RDP Sessions
RDPCacheHunting Incident
Details
| ID | RDP Sessions |
|---|---|
| Group | incident |
| Version | -1 |
| From Version | 6.9.0 |
Layout Structure
Legacy Summary 0 sections
No sections defined.
Incident Info 11 sections
IP Indicators
Domain Indicators
URL Indicators
Windows Path Indicators
Indicators Type
Date and Time Indicators
Executables Indicators
Overall Strings Score
Email Address Indicators
Strings Similarity
| Field ID | Position |
|---|---|
| incidentrdpachehuntingstringssimilarity | Col 0-2, Height: 106 |
String Sifter
| Field ID | Position |
|---|---|
| incidentrdpcachehuntingstringsifter | Col 0-2, Height: 106 |
RDP Image 1 section
War Room Entries
Evidence Board 0 sections
No sections defined.
Technical Details 1 section
Use Case Description
| Field ID | Position |
|---|---|
| usecasedescription | Col 0-6, Height: 44 |
War Room 0 sections
No sections defined.
Work Plan 0 sections
No sections defined.
Related Incidents 0 sections
No sections defined.
Canvas 0 sections
No sections defined.
{ "detailsV2": { "tabs": [ { "id": "summary", "name": "Legacy Summary", "type": "summary" }, { "id": "caseinfoid", "name": "Incident Info", "sections": [ { "columns": [ { "displayed": true, "isDefault": true, "key": "value", "width": 300 }, { "displayed": true, "isDefault": true, "key": "score", "width": 120 }, { "displayed": true, "isDefault": true, "key": "firstSeen", "width": 275 }, { "displayed": true, "isDefault": true, "key": "lastSeen", "width": 275 }, { "displayed": true, "isDefault": true, "key": "timestamp", "width": 190 }, { "displayed": true, "isDefault": true, "key": "relatedIncCount", "width": 150 }, { "displayed": true, "isDefault": true, "key": "sourceBrands", "width": 175 }, { "displayed": true, "isDefault": true, "key": "sourceInstances", "width": 175 }, { "displayed": true, "isDefault": true, "key": "expirationStatus", "width": 175 }, { "displayed": true, "isDefault": true, "key": "expiration", "width": 190 } ], "displayType": "ROW", "h": 3, "i": "caseinfoid-field-changed-caseinfoid-7ce69dd0-a07f-11e9-936c-5395a1acf11e", "maxW": 3, "minH": 1, "moved": false, "name": "IP Indicators", "query": "type:IP", "queryType": "input", "static": false, "type": "indicators", "w": 1, "x": 1, "y": 6 }, { "columns": [ { "displayed": true, "isDefault": true, "key": "value", "width": 300 }, { "displayed": true, "isDefault": true, "key": "score", "width": 120 }, { "displayed": true, "isDefault": true, "key": "firstSeen", "width": 275 }, { "displayed": true, "isDefault": true, "key": "lastSeen", "width": 275 }, { "displayed": true, "isDefault": true, "key": "timestamp", "width": 190 }, { "displayed": true, "isDefault": true, "key": "relatedIncCount", "width": 150 }, { "displayed": true, "isDefault": true, "key": "sourceBrands", "width": 175 }, { "displayed": true, "isDefault": true, "key": "sourceInstances", "width": 175 }, { "displayed": true, "isDefault": true, "key": "expirationStatus", "width": 175 }, { "displayed": true, "isDefault": true, "key": "expiration", "width": 190 } ], "h": 2, "i": "caseinfoid-field-changed-caseinfoid-38c534a0-0cdc-11ed-89d1-e5ac65360f00", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Domain Indicators", "query": "type:Domain", "queryType": "input", "static": false, "type": "indicators", "w": 1, "x": 1, "y": 0 }, { "columns": [ { "displayed": true, "isDefault": true, "key": "value", "width": 300 }, { "displayed": true, "isDefault": true, "key": "score", "width": 120 }, { "displayed": true, "isDefault": true, "key": "firstSeen", "width": 275 }, { "displayed": true, "isDefault": true, "key": "lastSeen", "width": 275 }, { "displayed": true, "isDefault": true, "key": "timestamp", "width": 190 }, { "displayed": true, "isDefault": true, "key": "relatedIncCount", "width": 150 }, { "displayed": true, "isDefault": true, "key": "sourceBrands", "width": 175 }, { "displayed": true, "isDefault": true, "key": "sourceInstances", "width": 175 }, { "displayed": true, "isDefault": true, "key": "expirationStatus", "width": 175 }, { "displayed": true, "isDefault": true, "key": "expiration", "width": 190 } ], "h": 2, "i": "caseinfoid-field-changed-caseinfoid-42633610-0cdc-11ed-89d1-e5ac65360f00", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "URL Indicators", "query": "type:URL", "queryType": "input", "static": false, "type": "indicators", "w": 1, "x": 1, "y": 2 }, { "columns": [ { "displayed": true, "isDefault": true, "key": "value", "width": 300 } ], "h": 2, "i": "caseinfoid-field-changed-caseinfoid-06e49f40-0cdf-11ed-89d1-e5ac65360f00", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Windows Path Indicators", "query": "type:\"Windows File Path\"", "queryType": "input", "static": false, "type": "indicators", "w": 1, "x": 0, "y": 2 }, { "description": "", "h": 2, "i": "caseinfoid-8c0f6750-0d83-11ed-9e08-b96f717afa75", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Indicators Type", "query": "Indicators-type", "queryType": "script", "static": false, "type": "dynamic", "w": 1, "x": 0, "y": 0 }, { "columns": [ { "displayed": true, "isDefault": true, "key": "value", "width": 300 } ], "h": 3, "i": "caseinfoid-8e64f340-0d87-11ed-a87d-ffc9245ec67b", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Date and Time Indicators", "query": "type:\"Windows Date and Time\"", "queryType": "input", "static": false, "type": "indicators", "w": 1, "x": 0, "y": 6 }, { "columns": [ { "displayed": true, "isDefault": true, "key": "value", "width": 300 } ], "description": "", "h": 2, "i": "caseinfoid-99427990-0d87-11ed-a87d-ffc9245ec67b", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Executables Indicators", "query": "type:\"Windows Executables\"", "queryType": "input", "static": false, "type": "indicators", "w": 1, "x": 0, "y": 4 }, { "h": 2, "i": "caseinfoid-4cf90f60-119a-11ed-bd36-d1bd96220a2e", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Overall Strings Score", "query": "SetRDPOverallScore", "queryType": "script", "static": false, "type": "dynamic", "w": 1, "x": 2, "y": 0 }, { "h": 2, "i": "caseinfoid-87b6fcf0-1255-11ed-bd36-d1bd96220a2e", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Email Address Indicators", "query": "type:\"email\"", "queryType": "input", "static": false, "type": "indicators", "w": 1, "x": 1, "y": 4 }, { "displayType": "ROW", "h": 3, "hideItemTitleOnlyOne": true, "hideName": false, "i": "caseinfoid-e8540fc1-1426-11ee-a737-19f59cf74e83", "items": [ { "dropEffect": "move", "endCol": 2, "fieldId": "incidentrdpachehuntingstringssimilarity", "height": 106, "id": "479f2bb0-1ac4-11ee-874e-530925bceb83", "index": 0, "listId": "caseinfoid-e8540fc1-1426-11ee-a737-19f59cf74e83", "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Strings Similarity", "static": false, "w": 1, "x": 2, "y": 2 }, { "displayType": "ROW", "h": 4, "hideItemTitleOnlyOne": true, "hideName": false, "i": "caseinfoid-f42767c1-1426-11ee-a737-19f59cf74e83", "items": [ { "endCol": 2, "fieldId": "incidentrdpcachehuntingstringsifter", "height": 106, "id": "4c314340-18dd-11ee-8250-4d18bfc11034", "index": 1, "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "String Sifter", "static": false, "w": 1, "x": 2, "y": 5 } ], "type": "custom" }, { "hidden": false, "id": "zeizgsgise", "name": "RDP Image", "sections": [ { "h": 5, "i": "caseinfoid-zeizgsgise-caseinfoid-f93d1ae0-df81-11ed-a0c9-ff82a3e1ffaf", "items": [], "maxH": null, "maxW": 3, "minH": 1, "moved": false, "name": "War Room Entries", "query": { "tags": [ "RDPCacheImage" ] }, "queryType": "warRoomFilter", "static": false, "type": "invTimeline", "w": 3, "x": 0, "y": 0 } ], "type": "custom" }, { "id": "evidenceBoard", "name": "Evidence Board", "type": "evidenceBoard" }, { "hidden": false, "id": "ozhko2yuki", "name": "Technical Details", "sections": [ { "displayType": "ROW", "h": 7, "hideItemTitleOnlyOne": true, "hideName": true, "i": "caseinfoid-26052c30-1245-11ed-bd36-d1bd96220a2e", "items": [ { "endCol": 6, "fieldId": "usecasedescription", "height": 44, "id": "2826fac0-1245-11ed-bd36-d1bd96220a2e", "index": 0, "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Use Case Description", "static": false, "w": 3, "x": 0, "y": 0 } ], "type": "custom" }, { "id": "warRoom", "name": "War Room", "type": "warRoom" }, { "id": "workPlan", "name": "Work Plan", "type": "workPlan" }, { "id": "relatedIncidents", "name": "Related Incidents", "type": "relatedIncidents" }, { "id": "canvas", "name": "Canvas", "type": "canvas" } ] }, "edit": { "sections": [ { "description": "", "fields": [ { "fieldId": "incident_name", "isVisible": true }, { "fieldId": "incident_occurred", "isVisible": true }, { "fieldId": "incident_reminder", "isVisible": true }, { "fieldId": "incident_owner", "isVisible": true }, { "fieldId": "incident_roles", "isVisible": true }, { "fieldId": "incident_type", "isVisible": true }, { "fieldId": "incident_severity", "isVisible": true }, { "fieldId": "incident_playbookid", "isVisible": true }, { "fieldId": "incident_labels", "isVisible": true }, { "fieldId": "incident_phase", "isVisible": true }, { "fieldId": "incident_details", "isVisible": true }, { "fieldId": "incident_attachment", "isVisible": true } ], "isVisible": true, "name": "Basic Information", "query": null, "queryType": "", "readOnly": false, "type": "" }, { "description": "", "isVisible": true, "name": "Custom Fields", "query": null, "queryType": "", "readOnly": false, "type": "" } ] }, "group": "incident", "id": "RDP Sessions", "name": "RDP Sessions", "system": false, "version": -1, "fromVersion": "6.9.0", "description": "" }