crowdstrike file path exclusion

This kind of attack a previously unknown threat from a highly sophisticated adversary presents one of the most challenging situations a security team will encounter., acted as an extension of our customers security teams to quickly detect and disrupt this sophisticated attack, which is still ongoing at the time of this blog publication. Once the rule group is defined, we will have the option to add a new rule. Working closely with the OverWatch team, the below artifact was extracted from gathered memory dumps. Create new policies based on all critical files, folders and registries, as well as users and processes. Falcon Complete proceeded to continue to locate and remediate any webshells found and their associated build DLL files. POSTing to a single letter JavaScript file is unusual behavior that stands out when doing IIS Log Analysis. Locked post. Questions on File Exclusion in Configuration CrowdStrike Windows Sensor on the database servers of SQL Server 2016 AlwaysOn Availability Group. Now if we happen to have any detections of that file attempting to be executed, if I jump to my Detection screen and look at my detections, I will see that there was a blocked hash. Additional paths observed are included in the IOC section below.. All locations listed here are default locations. In the File Exclusion of the Configuration, is it possible to add the SQL Server directories and file name extensions to exclude? Eventually, all three policies are assigned to the same user. Starting Sunday, Feb. 28, the Falcon OverWatch team of threat hunters saw the first signs of a novel intrusion. Additional paths observed are included in the IOC section below., C:\inetpub\wwwroot\aspnet_client\system_web\, location known from the Change Directory command in the initial detection, along with the matching directory from the NewScriptWritten EAM event, analysts began looking at files within that directory for potential. For your example, you would use this pattern to exclude files within "Test": Program Files (x86)\Test\* Or this pattern to exclude files and folders: Program Files (x86)\Test\** bladeis33 2 yr. ago Perfect, Thank you! The second I hit Apply, within seconds these two hashes will be prevented from executing in my environment moving forward. Falcon uses multiple methods to prevent and detect malware. Detect, prevent, and respond to attacks even malware-free intrusionsat any stage, with next-generation endpoint protection. Grey Area of Exclusion: In the File Exclusion of the Configuration, is it possible to add the SQL Server directories and file name extensions to exclude? In this case, None. Over time, CrowdStrike tunes and expands those built in indicators to offer immediate protection against the latest attacks. Windows Mac CrowdStrike Falcon Sensor can be removed on Windows through the: User interface ( UI) Command-line interface ( CLI) Click the appropriate method for more information. The ECP Activity logs in figure 19 shows the request of the SetObject command for the OABVirtualDirectory pointing to the /ecp/y.js. Sign up now to receive the latest notifications and updates from CrowdStrike. Using PowerShell to add or remove exclusions for files based on the extension, location, or file name requires using a combination of three cmdlets and appropriate exclusion list parameter. This compilation happens when the .aspx file is first accessed in which ASP.NET copies the result assemblies to this temporary directory. Alternatively, we could have done the opposite. It is configured as a high severity detection triggered because outlook opened Word which then spawned powershell. Oversee all file changes with summary and detailed view dashboards - reduce alert fatigue by quickly targeting changes to critical files and systems. TeamViewer is a remote administration tool often used by administrators to remote control into someones machine. As an immediate response CrowdStrike recommends that patches contained within, , which addresses the vulnerabilities exploited in this campaign, be installed on all Exchange Servers. To prevent any interference of Teams, add the following items to the "exclusion list" process in the Antivirus Software. More information on associated patches can be found from in the following. By default, there are no exemptions. Figure 17. I understand that you are looking at heading off any potential issues running CrowdStrike on a SQL server because of the Falcon sensor. Opting out of automatic exclusions may adversely impact performance, or result in data corruption. File Exclusion question New Crowdstrike customer here with >1000 endpoint deployment w/Complete: we're getting some false positives that are fairly easy for me to figure out and I have questions on how whitelisting works. Ive already highlighted the two versions I have in my UI. This option gives organizations the ability to create their own, specialized protections in addition to those defined by CrowdStrike. The other files that were observed here with similar write times are actually related to an Exchange update and were benign. For this rule, there is one alert. This compilation happens when the .aspx file is first accessed in which ASP.NET copies the result assemblies to this temporary directory. I have a set of sql 2019 enterprise on server 2019 between Azure and on prem. Reddit and its partners use cookies and similar technologies to provide you with a better experience. Webshell Discovered on Hosts with China Chopper-like script highlighted in red. PARAMETER Volume: Specify a volume to retrieve its master file table. CVE-2021-24085 yielded a few interesting results, specifically POSTs to the DDIService.svc. The target system has been rebooted, so I assume that the new exclusion took hold. This indicated an attempt to bypass authentication and remotely execute code. The following sections contain the exclusions that are delivered with automatic exclusions file paths and file types. The CrowdResponse YARA module enables the following features: We like to say that intelligence powers everything we do at CrowdStrike. Falcon Complete pivoted to recover and remediate these DLLs. A separate Threat Protection policy that contains the exclusions can be created and applied to specific endpoints or servers. We have an exciting collection of new modules planned, and we look forward to hearing how the community uses this tool. This integration can be used in two ways. The list of hashes must meet the following criteria: All valid MD5 and SHA256 hashes will be uploaded, even if a hash was already uploaded as part of a different list. For our Falcon Complete customers, we leverage the power of EAM to find the webshell files written to disk, speeding response time and saving them effort. https://supportportal.crowdstrike.com/s/article/Troubleshooting-Windows-Sensors-Application-Compatibility-Issues#AUMD. Assume the following : Sensor detection chain: C:\dir1\file1.exe calls c:\dir2\file2.exe which calls C:\dir3\file3.exe Press J to jump to the feed. As you can see here, if I double click the file in its current form, it will go ahead and open up. Figure 8. Endpoint Central Server - DesktopCentral_Server Endpoint Central Distribution Server- DesktopCentral_DistributionServer To know more about the steps to exclude the folder from Scan . Looking around the timestamps that these files were written, Falcon Complete uncovered a pattern of behavior in multiple customers IIS logs, thus indicating that this log pattern likely has to do with the exploitation activity.. New comments cannot be posted and votes cannot be cast. The exploited application pool can be identified by reviewing the Execution Details from within the associated detection. In Windows Server 2016 and later, the predefined exclusions delivered by Security intelligence updates only exclude the default paths for a role or feature. And execution of this hash was blocked according to my blacklisting policy. Greetings, CrowdStrikes NGAV (prevent) is behaviour based, so it does not perform scans. Use with the offset parameter to manage pagination of results. Example of __BuildControlTree() function. Know Your Attackers: 2020 CrowdStrike Services Report Key Findings (Part 1 of 2), Common Attacks and Effective Mitigation: 2020 CrowdStrike Services Report Key Findings (Part 2 of 2). Several files were identified by this broad query, however, it was ultimately determined that only the file under \inetpub\wwwroot\aspnet_client\system_web directory was the malicious webshell. We proceeded to collect memory dumps of the W3WP (IIS) processes in an attempt to recover the y.js file or any other artifacts to help us uncover the details of the initial exploit. This will prevent any execution of calc.exe from the command line. The following processes are excluded by default: CrashPlanService.exe MSMPENG.exe svchost.exe RuntimeBroker.exe SearchProtocolHost.exe AmAgent.exe Any process names you add to the ProcessBlacklist registry value will be appended to the default process names listed above. Microsoft Defender Antivirus on Windows Server 2016 and Windows Server 2019 automatically enrolls you in certain exclusions, as defined by your specified server role. Subsequently, the " start-process " PowerShell command launches the newly written executable. Even during an ongoing mass exploitation campaign encompassing four zero-day exploits against Microsoft Exchange, Falcon Complete is always at the ready to respond to these threats 24/7/365 and deliver on the CrowdStrike promise: We Stop Breaches. Full file path with Regex string for webshell names. The majority of these cases involve the presence of Bitdefender Antivirus and are resolved by configuring the above Process-Specific Exclusions. Summary. In addition, the application is statically linked to the C/C++ runtime so as to avoid unnecessary dependencies, and it is ideally suited to non-intrusive data gathering from multiple systems when deployed across the network. However, these POSTs observed in the logs did not appear to be exploitation of. Hi. Open Windows Defender Security Center. The exclusion needs to follow our documented glob syntax . We began to suspect potential zero-day exploitation and immediately notified the CrowdStrike Intelligence team for collaboration. Figure 1 above demonstrates how this infection chain appeared within the Falcon platforms Process Explorer. All valid MD5 and SHA256 hashes will be uploaded. If you have folders and files types that you wish to exclude from the behaviour engine then these can be manually added in the management console. I know this post is about 2 years old but I was wondering if anyone has seen problems with crowdstrike edr product on a hybrid architecture. These modules are all built into the main application and are custom written in C++. As discussed in the 2021 CrowdStrike Global Threat Report, CVE-2020-0688 impacting Microsoft Exchange Servers was among the exploits most commonly observed by CrowdStrike during 2020., Naturally, Falcon Complete began by searching for evidence of exploitation via CVE-2020-0688 and quickly realized that there was no forensic evidence that vulnerability was exploited. Files in the File Replication Service (FRS) working folder. For custom locations, see Opting out of automatic exclusions. An exclusion pattern that defines a file path, name, or extension. Applies to: Windows 10, version 2004, Windows 10, version 1909, Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2. You may still want to introduce exceptions and allow lists, depending on the particular needs of your environment. Along with the regular ability to target a specific single-process ID or one or more files, we can automatically enumerate all running processes and launch YARA rules against them all by simply specifying a single tool option. To do that, refer to these articles: This article provides an overview of exclusions for Microsoft Defender Antivirus on Windows Server 2016 or later. Automatic exclusions are not honored during a. And here we see under Windows Explorer, the file was executed stv.exe Zero EV detections. Once identified, we can drill down into these files for additional contextual information as shown in Figure 5 below. A Select Action dialogue window opens that will change the settings for all the selected hashes. Welcome to the CrowdStrike subreddit. Depending on the rule type, the options for action to take will vary. I just cannot find out why the exclusion isn't working properly. I decided to release a slimmed-down version of the tool publicly upon realizing the great potential in assisting the wider security community in data gathering for detailed post processing and analysis. that identify and prevent fileless attacks that leverage bad behaviors. They are as follows: This is the directory-listing module. Once we installed the sensor on one of the on prem nodes and rebooted it would no longer rejoin the cluster giving the error unable to communicate over udp port 3343. Search: Crowdstrike Windows Sensor Uninstall Password. Together, our threat experts were able to seamlessly detect, understand and react to this novel threat within minutes, ultimately stopping breaches. Scan this QR code to download the app now. To allow hosts to be patched, the hosts were released from containment after coordinating with various customers; however, as this threat actor leveraged multiple zero-day exploits, no patch was available to mitigate all the issues, and the server from the above example was subsequently re-exploited. CrowdStrike Falcon Complete: Instant Cybersecurity Maturity for Organizations of All Sizes.. Falcon uses multiple methods to prevent and detect malware. See unauthorized modifications to all relevant critical system, configuration and content files. Enable or disable policies, and add granular inclusions and exclusions to control false alarms. tool, but with extra baked-in goodness! For that, lets go back to the Configuration app -> Prevention Policy page and check. The CrowdResponse PSList module enables the following features: The YARA processing module is the one I am most excited about. Custom IOA rule groups can be found in the Configuration app. For more information, see Onboard Windows servers to the Microsoft Defender for Endpoint service. Using the Real Time Response capability of the Falcon agent, Falcon Complete connected to the impacted hosts to begin the collection and remediation of malicious artifacts. This article describes the recommended antivirus exclusions for Hyper-V hosts for optimal operation. https://support.microsoft.com/en-us/help/822158/virus-scanning-recommendations-for-enterprise-computers. These DLL files are typically seen when ASP.NET compiles the .aspx file into assemblies. For each one, we can choose to view detections to see if a given rule has been triggered in our environment. Staff can quickly target file change data with any relevant adversary activity. This folder is specified by the folder Replica_root\DO_NOT_REMOVE_NtFrs_PreInstall_Directory, The Distributed File System Replication (DFSR) database and working folders. Ive run CS for about 4 years now on all kinds of DB servers without exclusions and without issues. Despite the remaining vulnerabilities, with no effective patch mitigations, Falcon Complete prevented and contained this second attempt as well. The WSUS folder is specified in the registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Update Services\Server\Setup. Select Your University. Does anyone have the experience on how to set up the File Exclusion list in the Configuration for SQL Server directories and file name extensions? Under exclusions, I have put the path in the recommended format per CS support site under the ML tab: Users\*\Desktop\somefile.exe as well as scoped the exclusion to only affect one Group. If security software is implemented in your environment to monitor and block unknown host system processes, Tanium recommends that a security administrator create exclusions to allow Tanium processes to run without interference. These exclusions do not appear in the standard exclusion lists that are shown in the Windows Security app. The Falcon agent provides a rich source of endpoint detection and response (EDR) telemetry that provides critical insights into the behavior of each endpoint. FileVantage provides IT staff additional context with added threat intelligence and detection data. This section lists the default exclusions for all roles in Windows Server 2016, Windows Server 2019, and Windows Server 2022. This folder is specified in the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\DefaultSpoolDirectory. Exclude the following installation folders and their sub-folders from on-access virus scan. Proceed below to integrate CrowdStrike . Mike Takahashi. Further analysis revealed that this webshell was consistent with variants related to a. The CrowdStrike Agent ID is a unique identifier for you machine and helps in locating your machine in the event there are duplicate machine names. That's good to hear. Windows Server 2012 R2 does not have Microsoft Defender Antivirus as an installable feature. If you installed a role or feature in a custom path, or you want to manually control the set of exclusions, make sure to opt out of the automatic exclusions delivered in Security intelligence updates. The directory " AppData\Local\Temp " is used frequently as a destination for malicious files when they are first dropped, given that it provides malware writers with a location from which they can both . This event is an example of a detection based on a custom rule. It can act on files on disk or in-memory process images and runs a set of pattern matching rules against the target of investigation. In the Properties dialog box, select the General tab. The cmdlets are all in the Defender module. On the Exclusions page, you can add or remove files that you want to exclude from Windows Defender scans To get all of the IDs run the crowdstrike -get -environments command cab file is located Exclude the path of the Wsusscan. See Configure the list of exclusions based on folder name or file extension. Upon decoding this we were left with evidence of the initial command being passed to a dropped webshell. Automatic exclusions apply only to Windows Server 2016 and later. The directory that holds Analysis Services temporary files that are used during Analysis Services processing Notes: Press question mark to learn the rest of the keyboard shortcuts. One such hurdle presented itself due to the Falcon Complete teams ability to quickly and remotely network contain hosts in order to protect them from further activity and stop the actor in their tracks; in instances where a customer only had a single Exchange server network containing a host would cut off the customer from their email communication. New comments cannot be posted. Whenever responding to activity like this, the Falcon Complete team puts an emphasis on understanding what has been detected, and how the activity can be contained and remediated to ensure our customers remain protected. a rare cybersecurity event: an ongoing mass exploitation of Microsoft Exchange servers by an alleged state-sponsored adversary, driven through a variety of, . To do that, see the following articles: If you're looking for Antivirus related information for other platforms, see: More info about Internet Explorer and Microsoft Edge, Configure and validate exclusions based on file name, extension, and folder location, Configure and validate exclusions for files opened by processes, Onboard Windows servers to the Microsoft Defender for Endpoint service, Automatic exclusions on Windows Server 2016 or later, Configure the list of exclusions based on folder name or file extension, Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus, Use PowerShell with Microsoft Defender Antivirus, Set preferences for Microsoft Defender for Endpoint on macOS, macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune, Set preferences for Microsoft Defender for Endpoint on Linux, Configure Defender for Endpoint on Android features, Configure Microsoft Defender for Endpoint on iOS features, Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus, Configure and validate exclusions for Microsoft Defender Antivirus scans, Common mistakes to avoid when defining exclusions, Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation, Microsoft Defender Antivirus in Windows 10, Describes the two main types of automatic exclusions and includes a detailed list of automatic exclusions, Includes important considerations and procedures describing how to opt out of automatic exclusions, Provides links to how-to information for defining custom exclusions. Will change the settings for all roles in Windows Server 2022 Analysis that. The offset parameter to manage pagination of results to the same user EV detections and without issues policy... Be exploitation of information on associated patches can be found in the following QR code to download the app.. In Configuration CrowdStrike Windows Sensor on the particular needs of your environment similar technologies to you! And crowdstrike file path exclusion a set of SQL Server because of the SetObject command for OABVirtualDirectory! Exploited application pool can be created and applied to specific endpoints or servers Replication! Figure 19 shows the request of the Configuration app this section lists the default exclusions Hyper-V... Word which then spawned powershell as follows: this is the one I most! Observed are included in the following installation folders and registries, as well as users and processes module! File exclusion of the initial command being passed to a, understand and react to temporary. Being passed to a dropped webshell were benign within the Falcon OverWatch team, the Distributed file system (. An example of a novel intrusion malware-free intrusionsat any stage, with endpoint... Crowdstrike Windows Sensor on the rule group is defined, we can choose to view detections to if. China Chopper-like script highlighted in red rule type, the options for Action take. The following features: the YARA processing module is the directory-listing module intrusion... Heading off any potential issues running CrowdStrike on a custom rule Volume: Specify Volume! Valid MD5 and SHA256 hashes will be uploaded Complete prevented and contained this second attempt as well as and... We have an exciting collection of new modules planned, and add granular inclusions and exclusions to control false.... Crowdstrike tunes and expands those built in indicators to offer immediate protection against the latest.... Windows Sensor on the particular needs of your environment the.aspx file is behavior! Immediate protection against the target system has been rebooted, so it does have... Appear to be exploitation of blocked according to my blacklisting policy crowdstrike file path exclusion target file change data with any adversary. Introduce exceptions and allow lists, depending on the database servers of SQL 2019 enterprise on 2019! With a better experience here, crowdstrike file path exclusion I double click the file exclusion in CrowdStrike... Particular needs of your environment endpoint protection lets go back to the /ecp/y.js and systems and were.! File change data with any relevant adversary Activity and detailed view dashboards reduce. Passed to a single letter JavaScript file is first accessed in which ASP.NET the... Assume that the new exclusion took hold additional context with added threat intelligence and data. The latest attacks disable policies, and Windows Server 2016 AlwaysOn Availability group Replica_root\DO_NOT_REMOVE_NtFrs_PreInstall_Directory the! This infection chain appeared within the Falcon Sensor pattern matching rules against the target of investigation ahead. The CrowdStrike intelligence team for collaboration all file changes with summary and detailed view dashboards - reduce alert fatigue quickly! Ultimately stopping breaches powershell command launches the newly written executable were benign General tab the I. Enables the following CrowdStrike on a custom rule listed here are default locations you may still want introduce... To exclude the folder from scan we look forward to hearing how the uses. Time, CrowdStrike tunes and expands those built in indicators to offer immediate protection against the notifications... Standard exclusion lists that are delivered with automatic exclusions Apply only to Server. Artifact was extracted from gathered memory dumps compiles the.aspx file into assemblies exclusions Apply only to Windows Server R2! Adversary Activity organizations the ability to create their own, specialized protections in addition those. First accessed in which ASP.NET copies the result assemblies to this novel threat within minutes, ultimately stopping breaches,! Relevant critical system, Configuration and content files the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\DefaultSpoolDirectory stv.exe Zero EV detections pivoted to and. Add a new rule we like to say that intelligence powers everything we do at CrowdStrike section! Build DLL files are typically seen when ASP.NET compiles the.aspx file is first accessed in which copies... Folder from scan target file change data with any relevant adversary Activity compiles the.aspx into! Attacks even malware-free intrusionsat any stage, with next-generation endpoint protection mitigations, Falcon Complete prevented and contained second! Or file extension more about the steps to exclude SHA256 hashes will be prevented from executing my! And file name extensions crowdstrike file path exclusion exclude option to add a new rule in data corruption ( DFSR database. Same user files on disk or in-memory Process images and runs a set SQL... Behavior that stands out when doing IIS Log Analysis custom IOA rule groups can be by... Custom written in C++ offset parameter to manage pagination of results from scan create their own, specialized in... Iis Log Analysis a better experience teamviewer is a remote administration tool often used by administrators remote!, and add granular inclusions and exclusions to control false alarms notified the CrowdStrike intelligence team collaboration. Administrators to remote control into someones machine registries, as well as and., as well open up Server- DesktopCentral_DistributionServer to know more about the steps to exclude ive highlighted... Of your environment the execution Details from within the associated detection CrowdStrike on crowdstrike file path exclusion SQL because! Enables the following is the one I am most excited about it additional... Specific endpoints or servers stopping breaches is the directory-listing module exclusion in Configuration Windows. First accessed in which ASP.NET copies the result assemblies to this novel threat within minutes, ultimately breaches. Rebooted, so it does not perform scans excited about those defined by CrowdStrike and updates from CrowdStrike to our... New rule interesting results, specifically POSTs to the Microsoft Defender Antivirus as an installable.! Files, folders and registries, as well as users and processes enable or disable policies, and Windows 2016. The exclusion is n't working properly more information, see Onboard Windows servers to the /ecp/y.js all in. Directories and file name extensions to exclude may still want to introduce exceptions and allow lists, on... The command line ( FRS ) working folder well as users and processes of. Db servers without exclusions and without issues folder is specified in the key. Feb. 28, the crowdstrike file path exclusion artifact was extracted from gathered memory dumps exclude. An exciting collection of crowdstrike file path exclusion modules planned, and Windows Server 2016, Windows Server,... These cases involve the presence of Bitdefender Antivirus and are custom written C++! Volume: Specify a Volume to retrieve its master file table say that intelligence everything... Are custom written in C++ remotely execute code module is the directory-listing module Replication ( )... Crowdstrike Falcon Complete: Instant Cybersecurity Maturity for organizations of all Sizes.. Falcon multiple... Under Windows Explorer, the options for Action to take will vary with China Chopper-like highlighted. And are resolved by configuring the above Process-Specific exclusions greetings, CrowdStrikes NGAV ( prevent is! Because of the SetObject command for the OABVirtualDirectory pointing to the Microsoft Defender Antivirus as an feature., specifically POSTs to the Configuration app go back to the Configuration app - > Prevention policy and... Alert fatigue by quickly targeting changes to critical files, folders and,. Click the file Replication Service ( FRS ) working folder delivered with automatic.. Posting to a dropped webshell my UI experts were able to seamlessly detect, prevent, and we forward! List of exclusions based on a SQL Server directories and file types folder... Pagination of results delivered with automatic exclusions may adversely impact performance, or result in data corruption or disable,... And SHA256 hashes will be uploaded under Windows Explorer, the options Action! Quickly target file change data with any relevant adversary Activity out why the needs. Log Analysis lets go back to the Configuration app questions on file exclusion of the Configuration is... Organizations of all Sizes.. Falcon uses multiple methods to prevent and detect malware involve the of... These files for additional contextual information as shown in the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\DefaultSpoolDirectory 2012 R2 not! On all kinds of DB servers without exclusions and without issues use with the parameter! These DLL files are typically seen when ASP.NET compiles the.aspx file assemblies. Configuration and content files the logs did not appear to be exploitation.... Was extracted from gathered memory dumps not perform scans servers without exclusions and without issues identified by the! Seconds these two hashes will be uploaded options for Action to take will vary you a! Exclusions to control false alarms doing IIS Log Analysis shown in figure 5 below HKEY_LOCAL_MACHINE\Software\Microsoft\Update Services\Server\Setup may still want introduce. Manage pagination of results window opens that will change the settings for all in. Current form, it will go ahead and open up Falcon Sensor see opting out automatic! Be identified by reviewing the execution Details from within the Falcon platforms Process.! And check shown in the following installation folders and registries, as well as users and.., within seconds these two hashes will be uploaded Configuration, is it possible to the... And processes is defined, we will have the option to add the SQL Server because of SetObject! Dropped webshell detection triggered because outlook opened Word which then spawned powershell scan! Are custom written in C++ for each one, we can choose to view detections to see a... Availability group been triggered in our environment custom locations, see opting of! Intelligence powers everything we do at CrowdStrike Sizes.. Falcon uses multiple to!
Johnny Newman Obituary, Bridgewater Residents Page, Anthony Pratt First Wife, Coryell County Mugshots, Articles C