PS-Remote Get Network Traffic

This playbook leverages the Windows built-in PowerShell and WinRM capabilities to connect to a Windows host. It then connectst to the Netsh tool to create an ETL file which is the equivalent of a Wireshark PCAP file by using the PS-Remote integration. After receiving the resultant ETL, XSOAR will be able to convert the ETL to a PCAP file to be parsed and enriched later. Review the Microsoft documentation for how to use ETL filters (https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj129382(v=ws.11)#using-filters-to-limit-etl-trace-file-details).

Pack

WindowsForensics

Tasks

12

Inputs

• Host — A single hostname or IP address from which to create the ETL file. For example, testpc01.
• EtlSizeLimit — The maximum file size for the ETL. Once the file has reached this size, the capture will stop. For example, 10MB. The default size is 10MB.
• EtlPath — The path on the hostname on which to create the ETL file. The default path will be c:\etl.etl. If the AddHostNameToFile input is "true", the file downloaded to XSOAR will contain the hostname.
• EtlFilter — The filter to apply when creating the ETL file. For example, IPv4.Address=1.1.1.1 to capture traffic just from the 1.1.1.1 IP address. If no filter is specified, all traffic will be recorded.
• ETlTimeToRecord — The time to record in seconds.
• ZipEtl — Specify "true" to zip the ETL file before sending it to XSOAR.
• AddHostNameToFile — Specify "true" for the downloaded filename to contain the hostname, or "false" to keep the filename as configured in the FilePath argument.

Outputs

• PcapDetails — The PCAP file details.

Commands used

• ps-remote-download-file
• ps-remote-etl-create-start
• ps-remote-etl-create-stop