Multiple Case of: WIN-DET-CREDS-HMPA-CREDGUARDCLONE-LSASSDUMP-1

Hi everyone,
after enabling "aggressive threat" protection" From sophos central, XDR started creating lots of cases for me, on almost all computers with this event:
WIN-DET-CREDS-HMPA-CREDGUARDCLONE-LSASSDUMP-1
I can't find much about it and I don't understand if it's a false positive or I should be seriously worried...
Intecept-X shows no anomalies on these computers.
I attach the detail of one of the events

{
  "meta_eid": "xxxx",
  "meta_public_ip": "x.x.x.x",
  "meta_aggressive_activity": "True",
  "meta_os_platform": "windows",
  "meta_os_version": "10.0.19045",
  "meta_domain_controller": "False",
  "customer_region": "us-west-2",
  "meta_ip_address": "10.81.234.132",
  "meta_query_pack_version": "1.20.157",
  "meta_boot_time": 1720599479,
  "meta_endpoint_type": "computer",
  "meta_hostname": "DT-XX",
  "meta_mac_address": "00:ff:e5:8a:xx.xx",
  "stream_ingest_time": "1720714159617",
  "meta_os_name": "Microsoft Windows 10 Pro",
  "customer_id": "3f3694b2-8e47-455b-bb7e-7ab28e2a9f18",
  "meta_ip_mask": "255.255.255.0",
  "meta_username": "mbartolotta.vpn",
  "osquery_action": "added",
  "calendar_time": 1720714066000,
  "ioc_event_files": [
    {
      "file_path": "C:\\Windows\\SysWOW64\\WerFault.exe",
      "sha256": "9c39e90ebfdea833750e4f85efd068c9a51132b03e6495c4b32de7e8e8414e3b",
      "file_name": "WerFault.exe",
      "command_line": "C:\\Windows\\SysWOW64\\WerFault.exe -pss -s 504 -p 14980 -ip 14980"
    }
  ],
  "event_count": 2,
  "ioc_event_threat_source": "Behavioral",
  "process_parent_path": "C:\\Windows\\System32\\svchost.exe",
  "process_local_rep_signers": {
    "reputationData": {
      "isSigned": 1,
      "signerInfo": [
        {
          "isValid": 1,
          "signer": "Microsoft Windows"
        }
      ]
    }
  },
  "ioc_event_time": 1720714066000,
  "process_cmd_line": "C:\\Windows\\SysWOW64\\WerFault.exe -pss -s 504 -p 14980 -ip 14980",
  "process_name": "WerFault.exe",
  "process_cmd_line_truncated": 0,
  "ioc_event_events": [
    {
      "details": {
        "alertId": "a8116287-c39e-465e-bd14-14fd5e0cf646",
        "mitigation": {
          "reason": "CredGuardClone",
          "setting": "CredGuard",
          "version": 0
        },
        "process": {
          "image": {
            "path": "C:\\Windows\\SysWOW64\\WerFault.exe",
            "productName": "Windows Problem Reporting",
            "productVersion": "10",
            "sha256": {
              "!sha256": "9c39e90ebfdea833750e4f85efd068c9a51132b03e6495c4b32de7e8e8414e3b"
            },
            "signed": true
          },
          "pid": 5436,
          "spid": {
            "!spid": "[5436:133651876655206231]"
          }
        },
        "silent": true,
        "thumbprints": [
          {
            "data": "cad8c0d1f3bc5593a394cc387351ce27cb673b19a7123644255fd700d6acd0e7",
            "type": "Primary"
          }
        ]
      },
      "eventSummary": "Process werfault.exe triggered HMPA CredGuardClone mitigation.",
      "event_value": "CredGuardClone",
      "report": "Mitigation   CredGuardClone\r\nPolicy       CredGuard\r\nTimestamp    2024-07-11T16:07:46\r\n\r\nPlatform     10.0.19045/x64 v992 06_3c-\r\nPID          5436\r\nWoW          x86\r\nEnabled      08FF2E3040000006\r\nSilent       0002000000000000\r\nApplication  C:\\Windows\\SysWOW64\\WerFault.exe\r\nCreated      2024-06-29T10:05:16\r\nModified     2024-06-29T10:05:16\r\nDescription  Windows Problem Reporting 10\r\n\r\nCloning process (14980) via NtCreateProcessEx\n\r\nStack Trace\r\n#  Address  Module                   Location\r\n-- -------- ------------------------ ----------------------------------------\r\n1  0045C062 WerFault.exe            \r\n            50                       PUSH         EAX\n            6804a94200               PUSH         DWORD 0x42a904\n            50                       PUSH         EAX\n            beb8a84200               MOV          ESI, 0x42a8b8\n            8945e0                   MOV          [EBP-0x20], EAX\n            56                       PUSH         ESI\n            6864a84200               PUSH         DWORD 0x42a864\n            6818010000               PUSH         DWORD 0x118\n            ff7504                   PUSH         DWORD [EBP+0x4]\n            e817040000               CALL         0x45c49b\n            83c41c                   ADD          ESP, 0x1c\n            837de000                 CMP          DWORD [EBP-0x20], 0x0\n            7571                     JNZ          0x45c0fe\n            8b8df0feffff             MOV          ECX, [EBP-0x110]\n            85c9                     TEST         ECX, ECX\n            7467                     JZ           0x45c0fe\n\r\n2  0045C3BD WerFault.exe            \r\n3  00433A42 WerFault.exe            \r\n4  0046FECA WerFault.exe            \r\n5  7604FCC9 kernel32.dll             BaseThreadInitThunk +0x19\r\n6  772180CE ntdll.dll                RtlGetAppContainerNamedObjectPath +0x11e\r\n7  7721809E ntdll.dll                RtlGetAppContainerNamedObjectPath +0xee\r\n\r\nLoaded Modules (33)\r\n-----------------------------------------------------------------------------\r\n0\r\n...truncated...\r\n)\r\n75EF0000-76010000 C:\\Windows\\System32\\ucrtbase.dll (Microsoft Corporation), \r\n                  version: 10.0.19041.3636 (WinBuild.160101.0800)\r\n76030000-76120000 C:\\Windows\\SysWOW64\\kernel32.dll (Microsoft Corporation), \r\n                  version: 10.0.19041.4474 (WinBuild.160101.0800)\r\n768F0000-76B2A000 C:\\Windows\\SysWOW64\\KernelBase.dll (Microsoft Corporation), \r\n                  version: 10.0.19041.4522 (WinBuild.160101.0800)\r\n76D00000-76E9D000 C:\\Windows\\System32\\USER32.dll (Microsoft Corporation), \r\n                  version: 10.0.19041.4522 (WinBuild.160101.0800)\r\n76EA0000-76F1B000 C:\\Windows\\System32\\msvcp_win.dll (Microsoft Corporation), \r\n                  version: 10.0.19041.3636 (WinBuild.160101.0800)\r\n76F20000-771A0000 C:\\Windows\\System32\\combase.dll (Microsoft Corporation), \r\n                  version: 10.0.19041.4412 (WinBuild.160101.0800)\r\n771A0000-771AA000 C:\\Windows\\System32\\wow64cpu.dll (Microsoft Corporation), \r\n                  version: 10.0.19041.3636 (WinBuild.160101.0800)\r\n771B0000-77354000 C:\\Windows\\SysWOW64\\ntdll.dll (Microsoft Corporation), \r\n                  version: 10.0.19041.4522 (WinBuild.160101.0800)\r\n\r\nProcess Trace\r\n1  C:\\Windows\\SysWOW64\\WerFault.exe [5436] *\r\n   C:\\Windows\\SysWOW64\\WerFault.exe -pss -s 504 -p 14980 -ip 14980\r\n2  C:\\Windows\\System32\\svchost.exe [1776] *\r\n   C:\\Windows\\System32\\svchost.exe -k WerSvcGroup\r\n3  C:\\Windows\\System32\\services.exe [960] *\r\n4  C:\\Windows\\System32\\wininit.exe [836] *\r\n   wininit.exe\r\n\r\nServices\r\n1776  WerSvc\r\n\r\nDropped Files\r\n1  C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\7b2a790b-4899-41db-970e-6f1a7a894d0c\r\n     Dropped by C:\\Windows\\SysWOW64\\WerFault.exe [5436]\r\n2  C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\f027e96d-cd6a-4f15-87c9-20590d9e03c1\r\n     Dropped by C:\\Windows\\SysWOW64\\WerFault.exe [5436]\r\n1  C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\896bb261-a30a-4c1f-addf-8717f3193bf3\r\n     Dropped by C:\\Windows\\System32\\svchost.exe [1776]\r\n\r\nThumbprint (pfn)\r\ncad8c0d1f3bc5593a394cc387351ce27cb673b19a7123644255fd700d6acd0e7",
      "senderSpid": {
        "!spid": "[2112:133650730837011942]"
      },
      "time": {
        "!uint64": "133651876661915864"
      },
      "timestamp": {
        "!uint64": "1720714066"
      },
      "type": "HmpaDetection",
      "version": 2
    },
    {
      "cmdline": "C:\\Windows\\SysWOW64\\WerFault.exe -pss -s 504 -p 14980 -ip 14980",
      "event_value": "C:\\Windows\\SysWOW64\\WerFault.exe -pss -s 504 -p 14980 -ip 14980",
      "irep": 5,
      "newSpid": {
        "!spid": "[5436:133651876655206231]"
      },
      "pwin32Path": "C:\\Windows\\System32\\svchost.exe",
      "rep": 5,
      "sha256": {
        "!sha256": "9c39e90ebfdea833750e4f85efd068c9a51132b03e6495c4b32de7e8e8414e3b"
      },
      "spid": {
        "!spid": "[1776:133651876653203662]"
      },
      "stid": {
        "!stid": "[14408:133651876654535333]"
      },
      "time": {
        "!uint64": "133651876655197713"
      },
      "type": "ProcessCreate",
      "userSid": {
        "!sid": "S-1-5-18"
      },
      "versionInfo": {
        "CompanyName": "Microsoft Corporation",
        "FileDescription": "Windows Problem Reporting",
        "FileVersion": "10.0.19041.4474 (WinBuild.160101.0800)",
        "InternalName": "WerFault",
        "LegalCopyright": "© Microsoft Corporation. All rights reserved.",
        "LegalTrademarks": "",
        "OriginalFilename": "WerFault.exe",
        "ProductName": "Microsoft® Windows® Operating System",
        "ProductVersion": "10.0.19041.4474"
      },
      "win32Path": "C:\\Windows\\SysWOW64\\WerFault.exe"
    },
    {
      "contextSummary": null,
      "eventSummary": "werfault.exe is associated by SPID to the high-risk detection WIN-DET-CREDS-HMPA-CREDGUARDCLONE-LSASSDUMP-1.",
      "indicator": "Risk_Correlated",
      "insights": [
        "Correlated_By_SPID",
        "High_Risk_Correlated",
        "Microsoft_Signed"
      ],
      "process": "werfault.exe",
      "riskState": "HIGH",
      "spid": {
        "!spid": "[5436:133651876655206231]"
      },
      "type": "AttackProfile",
      "userSid": {
        "!sid": "S-1-5-18"
      }
    }
  ],
  "process_pua_score": 18,
  "process_file_size": 489968,
  "process_local_rep": 91,
  "sophos_pid": "5436:133651876655206231",
  "process_pid": 5436,
  "ioc_event_path": "C:\\Windows\\SysWOW64\\WerFault.exe",
  "process_ml_score_band": "LIKELY_BENIGN",
  "process_ml_score": 6,
  "ioc_events_size": 14668,
  "ioc_event_username": "SYSTEM",
  "process_parent_sophos_pid": "1776:133651876653203662",
  "ioc_event_ttp_summary": "TA0006-T1003.001",
  "process_path": "C:\\Windows\\SysWOW64\\WerFault.exe",
  "process_parent_name": "svchost.exe",
  "process_sha256": "9c39e90ebfdea833750e4f85efd068c9a51132b03e6495c4b32de7e8e8414e3b",
  "ioc_event_sid": "S-1-5-18",
  "ioc_event_event": "{\"time\":1720714066,\"mitre_ttps\":[{\"tactic\":\"TA0006\",\"technique\":\"T1003.001\",\"ttpDescriptionId\":\"T1003.001\",\"verbosity\":8}],\"detection_id\":\"CREDS-HMPA-CREDGUARDCLONE-LSASSDUMP-1\",\"sophos_tid\":\"14408:133651876654535333\",\"path\":\"C:\\\\Windows\\\\SysWOW64\\\\WerFault.exe\",\"sid\":\"S-1-5-18\",\"username\":\"SYSTEM\",\"threat_source\":\"Behavioral\",\"events\":\"[{\\\"details\\\":{\\\"alertId\\\":\\\"a8116287-c39e-465e-bd14-14fd5e0cf646\\\",\\\"mitigation\\\":{\\\"reason\\\":\\\"CredGuardClone\\\",\\\"setting\\\":\\\"CredGuard\\\",\\\"version\\\":0},\\\"process\\\":{\\\"image\\\":{\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\WerFault.exe\\\",\\\"productName\\\":\\\"Windows Problem Reporting\\\",\\\"productVersion\\\":\\\"10\\\",\\\"sha256\\\":{\\\"!sha256\\\":\\\"9c39e90ebfdea833750e4f85efd068c9a51132b03e6495c4b32de7e8e8414e3b\\\"},\\\"signed\\\":true},\\\"pid\\\":5436,\\\"spid\\\":{\\\"!spid\\\":\\\"[5436:133651876655206231]\\\"}},\\\"silent\\\":true,\\\"thumbprints\\\":[{\\\"data\\\":\\\"cad8c0d1f3bc5593a394cc387351ce27cb673b19a7123644255fd700d6acd0e7\\\",\\\"type\\\":\\\"Primary\\\"}]},\\\"eventSummary\\\":\\\"Process werfault.exe triggered HMPA CredGuardClone mitigation.\\\",\\\"event_value\\\":\\\"CredGuardClone\\\",\\\"report\\\":\\\"Mitigation   CredGuardClone\\\\r\\\\nPolicy       CredGuard\\\\r\\\\nTimestamp    2024-07-11T16:07:46\\\\r\\\\n\\\\r\\\\nPlatform     10.0.19045/x64 v992 06_3c-\\\\r\\\\nPID          5436\\\\r\\\\nWoW          x86\\\\r\\\\nEnabled      08FF2E3040000006\\\\r\\\\nSilent       0002000000000000\\\\r\\\\nApplication  C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\WerFault.exe\\\\r\\\\nCreated      2024-06-29T10:05:16\\\\r\\\\nModified     2024-06-29T10:05:16\\\\r\\\\nDescription  Windows Problem Reporting 10\\\\r\\\\n\\\\r\\\\nCloning process (14980) via NtCreateProcessEx\\\\n\\\\r\\\\nStack Trace\\\\r\\\\n#  Address  Module                   Location\\\\r\\\\n-- -------- ------------------------ ----------------------------------------\\\\r\\\\n1  0045C062 WerFault.exe            \\\\r\\\\n            50                       PUSH         EAX\\\\n            6804a94200               PUSH         DWORD 0x42a904\\\\n            50                       PUSH         EAX\\\\n            beb8a84200               MOV          ESI, 0x42a8b8\\\\n            8945e0                   MOV          [EBP-0x20], EAX\\\\n            56                       PUSH         ESI\\\\n            6864a84200               PUSH         DWORD 0x42a864\\\\n            6818010000               PUSH         DWORD 0x118\\\\n            ff7504                   PUSH         DWORD [EBP+0x4]\\\\n            e817040000               CALL         0x45c49b\\\\n            83c41c                   ADD          ESP, 0x1c\\\\n            837de000                 CMP          DWORD [EBP-0x20], 0x0\\\\n            7571                     JNZ          0x45c0fe\\\\n            8b8df0feffff             MOV          ECX, [EBP-0x110]\\\\n            85c9                     TEST         ECX, ECX\\\\n            7467                     JZ           0x45c0fe\\\\n\\\\r\\\\n2  0045C3BD WerFault.exe            \\\\r\\\\n3  00433A42 WerFault.exe            \\\\r\\\\n4  0046FECA WerFault.exe            \\\\r\\\\n5  7604FCC9 kernel32.dll             BaseThreadInitThunk +0x19\\\\r\\\\n6  772180CE ntdll.dll                RtlGetAppContainerNamedObjectPath +0x11e\\\\r\\\\n7  7721809E ntdll.dll                RtlGetAppContainerNamedObjectPath +0xee\\\\r\\\\n\\\\r\\\\nLoaded Modules (33)\\\\r\\\\n-----------------------------------------------------------------------------\\\\r\\\\n0\\\\r\\\\n...truncated...\\\\r\\\\n)\\\\r\\\\n75EF0000-76010000 C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\ucrtbase.dll (Microsoft Corporation), \\\\r\\\\n                  version: 10.0.19041.3636 (WinBuild.160101.0800)\\\\r\\\\n76030000-76120000 C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\kernel32.dll (Microsoft Corporation), \\\\r\\\\n                  version: 10.0.19041.4474 (WinBuild.160101.0800)\\\\r\\\\n768F0000-76B2A000 C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\KernelBase.dll (Microsoft Corporation), \\\\r\\\\n                  version: 10.0.19041.4522 (WinBuild.160101.0800)\\\\r\\\\n76D00000-76E9D000 C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\USER32.dll (Microsoft Corporation), \\\\r\\\\n                  version: 10.0.19041.4522 (WinBuild.160101.0800)\\\\r\\\\n76EA0000-76F1B000 C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\msvcp_win.dll (Microsoft Corporation), \\\\r\\\\n                  version: 10.0.19041.3636 (WinBuild.160101.0800)\\\\r\\\\n76F20000-771A0000 C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\combase.dll (Microsoft Corporation), \\\\r\\\\n                  version: 10.0.19041.4412 (WinBuild.160101.0800)\\\\r\\\\n771A0000-771AA000 C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wow64cpu.dll (Microsoft Corporation), \\\\r\\\\n                  version: 10.0.19041.3636 (WinBuild.160101.0800)\\\\r\\\\n771B0000-77354000 C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\ntdll.dll (Microsoft Corporation), \\\\r\\\\n                  version: 10.0.19041.4522 (WinBuild.160101.0800)\\\\r\\\\n\\\\r\\\\nProcess Trace\\\\r\\\\n1  C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\WerFault.exe [5436] *\\\\r\\\\n   C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\WerFault.exe -pss -s 504 -p 14980 -ip 14980\\\\r\\\\n2  C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe [1776] *\\\\r\\\\n   C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe -k WerSvcGroup\\\\r\\\\n3  C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\services.exe [960] *\\\\r\\\\n4  C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wininit.exe [836] *\\\\r\\\\n   wininit.exe\\\\r\\\\n\\\\r\\\\nServices\\\\r\\\\n1776  WerSvc\\\\r\\\\n\\\\r\\\\nDropped Files\\\\r\\\\n1  C:\\\\\\\\ProgramData\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\WER\\\\\\\\Temp\\\\\\\\7b2a790b-4899-41db-970e-6f1a7a894d0c\\\\r\\\\n     Dropped by C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\WerFault.exe [5436]\\\\r\\\\n2  C:\\\\\\\\ProgramData\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\WER\\\\\\\\Temp\\\\\\\\f027e96d-cd6a-4f15-87c9-20590d9e03c1\\\\r\\\\n     Dropped by C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\WerFault.exe [5436]\\\\r\\\\n1  C:\\\\\\\\ProgramData\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\WER\\\\\\\\Temp\\\\\\\\896bb261-a30a-4c1f-addf-8717f3193bf3\\\\r\\\\n     Dropped by C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe [1776]\\\\r\\\\n\\\\r\\\\nThumbprint (pfn)\\\\r\\\\ncad8c0d1f3bc5593a394cc387351ce27cb673b19a7123644255fd700d6acd0e7\\\",\\\"senderSpid\\\":{\\\"!spid\\\":\\\"[2112:133650730837011942]\\\"},\\\"time\\\":{\\\"!uint64\\\":\\\"133651876661915864\\\"},\\\"timestamp\\\":{\\\"!uint64\\\":\\\"1720714066\\\"},\\\"type\\\":\\\"HmpaDetection\\\",\\\"version\\\":2},{\\\"cmdline\\\":\\\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\WerFault.exe -pss -s 504 -p 14980 -ip 14980\\\",\\\"event_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\WerFault.exe -pss -s 504 -p 14980 -ip 14980\\\",\\\"irep\\\":5,\\\"newSpid\\\":{\\\"!spid\\\":\\\"[5436:133651876655206231]\\\"},\\\"pwin32Path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\\\",\\\"rep\\\":5,\\\"sha256\\\":{\\\"!sha256\\\":\\\"9c39e90ebfdea833750e4f85efd068c9a51132b03e6495c4b32de7e8e8414e3b\\\"},\\\"spid\\\":{\\\"!spid\\\":\\\"[1776:133651876653203662]\\\"},\\\"stid\\\":{\\\"!stid\\\":\\\"[14408:133651876654535333]\\\"},\\\"time\\\":{\\\"!uint64\\\":\\\"133651876655197713\\\"},\\\"type\\\":\\\"ProcessCreate\\\",\\\"userSid\\\":{\\\"!sid\\\":\\\"S-1-5-18\\\"},\\\"versionInfo\\\":{\\\"CompanyName\\\":\\\"Microsoft Corporation\\\",\\\"FileDescription\\\":\\\"Windows Problem Reporting\\\",\\\"FileVersion\\\":\\\"10.0.19041.4474 (WinBuild.160101.0800)\\\",\\\"InternalName\\\":\\\"WerFault\\\",\\\"LegalCopyright\\\":\\\"\\\\u00a9 Microsoft Corporation. All rights reserved.\\\",\\\"LegalTrademarks\\\":\\\"\\\",\\\"OriginalFilename\\\":\\\"WerFault.exe\\\",\\\"ProductName\\\":\\\"Microsoft\\\\u00ae Windows\\\\u00ae Operating System\\\",\\\"ProductVersion\\\":\\\"10.0.19041.4474\\\"},\\\"win32Path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\SysWOW64\\\\\\\\WerFault.exe\\\"},{\\\"contextSummary\\\":null,\\\"eventSummary\\\":\\\"werfault.exe is associated by SPID to the high-risk detection WIN-DET-CREDS-HMPA-CREDGUARDCLONE-LSASSDUMP-1.\\\",\\\"indicator\\\":\\\"Risk_Correlated\\\",\\\"insights\\\":[\\\"Correlated_By_SPID\\\",\\\"High_Risk_Correlated\\\",\\\"Microsoft_Signed\\\"],\\\"process\\\":\\\"werfault.exe\\\",\\\"riskState\\\":\\\"HIGH\\\",\\\"spid\\\":{\\\"!spid\\\":\\\"[5436:133651876655206231]\\\"},\\\"type\\\":\\\"AttackProfile\\\",\\\"userSid\\\":{\\\"!sid\\\":\\\"S-1-5-18\\\"}}]\"}",
  "ioc_event_sophos_tid": "14408:133651876654535333",
  "process_global_rep": -1,
  "counter": 91,
  "epoch": 1720426655,
  "folded": 0,
  "host_identifier": "4C4C4544-004B-5010-804C-C8C04F393932",
  "query_name": "sophos_runtime_iocs_windows",
  "numerics": false,
  "tag": "stream",
  "unix_time": 1720714066000
}

Parents Reply Children