RemoveFileWrapper

This script allows removing specified files using Cortex XDR, CrowdStrike and Microsoft Defender (Advanced Threat Protection).

Type

python

Pack

Malware

Source

from CommonServerPython import *

""" STANDALONE FUNCTION """


def create_commands(device_ids: List[str], file_path: str, file_hash: str) -> List[CommandRunner.Command]:
    """
    Create a list of `Command` of the remove file command to `Cortex XDR` and `CrowdstrikeFalcon`

    :param device_ids: device IDs to run on
    :param file_path: path of the file to delete
    :param file_hash: hash of the file to delete
    :return: A list of `Command` for the script
    """
    cs_os_to_ids = get_crowdstrike_os_to_id(device_ids)
    incident_id = demisto.incident()["id"]

    # creating a command object for each supported integration
    xdr_command = CommandRunner.Command(
        commands="xdr-run-script-delete-file",
        args_lst={
            "endpoint_ids": ",".join(device_ids),
            "file_path": file_path,
        },
    )

    falcon_command = CommandRunner.Command(
        commands="cs-falcon-rtr-remove-file",
        args_lst=[
            {
                "host_ids": ",".join(ids),
                "file_path": file_path,
                "os": os_,
            }
            for os_, ids in cs_os_to_ids.items()
        ],
    )

    microsoft_atp_command = CommandRunner.Command(
        commands="microsoft-atp-stop-and-quarantine-file",
        args_lst={
            "machine_id": ",".join(device_ids),
            "file_hash": file_hash,
            "comment": f"Action was taken by Cortex XSOAR - incident #{incident_id}",
        },
    )

    path_based_commands = {xdr_command, falcon_command}
    hash_based_commands = {microsoft_atp_command}

    commands = set()
    if file_path:
        commands.update(path_based_commands)
    if file_hash:
        commands.update(hash_based_commands)

    return list(commands)


def get_crowdstrike_os_to_id(device_ids: List[str]) -> Dict[str, Set[str]]:
    """
    Get the OS for each device id

    :param device_ids: List of device ids
    :return: A mapping between the OS (Windows, Linux, Mac) and the devices
    """
    endpoint_executor = CommandRunner.Command(
        brand="CrowdstrikeFalcon", commands="endpoint", args_lst={"id": ",".join(device_ids)}
    )
    endpoint_results, _ = CommandRunner.execute_commands(endpoint_executor, extract_contents=True)
    os_to_ids: Dict[str, Set[str]] = {}
    for endpoint_res in endpoint_results:
        if not isinstance(endpoint_res.result, dict):
            continue
        for endpoints in endpoint_res.result.get("resources", []):
            if not isinstance(endpoints, list):
                endpoints = [endpoints]
            for endpoint in endpoints:
                os_ = endpoint.get("platform_name")
                if os_ not in os_to_ids:
                    os_to_ids[os_] = set()
                os_to_ids[os_].add(endpoint.get("device_id"))
    return os_to_ids


def run_remove_file(device_ids: List[str], file_path: str, file_hash: str) -> list:
    """
    Given arguments to the command, returns a list of results to return
    :param device_ids: List of device ids to remove the file from
    :param file_path: Path of the file to remove
    :param file_hash: Hash of the file to remove (only supported on MSDE)
    :return: list of results to return
    :rtype: ``list``
    """
    command_executors = create_commands(device_ids, file_path, file_hash)
    return CommandRunner.run_commands_with_summary(command_executors)


""" MAIN FUNCTION """


def main():  # pragma: no cover
    try:
        args = demisto.args()
        if not argToBoolean(args.get("approve_action", False)):
            raise ValueError("approve_action must be `yes`")
        device_ids = argToList(args.get("device_ids"))
        file_path = args.get("file_path", "")
        file_hash = args.get("file_hash", "")
        if not device_ids:
            raise ValueError("Device id is not specified")
        if not (file_path or file_hash):
            raise ValueError("Neither path nor hash(es) of the file(s) to delete were specified.")
        return_results(run_remove_file(device_ids, file_path, file_hash))
    except Exception as e:
        return_error(f"Failed to execute RemoveFileWrapper. Error: {e!s}")


""" ENTRY POINT """

if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README

{
    "CrowdStrike": {
        "Command": {
            "rm": {
                "HostID": "0bde2c4645294245aca522971ccc44c4", 
                "Error": "Success"
            }
        }
    }
}