kanra•5d ago

Cybersec/SecOps

Hi. I just would like a clarification for this issue i have. Falcon alert is detecting malware coming from an end-user. cynetEPS.exe as the triggering indicator associated with IoC (hash file). I'd like to know if this is a false positive. Falcon blocked it and i havent checked yet if cynet was installed or already installed or a client tool. It might be a masquerade or what. I'd like to know what you guys think about this. Thanks

7 Replies

_null•5d ago

can you share the hash by chance? hashes are a reliable indicator; I'm not familiar with that specific malware though, it could be something that you wouldn't consider malware.

kanraOP•5d ago

Unfortunately, i dont have the authority to view the hash. I was tasked to verify if cynet is installed in the system. But i wanna go an extra mile to at least determine what was the actual cause as it might happen again

_null•5d ago

you would have to dig through logs to do something like that its very doable, but takes some skill

Doulos•4d ago

if you have powershell access

Get-FileHash -Path "C:\path\to\file" -Algorithm SHA256

Get-FileHash -Path "C:\path\to\file" -Algorithm SHA256

! Smokey•3d ago

The location of Cynet could help you identify if the issue is actually a problem or not:

where /r C:\ cynetEPS.exe

where /r C:\ cynetEPS.exe

or in powershell:

Get-ChildItem -Path C:\ -Filter cynetEPS.exe -Recurse -ErrorAction SilentlyContinue | Select-Object FullName

Get-ChildItem -Path C:\ -Filter cynetEPS.exe -Recurse -ErrorAction SilentlyContinue | Select-Object FullName

You can also check the execution history of that file:

Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688} | Where-Object {$_.Message -like "*cynetEPS.exe*"} | Select-Object TimeCreated, Message -First 10

Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688} | Where-Object {$_.Message -like "*cynetEPS.exe*"} | Select-Object TimeCreated, Message -First 10

( I am not sure about the ID but I think that might be the correct one! ) I hope something of these helps you out!

_null•3d ago

I should have thought of that. Much easier. Thank you for helping out.

! Smokey•3d ago

No problem at all. By the way my DMs are always open for help!

Cybersec/SecOps

Did you find this page helpful?