Credential Dumping

MikeVerin
MikeVerin
in WatchGuard EPDR/EDR/EPP

is this false positive?
ParentFilenameParentFilename viber.exe

  • EventTypeEventTypeProcessOps
  • 2TimestampTimestamp2026/09/09 10:47:43.165528446
  • 3OperationOperationCreateProc
  • 4ParentStatusParentStatusStatusOk
  • 5ChildStatusChildStatusNotUploadGWLocal
  • 6OpenTimeStampOpenTimeStamp1970/01/01 00:00:00.0000
  • 7ParentDriveParentDrive0
  • 8ParentPidParentPid1422339214
  • 9ParentFilenameParentFilenameempty
  • 10ParentpathParentpathEMPTY
  • 11ChildpathChildpathSYSTEM|\smss.exe
  • 12ChildDriveChildDrive3
  • 13Childmd5Childmd5867760C6D48784FA4156ECD17FEF3A6E
  • 14ChildFilenameChildFilenamesmss.exe
  • 15ChildPidChildPid1422339216
  • 16AccessTypeAccessType0
  • 17ChildAttributesChildAttributesISPE|NOSHELL|PROCESSLOST
  • 18ChildFileSizeChildFileSize0
  • 19PeCreationSourcePeCreationSource-1
  • 20CommandLineCommandLine\SystemRoot\System32\smss.exe
  • 21TotalResolutionTimeTotalResolutionTime0
  • 22AnalysisTimeAnalysisTime0
  • 23RemediationResultRemediationResultUnknown
  • 24ChildClassificationChildClassificationGoodware
  • 25ActionActionAllow
  • 26ServiceLevelServiceLevelHardening
  • 27ExtendedInfoExtendedInfo D2
  • 28OperationFlagsOperationFlagsUNTRUSTED_LEVEL
  • 29WinningTechWinningTechUnknown
  • 30DetectionIdDetectionIdUnknown
  • 31LoggedUserLoggedUserNT AUTHORITY\SYSTEM
  • 32RemoteUsernameRemoteUsernameNT_AUTHORITY\SYSTEM
  • 33OpStatusOpStatusSend advanced reporting tool.
  • 34PandadatetimePandadatetime2026/09/09 10:47:43.630
  • 35PandaTimeStatusPandaTimeStatusPandaTimeOk
  • 36ProcessTreeIdProcessTreeId1422339209
  • 37SessionIdSessionId11367
  • 38ThreadIdThreadId0
  • 39ErrorCodeErrorCodeSuccess

Comments

  • miltonluna
    miltonluna

    @geometry dash said:"If the executable is clean and uncompromised, submit the event details to WatchGuard Support as a false positive and create an exception rule in your endpoint policy."

Categories