEXT: ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC",
173 PROCESSOR_ARCHITECTURE: "AMD64",
174 PROCESSOR_IDENTIFIER: "Intel64 Family 6 Model 44 Stepping 2, GenuineIntel",
175 PROCESSOR_LEVEL: "6",
176 PROCESSOR_REVISION: "2c02",
177 ProgramData: "C:\\ProgramData",
178 ProgramFiles: "C:\\Program Files",
179 "ProgramFiles(x86)": "C:\\Program Files (x86)",
180 ProgramW6432: "C:\\Program Files",
181 PSModulePath:
182 "%ProgramFiles%\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules",
183 PUBLIC: "C:\\Users\\Public",
184 SystemDrive: "C:",
185 SystemRoot: "C:\\Windows",
186 TEMP: "C:\\Windows\\TEMP",
187 TMP: "C:\\Windows\\TEMP",
188 USERNAME: "SYSTEM",
189 USERPROFILE: "C:\\Windows\\system32\\config\\systemprofile",
190 windir: "C:\\Windows"
191 }
192 },
193 {
194 Name: "svchost.exe",
195 PebBaseAddress: "0xbc2c40000",
196 Pid: 808,
197 ImagePathName: "C:\\Windows\\system32\\svchost.exe",
198 CommandLine: "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p",
199 CurrentDirectory: "C:\\Windows\\system32\\",
200 Env: {
201 ALLUSERSPROFILE: "C:\\ProgramData",
202 APPDATA: "C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming",
203 CommonProgramFiles: "C:\\Program Files\\Common Files",
204 "CommonProgramFiles(x86)": "C:\\Program Files (x86)\\Common Files",
205 CommonProgramW6432: "C:\\Program Files\\Common Files",
206 COMPUTERNAME: "WIN-HFOU106TD7K",
207 ComSpec: "C:\\Windows\\system32\\cmd.exe",
208 DriverData: "C:\\Windows\\System32\\Drivers\\DriverData",
209 LOCALAPPDATA: "C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local",
210 NUMBER_OF_PROCESSORS: "4",
211 OS: "Windows_NT",
212 Path: "C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Windows\\System32\\OpenSSH\\;C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\WindowsApps",
213 PATHEXT: ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC",
214 PROCESSOR_ARCHITECTURE: "AMD64",
215 PROCESSOR_IDENTIFIER: "Intel64 Family 6 Model 44 Stepping 2, GenuineIntel",
216 PROCESSOR_LEVEL: "6",
217 PROCESSOR_REVISION: "2c02",
218 ProgramData: "C:\\ProgramData",
219 ProgramFiles: "C:\\Program Files",
220 "ProgramFiles(x86)": "C:\\Program Files (x86)",
221 ProgramW6432: "C:\\Program Files",
222 PSModulePath:
223 "%ProgramFiles%\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules",
224 PUBLIC: "C:\\Users\\Public",
225 SystemDrive: "C:",
226 SystemRoot: "C:\\Windows",
227 TEMP: "C:\\Windows\\TEMP",
228 TMP: "C:\\Windows\\TEMP",
229 USERDOMAIN: "WORKGROUP",
230 USERNAME: "WIN-HFOU106TD7K$",
231 USERPROFILE: "C:\\Windows\\system32\\config\\systemprofile",
232 windir: "C:\\Windows"
233 }
234 },
235 {
236 Name: "fontdrvhost.exe",
237 PebBaseAddress: "0x61189f8000",
238 Pid: 832,
239 ImagePathName: "C:\\Windows\\system32\\fontdrvhost.exe",
240 CommandLine: '"fontdrvhost.exe"',
241 CurrentDirectory: "C:\\Windows\\system32\\",
242 Env: {
243 ALLUSERSPROFILE: "C:\\ProgramData",
244 CommonProgramFiles: "C:\\Program Files\\Common Files",
245 "CommonProgramFiles(x86)": "C:\\Program Files (x86)\\Common Files",
246 CommonProgramW6432: "C:\\Program Files\\Common Files",
247 COMPUTERNAME: "WIN-HFOU106TD7K",
248 ComSpec: "C:\\Windows\\system32\\cmd.exe",
249 DriverData: "C:\\Windows\\System32\\Drivers\\DriverData",
250 LOCALAPPDATA: "%TEMP%\\Packages\\microsoft.windows.fontdrvhost\\AC",
251 NUMBER_OF_PROCESSORS: "4",
252 OS: "Windows_NT",
253 Path: "C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Windows\\System32\\OpenSSH\\",
254 PATHEXT: ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC",
255 PROCESSOR_ARCHITECTURE: "AMD64",
256 PROCESSOR_IDENTIFIER: "Intel64 Family 6 Model 44 Stepping 2, GenuineIntel",
257 PROCESSOR_LEVEL: "6",
258 PROCESSOR_REVISION: "2c02",
259 ProgramData: "C:\\ProgramData",
260 ProgramFiles: "C:\\Program Files",
261 "ProgramFiles(x86)": "C:\\Program Files (x86)",
262 ProgramW6432: "C:\\Program Files",
263 PSModulePath:
264 "%ProgramFiles%\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules",
265 PUBLIC: "C:\\Users\\Public",
266 SystemDrive: "C:",
267 SystemRoot: "C:\\Windows",
268 TEMP: "%TEMP%\\Packages\\microsoft.windows.fontdrvhost\\AC\\Temp",
269 TMP: "%TEMP%\\Packages\\microsoft.windows.fontdrvhost\\AC\\Temp",
270 USERDOMAIN: "Font Driver Host",
271 USERNAME: "UMFD-1",
272 USERPROFILE: "C:\\Users\\Default",
273 windir: "C:\\Windows"
274 }
275 },
276 {
277 Name: "fontdrvhost.exe",
278 PebBaseAddress: "0xb19d6b6000",
279 Pid: 840,
280 ImagePathName: "C:\\Windows\\system32\\fontdrvhost.exe",
281 CommandLine: '"fontdrvhost.exe"',
282 CurrentDirectory: "C:\\Windows\\system32\\",
283 Env: {
284 ALLUSERSPROFILE: "C:\\ProgramData",
285 CommonProgramFiles: "C:\\Program Files\\Common Files",
286 "CommonProgramFiles(x86)": "C:\\Program Files (x86)\\Common Files",
287 CommonProgramW6432: "C:\\Program Files\\Common Files",
288 COMPUTERNAME: "WIN-HFOU106TD7K",
289 ComSpec: "C:\\Windows\\system32\\cmd.exe",
290 DriverData: "C:\\Windows\\System32\\Drivers\\DriverData",
291 LOCALAPPDATA: "%TEMP%\\Packages\\microsoft.windows.fontdrvhost\\AC",
292 NUMBER_OF_PROCESSORS: "4",
293 OS: "Windows_NT",
294 Path: "C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Windows\\System32\\OpenSSH\\",
295 PATHEXT: ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC",
296 PROCESSOR_ARCHITECTURE: "AMD64",
297 PROCESSOR_IDENTIFIER: "Intel64 Family 6 Model 44 Stepping 2, GenuineIntel",
298 PROCESSOR_LEVEL: "6",
299 PROCESSOR_REVISION: "2c02",
300 ProgramData: "C:\\ProgramData",
301 ProgramFiles: "C:\\Program Files",
302 "ProgramFiles(x86)": "C:\\Program Files (x86)",
303 ProgramW6432: "C:\\Program Files",
304 PSModulePath:
305 "%ProgramFiles%\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules",
306 PUBLIC: "C:\\Users\\Public",
307 SystemDrive: "C:",
308 SystemRoot: "C:\\Windows",
309 TEMP: "%TEMP%\\Packages\\microsoft.windows.fontdrvhost\\AC\\Temp",
310 TMP: "%TEMP%\\Packages\\microsoft.windows.fontdrvhost\\AC\\Temp",
311 USERDOMAIN: "Font Driver Host",
312 USERNAME: "UMFD-0",
313 USERPROFILE: "C:\\Users\\Default",
314 windir: "C:\\Windows"
315 }
316 },
317 {
318 Name: "svchost.exe",
319 PebBaseAddress: "0xd3e48df000",
320 Pid: 928,
321 ImagePathName: "C:\\Windows\\system32\\svchost.exe",
322 CommandLine: "C:\\Windows\\system32\\svchost.exe -k RPCSS -p",
323 CurrentDirectory: "C:\\Windows\\system32\\",
324 Env: {
325 ALLUSERSPROFILE: "C:\\ProgramData",
326 APPDATA: "C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Roaming",
327 CommonProgramFiles: "C:\\Program Files\\Common Files",
328 "CommonProgramFiles(x86)": "C:\\Program Files (x86)\\Common Files",
329 CommonProgramW6432: "C:\\Program Files\\Common Files",
330 COMPUTERNAME: "WIN-HFOU106TD7K",
331 ComSpec: "C:\\Windows\\system32\\cmd.exe",
332 DriverData: "C:\\Windows\\System32\\Drivers\\DriverData",
333 LOCALAPPDATA: "C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local",
334 NUMBER_OF_PROCESSORS: "4",
335 OS: "Windows_NT",
336 Path: "C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Windows\\System32\\OpenSSH\\;C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Microsoft\\WindowsApps",
337 PATHEXT: ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC",
338 PROCESSOR_ARCHITECTURE: "AMD64",
339 PROCESSOR_IDENTIFIER: "Intel64 Family 6 Model 44 Stepping 2, GenuineIntel",
340 PROCESSOR_LEVEL: "6",
341 PROCESSOR_REVISION: "2c02",
342 ProgramData: "C:\\ProgramData",
343 ProgramFiles: "C:\\Program Files",
344 "ProgramFiles(x86)": "C:\\Program Files (x86)",
345 ProgramW6432: "C:\\Program Files",
346 PSModulePath:
347 "%ProgramFiles%\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules",
348 PUBLIC: "C:\\Users\\Public",
349 SystemDrive: "C:",
350 SystemRoot: "C:\\Windows",
351 TEMP: "C:\\Windows\\SERVIC~1\\NETWOR~1\\AppData\\Local\\Temp",
352 TMP: "C:\\Windows\\SERVIC~1\\NETWOR~1\\AppData\\Local\\Temp",
353 USERDOMAIN: "WORKGROUP",
354 USERNAME: "WIN-HFOU106TD7K$",
355 USERPROFILE: "C:\\Windows\\ServiceProfiles\\NetworkService",
356 windir: "C:\\Windows"
357 }
358 },
359 {
360 Pid: 1188,
361 Name: "svchost.exe",
362 Family: "IPv4",
363 Type: "TCP",
364 Status: "LISTEN",
365 "Laddr.IP": "0.0.0.0",
366 "Laddr.Port": 49665,
367 "Raddr.IP": "0.0.0.0",
368 "Raddr.Port": 0,
369 Timestamp: "2023-11-07T16:32:28Z"
370 },
371 {
372 Pid: 680,
373 Name: "lsass.exe",
374 Family: "IPv4",
375 Type: "TCP",
376 Status: "LISTEN",
377 "Laddr.IP": "0.0.0.0",
378 "Laddr.Port": 49666,
379 "Raddr.IP": "0.0.0.0",
380 "Raddr.Port": 0,
381 Timestamp: "2023-11-07T16:32:31Z"
382 },
383 {
384 Pid: 464,
385 Name: "svchost.exe",
386 Family: "IPv4",
387 Type: "TCP",
388 Status: "LISTEN",
389 "Laddr.IP": "0.0.0.0",
390 "Laddr.Port": 49667,
391 "Raddr.IP": "0.0.0.0",
392 "Raddr.Port": 0,
393 Timestamp: "2023-11-07T16:32:33Z"
394 },
395 {
396 Pid: 464,
397 Name: "svchost.exe",
398 Family: "IPv4",
399 Type: "TCP",
400 Status: "LISTEN",
401 "Laddr.IP": "0.0.0.0",
402 "Laddr.Port": 49668,
403 "Raddr.IP": "0.0.0.0",
404 "Raddr.Port": 0,
405 Timestamp: "2023-11-07T16:32:33Z"
406 },
407 {
408 Pid: 1524,
409 Name: "spoolsv.exe",
410 Family: "IPv4",
411 Type: "TCP",
412 Status: "LISTEN",
413 "Laddr.IP": "0.0.0.0",
414 "Laddr.Port": 49670,
415 "Raddr.IP": "0.0.0.0",
416 "Raddr.Port": 0,
417 Timestamp: "2023-11-07T16:32:55Z"
418 },
419 {
420 Pid: 660,
421 Name: "services.exe",
422 Family: "IPv4",
423 Type: "TCP",
424 Status: "LISTEN",
425 "Laddr.IP": "0.0.0.0",
426 "Laddr.Port": 49676,
427 "Raddr.IP": "0.0.0.0",
428 "Raddr.Port": 0,
429 Timestamp: "2023-11-07T16:33:00Z"
430 },
431 {
432 Pid: 4312,
433 Name: "Velociraptor.exe",
434 Family: "IPv4",
435 Type: "TCP",
436 Status: "ESTAB",
437 "Laddr.IP": "192.168.200.3",
438 "Laddr.Port": 49876,
439 "Raddr.IP": "5.161.59.220",
440 "Raddr.Port": 8000,
441 Timestamp: "2023-11-08T06:27:07Z"
442 },
443 {
444 Pid: 464,
445 Name: "svchost.exe",
446 Family: "IPv4",
447 Type: "TCP",
448 Status: "ESTAB",
449 "Laddr.IP": "192.168.200.3",
450 "Laddr.Port": 49964,
451 "Raddr.IP": "20.7.1.246",
452 "Raddr.Port": 443,
453 Timestamp: "2023-11-09T08:38:11Z"
454 },
455 {
456 Pid: 2172,
457 Name: "wazuh-agent.exe",
458 Family: "IPv4",
459 Type: "TCP",
460 Status: "ESTAB",
461 "Laddr.IP": "192.168.200.3",
462 "Laddr.Port": 50109,
463 "Raddr.IP": "5.161.59.220",
464 "Raddr.Port": 1514,
465 Timestamp: "2023-11-10T17:58:50Z"
466 },
467 {
468 Pid: 4,
469 Name: "System",
470 Family: "IPv4",
471 Type: "TCP",
472 Status: "LISTEN",
473 "Laddr.IP": "0.0.0.0",
474 "Laddr.Port": 445,
475 "Raddr.IP": "0.0.0.0",
476 "Raddr.Port": 0,
477 Timestamp: "2023-11-07T16:32:58Z"
478 },
479 {
480 Pid: 4,
481 Name: "System",
482 Family: "IPv4",
483 Type: "TCP",
484 Status: "LISTEN",
485 "Laddr.IP": "0.0.0.0",
486 "Laddr.Port": 5357,
487 "Raddr.IP": "0.0.0.0",
488 "Raddr.Port": 0,
489 Timestamp: "2023-11-07T16:32:57Z"
490 },
491 {
492 Pid: 4,
493 Name: "System",
494 Family: "IPv4",
495 Type: "TCP",
496 Status: "LISTEN",
497 "Laddr.IP": "0.0.0.0",
498 "Laddr.Port": 5985,
499 "Raddr.IP": "0.0.0.0",
500 "Raddr.Port": 0,
501 Timestamp: "2023-11-07T16:32:58Z"
502 },
503 {
504 Pid: 4,
505 Name: "System",
506 Family: "IPv4",
507 Type: "TCP",
508 Status: "LISTEN",
509 "Laddr.IP": "0.0.0.0",
510 "Laddr.Port": 47001,
511 "Raddr.IP": "0.0.0.0",
512 "Raddr.Port": 0,
513 Timestamp: "2023-11-07T16:32:56Z"
514 },
515 {
516 Pid: 928,
517 Name: "svchost.exe",
518 Family: "IPv6",
519 Type: "TCP",
520 Status: "LISTEN",
521 "Laddr.IP": "::",
522 "Laddr.Port": 135,
523 "Raddr.IP": "::",
524 "Raddr.Port": 0,
525 Timestamp: "2023-11-07T16:32:23Z"
526 },
527 {
528 Pid: 4,
529 Name: "System",
530 Family: "IPv6",
531 Type: "TCP",
532 Status: "LISTEN",
533 "Laddr.IP": "::",
534 "Laddr.Port": 445,
535 "Raddr.IP": "::",
536 "Raddr.Port": 0,
537 Timestamp: "2023-11-07T16:32:58Z"
538 },
539 {
540 Pid: 344,
541 Name: "svchost.exe",
542 Family: "IPv6",
543 Type: "TCP",
544 Status: "LISTEN",
545 "Laddr.IP": "::",
546 "Laddr.Port": 3389,
547 "Raddr.IP": "::",
548 "Raddr.Port": 0,
549 Timestamp: "2023-11-07T16:32:28Z"
550 },
551 {
552 Pid: 4,
553 Name: "System",
554 Family: "IPv6",
555 Type: "TCP",
556 Status: "LISTEN",
557 "Laddr.IP": "::",
558 "Laddr.Port": 5357,
559 "Raddr.IP": "::",
560 "Raddr.Port": 0,
561 Timestamp: "2023-11-07T16:32:57Z"
562 },
563 {
564 Pid: 4,
565 Name: "System",
566 Family: "IPv6",
567 Type: "TCP",
568 Status: "LISTEN",
569 "Laddr.IP": "::",
570 "Laddr.Port": 5985,
571 "Raddr.IP": "::",
572 "Raddr.Port": 0,
573 Timestamp: "2023-11-07T16:32:58Z"
574 },
575 {
576 Pid: 4,
577 Name: "System",
578 Family: "IPv6",
579 Type: "TCP",
580 Status: "LISTEN",
581 "Laddr.IP": "::",
582 "Laddr.Port": 47001,
583 "Raddr.IP": "::",
584 "Raddr.Port": 0,
585 Timestamp: "2023-11-07T16:32:56Z"
586 },
587 {
588 Pid: 540,
589 Name: "wininit.exe",
590 Family: "IPv6",
591 Type: "TCP",
592 Status: "LISTEN",
593 "Laddr.IP": "::",
594 "Laddr.Port": 49664,
595 "Raddr.IP": "::",
596 "Raddr.Port": 0,
597 Timestamp: "2023-11-07T16:32:23Z"
598 },
599 {
600 Pid: 1188,
601 Name: "svchost.exe",
602 Family: "IPv6",
603 Type: "TCP",
604 Status: "LISTEN",
605 "Laddr.IP": "::",
606 "Laddr.Port": 49665,
607 "Raddr.IP": "::",
608 "Raddr.Port": 0,
609 Timestamp: "2023-11-07T16:32:28Z"
610 },
611 {
612 Pid: 680,
613 Name: "lsass.exe",
614 Family: "IPv6",
615 Type: "TCP",
616 Status: "LISTEN",
617 "Laddr.IP": "::",
618 "Laddr.Port": 49666,
619 "Raddr.IP": "::",
620 "Raddr.Port": 0,
621 Timestamp: "2023-11-07T16:32:31Z"
622 },
623 {
624 Pid: 464,
625 Name: "svchost.exe",
626 Family: "IPv6",
627 Type: "TCP",
628 Status: "LISTEN",
629 "Laddr.IP": "::",
630 "Laddr.Port": 49667,
631 "Raddr.IP": "::",
632 "Raddr.Port": 0,
633 Timestamp: "2023-11-07T16:32:33Z"
634 },
635 {
636 Pid: 464,
637 Name: "svchost.exe",
638 Family: "IPv6",
639 Type: "TCP",
640 Status: "LISTEN",
641 "Laddr.IP": "::",
642 "Laddr.Port": 49668,
643 "Raddr.IP": "::",
644 "Raddr.Port": 0,
645 Timestamp: "2023-11-07T16:32:33Z"
646 },
647 {
648 Pid: 1524,
649 Name: "spoolsv.exe",
650 Family: "IPv6",
651 Type: "TCP",
652 Status: "LISTEN",
653 "Laddr.IP": "::",
654 "Laddr.Port": 49670,
655 "Raddr.IP": "::",
656 "Raddr.Port": 0,
657 Timestamp: "2023-11-07T16:32:55Z"
658 },
659 {
660 Pid: 660,
661 Name: "services.exe",
662 Family: "IPv6",
663 Type: "TCP",
664 Status: "LISTEN",
665 "Laddr.IP": "::",
666 "Laddr.Port": 49676,
667 "Raddr.IP": "::",
668 "Raddr.Port": 0,
669 Timestamp: "2023-11-07T16:33:00Z"
670 },
671 {
672 Pid: 2140,
673 Name: "svchost.exe",
674 Family: "IPv4",
675 Type: "UDP",
676 Status: "",
677 "Laddr.IP": "0.0.0.0",
678 "Laddr.Port": 123,
679 "Raddr.IP": "",
680 "Raddr.Port": 0,
681 Timestamp: "2023-11-07T16:32:56Z"
682 },
683 {
684 Pid: 4,
685 Name: "System",
686 Family: "IPv4",
687 Type: "UDP",
688 Status: "",
689 "Laddr.IP": "192.168.200.3",
690 "Laddr.Port": 137,
691 "Raddr.IP": "",
692 "Raddr.Port": 0,
693 Timestamp: "2023-11-07T16:32:31Z"
694 },
695 {
696 Pid: 4,
697 Name: "System",
698 Family: "IPv4",
699 Type: "UDP",
700 Status: "",
701 "Laddr.IP": "192.168.200.3",
702 "Laddr.Port": 138,
703 "Raddr.IP": "",
704 "Raddr.Port": 0,
705 Timestamp: "2023-11-07T16:32:31Z"
706 },
707 {
708 Pid: 344,
709 Name: "svchost.exe",
710 Family: "IPv4",
711 Type: "UDP",
712 Status: "",
713 "Laddr.IP": "0.0.0.0",
714 "Laddr.Port": 3389,
715 "Raddr.IP": "",
716 "Raddr.Port": 0,
717 Timestamp: "2023-11-07T16:32:28Z"
718 },
719 {
720 Pid: 2384,
721 Name: "svchost.exe",
722 Family: "IPv4",
723 Type: "UDP",
724 Status: "",
725 "Laddr.IP": "0.0.0.0",
726 "Laddr.Port": 3702,
727 "Raddr.IP": "",
728 "Raddr.Port": 0,
729 Timestamp: "2023-11-07T16:32:57Z"
730 },
731 {
732 Pid: 2384,
733 Name: "svchost.exe",
734 Family: "IPv4",
735 Type: "UDP",
736 Status: "",
737 "Laddr.IP": "0.0.0.0",
738 "Laddr.Port": 3702,
739 "Raddr.IP": "",
740 "Raddr.Port": 0,
741 Timestamp: "2023-11-07T16:32:57Z"
742 },
743 {
744 Pid: 1424,
745 Name: "svchost.exe",
746 Family: "IPv4",
747 Type: "UDP",
748 Status: "",
749 "Laddr.IP": "0.0.0.0",
750 "Laddr.Port": 5353,
751 "Raddr.IP": "",
752 "Raddr.Port": 0,
753 Timestamp: "2023-11-07T16:32:31Z"
754 },
755 {
756 Pid: 1424,
757 Name: "svchost.exe",
758 Family: "IPv4",
759 Type: "UDP",
760 Status: "",
761 "Laddr.IP": "0.0.0.0",
762 "Laddr.Port": 5355,
763 "Raddr.IP": "",
764 "Raddr.Port": 0,
765 Timestamp: "2023-11-13T20:35:42Z"
766 },
767 {
768 Pid: 2384,
769 Name: "svchost.exe",
770 Family: "IPv4",
771 Type: "UDP",
772 Status: "",
773 "Laddr.IP": "0.0.0.0",
774 "Laddr.Port": 49866,
775 "Raddr.IP": "",
776 "Raddr.Port": 0,
777 Timestamp: "2023-11-07T16:32:57Z"
778 },
779 {
780 Pid: 464,
781 Name: "svchost.exe",
782 Family: "IPv4",
783 Type: "UDP",
784 Status: "",
785 "Laddr.IP": "127.0.0.1",
786 "Laddr.Port": 50471,
787 "Raddr.IP": "",
788 "Raddr.Port": 0,
789 Timestamp: "2023-11-07T16:32:59Z"
790 },
791 {
792 Pid: 2140,
793 Name: "svchost.exe",
794 Family: "IPv6",
795 Type: "UDP",
796 Status: "",
797 "Laddr.IP": "::",
798 "Laddr.Port": 123,
799 "Raddr.IP": "",
800 "Raddr.Port": 0,
801 Timestamp: "2023-11-07T16:32:56Z"
802 },
803 {
804 Pid: 344,
805 Name: "svchost.exe",
806 Family: "IPv6",
807 Type: "UDP",
808 Status: "",
809 "Laddr.IP": "::",
810 "Laddr.Port": 3389,
811 "Raddr.IP": "",
812 "Raddr.Port": 0,
813 Timestamp: "2023-11-07T16:32:28Z"
814 },
815 {
816 Pid: 2384,
817 Name: "svchost.exe",
818 Family: "IPv6",
819 Type: "UDP",
820 Status: "",
821 "Laddr.IP": "::",
822 "Laddr.Port": 3702,
823 "Raddr.IP": "",
824 "Raddr.Port": 0,
825 Timestamp: "2023-11-07T16:32:57Z"
826 },
827 {
828 Pid: 2384,
829 Name: "svchost.exe",
830 Family: "IPv6",
831 Type: "UDP",
832 Status: "",
833 "Laddr.IP": "::",
834 "Laddr.Port": 3702,
835 "Raddr.IP": "",
836 "Raddr.Port": 0,
837 Timestamp: "2023-11-07T16:32:57Z"
838 },
839 {
840 Pid: 1424,
841 Name: "svchost.exe",
842 Family: "IPv6",
843 Type: "UDP",
844 Status: "",
845 "Laddr.IP": "::",
846 "Laddr.Port": 5353,
847 "Raddr.IP": "",
848 "Raddr.Port": 0,
849 Timestamp: "2023-11-07T16:32:31Z"
850 },
851 {
852 Pid: 1424,
853 Name: "svchost.exe",
854 Family: "IPv6",
855 Type: "UDP",
856 Status: "",
857 "Laddr.IP": "::",
858 "Laddr.Port": 5355,
859 "Raddr.IP": "",
860 "Raddr.Port": 0,
861 Timestamp: "2023-11-13T20:35:42Z"
862 },
863 {
864 Pid: 2384,
865 Name: "svchost.exe",
866 Family: "IPv6",
867 Type: "UDP",
868 Status: "",
869 "Laddr.IP": "::",
870 "Laddr.Port": 49867,
871 "Raddr.IP": "",
872 "Raddr.Port": 0,
873 Timestamp: "2023-11-07T16:32:57Z"
874 }
875 ]
876
877 export const commandResult: CommandResult[] = [
878 {
879 Stdout: "\r\n\r\nAccountType : 512\r\nCaption : WIN-HFOU106TD7K\\Administrator\r\nDomain : WIN-HFOU106TD7K\r\nSID : S-1-5-21-1287727892-3649796646-2502983199-500\r\nFullName : \r\nName : Administrator\r\n\r\nAccountType : 512\r\nCaption : WIN-HFOU106TD7K\\DefaultAccount\r\nDomain : WIN-HFOU106TD7K\r\nSID : S-1-5-21-1287727892-3649796646-2502983199-503\r\nFullName : \r\nName : DefaultAccount\r\n\r\nAccountType : 512\r\nCaption : WIN-HFOU106TD7K\\Guest\r\nDomain : WIN-HFOU106TD7K\r\nSID : S-1-5-21-1287727892-3649796646-2502983199-501\r\nFullName : \r\nName : Guest\r\n\r\nAccountType : 512\r\nCaption : WIN-HFOU106TD7K\\WDAGUtilityAccount\r\nDomain : WIN-HFOU106TD7K\r\nSID : S-1-5-21-1287727892-3649796646-2502983199-504\r\nFullName : \r\nName : WDAGUtilityAccount\r\n\r\n\r\n\r\n",
880 Stderr: '#< CLIXML\r\n<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>',
881 ReturnCode: 0,
882 Complete: true
883 }
884 ]
885
886 export const quarantineResult: QuarantineResult[] = [
887 {
888 Time: "2023-11-14T21:03:03Z",
889 Result: "VelociraptorQuarantine IPSec policy removed."
890 },
891 {
892 Time: "2023-11-14T21:03:03Z",
893 Result: "VelociraptorQuarantine IPSec policy created."
894 },
895 {
896 Time: "2023-11-14T21:03:03Z",
897 Result: "Entry added: netsh ipsec static add filter filterlist=VelociraptorQuarantine PermitFilterList srcaddr=me srcport=0 dstaddr=velo.socfortress.co dstport=8000 protocol=tcp mirrored=yes description=VelociraptorFrontEnd"
898 },
899 {
900 Time: "2023-11-14T21:03:04Z",
901 Result: "Entry added: netsh ipsec static add filter filterlist=VelociraptorQuarantine PermitFilterList srcaddr=me srcport=0 dstaddr=any dstport=53 protocol=udp mirrored=yes description=DNS"
902 },
903 {
904 Time: "2023-11-14T21:03:04Z",
905 Result: "Entry added: netsh ipsec static add filter filterlist=VelociraptorQuarantine PermitFilterList srcaddr=me srcport=0 dstaddr=any dstport=53 protocol=tcp mirrored=yes description=DNS TCP"
906 },
907 {
908 Time: "2023-11-14T21:03:04Z",
909 Result: "Entry added: netsh ipsec static add filter filterlist=VelociraptorQuarantine PermitFilterList srcaddr=me srcport=68 dstaddr=any dstport=67 protocol=udp mirrored=yes description=DHCP"
910 },
911 {
912 Time: "2023-11-14T21:03:04Z",
913 Result: "Entry added: netsh ipsec static add filter filterlist=VelociraptorQuarantine BlockFilterList srcaddr=any dstaddr=any mirrored=yes description=All other traffic"
914 },
915 {
916 Time: "2023-11-14T21:03:04Z",
917 Result: "FilterAction added: netsh ipsec static add filteraction name=VelociraptorQuarantine PermitAction action=Permit"
918 },
919 {
920 Time: "2023-11-14T21:03:04Z",
921 Result: "FilterAction added: netsh ipsec static add filteraction name=VelociraptorQuarantine BlockAction action=Block"
922 },
923 {
924 Time: "2023-11-14T21:03:05Z",
925 Result: "Rule added: netsh ipsec static add rule name=VelociraptorQuarantine PermitRule policy=VelociraptorQuarantine filterlist=VelociraptorQuarantine PermitFilterList filteraction=VelociraptorQuarantine PermitAction"
926 },
927 {
928 Time: "2023-11-14T21:03:05Z",
929 Result: "Rule added: netsh ipsec static add rule name=VelociraptorQuarantine BlockRule policy=VelociraptorQuarantine filterlist=VelociraptorQuarantine BlockFilterList filteraction=VelociraptorQuarantine BlockAction"
930 },
931 {
932 Time: "2023-11-14T21:03:05Z",
933 Result: "VelociraptorQuarantine IPSec policy applied."
934 },
935 {
936 Time: "2023-11-14T21:03:05Z",
937 Result: "VelociraptorQuarantine connection test successful."
938 }
939 ]
940
941 export const artifact_list: Artifact[] = [
942 {
943 description: "This artifact contains the initial data collected from the user session.",
944 name: "session_data_artifact"
945 },
946 {
947 description: "This artifact stores the processed results after the data flow execution.",
948 name: "processed_results_artifact"
949 },
950 {
951 description: "This artifact includes the logs generated during the data collection process.",
952 name: "logs_artifact"
953 }
954 ]