F038MEDIUMSuspiciousvalidator: passed

NCPA monitoring agent staged in temp directory with execution (TA0002: Execution, TA0009: Collection)

C:\Windows\Temp\ncpa-2.0.4.exe

Analyst narrative

NCPA 2.0.4 (Nagios Check NRPE Agent) executable detected in C:\Windows\Temp\ncpa-2.0.4.exe with executed flag in AppCompatCache. NCPA is a legitimate monitoring tool; staging in temp suggests attacker deployment for collection or lateral movement.

Claims asserted

pathC:\Windows\Temp\ncpa-2.0.4.exerun_appcompatcacheparserget_amcache

Proof chain · 3 facts

Every confirmed claim links by foreign key to the typed fact that validated it, and to the forensic tool that produced that fact. This is one finding_trace() query.

▷

appcompatcache execution factappcompatcache:sysvol/windows/temp/ncpa-2.0.4.exe

run_appcompatcacheparser

›

Raw tool output · a77e3b3a90a16efa4308115dfa29cd624f06d409

{"ControlSet": "1", "CacheEntryPosition": "58", "Path": "SYSVOL\\Windows\\Temp\\ncpa-2.0.4.exe", "LastModifiedTimeUTC": "2018-03-14 13:37:42", "Executed": "No", "Duplicate": "False", "SourceFile": "/tmp/sift-onboard-mnt/rd01-case/Windows/System32/config/SYSTEM"}

▷

appcompatcache execution factappcompatcache:sysvol/windows/temp/ncpa-2.0.4.exe

run_appcompatcacheparser

›

Raw tool output · 3c5bce536b378587bd55890099d37b67a3e92c87

{"ControlSet": "2", "CacheEntryPosition": "58", "Path": "SYSVOL\\Windows\\Temp\\ncpa-2.0.4.exe", "LastModifiedTimeUTC": "2018-03-14 13:37:42", "Executed": "No", "Duplicate": "True", "SourceFile": "/tmp/sift-onboard-mnt/rd01-case/Windows/System32/config/SYSTEM"}

•

file execution factsha1:60083cabeaad20fb97938602edf856ae8f2829bc

get_amcache

›

Raw tool output · 44ee16d1ce50440b887c7b582468e05c7ceffa21

{"path": "C:\\Windows\\Temp\\ncpa-2.0.4.exe", "sha1": "60083cabeaad20fb97938602edf856ae8f2829bc", "first_run": "", "publisher": null, "file_size": null}

Source tools

get_amcacherun_appcompatcacheparser