MDE - Search And Block Software

This playbook will search a file or process activity of a software by a given image file name using Microsoft Defender For Endpoint. The analyst can then choose the files to block.

Pack

MicrosoftDefenderAdvancedThreatProtection

Tasks

19

Inputs

• Filename — File name to search
• TimeFrame — Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.
• Defender Indicator Title — The indicator alert title in Defender.
• Indicator Expiration — DateTime string indicating when the indicator expires. Format: (<number> <time unit>, e.g., 12 hours, 7 days).

Commands used

• microsoft-atp-advanced-hunting
• microsoft-atp-sc-indicator-create