Hunting an IP and Seeing Conflicting Process Info - Anyone seen this?
Was practicing some hunting on an endpoint yesterday and the answer I came to from Crowdstrike event searching doesn't match the answer I came to from analysis on the host. Hoping someone might have an explanation on what I've missed. Here's my story:
I was hunting an IP on a host - 72.21.81.200. From Crowdstrike, I ran an event search for that IP and found my event:
I pivoted from that event to the process tree to see what was calling out to that IP. Based on this output, it looks like searchapp.exe is my source. (I also checked other events for this IP and they all pointed to the same exe):
Locally on the host, I ran netstat -bnf and searched the output for my hunted IP and the process making the connection request. Netstat picked the IP up, but only ever showed it for a setup.exe process (setup.exe for VisualStudio was running on this machine)
At this point I was a little confused as to why I saw different results. I also checked the searchapp.exe process on this machine and task manager shows the process as "suspended", so I don't think searchapp.exe was even running. I ran an event search for setup.exe and didn't get any results, so I'm at a loss as to how to interpret what I'm seeing. If anyone has ideas, I'd appreciate the input because I'm at a loss!
Posted Jan 6, 2022, 6:03 PM UTC
What happens if you search for
NetworkConnectIP4event for 72.21.81.200? What you are seeing fromsearchapp.exeis aDnsRequestthat maps to the IP but that's not the actual IP connection event. Does this improve results?Yes! That does help.
If I search for networkconnectip4 events for that IP and then draw process tree for each event, I get svchost.exe searchapp.exe setup.exe
Looks like I just needed to dig a bit futher. I'm still surprised to see the searchapp.exe. I have more results for that exe than for the setup.exe.
Is there a better way for me to marry the network connection to the process without going through and running the Process Explorer? When I try "show responsible process data" I don't get any results.
Thank you for the help, Andrew!
There sure is. If you go to "IP Search" under Investigate it will make things much easier for you. See these screen shots: https://imgur.com/a/MH6yixO
After you get your results, if you click on the PID for the process you're interested in it will draw a Process Explorer for you.