Malwarebytes
Scan and Remediate threats on endpoints in the Malwarebytes cloud.
Endpoint · ThreatDown
Details
| ID | Malwarebytes |
|---|---|
| Provider | Malwarebytes |
| Category | Endpoint |
| From Version | 5.0.0 |
| Docker Image | demisto/auth-utils:1.0.0.10608895 |
| Supported Modules | Agentix XSIAM |
README
Overview
| Scan and Remediate threats on endpoints in the ThreatDown | Nebula. |
| This integration was integrated and tested with ThreatDown | Nebula. |
ThreatDown (powered by Malwarebytes) Playbook
- Malwarebytes - Scan & Remediate Endpoint
- Malwarebytes - Isolate Endpoint
Use Cases
- Trigger ThreatDown Scans and Remediation as part of Cortex XSOAR Playbook.
- Trigger ThreatDown EDR Advanced Capabilities as part of a Cortex XSOAR Playbook.
- Create Cortex XSOAR incidents based on threats detected by ThreatDown.
Configure ThreatDown (powered by Malwarebytes) on Cortex XSOAR
This integration collects your E-mail and Company Name for usage analytics of ThreatDown, if provided in the config.
- Navigate to Settings > Integrations > Servers & Services.
- Search for ThreatDown.
- Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Account ID
- Client ID
- Client Secret
- Region
- Fetch incidents
- Incident type
- Fetch Event List
- RTP Detections Threat Category
- Suspicious Activity Severity
- Trust any certificate (not secure)
- Use system proxy settings
- Company Name
- Click Test to validate the URLs, token, and connection.
Fetched Incidents Data
The fetch incidents command is the function that Cortex XSOAR calls every minute to import new incidents and is triggered by the “Fetches incidents” parameter in the integration configuration.
What kind of objects/entities the integration should fetch (events/alerts/incidents/cases/tickets/etc)?
- Create a Cortex XSOAR incident upon a ThreatDown Real-time protection detections.
- Create a Cortex XSOAR incident upon a ThreatDown Suspicious Activity detections.
Are there any filters available to allow users to filter those incidents (e.g. type, status, etc) ?
Filters like Severity, Malware Category will be provided on the integration config.
Commands
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
- malwarebytes-scan-and-remediate
- malwarebytes-scan-and-report
- malwarebytes-isolate-endpoint
- malwarebytes-isolate-process
- malwarebytes-isolate-desktop
- malwarebytes-isolate-network
- malwarebytes-deisolate-endpoint
- malwarebytes-list-endpoints
- malwarebytes-list-endpoint-info
- malwarebytes-get-scan-detections
- malwarebytes-get-job-status
- malwarebytes-open-sa-incident
- malwarebytes-remediate-sa-incident
- malwarebytes-close-sa-incident
- malwarebytes-get-sa-activities
1. malwarebytes-scan-and-remediate
Initiate Scan and Remediate action on an endpoint based on IP or Hostname.
Base Command
malwarebytes-scan-and-remediate
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname of an endpoint in Malwarebytes Cloud. | Optional |
| ip | IP of an endpoint in Malwarebytes Cloud. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Scan.Machine_ID | string | Endpoint ID of the host |
| Malwarebytes.Scan.Job_ID | string | Job ID of the scanned host |
Command Example
!malwarebytes-scan-and-remediate hostname=DESKTOP-LI4MQ7B
Context Example
{
"Malwarebytes.Scan": {
"Machine_ID": "211d8c3e-142c-4849-b1f0-1680b4bd239c",
"Job_ID": "964776a3-9cd8-45a2-9c56-59f692f42cc6"
}
}
Human Readable Output
Scan and Remediate action has been successfully started on the Endpoint: DESKTOP-LI4MQ7B with the job_id: 964776a3-9cd8-45a2-9c56-59f692f42cc6. Use job_id in malwarebytes-get-job-status command to check status and malwarebytes-get-scan-detections command to view results
2. malwarebytes-scan-and-report
Initiate Scan and report action on an endpoint based on IP or Hostname.
Base Command
malwarebytes-scan-and-report
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname of an endpoint in Malwarebytes Cloud. | Optional |
| ip | IP of an endpoint in Malwarebytes Cloud. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Scan.Machine_ID | string | Endpoint ID of the host |
| Malwarebytes.Scan.Job_ID | string | Job ID of the scanned host |
Command Example
!malwarebytes-scan-and-report hostname=TA-AZ-CLT1
Context Example
{
"Malwarebytes.Scan": {
"Machine_ID": "017febb6-ae68-4c15-9918-d911c72d062a",
"Job_ID": "88c6de27-d7d2-45da-a0b9-239a774afe50"
}
}
Human Readable Output
Scan and Report action has been successfully started on the Endpoint: TA-AZ-CLT1 with the job_id: 88c6de27-d7d2-45da-a0b9-239a774afe50. Use job_id in malwarebytes-get-job-status command to check status and malwarebytes-get-scan-detections command to view results
3. malwarebytes-isolate-endpoint
Initiate Isolation action on an endpoint based on IP or Hostname. This action isolate an endpoint by Process, Network and Desktop.
Base Command
malwarebytes-isolate-endpoint
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname of an endpoint in Malwarebytes Cloud. | Optional |
| ip | IP of an endpoint in Malwarebytes Cloud. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Scan.Machine_ID | string | Endpoint ID of the host |
| Malwarebytes.Scan.Job_ID | string | Job ID of the scanned host |
Command Example
!malwarebytes-isolate-endpoint hostname=DESKTOP-LI4MQ7B
Context Example
{
"Malwarebytes.Scan": {
"Machine_ID": "211d8c3e-142c-4849-b1f0-1680b4bd239c",
"Job_ID": "c133caaf-2c1c-4c54-86b5-b45354608e4d"
}
}
Human Readable Output
Isolation action has been successfully started on the Endpoint: DESKTOP-LI4MQ7B with the job_id: c133caaf-2c1c-4c54-86b5-b45354608e4d. Use job_id in malwarebytes-get-job-status command to view results
4. malwarebytes-isolate-process
Initiate Process Isolation action on an endpoint based on IP or Hostname.
Base Command
malwarebytes-isolate-process
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname of an endpoint in Malwarebytes Cloud. | Optional |
| ip | IP of an endpoint in Malwarebytes Cloud. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Scan.Machine_ID | string | Endpoint ID of the host |
| Malwarebytes.Scan.Job_ID | string | Job ID of the scanned host |
Command Example
!malwarebytes-isolate-process hostname=DESKTOP-LI4MQ7B
Context Example
{
"Malwarebytes.Scan": {
"Machine_ID": "211d8c3e-142c-4849-b1f0-1680b4bd239c",
"Job_ID": "72708102-465f-4a3e-8be5-de93cdae6cad"
}
}
Human Readable Output
Process Isolation action has been successfully started on the Endpoint: DESKTOP-LI4MQ7B with the job_id: 72708102-465f-4a3e-8be5-de93cdae6cad. Use job_id in malwarebytes-get-job-status command to view results
5. malwarebytes-isolate-desktop
Initiate Desktop Isolation action on an endpoint based on IP or Hostname.
Base Command
malwarebytes-isolate-desktop
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname of an endpoint in Malwarebytes Cloud. | Optional |
| ip | IP of an endpoint in Malwarebytes Cloud. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Scan.Machine_ID | string | Endpoint ID of the host |
| Malwarebytes.Scan.Job_ID | string | Job ID of the scanned host |
Command Example
!malwarebytes-isolate-desktop hostname=TA-AZ-CLT1
Context Example
{
"Malwarebytes.Scan": {
"Machine_ID": "017febb6-ae68-4c15-9918-d911c72d062a",
"Job_ID": "6b0d17b7-bb5b-4314-a841-f25ae93c6a8e"
}
}
Human Readable Output
Desktop Isolation action has been successfully started on the Endpoint: TA-AZ-CLT1 with the job_id: 6b0d17b7-bb5b-4314-a841-f25ae93c6a8e. Use job_id in malwarebytes-get-job-status command to view results
6. malwarebytes-isolate-network
Initiate Network Isolation action on an endpoint based on IP or Hostname.
Base Command
malwarebytes-isolate-network
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname of an endpoint in Malwarebytes Cloud. | Optional |
| ip | IP of an endpoint in Malwarebytes Cloud. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Scan.Machine_ID | string | Endpoint ID of the host |
| Malwarebytes.Scan.Job_ID | string | Job ID of the scanned host |
Command Example
!malwarebytes-isolate-network hostname=TA-AZ-CLT1
Context Example
{
"Malwarebytes.Scan": {
"Machine_ID": "017febb6-ae68-4c15-9918-d911c72d062a",
"Job_ID": "cc92a1f4-7253-415d-a743-64f0ea7afb65"
}
}
Human Readable Output
Network Isolation action has been successfully started on the Endpoint: TA-AZ-CLT1 with the job_id: cc92a1f4-7253-415d-a743-64f0ea7afb65. Use job_id in malwarebytes-get-job-status command to view results
7. malwarebytes-deisolate-endpoint
Initiate Deisolation action on an endpoint based on IP or Hostname. This action deisolate an endpoint by Process, Network and Desktop.
Base Command
malwarebytes-deisolate-endpoint
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname of an endpoint in Malwarebytes Cloud. | Optional |
| ip | IP of an endpoint in Malwarebytes Cloud. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Scan.Machine_ID | string | Endpoint ID of the host |
| Malwarebytes.Scan.Job_ID | string | Job ID of the scanned host |
Command Example
!malwarebytes-deisolate-endpoint hostname=TA-AZ-CLT1
Context Example
{
"Malwarebytes.Scan": {
"Machine_ID": "017febb6-ae68-4c15-9918-d911c72d062a",
"Job_ID": "8dab60e1-e6d8-47c3-b321-0a74de329d20"
}
}
Human Readable Output
Deisolation action has been successfully started on the Endpoint: TA-AZ-CLT1 with the job_id: 8dab60e1-e6d8-47c3-b321-0a74de329d20. Use job_id in malwarebytes-get-job-status command to view results
8. malwarebytes-list-endpoints
List all/online/offline endpoints available in the Malwarebytes Cloud.
Base Command
malwarebytes-list-endpoints
Input
| Argument Name | Description | Required |
|---|---|---|
| endpoints | Enter value ‘all’ to get all endpoints and value ‘online’ or ‘offline’ to get online/offline endpoints. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Endpoint.total_count | int | total count of all/online/offline endpoints. |
Command Example
!malwarebytes-list-endpoints endpoints=all
Context Example
{
"Malwarebytes.Endpoint": {
"total_count": 5
}
}
Human Readable Output
Found all 5 Endpoints from Malwarebytes Cloud
| created_at | id | last_seen_at | name | online | os_architecture | os_platform | os_release_name |
|---|---|---|---|---|---|---|---|
| 2020-02-05T10:12:55.187467Z | 017febb6-ae68-4c15-9918-d911c72d062a | 2020-04-16T14:05:41.668409Z | TA-AZ-CLT1 | false | AMD64 | WINDOWS | Microsoft Windows 10 Pro |
| 2020-03-31T08:42:14.319976Z | 1d711cdc-6c6c-4457-927f-2528ecc857a0 | 2020-04-15T08:50:42.737922Z | EC2AMAZ-KK7M02P | false | AMD64 | WINDOWS | Microsoft Windows Server 2019 Datacenter |
| 2020-02-05T09:50:02.194556Z | 211d8c3e-142c-4849-b1f0-1680b4bd239c | 2020-04-22T09:07:41.206037Z | DESKTOP-LI4MQ7B | true | AMD64 | WINDOWS | Microsoft Windows 10 Enterprise |
| 2019-11-25T19:47:15.833008Z | b5740188-00a2-434b-a180-5b0fa85cb10b | 2020-04-21T18:17:43.064707Z | DESKTOP-91UJNA1 | false | AMD64 | WINDOWS | Microsoft Windows 10 Pro |
| 2019-10-18T09:26:26.993555Z | 5074ade3-5716-44d8-83c7-5985379c0399 | 2020-04-22T09:32:25.813131Z | DESKTOP-664HFM6 | true | AMD64 | WINDOWS | Microsoft Windows 10 Pro |
9. malwarebytes-list-endpoint-info
Lists more granular information about an endpoint.
Base Command
malwarebytes-list-endpoint-info
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname of an endpoint in Malwarebytes Cloud. | Optional |
| ip | IP of an endpoint in Malwarebytes Cloud. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Endpoint.Assets | string | Asset information of the endpoint. |
| Malwarebytes.Endpoint.Hostname | string | The hostname that is mapped to this endpoint. |
| Malwarebytes.Endpoint.IPAddress | string | The IP address of the endpoint. |
| Malwarebytes.Endpoint.Domain | string | The domain of the endpoint. |
| Malwarebytes.Endpoint.MACAddress | string | The MAC address of the endpoint. |
| Malwarebytes.Endpoint.OS | string | Endpoint OS. |
| Malwarebytes.Endpoint.OSVersion | string | OS version. |
| Malwarebytes.Endpoint.Model | string | The model of the machine or device. |
| Malwarebytes.Endpoint.Memory | int | Memory on this endpoint. |
| Endpoint.Hostname | string | The hostname that is mapped to this endpoint. |
| Endpoint.IPAddress | string | The IP address of the endpoint. |
| Endpoint.Domain | string | The domain of the endpoint. |
| Endpoint.MACAddress | string | The MAC address of the endpoint. |
| Endpoint.OS | string | Endpoint OS. |
| Endpoint.OSVersion | string | OS version. |
| Endpoint.Model | string | The model of the machine or device. |
| Endpoint.Memory | int | Memory on this endpoint. |
Command Example
!malwarebytes-list-endpoint-info hostname=TA-AZ-CLT1
Context Example
{
"Malwarebytes.Endpoint": {
"MACAddress": "000D3A0AFEC2",
"Domain": "",
"Assets": {
"computer_info": {
"model": "Virtual Machine",
"manufacturer": "Microsoft Corporation"
},
"plugin_version": "1.2.0.330",
"object_sid": "",
"updates_installed": [],
"dhcp_scope_name": "",
"object_guid": "",
"drives": [
{
"name": "C:\\",
"total_size": 135838822400,
"freespace_available": 124591616000,
"freespace_total": 124591616000,
"volume_label": "Windows",
"drive_format": "NTFS"
},
{
"name": "D:\\",
"total_size": 8588816384,
"freespace_available": 7477661696,
"freespace_total": 7477661696,
"volume_label": "Temporary Storage",
"drive_format": "NTFS"
}
],
"domain_name": "",
"culture": "en-US",
"nics": [
{
"ips": [
"10.0.0.11"
],
"description": "Microsoft Hyper-V Network Adapter",
"mac_address": "000D3A0AFEC2"
}
],
"host_name": "TA-AZ-CLT1",
"software_installed": [
{
"product": "Google Chrome",
"version": "80.0.3987.87",
"vendor": "Google LLC",
"installed_date": "2020-02-05T00:00:00Z"
},
{
"product": "Malwarebytes Endpoint Agent",
"version": "1.2.0.0",
"vendor": "Malwarebytes",
"installed_date": "2020-02-05T00:00:00Z"
}
],
"memory": {
"total_physical": 4294967296,
"total_virtual": 5368094720,
"free_virtual": 2920792064,
"free_physical": 1683750912
},
"time_zone": "Etc/GMT",
"startups": [
{
"value": "explorer.exe",
"name": "Shell",
"key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"
},
{
"value": "",
"name": "System",
"key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"
},
{
"value": "",
"name": "Taskman",
"key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"
},
{
"value": "C:\\windows\\system32\\userinit.exe,",
"name": "Userinit",
"key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon"
},
{
"value": "C:\\windows\\system32\\SecurityHealthSystray.exe",
"name": "SecurityHealth",
"key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
},
{
"value": "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}",
"name": "WebCheck",
"key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellServiceObjectDelayLoad"
},
{
"name": "Authentication Packages",
"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa"
},
{
"name": "Notification Packages",
"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa"
},
{
"name": "Security Packages",
"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa"
},
{
"value": "credssp.dll",
"name": "SecurityProviders",
"key": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders"
}
],
"fully_qualified_host_name": "TA-AZ-CLT1",
"os_info": {
"os_release_name": "Microsoft Windows 10 Pro",
"os_type": "Workstation",
"os_architecture": "Amd64",
"os_platform": "Windows",
"os_version": "10.0.17763"
}
},
"OS": "Windows",
"Hostname": "TA-AZ-CLT1",
"Memory": {
"total_physical": 4294967296,
"total_virtual": 5368094720,
"free_virtual": 2920792064,
"free_physical": 1683750912
},
"Model": "Virtual Machine",
"OSVersion": "10.0.17763",
"IPAddress": [
{
"ips": [
"10.0.0.11"
],
"description": "Microsoft Hyper-V Network Adapter",
"mac_address": "000D3A0AFEC2"
}
]
},
"Endpoint": {
"MACAddress": "000D3A0AFEC2",
"Domain": "",
"OS": "Windows",
"Hostname": "TA-AZ-CLT1",
"Memory": 5368094720,
"Model": "Virtual Machine",
"OSVersion": "10.0.17763",
"IPAddress": "10.0.0.11"
}
}
Human Readable Output
Endpoint Information for the Hostname: TA-AZ-CLT1
| computer_info | culture | dhcp_scope_name | domain_name | drives | fully_qualified_host_name | host_name | memory | nics | object_guid | object_sid | os_info | plugin_version | software_installed | startups | time_zone | updates_installed |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| manufacturer: Microsoft Corporation model: Virtual Machine |
en-US | {‘freespace_available’: 124591616000, ‘volume_label’: ‘Windows’, ‘drive_format’: ‘NTFS’, ‘freespace_total’: 124591616000, ‘name’: ‘C:\’, ‘total_size’: 135838822400}, {‘freespace_available’: 7477661696, ‘volume_label’: ‘Temporary Storage’, ‘drive_format’: ‘NTFS’, ‘freespace_total’: 7477661696, ‘name’: ‘D:\’, ‘total_size’: 8588816384} |
TA-AZ-CLT1 | TA-AZ-CLT1 | total_virtual: 5368094720 free_virtual: 2920792064 total_physical: 4294967296 free_physical: 1683750912 |
{‘mac_address’: ‘000D3A0AFEC2’, ‘description’: ‘Microsoft Hyper-V Network Adapter’, ‘ips’: [‘10.0.0.11’]} | os_platform: Windows os_architecture: Amd64 os_version: 10.0.17763 os_release_name: Microsoft Windows 10 Pro os_type: Workstation |
1.2.0.330 | {‘vendor’: ‘Google LLC’, ‘product’: ‘Google Chrome’, ‘installed_date’: ‘2020-02-05T00:00:00Z’, ‘version’: ‘80.0.3987.87’}, {‘vendor’: ‘Malwarebytes’, ‘product’: ‘Malwarebytes Endpoint Agent’, ‘installed_date’: ‘2020-02-05T00:00:00Z’, ‘version’: ‘1.2.0.0’} |
{‘key’: ‘HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon’, ‘name’: ‘Shell’, ‘value’: ‘explorer.exe’}, {‘key’: ‘HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon’, ‘name’: ‘System’, ‘value’: ‘’}, {‘key’: ‘HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon’, ‘name’: ‘Taskman’, ‘value’: ‘’}, {‘key’: ‘HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon’, ‘name’: ‘Userinit’, ‘value’: ‘C:\windows\system32\userinit.exe,’}, {‘key’: ‘HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run’, ‘name’: ‘SecurityHealth’, ‘value’: ‘C:\windows\system32\SecurityHealthSystray.exe’}, {‘key’: ‘HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad’, ‘name’: ‘WebCheck’, ‘value’: ‘{E6FB5E20-DE35-11CF-9C87-00AA005127ED}’}, {‘key’: ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa’, ‘name’: ‘Authentication Packages’}, {‘key’: ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa’, ‘name’: ‘Notification Packages’}, {‘key’: ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa’, ‘name’: ‘Security Packages’}, {‘key’: ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders’, ‘name’: ‘SecurityProviders’, ‘value’: ‘credssp.dll’} |
Etc/GMT |
10. malwarebytes-get-scan-detections
Lists detections from an endpoint for the scans initiated from Cortex XSOAR.
Base Command
malwarebytes-get-scan-detections
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | Job ID of the initiated Scan actions only. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Scan.Job_ID | string | Job_Id of the initiated Scan/Isolation/Deisolation actions. |
| Malwarebytes.Scan.Status | string | Scan Status for the host |
| Malwarebytes.Scan.Detections | string | Scan detections for the host |
Command Example
!malwarebytes-get-scan-detections job_id=931f63ca-e14f-43ad-85d2-3eb8236f1bdd
Context Example
{
"Malwarebytes.Scan": {
"Status": "COMPLETED",
"Detections": [
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\CCOKDBVT\\MHTQR4AW1913.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\CCOKDBVT\\EKATI3479.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\CCOKDBVT\\5WRQN2VY9117.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\AMDSCQBK\\EKATI3234.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\RKSUGKK2\\EKATI1111.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\RKSUGKK2\\5IPWAWNR7377.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\REAQNH4P\\UWAEL22C6434.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\REAQNH4P\\GJL0GTPS2496.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\REAQNH4P\\EKATI5786.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\REAQNH4P\\AAWK4JEC6577.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\R5QH05OL\\EKATI5120.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\QJTCQTO5\\EKATI3976.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\QGZQD505\\EKATI6903.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\QDI3PGI1\\EKATI8011.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\PHVALVXM\\EKATI5172.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\PCHQV24F\\EKATI8221.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\PCHQV24F\\0LI1UX235485.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\OX4R0SZA\\EKATI6865.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\K2LXHNO1\\EKATI6770.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\K1UQJ5KL\\EKATI1034.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\JI4PZP0K\\EKATI5574.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\ICOWWYNX\\EKATI7940.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\HUOBVYD0\\EKATI8486.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\H0LKYXKH\\EKATI6183.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\ZWIZHTVD\\EKATI6050.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\ZAAN0543\\EKATI4385.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\YWDLSBOE\\EKATI7806.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\XXQBCKEL\\Y2YWHFY47970.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\XXQBCKEL\\HVAVEBY58253.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\XXQBCKEL\\EKATI6877.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\XDFR4BMU\\EKATI1611.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\X5IN24J2\\EKATI2562.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\X3DL34QB\\EKATI4718.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\WAWZXFJU\\EKATI3613.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\VAIVLV51\\EKATI2378.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\FW3M1KTG\\NKWWQ5337273.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\FW3M1KTG\\KQDYZ5DZ2805.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\FW3M1KTG\\EKATI8812.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\FNKI23QO\\EKATI9379.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\FMULGDCG\\EKATI5361.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\EZ3VSVR0\\EKATI3626.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\DYEBLIJJ\\EKATI2757.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\DVM05IV0\\EKATI4168.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\DKI4HFKX\\EKATI2083.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\TXS354JE\\EKATI7864.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\TFDVXDEW\\EKATI3594.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\TCERNEHR\\EKATI3060.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\SSODDPVL\\EKATI3273.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\SK4GT55H\\NSMDWPVW1226.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\SK4GT55H\\EKATI6166.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\SJRCS2D5\\EKATI3838.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\S0RPYHDI\\EKATI1244.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\MDX3HHPZ\\EKATI7764.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\MA2EZOX5\\HURT2A3R4366.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\MA2EZOX5\\GVXQMXK04108.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\MA2EZOX5\\EKATI5862.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\LTMZR34O\\EKATI8397.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\5KE1T1MN\\EKATI3121.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\40ASYTIK\\EKATI2489.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\2VR0DR23\\EKATI9180.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\22PMRE41\\EKATI2935.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\1U0KTXL4\\EKATI4859.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.FileLocker",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\0TNNQOPO\\EKATI4374.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "arw",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Ransom.Ekati",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\0TNNQOPO\\CHLGY5ZD1037.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "Malware",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Generic.Malware/Suspicious",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\BIN3333.RAR",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "Malware",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "DDoSTool.Nitol",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\CCTV.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "PUP",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "PUP.Optional.Solimba",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\MICROSOFT OFFICE 2007 SERVICE PACK 2.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "Malware",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Trojan.ServStart",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\FCK_RSC.DUMP",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
},
{
"category": "Malware",
"status": "found",
"machine_name": "DESKTOP-664HFM6",
"reported_at": "2020-03-03T13:28:57.393772Z",
"threat_name": "Generic.Malware/Suspicious",
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\2211.RAR",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399",
"type": [
"file"
]
}
],
"Job_ID": "931f63ca-e14f-43ad-85d2-3eb8236f1bdd"
}
}
Human Readable Output
Scan Detections Report for the Job_Id: 931f63ca-e14f-43ad-85d2-3eb8236f1bdd
| category | machine_id | machine_name | path | reported_at | status | threat_name | type |
|---|---|---|---|---|---|---|---|
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\CCOKDBVT\MHTQR4AW1913.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\CCOKDBVT\EKATI3479.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\CCOKDBVT\5WRQN2VY9117.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\AMDSCQBK\EKATI3234.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\RKSUGKK2\EKATI1111.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\RKSUGKK2\5IPWAWNR7377.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\REAQNH4P\UWAEL22C6434.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\REAQNH4P\GJL0GTPS2496.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\REAQNH4P\EKATI5786.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\REAQNH4P\AAWK4JEC6577.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\R5QH05OL\EKATI5120.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\QJTCQTO5\EKATI3976.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\QGZQD505\EKATI6903.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\QDI3PGI1\EKATI8011.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\PHVALVXM\EKATI5172.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\PCHQV24F\EKATI8221.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\PCHQV24F\0LI1UX235485.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\OX4R0SZA\EKATI6865.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\K2LXHNO1\EKATI6770.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\K1UQJ5KL\EKATI1034.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\JI4PZP0K\EKATI5574.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\ICOWWYNX\EKATI7940.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\HUOBVYD0\EKATI8486.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\H0LKYXKH\EKATI6183.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\ZWIZHTVD\EKATI6050.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\ZAAN0543\EKATI4385.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\YWDLSBOE\EKATI7806.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\XXQBCKEL\Y2YWHFY47970.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\XXQBCKEL\HVAVEBY58253.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\XXQBCKEL\EKATI6877.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\XDFR4BMU\EKATI1611.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\X5IN24J2\EKATI2562.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\X3DL34QB\EKATI4718.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\WAWZXFJU\EKATI3613.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\VAIVLV51\EKATI2378.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\FW3M1KTG\NKWWQ5337273.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\FW3M1KTG\KQDYZ5DZ2805.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\FW3M1KTG\EKATI8812.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\FNKI23QO\EKATI9379.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\FMULGDCG\EKATI5361.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\EZ3VSVR0\EKATI3626.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\DYEBLIJJ\EKATI2757.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\DVM05IV0\EKATI4168.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\DKI4HFKX\EKATI2083.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\TXS354JE\EKATI7864.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\TFDVXDEW\EKATI3594.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\TCERNEHR\EKATI3060.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\SSODDPVL\EKATI3273.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\SK4GT55H\NSMDWPVW1226.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\SK4GT55H\EKATI6166.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\SJRCS2D5\EKATI3838.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\S0RPYHDI\EKATI1244.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\MDX3HHPZ\EKATI7764.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\MA2EZOX5\HURT2A3R4366.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\MA2EZOX5\GVXQMXK04108.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\MA2EZOX5\EKATI5862.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\LTMZR34O\EKATI8397.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\5KE1T1MN\EKATI3121.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\40ASYTIK\EKATI2489.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\2VR0DR23\EKATI9180.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\22PMRE41\EKATI2935.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\1U0KTXL4\EKATI4859.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\0TNNQOPO\EKATI4374.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.FileLocker | file |
| arw | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\0TNNQOPO\CHLGY5ZD1037.EXE | 2020-03-03T13:28:57.393772Z | found | Ransom.Ekati | file |
| Malware | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\BIN3333.RAR | 2020-03-03T13:28:57.393772Z | found | Generic.Malware/Suspicious | file |
| Malware | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\CCTV.EXE | 2020-03-03T13:28:57.393772Z | found | DDoSTool.Nitol | file |
| PUP | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\MICROSOFT OFFICE 2007 SERVICE PACK 2.EXE | 2020-03-03T13:28:57.393772Z | found | PUP.Optional.Solimba | file |
| Malware | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\FCK_RSC.DUMP | 2020-03-03T13:28:57.393772Z | found | Trojan.ServStart | file |
| Malware | 5074ade3-5716-44d8-83c7-5985379c0399 | DESKTOP-664HFM6 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\2211.RAR | 2020-03-03T13:28:57.393772Z | found | Generic.Malware/Suspicious | file |
11. malwarebytes-get-job-status
Lists scan/isolation/deisolation status of the endpoint for the scan/isolation/deisolation initated from Cortex XSOAR.
Base Command
malwarebytes-get-job-status
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | Job_Id of the initiated Scan/Isolation/Deisolation actions. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Scan.Job_ID | string | Job_Id of the initiated Scan/Isolation/Deisolation actions. |
| Malwarebytes.Scan.Status | string | Scan Status for the host |
Command Example
!malwarebytes-get-job-status job_id=831afff7-7511-40be-a1ce-eace622e1e3e
Context Example
{
"Malwarebytes.Scan": {
"Status": "EXPIRED",
"Job_ID": "831afff7-7511-40be-a1ce-eace622e1e3e"
}
}
Human Readable Output
Scan Status for the job_id 831afff7-7511-40be-a1ce-eace622e1e3e is EXPIRED
12. malwarebytes-open-sa-incident
Open Suspicious Activity for investigation in Malwarebytes Cloud. Use malwarebytes-get-sa-activities command to get machine and detection ID.
Base Command
malwarebytes-open-sa-incident
Input
| Argument Name | Description | Required |
|---|---|---|
| machine_id | Machine ID of an endpoint where Suspicious Activity is found. | Required |
| detection_id | Detection ID of the Suspicious Activity. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.SA.Machine_ID | string | Machine ID of the Suspicious host |
Command Example
!malwarebytes-open-sa-incident machine_id=5074ade3-5716-44d8-83c7-5985379c0399 detection_id=69306685
Context Example
{
"Malwarebytes.SA": {
"Machine_ID": "5074ade3-5716-44d8-83c7-5985379c0399"
}
}
Human Readable Output
Open SA Incident action is initiated Successfully for the detection id: 69306685
13. malwarebytes-remediate-sa-incident
Remediate Suspicious Activity from Malwarebytes Cloud. Use malwarebytes-get-sa-activities command to get machine and detection ID.
Base Command
malwarebytes-remediate-sa-incident
Input
| Argument Name | Description | Required |
|---|---|---|
| machine_id | Machine ID of an endpoint in Malwarebytes Cloud where Suspicious Activity is found. | Required |
| detection_id | Detection ID of the Suspicious Activity | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.SA.Machine_ID | string | Machine ID of the Suspicious host |
Command Example
!malwarebytes-remediate-sa-incident machine_id=5074ade3-5716-44d8-83c7-5985379c0399 detection_id=69306697
Context Example
{
"Malwarebytes.SA": {
"Machine_ID": "5074ade3-5716-44d8-83c7-5985379c0399"
}
}
Human Readable Output
Remediate SA Incident action is initiated Successfully for the detection id: 69306697
14. malwarebytes-close-sa-incident
Close Suspicious Activity Incident in Malwarebytes Cloud. Use malwarebytes-get-sa-activities command to get machine and detection ID.
Base Command
malwarebytes-close-sa-incident
Input
| Argument Name | Description | Required |
|---|---|---|
| machine_id | Machine ID of an endpoint in Malwarebytes Cloud where Suspicious Activity is found. | Required |
| detection_id | Detection ID of the Suspicious Activity. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.SA.Machine_ID | string | Machine ID of the Suspicious host |
Command Example
!malwarebytes-close-sa-incident machine_id=5074ade3-5716-44d8-83c7-5985379c0399 detection_id=69306685
Context Example
{
"Malwarebytes.SA": {
"Machine_ID": "5074ade3-5716-44d8-83c7-5985379c0399"
}
}
Human Readable Output
Close SA Incident action is initiated Successfully for the detection id: 69306685
15. malwarebytes-get-sa-activities
Lists all suspicious activities from hostname value and list all the hostnames from path of file.
Base Command
malwarebytes-get-sa-activities
Input
| Argument Name | Description | Required |
|---|---|---|
| hostname | Hostname of the endpoint. | Optional |
| path | Path of the file to be searched in suspicious activities. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Malwarebytes.Endpoint.Suspicious_Activities | string | Suspicious Activities for the host |
Command Example
!malwarebytes-get-sa-activities hostname=DESKTOP-664HFM6
Context Example
{
"Malwarebytes.Endpoint": {
"Suspicious_Activities": [
{
"status": "closed",
"detection_id_list": [
69306685
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-22T00:22:03.000Z",
"detected_by_count": 1,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\51I24R0R\\4S4USN157912.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "processing",
"detection_id_list": [
69306697
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-22T00:22:03.000Z",
"detected_by_count": 2,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\51I24R0R\\EKATI3419.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69298563
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-22T00:03:17.000Z",
"detected_by_count": 10,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\ZRPQZLD0\\EKATI4166.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69297395
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-22T00:00:18.000Z",
"detected_by_count": 3,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\ULHYC0ZK\\EKATI7387.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69293149
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-21T23:51:31.000Z",
"detected_by_count": 10,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\SXM2TCFT\\EKATI7194.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69224002
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T21:26:21.000Z",
"detected_by_count": 3,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\Y20DB3LK\\EKATI3988.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69216054
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-21T21:14:39.000Z",
"detected_by_count": 10,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\1VG2J1ZZ\\EKATI9823.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69216153
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T21:13:28.000Z",
"detected_by_count": 1,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\CJGQRXFS\\WR1LKLFO5074.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69216169
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T21:13:27.000Z",
"detected_by_count": 2,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\CJGQRXFS\\EKATI7396.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69205108
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-21T20:53:33.000Z",
"detected_by_count": 10,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\WGKUJRGM\\EKATI7827.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69199010
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T20:41:41.000Z",
"detected_by_count": 1,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\NURKWB4B\\MIYO4ZBX5817.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69199008
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T20:41:40.000Z",
"detected_by_count": 2,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\NURKWB4B\\EKATI1485.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69196909
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-21T20:41:15.000Z",
"detected_by_count": 10,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\Z2QEP4IQ\\EKATI1206.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69183153
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T20:18:19.000Z",
"detected_by_count": 1,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\R0TZHA1D\\QTVKKU0O3864.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69183344
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T20:18:18.000Z",
"detected_by_count": 2,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\R0TZHA1D\\EKATI3336.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69182161
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-21T20:16:25.000Z",
"detected_by_count": 10,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\Y5B35RXH\\EKATI4787.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
69182258
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T20:16:06.000Z",
"detected_by_count": 2,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\QI2K3DLV\\EKATI8446.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
68915780
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-21T13:35:33.000Z",
"detected_by_count": 1,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\LERQ0DSN\\PFNLX1ZC2666.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
68915910
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-21T13:35:28.000Z",
"detected_by_count": 10,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\LERQ0DSN\\EKATI1279.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
68917631
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T13:35:21.000Z",
"detected_by_count": 1,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\KGSXOYUY\\1DM4MJK56911.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
68917642
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-21T13:35:21.000Z",
"detected_by_count": 3,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\KGSXOYUY\\EKATI5694.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
67932985
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-20T08:46:20.000Z",
"detected_by_count": 10,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\TLX3EVTX\\EKATI4102.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
67932021
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-20T08:45:38.000Z",
"detected_by_count": 9,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\LYFB0FPR\\EKATI8717.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
67932009
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-20T08:45:35.000Z",
"detected_by_count": 8,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\X0BDZ1FX\\EKATI5156.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
67932084
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-20T08:45:32.000Z",
"detected_by_count": 3,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\ZAX2TN0U\\EKATI3331.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
67932008
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-20T08:45:08.000Z",
"detected_by_count": 10,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\V1YOTCGH\\EKATI1530.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
67932145
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-20T08:45:02.000Z",
"detected_by_count": 1,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\IJJZUABZ\\E55QEANT8731.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
67932186
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-20T08:45:02.000Z",
"detected_by_count": 2,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\IJJZUABZ\\EKATI7353.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "closed",
"detection_id_list": [
67931295
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-20T08:43:34.000Z",
"detected_by_count": 9,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\IMPDUHIQ\\EKATI3476.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "processing",
"detection_id_list": [
67931302
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-20T08:43:31.000Z",
"detected_by_count": 9,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\4KQQJWG5\\EKATI4354.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "processing",
"detection_id_list": [
67931496
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-20T08:43:24.000Z",
"detected_by_count": 1,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\AVQCVSEN\\CSF2FQEI8635.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
67931509
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 2,
"timestamp": "2020-04-20T08:43:24.000Z",
"detected_by_count": 3,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\AVQCVSEN\\EKATI2270.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
},
{
"status": "detected",
"detection_id_list": [
67931294
],
"account_id": "2020bd17-a809-4102-b744-94fe8ad1c591",
"pc_hostname": "DESKTOP-664HFM6",
"level": 3,
"timestamp": "2020-04-20T08:43:16.000Z",
"detected_by_count": 11,
"path": "C:\\USERS\\ROHIN SAMBATH KUMAR\\DESKTOP\\RGCNKCKH\\EKATI1130.EXE",
"machine_id": "5074ade3-5716-44d8-83c7-5985379c0399"
}
]
}
}
Human Readable Output
Suspicious Activites found for the host: DESKTOP-664HFM6
| account_id | detected_by_count | detection_id_list | level | machine_id | path | pc_hostname | status | timestamp |
|---|---|---|---|---|---|---|---|---|
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 1 | 69306685 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\51I24R0R\4S4USN157912.EXE | DESKTOP-664HFM6 | closed | 2020-04-22T00:22:03.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 2 | 69306697 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\51I24R0R\EKATI3419.EXE | DESKTOP-664HFM6 | processing | 2020-04-22T00:22:03.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 10 | 69298563 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\ZRPQZLD0\EKATI4166.EXE | DESKTOP-664HFM6 | detected | 2020-04-22T00:03:17.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 3 | 69297395 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\ULHYC0ZK\EKATI7387.EXE | DESKTOP-664HFM6 | detected | 2020-04-22T00:00:18.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 10 | 69293149 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\SXM2TCFT\EKATI7194.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T23:51:31.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 3 | 69224002 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\Y20DB3LK\EKATI3988.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T21:26:21.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 10 | 69216054 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\1VG2J1ZZ\EKATI9823.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T21:14:39.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 1 | 69216153 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\CJGQRXFS\WR1LKLFO5074.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T21:13:28.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 2 | 69216169 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\CJGQRXFS\EKATI7396.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T21:13:27.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 10 | 69205108 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\WGKUJRGM\EKATI7827.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T20:53:33.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 1 | 69199010 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\NURKWB4B\MIYO4ZBX5817.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T20:41:41.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 2 | 69199008 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\NURKWB4B\EKATI1485.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T20:41:40.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 10 | 69196909 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\Z2QEP4IQ\EKATI1206.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T20:41:15.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 1 | 69183153 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\R0TZHA1D\QTVKKU0O3864.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T20:18:19.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 2 | 69183344 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\R0TZHA1D\EKATI3336.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T20:18:18.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 10 | 69182161 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\Y5B35RXH\EKATI4787.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T20:16:25.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 2 | 69182258 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\QI2K3DLV\EKATI8446.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T20:16:06.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 1 | 68915780 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\LERQ0DSN\PFNLX1ZC2666.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T13:35:33.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 10 | 68915910 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\LERQ0DSN\EKATI1279.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T13:35:28.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 1 | 68917631 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\KGSXOYUY\1DM4MJK56911.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T13:35:21.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 3 | 68917642 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\KGSXOYUY\EKATI5694.EXE | DESKTOP-664HFM6 | detected | 2020-04-21T13:35:21.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 10 | 67932985 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\TLX3EVTX\EKATI4102.EXE | DESKTOP-664HFM6 | detected | 2020-04-20T08:46:20.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 9 | 67932021 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\LYFB0FPR\EKATI8717.EXE | DESKTOP-664HFM6 | detected | 2020-04-20T08:45:38.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 8 | 67932009 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\X0BDZ1FX\EKATI5156.EXE | DESKTOP-664HFM6 | detected | 2020-04-20T08:45:35.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 3 | 67932084 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\ZAX2TN0U\EKATI3331.EXE | DESKTOP-664HFM6 | detected | 2020-04-20T08:45:32.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 10 | 67932008 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\V1YOTCGH\EKATI1530.EXE | DESKTOP-664HFM6 | detected | 2020-04-20T08:45:08.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 1 | 67932145 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\IJJZUABZ\E55QEANT8731.EXE | DESKTOP-664HFM6 | detected | 2020-04-20T08:45:02.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 2 | 67932186 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\IJJZUABZ\EKATI7353.EXE | DESKTOP-664HFM6 | detected | 2020-04-20T08:45:02.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 9 | 67931295 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\IMPDUHIQ\EKATI3476.EXE | DESKTOP-664HFM6 | closed | 2020-04-20T08:43:34.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 9 | 67931302 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\4KQQJWG5\EKATI4354.EXE | DESKTOP-664HFM6 | processing | 2020-04-20T08:43:31.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 1 | 67931496 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\AVQCVSEN\CSF2FQEI8635.EXE | DESKTOP-664HFM6 | processing | 2020-04-20T08:43:24.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 3 | 67931509 | 2 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\AVQCVSEN\EKATI2270.EXE | DESKTOP-664HFM6 | detected | 2020-04-20T08:43:24.000Z |
| 2020bd17-a809-4102-b744-94fe8ad1c591 | 11 | 67931294 | 3 | 5074ade3-5716-44d8-83c7-5985379c0399 | C:\USERS\ROHIN SAMBATH KUMAR\DESKTOP\RGCNKCKH\EKATI1130.EXE | DESKTOP-664HFM6 | detected | 2020-04-20T08:43:16.000Z |
Configuration parameters
accountid— Account ID (required)clientid— Client ID (required)clientsecret— Client Secret (required)region— Region (required)isFetch— Fetch incidentsincidentType— Incident typeincidentFetchInterval— Incidents Fetch IntervalFetch_Event_List— Fetch Event Listrtp_threat_category— RTP Detections Threat Categorysuspicious_activity_severity— Suspicious Activity Severityinsecure— Trust any certificate (not secure)proxy— Use system proxy settingsemail— E-Mailcompany_name— Company Name
Commands (15)
-
malwarebytes-close-sa-incidentClose Suspicious Activity Incident in Malwarebytes Cloud. Use malwarebytes-get-sa-activities command to get machine and detection ID.
-
malwarebytes-deisolate-endpointInitiate Deisolation action on an endpoint based on IP or Hostname. This action deisolate an endpoint by Process, Network and Desktop.
-
malwarebytes-get-job-statusLists scan/isolation/deisolation status of the endpoint for the scan/isolation/deisolation initated from Demisto.
-
malwarebytes-get-sa-activitiesLists all suspicious activities from hostname value and list all the hostnames from path of file.
-
malwarebytes-get-scan-detectionsLists detections from an endpoint for the scans initiated from Demisto.
-
malwarebytes-isolate-desktopInitiate Desktop Isolation action on an endpoint based on IP or Hostname.
-
malwarebytes-isolate-endpointInitiate Isolation action on an endpoint based on IP or Hostname. This action isolate an endpoint by Process, Network and Desktop.
-
malwarebytes-isolate-networkInitiate Network Isolation action on an endpoint based on IP or Hostname.
-
malwarebytes-isolate-processInitiate Process Isolation action on an endpoint based on IP or Hostname.
-
malwarebytes-list-endpoint-infoLists more granular information about an endpoint.
-
malwarebytes-list-endpointsList all/online/offline endpoints available in the Malwarebytes Cloud.
-
malwarebytes-open-sa-incidentOpen Suspicious Activity for investigation in Malwarebytes Cloud. Use malwarebytes-get-sa-activities command to get machine and detection ID.
-
malwarebytes-remediate-sa-incidentRemediate Suspicious Activity from Malwarebytes Cloud. Use malwarebytes-get-sa-activities command to get machine and detection ID.
-
malwarebytes-scan-and-remediateInitiate Scan and Remediate action on an endpoint based on IP or Hostname.
-
malwarebytes-scan-and-reportInitiate Scan and report action on an endpoint based on IP or Hostname.
import demistomock as demisto from CommonServerPython import * from CommonServerUserPython import * """ IMPORTS """ import json import time import traceback from datetime import datetime import pytz import requests import urllib3 from oauthlib.oauth2 import BackendApplicationClient from requests_oauthlib import OAuth2Session # Disable insecure warnings urllib3.disable_warnings() """GLOBAL/PARAMS""" URL = "https://cloud.threatdown.com" # Maps the region selected in the integration params to its ThreatDown Nebula base URL. REGION_URLS = { "US": "https://cloud.threatdown.com", "EU": "https://cloud.euc1.threatdown.com", } # Get OAuth2 token def nebula_url(path): return f"{URL}{path}" def get_nebula_client(client_id, client_secret, account_id, use_ssl): client_scope = ["read", "write", "execute"] headers = {"x-mwb-clientid": client_id, "x-mwb-accountid": account_id} client = BackendApplicationClient(client_id, scope=client_scope) nebula = OAuth2Session(client=client, scope=client_scope) nebula.headers.update(headers) token = nebula.fetch_token( token_url=nebula_url("/oauth2/token"), client_secret=client_secret, scope=client_scope, verify=use_ssl ) return "Bearer " + token.get("access_token") # Test connectivity to the Nebula cloud def test_connectivity(account_id, client_id, auth_token, USE_SSL): url = URL + "/api/v2/endpoints" headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } response = requests.request("GET", url, headers=headers, verify=USE_SSL) if response.status_code == 200: return True else: raise Exception(response.text) # Get all the endpoints from the Malwarebytes Cloud def get_all_endpoints(account_id, client_id, auth_token, USE_SSL): url = URL + "/api/v2/endpoints" headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } response = requests.request("GET", url, headers=headers, verify=USE_SSL) if response.status_code == 200: try: machine_json = response.json() except Exception: raise Exception(f"Failed to parse response to json. response: {response.text}") machines = machine_json["machines"] cursor = machine_json["next_cursor"] while cursor != "": cursor_temp, machines_temp = get_all_endpoints_paginated(account_id, client_id, auth_token, cursor, USE_SSL) machines.extend(machines_temp) cursor = cursor_temp return machines else: raise Exception(response.text) def get_all_endpoints_paginated(account_id, client_id, auth_token, cursor, USE_SSL): url = URL + "/api/v2/endpoints?next_cursor=" + cursor headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } response = requests.request("GET", url, headers=headers, verify=USE_SSL) if response.status_code == 200: try: machine_json = response.json() except Exception: raise Exception(f"Failed to parse response to json. response: {response.text}") machines = machine_json["machines"] cursor = machine_json["next_cursor"] return cursor, machines else: return False # Get the scan status to acquire the scan info def get_scan_status(account_id, client_id, auth_token, job_id, USE_SSL): headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } url = URL + "/api/v2/jobs/" + str(job_id) response = requests.request("GET", url, headers=headers, verify=USE_SSL) if response.status_code == 200: try: scan_status_json = response.json() except Exception: raise Exception(f"Failed to parse response to json. response: {response.text}") scan_status = scan_status_json["state"] return scan_status else: raise Exception(response.text) # Get the scanid for the scan jobs initiated def get_scan_id(account_id, client_id, auth_token, job_id, USE_SSL): headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } url = URL + "/api/v2/jobs/" + str(job_id) response = requests.request("GET", url, headers=headers, verify=USE_SSL) if response.status_code == 200: try: scan_id_json = response.json() except Exception: raise Exception(f"Failed to parse response to json. response: {response.text}") scan_id = scan_id_json["scan_id"] return scan_id else: raise Exception(response.text) # Get the machine_id associated with scan_id def get_scan_id_machine(account_id, client_id, auth_token, job_id, USE_SSL): headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } url = URL + "/api/v2/jobs/" + str(job_id) response = requests.request("GET", url, headers=headers, verify=USE_SSL) if response.status_code == 200: try: scan_id_json = response.json() except Exception: raise Exception(f"Failed to parse response to json. response: {response.text}") machine_id = scan_id_json["machine_id"] return machine_id else: raise Exception(response.text) # Get detections for the scan jobs initiated def get_scan_detections(account_id, client_id, auth_token, ids, scan_id, USE_SSL): url = URL headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } url = url + "/api/v2/endpoints/" + str(ids) + "/scans/" + str(scan_id) + "/detections" response = requests.request("GET", url, headers=headers, verify=USE_SSL) if response.status_code == 200: try: detection_json = response.json() except Exception: raise Exception(f"Failed to parse response to json. response: {response.text}") detections = detection_json["detections"] cursor = detection_json["next_cursor"] while cursor != "": cursor_temp, detections_temp = get_scan_detections_paginated( account_id, client_id, auth_token, ids, scan_id, cursor, USE_SSL ) detections.extend(detections_temp) cursor = cursor_temp return detections else: raise Exception(response.text) def get_scan_detections_paginated(account_id, client_id, auth_token, ids, scan_id, cursor, USE_SSL): headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } url = URL + "/api/v2/endpoints/" + str(ids) + "/scans/" + str(scan_id) + "/detections?next_cursor=" + cursor response = requests.request("GET", url, headers=headers, verify=USE_SSL) if response.status_code == 200: try: detection_json = response.json() except Exception: raise Exception(f"Failed to parse response to json. response: {response.text}") detections = detection_json["detections"] cursor = detection_json["next_cursor"] return cursor, detections else: raise Exception(response.text) # Get Suspicious Activities found on all the endpoints def get_suspicious_activities(account_id, client_id, auth_token, USE_SSL): url = URL + "/api/v2/sa" headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } response = requests.request("GET", url, headers=headers, verify=USE_SSL) if response.status_code == 200: try: sa_detections_json = response.json() except Exception: raise Exception(f"Failed to parse response to json. response: {response.text}") sa_detection = sa_detections_json["sa"] cursor = sa_detections_json["next_cursor"] while cursor != "": cursor_temp, sa_detections_temp = get_suspicious_activities_paginated( account_id, client_id, auth_token, cursor, USE_SSL ) sa_detection.extend(sa_detections_temp) cursor = cursor_temp return sa_detection else: raise Exception(response.text) def get_suspicious_activities_paginated(account_id, client_id, auth_token, cursor, USE_SSL): url = URL + "/api/v2/sa?next_cursor=" + cursor headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } response = requests.request("GET", url, headers=headers, verify=USE_SSL) if response.status_code == 200: try: sa_detections_json = response.json() except Exception: raise Exception(f"Failed to parse response to json. response: {response.text}") sa_detection = sa_detections_json["sa"] cursor = sa_detections_json["next_cursor"] return cursor, sa_detection else: return False, False # Get RTP Detections found on all the endpoints def get_rtp_detections(account_id, client_id, auth_token, USE_SSL): url = URL + "/api/v2/detections/search" headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } body = {"is_rtp_stream_event": True, "sort_field": "reported_at", "sort_order": "asc"} response = requests.post(url, data=json.dumps(body), headers=headers, verify=USE_SSL) if response.status_code == 200: try: rtp_detections_json = response.json() except Exception: raise Exception(f"Failed to parse response to json. response: {response.text}") detections = rtp_detections_json["detections"] cursor = rtp_detections_json["next_cursor"] while cursor != "": cursor_temp, detections_temp = get_rtp_detections_paginated(account_id, client_id, auth_token, cursor, USE_SSL) detections.extend(detections_temp) cursor = cursor_temp return detections else: raise Exception(response.text) def get_rtp_detections_paginated(account_id, client_id, auth_token, cursor, USE_SSL): url = URL + "/api/v2/detections/search" headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } body = {"is_rtp_stream_event": True, "sort_field": "reported_at", "sort_order": "asc", "next_cursor": cursor} response = requests.post(url, data=json.dumps(body), headers=headers, verify=USE_SSL) if response.status_code == 200: try: rtp_detections_json = response.json() except Exception: raise Exception(f"Failed to parse response to json. response: {response.text}") detections = rtp_detections_json["detections"] cursor = rtp_detections_json["next_cursor"] return cursor, detections else: raise Exception(response.text) # Resolve machine_id from IP Address def get_machine_id_ip(account_id, client_id, auth_token, ip, USE_SSL): headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } url = URL + "/api/v2/endpoints" data = {"nics.ips": ip} response = requests.post(url, data=json.dumps(data), headers=headers, verify=USE_SSL) if response.status_code == 200: try: machine_json = response.json() except Exception: raise Exception(f"Failed to parse response to json. response: {response.text}") if len(machine_json["machines"]) != 0: machine_id = machine_json["machines"][0] machine_id = machine_id["machine"]["id"] return machine_id else: return False else: raise Exception(response.text) # Resolve machine_id from Hostname def get_machine_id_hostname(account_id, client_id, auth_token, hostname, USE_SSL): headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } url = URL + "/api/v2/endpoints" data = {"fully_qualified_host_name.keyword": hostname} response = requests.post(url, data=json.dumps(data), headers=headers, verify=USE_SSL) if response.status_code == 200: try: machine_json = response.json() except Exception: raise Exception(f"Failed to parse response to json. response: {response.text}") if len(machine_json["machines"]) != 0: machine_id = machine_json["machines"][0] machine_id = machine_id["machine"]["id"] return machine_id else: return False else: raise Exception(response.text) # Initiate POST Request for scan and report def post_scan_report(account_id, client_id, auth_token, ids, USE_SSL): headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } url = URL + "/api/v2/jobs" scan = { "command": "command.threat.scan", "data": {"scan_settings": {"type": "ThreatScan", "remove": False}}, "machine_ids": [ids], } response = requests.post(url, data=json.dumps(scan), headers=headers, verify=USE_SSL) if response.status_code == 201: try: scan_result_json = response.json() except Exception: raise Exception(f"Failed to parse response to json. response: {response.text}") job_id = scan_result_json["jobs"][0] job_id = job_id["job_id"] return job_id else: raise Exception(response.text) # Initiate POST Request for scan and quarantine def post_scan_remediate(account_id, client_id, auth_token, ids, USE_SSL): headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } url = URL + "/api/v2/jobs" scan = { "command": "command.threat.scan", "data": {"scan_settings": {"type": "ThreatScan", "remove": True}}, "machine_ids": [ids], } response = requests.post(url, data=json.dumps(scan), headers=headers, verify=USE_SSL) if response.status_code == 201: try: scan_result_json = response.json() except Exception: raise Exception(f"Failed to parse response to json. response: {response.text}") job_id = scan_result_json["jobs"][0] job_id = job_id["job_id"] return job_id else: raise Exception(response.text) # Initiate POST Request for Isolate actions def post_isolate(account_id, client_id, auth_token, ids, isolated, USE_SSL): headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } url = URL + "/api/v2/jobs/endpoints/isolate" if isolated == "isolate": isolate = {"data": {"desktop": True, "network": True, "process": True}, "machine_ids": [ids]} elif isolated == "desktop_isolate": isolate = {"data": {"desktop": True, "network": False, "process": False}, "machine_ids": [ids]} elif isolated == "network_isolate": isolate = {"data": {"desktop": False, "network": True, "process": False}, "machine_ids": [ids]} elif isolated == "process_isolate": isolate = {"data": {"desktop": False, "network": False, "process": True}, "machine_ids": [ids]} else: isolate = {} demisto.debug(f"{isolated=} didn't match any condition. {isolate=}") response = requests.post(url, data=json.dumps(isolate), headers=headers, verify=USE_SSL) if response.status_code == 201: try: isolate_result_json = response.json() except Exception: raise Exception(f"Failed to parse response to json. response: {response.text}") job_id = isolate_result_json["jobs"][0] job_id = job_id["job_id"] return job_id else: raise Exception(response.text) # Initiate POST Request for deisolation def post_deisolate(account_id, client_id, auth_token, ids, USE_SSL): headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } url = URL + "/api/v2/jobs/endpoints/unlock" deisolate = {"machine_ids": [ids]} response = requests.post(url, data=json.dumps(deisolate), headers=headers, verify=USE_SSL) if response.status_code == 201: try: deisolate_result_json = response.json() except Exception: raise Exception(f"Failed to parse response to json. response: {response.text}") job_id = deisolate_result_json["jobs"][0] job_id = job_id["job_id"] return job_id else: raise Exception(response.text) # Get endpoint info def get_endpoint_info(account_id, client_id, auth_token, ids, USE_SSL): headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } url = URL + "/api/v2/endpoints/" + ids + "/assets" response = requests.request("GET", url, headers=headers, verify=USE_SSL) if response.status_code == 200: # noqa: RET503 try: assets = response.json() except Exception: raise Exception(f"Failed to parse response to json. response: {response.text}") return assets # Get Latest High Severity Suspicious Activities to create incidents def fetch_suspicious_activities(suspicious_activities, suspicious_activity_severity, last_fetch_time, last_custom): if last_custom is not None and last_custom != suspicious_activity_severity: demisto.setLastRun({"time": None, "custom": None}) return False, False asc_suspicious_activities = [] if len(suspicious_activities) != 0: for i in reversed(suspicious_activities): asc_suspicious_activities.append(i) else: return False, False SA_severity = [] for i in suspicious_activity_severity: SA_severity.append(severity_text_to_number(i)) Filtered_SA = [] if len(asc_suspicious_activities) != 0: if last_fetch_time is None and last_custom is None: incident = { "name": "Malwarebytes Suspicious Activity Incident Detected on Host: " + str(asc_suspicious_activities[-1]["pc_hostname"]), "occurred": str(asc_suspicious_activities[-1]["timestamp"]), "severity": 3, "rawJSON": json.dumps(asc_suspicious_activities[-1]), } lastPointer = {"time": asc_suspicious_activities[-1]["timestamp"], "custom": suspicious_activity_severity} return lastPointer, incident else: last_count = 0 for i in asc_suspicious_activities: if i["level"] in SA_severity and i["status"] == "detected" and i["timestamp"] > last_fetch_time: Filtered_SA.append(i) if len(Filtered_SA) != 0: incident = { "name": "Malwarebytes Suspicious Activity Incident Detected on Host: " + str(Filtered_SA[last_count]["pc_hostname"]), "occurred": str(Filtered_SA[last_count]["timestamp"]), "severity": 3, "rawJSON": json.dumps(Filtered_SA[last_count]), } lastPointer = {"time": Filtered_SA[last_count]["timestamp"], "custom": suspicious_activity_severity} return lastPointer, incident else: return False, False else: return False, False # Get Real Time Protection Detections to Create Incidents def fetch_rtp_detections(category, rtp_detections, last_fetch_time, last_custom): if last_custom is not None and last_custom != category: demisto.setLastRun({"time": None, "custom": None}) return False, False asc_rtp_events_by_category = [] if len(rtp_detections) != 0: if last_fetch_time is None and last_custom is None: incident = { "name": "Malwarebytes RTP has protected against threat " + str(rtp_detections[-1]["threat_name"]) + " on Host: " + str(rtp_detections[-1]["machine_name"]), "occurred": str(rtp_detections[-1]["reported_at"]), "severity": 3, "rawJSON": json.dumps(rtp_detections[-1]), } lastPointer = {"time": rtp_detections[-1]["reported_at"], "custom": category} return lastPointer, incident else: last_count = 0 for i in rtp_detections: if i["category"] in category and i["reported_at"] > last_fetch_time: asc_rtp_events_by_category.append(i) if len(asc_rtp_events_by_category) != 0: incident = { "name": "Malwarebytes RTP has protected against threat " + str(asc_rtp_events_by_category[last_count]["threat_name"]) + " on Host: " + str(asc_rtp_events_by_category[last_count]["machine_name"]), "occurred": str(asc_rtp_events_by_category[last_count]["reported_at"]), "severity": 3, "rawJSON": json.dumps(asc_rtp_events_by_category[last_count]), } lastPointer = {"time": asc_rtp_events_by_category[last_count]["reported_at"], "custom": category} return lastPointer, incident else: return False, False else: return False, False # Convert Text Category to Malwarebytes Category def category_to_code(rtp_malware_category): if rtp_malware_category == "Malware": # noqa: RET503 return "MALWARE" elif rtp_malware_category == "PUP": return "PUP" elif rtp_malware_category == "PUM": return "PUM" elif rtp_malware_category == "Exploit": return "AE" elif rtp_malware_category == "Ransomware": return "ARW" elif rtp_malware_category == "Website": return "MWAC" # Remove empty fields from Scan Detections def remove_empty_detection_fields(detections): for i in detections: del ( i["affected_application"], i["detection_id_from_endpoint"], i["group_id"], i["id"], i["ip_address"], i["md5"], i["port"], i["process_name"], i["scan_id"], i["scanned_at"], i["scanned_at_local"], i["url"], ) # Convert Severity Text to Severity Number def severity_text_to_number(suspicious_activity_severity): if suspicious_activity_severity == "High": # noqa: RET503 return 3 elif suspicious_activity_severity == "Medium": return 2 elif suspicious_activity_severity == "Low": return 1 # Function to execute Scan and Remediate action def scan_and_remediate(account_id, client_id, auth_token, ip, hostname, USE_SSL): # This is the call made initiating scan_and_remediate action if ip: ids = get_machine_id_ip(account_id, client_id, auth_token, ip, USE_SSL) if ids: job_id = post_scan_remediate(account_id, client_id, auth_token, ids, USE_SSL) return_outputs( "Scan and Remediate action has been successfully started on the Endpoint: " + str(ip) + " with the job_id: " + str(job_id) + ". Use job_id in malwarebytes-get-job-status command to check status and " "malwarebytes-get-scan-detections command to view results", outputs={"Malwarebytes.Scan(val.Job_ID == obj.Job_ID)": {"Machine_ID": ids, "Job_ID": job_id}}, ) else: demisto.results("Endpoint is not found in the Malwarebytes Cloud") elif hostname: ids = get_machine_id_hostname(account_id, client_id, auth_token, hostname, USE_SSL) if ids: job_id = post_scan_remediate(account_id, client_id, auth_token, ids, USE_SSL) return_outputs( "Scan and Remediate action has been successfully started on the Endpoint: " + str(hostname) + " with the job_id: " + str(job_id) + ". Use job_id in malwarebytes-get-job-status command to check status and " "malwarebytes-get-scan-detections command to view results", outputs={"Malwarebytes.Scan(val.Job_ID == obj.Job_ID)": {"Machine_ID": ids, "Job_ID": job_id}}, ) else: demisto.results("Endpoint is not found in the Malwarebytes Cloud") else: return_error(message="Please Enter IP or Hostname", error="") # Function to execute Scan and Report action def scan_and_report(account_id, client_id, auth_token, ip, hostname, USE_SSL): # This is the call made initiating scan_and_report action if ip: ids = get_machine_id_ip(account_id, client_id, auth_token, ip, USE_SSL) if ids: job_id = post_scan_report(account_id, client_id, auth_token, ids, USE_SSL) return_outputs( "Scan and Report action has been successfully started on the Endpoint: " + str(ip) + " with the job_id: " + str(job_id) + ". Use job_id in malwarebytes-get-job-status command to check status and " "malwarebytes-get-scan-detections command to view results", outputs={"Malwarebytes.Scan(val.Job_ID == obj.Job_ID)": {"Machine_ID": ids, "Job_ID": job_id}}, ) else: demisto.results("Endpoint is not found in the Malwarebytes Cloud") elif hostname: ids = get_machine_id_hostname(account_id, client_id, auth_token, hostname, USE_SSL) if ids: job_id = post_scan_report(account_id, client_id, auth_token, ids, USE_SSL) return_outputs( "Scan and Report action has been successfully started on the Endpoint: " + str(hostname) + " with the job_id: " + str(job_id) + ". Use job_id in malwarebytes-get-job-status command to check status and " "malwarebytes-get-scan-detections command to view results", outputs={"Malwarebytes.Scan(val.Job_ID == obj.Job_ID)": {"Machine_ID": ids, "Job_ID": job_id}}, ) else: demisto.results("Endpoint is not found in the Malwarebytes Cloud") else: return_error(message="Please Enter IP or Hostname", error="") # Functions to execute Isolate Command def isolate_endpoint(account_id, client_id, auth_token, ip, hostname, USE_SSL): # This is the call made initiating Isolate Endpoint action isolated = "isolate" if ip: ids = get_machine_id_ip(account_id, client_id, auth_token, ip, USE_SSL) if ids: job_id = post_isolate(account_id, client_id, auth_token, ids, isolated, USE_SSL) if job_id: return_outputs( "Isolation action has been successfully started on the Endpoint: " + str(ip) + " with the job_id: " + str(job_id) + ". Use job_id in malwarebytes-get-job-status command to view results", outputs={"Malwarebytes.Scan(val.Job_ID == obj.Job_ID)": {"Machine_ID": ids, "Job_ID": job_id}}, ) else: return_error(message="Isolation action Failed for the Endpoint: " + str(ip), error="") else: demisto.results("Endpoint is not found in the Malwarebytes Cloud") elif hostname: ids = get_machine_id_hostname(account_id, client_id, auth_token, hostname, USE_SSL) if ids: job_id = post_isolate(account_id, client_id, auth_token, ids, isolated, USE_SSL) if job_id: return_outputs( "Isolation action has been successfully started on the Endpoint: " + str(hostname) + " with the job_id: " + str(job_id) + ". Use job_id in malwarebytes-get-job-status command to view results", outputs={"Malwarebytes.Scan(val.Job_ID == obj.Job_ID)": {"Machine_ID": ids, "Job_ID": job_id}}, ) else: return_error(message="Isolation action Failed for the Endpoint: " + str(hostname), error="") else: demisto.results("Endpoint is not found in the Malwarebytes Cloud") else: return_error(message="Please Enter IP or Hostname", error="") def isolate_process(account_id, client_id, auth_token, ip, hostname, USE_SSL): # This is the call made initiating Isolate Process action isolated = "process_isolate" if ip: ids = get_machine_id_ip(account_id, client_id, auth_token, ip, USE_SSL) if ids: job_id = post_isolate(account_id, client_id, auth_token, ids, isolated, USE_SSL) if job_id: return_outputs( "Process Isolation action has been successfully started on the Endpoint: " + str(ip) + " with the job_id: " + str(job_id) + ". Use job_id in malwarebytes-get-job-status command to view results", outputs={"Malwarebytes.Scan(val.Job_ID == obj.Job_ID)": {"Machine_ID": ids, "Job_ID": job_id}}, ) else: return_error(message="Process Isolation action Failed for the Endpoint: " + str(ip), error="") else: demisto.results("Endpoint is not found in the Malwarebytes Cloud") elif hostname: ids = get_machine_id_hostname(account_id, client_id, auth_token, hostname, USE_SSL) if ids: job_id = post_isolate(account_id, client_id, auth_token, ids, isolated, USE_SSL) if job_id: return_outputs( "Process Isolation action has been successfully started on the Endpoint: " + str(hostname) + " with the job_id: " + str(job_id) + ". Use job_id in malwarebytes-get-job-status command to view results", outputs={"Malwarebytes.Scan(val.Job_ID == obj.Job_ID)": {"Machine_ID": ids, "Job_ID": job_id}}, ) else: return_error(message="Process Isolation action Failed for the Endpoint: " + str(hostname), error="") else: demisto.results("Endpoint is not found in the Malwarebytes Cloud") else: return_error(message="Please Enter IP or Hostname", error="") def isolate_network(account_id, client_id, auth_token, ip, hostname, USE_SSL): # This is the call made initiating Isolate Network action isolated = "network_isolate" if ip: ids = get_machine_id_ip(account_id, client_id, auth_token, ip, USE_SSL) if ids: job_id = post_isolate(account_id, client_id, auth_token, ids, isolated, USE_SSL) if job_id: return_outputs( "Network Isolation action has been successfully started on the Endpoint: " + str(ip) + " with the job_id: " + str(job_id) + ". Use job_id in malwarebytes-get-job-status command to view results", outputs={"Malwarebytes.Scan(val.Job_ID == obj.Job_ID)": {"Machine_ID": ids, "Job_ID": job_id}}, ) else: return_error(message="Network Isolation action Failed for the Endpoint: " + str(ip), error="") else: demisto.results("Endpoint is not found in the Malwarebytes Cloud") elif hostname: ids = get_machine_id_hostname(account_id, client_id, auth_token, hostname, USE_SSL) if ids: job_id = post_isolate(account_id, client_id, auth_token, ids, isolated, USE_SSL) if job_id: return_outputs( "Network Isolation action has been successfully started on the Endpoint: " + str(hostname) + " with the job_id: " + str(job_id) + ". Use job_id in malwarebytes-get-job-status command to view results", outputs={"Malwarebytes.Scan(val.Job_ID == obj.Job_ID)": {"Machine_ID": ids, "Job_ID": job_id}}, ) else: return_error(message="Network Isolation action Failed for the Endpoint: " + str(hostname), error="") else: demisto.results("Endpoint is not found in the Malwarebytes Cloud") else: return_error(message="Please Enter IP or Hostname", error="") def isolate_desktop(account_id, client_id, auth_token, ip, hostname, USE_SSL): # This is the call made initiating Isolate Desktop action isolated = "desktop_isolate" if ip: ids = get_machine_id_ip(account_id, client_id, auth_token, ip, USE_SSL) if ids: job_id = post_isolate(account_id, client_id, auth_token, ids, isolated, USE_SSL) if job_id: return_outputs( "Desktop Isolation action has been successfully started on the Endpoint: " + str(ip) + " with the job_id: " + str(job_id) + ". Use job_id in malwarebytes-get-job-status command to view results", outputs={"Malwarebytes.Scan(val.Job_ID == obj.Job_ID)": {"Machine_ID": ids, "Job_ID": job_id}}, ) else: return_error(message="Desktop Isolation action Failed for the Endpoint: " + str(ip), error="") else: demisto.results("Endpoint is not found in the Malwarebytes Cloud") elif hostname: ids = get_machine_id_hostname(account_id, client_id, auth_token, hostname, USE_SSL) if ids: job_id = post_isolate(account_id, client_id, auth_token, ids, isolated, USE_SSL) if job_id: return_outputs( "Desktop Isolation action has been successfully started on the Endpoint: " + str(hostname) + " with the job_id: " + str(job_id) + ". Use job_id in malwarebytes-get-job-status command to view results", outputs={"Malwarebytes.Scan(val.Job_ID == obj.Job_ID)": {"Machine_ID": ids, "Job_ID": job_id}}, ) else: return_error(message="Desktop Isolation action Failed for the Endpoint: " + str(hostname), error="") else: demisto.results("Endpoint is not found in the Malwarebytes Cloud") else: return_error(message="Please Enter IP or Hostname", error="") # Function to execute Deisolate Command def deisolate_endpoint(account_id, client_id, auth_token, ip, hostname, USE_SSL): # This is the call made initiating scan_and_report action if ip: ids = get_machine_id_ip(account_id, client_id, auth_token, ip, USE_SSL) if ids: job_id = post_deisolate(account_id, client_id, auth_token, ids, USE_SSL) if job_id: return_outputs( "Deisolation action has been successfully started on the Endpoint: " + str(ip) + " with the job_id: " + str(job_id) + ". Use job_id in malwarebytes-get-job-status command to view results", outputs={"Malwarebytes.Scan(val.Job_ID == obj.Job_ID)": {"Machine_ID": ids, "Job_ID": job_id}}, ) else: return_error(message="Deisolation action Failed for the Endpoint: " + str(ip), error="") else: demisto.results("Endpoint is not found in the Malwarebytes Cloud") elif hostname: ids = get_machine_id_hostname(account_id, client_id, auth_token, hostname, USE_SSL) if ids: job_id = post_deisolate(account_id, client_id, auth_token, ids, USE_SSL) if job_id: return_outputs( "Deisolation action has been successfully started on the Endpoint: " + str(hostname) + " with the job_id: " + str(job_id) + ". Use job_id in malwarebytes-get-job-status command to view results", outputs={"Malwarebytes.Scan(val.Job_ID == obj.Job_ID)": {"Machine_ID": ids, "Job_ID": job_id}}, ) else: return_error(message="Deisolation action Failed for the Endpoint: " + str(hostname), error="") else: demisto.results("Endpoint is not found in the Malwarebytes Cloud") else: return_error(message="Please Enter IP or Hostname", error="") # Function to execute List all endpoints Command def list_all_endpoints(account_id, client_id, auth_token, endpoint, USE_SSL): machines = get_all_endpoints(account_id, client_id, auth_token, USE_SSL) found_machines = [] if len(machines) != 0: if endpoint == "all": found_machines = machines elif endpoint == "online": for i in machines: if i["online"] is True: found_machines.append(i) elif endpoint == "offline": for i in machines: if i["online"] is False: found_machines.append(i) return_outputs( readable_output=tableToMarkdown( "Found " + endpoint + " " + str(len(found_machines)) + " Endpoints from Malwarebytes Cloud: ", found_machines ), outputs={"Malwarebytes.Endpoint(val.total_count == obj.total_count)": {"total_count": len(found_machines)}}, raw_response=found_machines, ) else: demisto.results("No Endpoint Found!") # Function to execute List endpoint info Command def list_endpoint_info(account_id, client_id, auth_token, ip, hostname, USE_SSL): # This is the call made initiating get endpoint info action if ip: ids = get_machine_id_ip(account_id, client_id, auth_token, ip, USE_SSL) if ids: assets = get_endpoint_info(account_id, client_id, auth_token, ids, USE_SSL) ip_address = None mac_address = None try: ip_address = assets.get("nics")[0].get("ips")[0] except Exception: pass try: mac_address = assets.get("nics")[0].get("mac_address") except Exception: pass return_outputs( readable_output=tableToMarkdown(f"Endpoint Information for the IP: {ip}", assets), outputs={ "Malwarebytes.Endpoint(val.Hostname == obj.Hostname)": { "Hostname": assets.get("host_name"), "IPAddress": assets.get("nics"), "Domain": assets.get("domain_name"), "MACAddress": mac_address, "OS": assets.get("os_info", {}).get("os_platform"), "OSVersion": assets.get("os_info", {}).get("os_version"), "Model": assets.get("computer_info", {}).get("model"), "Memory": assets.get("memory", {}), "Assets": assets, }, "Endpoint(val.Hostname == obj.Hostname)": { "Hostname": assets.get("host_name"), "IPAddress": ip_address, "Domain": assets.get("domain_name"), "MACAddress": mac_address, "OS": assets.get("os_info", {}).get("os_platform"), "OSVersion": assets.get("os_info", {}).get("os_version"), "Model": assets.get("computer_info", {}).get("model"), "Memory": assets.get("memory", {}), }, }, raw_response=assets, ) else: demisto.results("Endpoint is not found in the Malwarebytes Cloud") elif hostname: ids = get_machine_id_hostname(account_id, client_id, auth_token, hostname, USE_SSL) if ids: assets = get_endpoint_info(account_id, client_id, auth_token, ids, USE_SSL) ip_address = None mac_address = None try: ip_address = assets.get("nics")[0].get("ips")[0] except Exception: pass try: mac_address = assets.get("nics")[0].get("mac_address") except Exception: pass return_outputs( readable_output=tableToMarkdown(f"Endpoint Information for the Hostname: {hostname}", assets), outputs={ "Malwarebytes.Endpoint(val.Hostname == obj.Hostname)": { "Hostname": assets.get("host_name"), "IPAddress": assets.get("nics"), "Domain": assets.get("domain_name"), "MACAddress": mac_address, "OS": assets.get("os_info", {}).get("os_platform"), "OSVersion": assets.get("os_info", {}).get("os_version"), "Model": assets.get("computer_info", {}).get("model"), "Memory": assets.get("memory", {}), "Assets": assets, }, "Endpoint(val.Hostname == obj.Hostname)": { "Hostname": assets.get("host_name"), "IPAddress": ip_address, "Domain": assets.get("domain_name"), "MACAddress": mac_address, "OS": assets.get("os_info", {}).get("os_platform"), "OSVersion": assets.get("os_info", {}).get("os_version"), "Model": assets.get("computer_info", {}).get("model"), "Memory": assets.get("memory", {}), }, }, raw_response=assets, ) else: demisto.results("Endpoint is not found in the Malwarebytes Cloud") else: return_error(message="Please Input an IP or Hostname", error="") # Function to execute Get Scan Detections Command def scan_detections(account_id, client_id, auth_token, job_id, USE_SSL): if job_id: status = get_scan_status(account_id, client_id, auth_token, job_id, USE_SSL) if status == "COMPLETED": scan_id = get_scan_id(account_id, client_id, auth_token, job_id, USE_SSL) machine_id = get_scan_id_machine(account_id, client_id, auth_token, job_id, USE_SSL) detections = get_scan_detections(account_id, client_id, auth_token, machine_id, scan_id, USE_SSL) if len(detections) != 0: remove_empty_detection_fields(detections) return_outputs( readable_output=tableToMarkdown(f"Scan Detections Report for the Job_Id: {job_id}", detections), outputs={ "Malwarebytes.Scan(val.Job_ID == obj.Job_ID)": { "Job_ID": job_id, "Status": status, "Detections": detections, } }, raw_response=detections, ) else: demisto.results("Scan has been Completed and No Threats have been found !") else: demisto.results("Scan Status for the job_id " + str(job_id) + " is " + str(status)) else: return_error(message="Please Enter Job_Id", error="") # Function to execute Get Scan Status Command def scan_status(account_id, client_id, auth_token, job_id, USE_SSL): if job_id: status = get_scan_status(account_id, client_id, auth_token, job_id, USE_SSL) return_outputs( "Scan Status for the job_id " + str(job_id) + " is " + str(status), outputs={"Malwarebytes.Scan(val.Job_ID == obj.Job_ID)": {"Job_ID": job_id, "Status": status}}, raw_response=[], ) else: return_error(message="Please Enter Job_Id", error="") # Function to execute Fetch Incidents Command def fetch_incidents(account_id, client_id, auth_token, event_list, USE_SSL): incident = None lastPointer = None if event_list == "Suspicious Activity (EPR)": suspicious_activities = get_suspicious_activities(account_id, client_id, auth_token, USE_SSL) # And retrieve it for use later lastRun = demisto.getLastRun() last_fetch_time = lastRun.get("time") last_custom = lastRun.get("custom") suspicious_activity_severity = demisto.params().get("suspicious_activity_severity") if suspicious_activity_severity: lastPointer, incident = fetch_suspicious_activities( suspicious_activities, suspicious_activity_severity, last_fetch_time, last_custom ) else: demisto.incidents([]) elif event_list == "RTP Detections (EP)": rtp_detections = get_rtp_detections(account_id, client_id, auth_token, USE_SSL) # And retrieve it for use later lastRun = demisto.getLastRun() last_fetch_time = lastRun.get("time") last_custom = lastRun.get("custom") rtp_malware_category = demisto.params().get("rtp_threat_category") category = [] if rtp_malware_category: for i in rtp_malware_category: category.append(category_to_code(i)) lastPointer, incident = fetch_rtp_detections(category, rtp_detections, last_fetch_time, last_custom) else: demisto.incidents([]) if incident and lastPointer: demisto.incidents([incident]) # You can store the last run time... demisto.setLastRun(lastPointer) else: demisto.incidents([]) def get_token(client_id, client_secret, account_id, use_ssl): integration_context = demisto.getIntegrationContext() token = integration_context.get("access_token") valid_until = integration_context.get("valid_until") time_now = int(time.time()) if token and valid_until and time_now < valid_until: # Token is still valid - did not expire yet return token token = get_nebula_client(client_id, client_secret, account_id, use_ssl) integration_context = { "access_token": token, "valid_until": time_now + 3595, # Assuming the expiration time is 1 hour } demisto.setIntegrationContext(integration_context) return token # Function to execute Open SA action def open_sa_incident(account_id, client_id, auth_token, machine_id, detection_id, USE_SSL): url = URL headers = {"X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Authorization": auth_token} url = url + "/api/v2/endpoints/" + str(machine_id) + "/sa/" + str(detection_id) + "/open" response = requests.put(url, data=None, headers=headers, verify=USE_SSL) if response.status_code == 201: return_outputs( "Open SA Incident action is initiated Successfully for the detection id: " + str(detection_id), outputs={"Malwarebytes.SA(val.Machine_ID == obj.Machine_ID)": {"Machine_ID": machine_id}}, raw_response=[], ) else: raise Exception(response.text) # Function to execute Remediate SA action def remediate_sa_incident(account_id, client_id, auth_token, machine_id, detection_id, USE_SSL): url = URL headers = { "X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Content-Type": "application/json", "Authorization": auth_token, } url = url + "/api/v2/endpoints/" + str(machine_id) + "/sa/" + str(detection_id) + "/remediate" response = requests.post(url, data=json.dumps({}), headers=headers, verify=USE_SSL) if response.status_code == 201: return_outputs( "Remediate SA Incident action is initiated Successfully for the detection id: " + str(detection_id), outputs={"Malwarebytes.SA(val.Machine_ID == obj.Machine_ID)": {"Machine_ID": machine_id}}, raw_response=[], ) elif response.status_code == 404: return_error( message="HTTP Error: " + str(response.status_code) + " as threat with detection id: " + str(detection_id) + " is already remediated", error="", ) else: raise Exception(response.text) # Function to execute Close Remediate SA action def close_sa_incident(account_id, client_id, auth_token, machine_id, detection_id, USE_SSL): url = URL headers = {"X-MWB-AccountID": account_id, "X-MWB-ClientID": client_id, "Authorization": auth_token} url = url + "/api/v2/endpoints/" + str(machine_id) + "/sa/" + str(detection_id) + "/close" response = requests.put(url, data=None, headers=headers, verify=USE_SSL) if response.status_code == 201: return_outputs( "Close SA Incident action is initiated Successfully for the detection id: " + str(detection_id), outputs={"Malwarebytes.SA(val.Machine_ID == obj.Machine_ID)": {"Machine_ID": machine_id}}, raw_response=[], ) else: raise Exception(response.text) def get_sa_activities_command(account_id, client_id, auth_token, hostname, path, USE_SSL): suspicious_activities = get_suspicious_activities(account_id, client_id, auth_token, USE_SSL) if hostname: Filtered_SA = [] for i in suspicious_activities: if i["pc_hostname"] == hostname: Filtered_SA.append(i) if len(Filtered_SA) != 0: return_outputs( readable_output=tableToMarkdown(f"Suspicious Activites found for the host: {hostname}", Filtered_SA), outputs={ "Malwarebytes.Endpoint(val.Suspicious_Activities == obj.Suspicious_Activities)": { "Suspicious_Activities": Filtered_SA } }, raw_response=Filtered_SA, ) else: demisto.results("No Suspicious Activites found for the host: " + str(hostname)) elif path: Filtered_SA = [] for i in suspicious_activities: if i["path"] == path: Filtered_SA.append(i) if len(Filtered_SA) != 0: return_outputs( readable_output=tableToMarkdown(f"File Path: {path} is found on the hosts", Filtered_SA), outputs={ "Malwarebytes.Endpoint(val.Suspicious_Activities == obj.Suspicious_Activities)": { "Suspicious_Activities": Filtered_SA } }, raw_response=Filtered_SA, ) else: demisto.results("File Path: " + str(path) + " is not found on any hosts.") else: return_error(message="Please enter hostname or path", error="") def send_usage_data(auth_token, account_id, client_id, msg_type, USE_SSL): url = "https://api-msp-telemetry.threatdown.com/data" headers = {"Content-Type": "application/json"} tz = pytz.timezone("Europe/Moscow") dt = datetime.now() loc_dt = tz.localize(dt).replace(microsecond=0) v = loc_dt.isoformat() temp = v.split("+") timestamp = temp[0] + "Z" body = { "timestamp": timestamp, "integration_code": "TA-CX", "integration_name": "Cortex XSOAR", "integration_app": "ThreatDown", "integration_app_version": "1.1.7", "nebula_account_id": account_id, "ov_account_id": "", "mbbr_license_key": "", "api_client_id": client_id, "custom_fields": [], "msg_type": msg_type, "token": auth_token, } try: response = requests.request("POST", url, data=json.dumps(body), headers=headers, verify=USE_SSL) if response.status_code == 200: data = json.loads(response.text) return data.get("statusCode") == 201 else: return False except Exception as e: demisto.results("Cannot send usage data, details" + str(e)) def main(): """CONSTANTS""" global URL region = demisto.params().get("region", "US") URL = REGION_URLS.get(region, REGION_URLS["US"]) account_id = demisto.params().get("accountid") client_id = demisto.params().get("clientid") client_secret = demisto.params().get("clientsecret") msg_type = "INTEGRATION INUSE" use_ssl = not demisto.params().get("insecure", False) auth_token = get_token(client_id, client_secret, account_id, use_ssl) try: # Remove proxy if not set to true in params handle_proxy() # Function to send usage data of customers to Malwarebytes send_usage_data(auth_token, account_id, client_id, msg_type, use_ssl) # The command demisto.command() holds the command sent from the user. LOG(f"command is {demisto.command()}") if demisto.command() == "test-module": # This is the call made when pressing the integration test button. status = test_connectivity(account_id, client_id, auth_token, use_ssl) if status is True: demisto.results("ok") elif demisto.command() == "malwarebytes-scan-and-remediate": ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") scan_and_remediate(account_id, client_id, auth_token, ip, hostname, use_ssl) elif demisto.command() == "malwarebytes-scan-and-report": ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") scan_and_report(account_id, client_id, auth_token, ip, hostname, use_ssl) elif demisto.command() == "malwarebytes-isolate-endpoint": ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") isolate_endpoint(account_id, client_id, auth_token, ip, hostname, use_ssl) elif demisto.command() == "malwarebytes-isolate-process": ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") isolate_process(account_id, client_id, auth_token, ip, hostname, use_ssl) elif demisto.command() == "malwarebytes-isolate-network": ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") isolate_network(account_id, client_id, auth_token, ip, hostname, use_ssl) elif demisto.command() == "malwarebytes-isolate-desktop": ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") isolate_desktop(account_id, client_id, auth_token, ip, hostname, use_ssl) elif demisto.command() == "malwarebytes-deisolate-endpoint": ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") deisolate_endpoint(account_id, client_id, auth_token, ip, hostname, use_ssl) elif demisto.command() == "malwarebytes-list-endpoints": endpoint = demisto.args().get("endpoints") list_all_endpoints(account_id, client_id, auth_token, endpoint, use_ssl) elif demisto.command() == "malwarebytes-list-endpoint-info": ip = demisto.args().get("ip") hostname = demisto.args().get("hostname") list_endpoint_info(account_id, client_id, auth_token, ip, hostname, use_ssl) elif demisto.command() == "malwarebytes-get-scan-detections": job_id = demisto.args().get("job_id") scan_detections(account_id, client_id, auth_token, job_id, use_ssl) elif demisto.command() == "malwarebytes-get-job-status": job_id = demisto.args().get("job_id") scan_status(account_id, client_id, auth_token, job_id, use_ssl) elif demisto.command() == "malwarebytes-open-sa-incident": machine_id = demisto.args().get("machine_id") detection_id = demisto.args().get("detection_id") open_sa_incident(account_id, client_id, auth_token, machine_id, detection_id, use_ssl) elif demisto.command() == "malwarebytes-remediate-sa-incident": machine_id = demisto.args().get("machine_id") detection_id = demisto.args().get("detection_id") remediate_sa_incident(account_id, client_id, auth_token, machine_id, detection_id, use_ssl) elif demisto.command() == "malwarebytes-close-sa-incident": machine_id = demisto.args().get("machine_id") detection_id = demisto.args().get("detection_id") close_sa_incident(account_id, client_id, auth_token, machine_id, detection_id, use_ssl) elif demisto.command() == "malwarebytes-get-sa-activities": hostname = demisto.args().get("hostname") path = demisto.args().get("path") get_sa_activities_command(account_id, client_id, auth_token, hostname, path, use_ssl) elif demisto.command() == "fetch-incidents": event_list = demisto.params().get("Fetch_Event_List") fetch_incidents(account_id, client_id, auth_token, event_list, use_ssl) except Exception as e: # Log exceptions return_error(f"Failed to execute {demisto.command()} command. Error: {e!s}{traceback.format_exc()!s}") if __name__ in ["__main__", "builtin", "builtins"]: main()