MDE - Host Advanced Hunting For Persistence

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook uses the Microsoft Defender For Endpoint Advanced Hunting feature to hunt for host persistence evidence.

Microsoft Defender for Endpoint · 33 tasks · 4 inputs · 12 outputs

Inputs

  • FileSha256 — A comma-separated list of file SHA256 hashes to hunt.
  • DeviceName — A comma-separated list of host names to hunt.
  • FileName — A comma-separated list of file names to hunt.
  • DeviceID — A comma-separated list of a device IDs to hunt.

Outputs

  • MicrosoftATP.HuntPersistenceEvidence.Result — The query results for Hunt Persistence Evidence.
  • MicrosoftATP.HuntPersistenceEvidence.Result.scheduled_job — The query results for scheduled_job query_purpose.
  • MicrosoftATP.HuntPersistenceEvidence.Result.registry_entry — The query results for registry_entry query_purpose.
  • MicrosoftATP.HuntPersistenceEvidence.Result.startup_folder_changes — The query results for startup_folder_changes query_purpose.
  • MicrosoftATP.HuntPersistenceEvidence.Result.new_service_created — The query results for new_service_created query_purpose.
  • MicrosoftATP.HuntPersistenceEvidence.Result.service_updated — The query results for service_updated query_purpose.
  • MicrosoftATP.HuntPersistenceEvidence.Result.file_replaced — The query results for file_replaced query_purpose.
  • MicrosoftATP.HuntPersistenceEvidence.Result.new_user — The query results for new_user query_purpose.
  • MicrosoftATP.HuntPersistenceEvidence.Result.new_group — The query results for new_group query_purpose.
  • MicrosoftATP.HuntPersistenceEvidence.Result.group_user_change — The query results for group_user_change query_purpose.
  • MicrosoftATP.HuntPersistenceEvidence.Result.local_firewall_change — The query results for local_firewall_change query_purpose.
  • MicrosoftATP.HuntPersistenceEvidence.Result.host_file_change — The query results for host_file_change query_purpose.

Commands used

microsoft-atp-advanced-hunting-persistence-evidence setIncident

Flowchart

true true true true true true true true true true true true Start Start Scheduled Tasks Scheduled Tasks Registry modification Registry modification Is the file created any Scheduled Tasks? - microsoft-atp-advanced-hunting-persistence-evidence Is the file created any S... microsoft-atp-advanced-huntin... A new user was created on the system? - microsoft-atp-advanced-hunting-persistence-evidence A new user was created on... microsoft-atp-advanced-huntin... Object (User or Group) Was Added To A Group? - microsoft-atp-advanced-hunting-persistence-evidence Object (User or Group) Wa... microsoft-atp-advanced-huntin... Local Group Was Created? - microsoft-atp-advanced-hunting-persistence-evidence Local Group Was Created? microsoft-atp-advanced-huntin... New/Exisiting Users New/Exisiting Users Startup Folder Startup Folder Startup Folder Modification - microsoft-atp-advanced-hunting-persistence-evidence Startup Folder Modification microsoft-atp-advanced-huntin... Check If Any Registry Values Were Modified - microsoft-atp-advanced-hunting-persistence-evidence Check If Any Registry Val... microsoft-atp-advanced-huntin... Any results? Any results? Add 'User's Group Modification' Tag And Set Severity to High - setIncident Add 'User's Group Modific... setIncident Done Done Any results? Any results? Add 'Local Group Creation' Tag And Set Severity to High - setIncident Add 'Local Group Creation... setIncident Done Done Any results? Any results? Add 'User Creation' Tag And Set Severity to High - setIncident Add 'User Creation' Tag A... setIncident Done Done Any results? Any results? Add 'Registry Modification' Tag And Set Severity to High - setIncident Add 'Registry Modificatio... setIncident Done Done Any results? Any results? Add 'Startup Folder Modification' Tag And Set Severity to High - setIncident Add 'Startup Folder Modif... setIncident Done Done Any results? Any results? Add 'Created Scheduled Tasks' Tag And Set Severity to High - setIncident Add 'Created Scheduled Ta... setIncident Done Done Are DeviceID and FileSha256 provided? Are DeviceID and FileSha2... Check if device information was provided Check if device informati... Done Done Are DeviceID,FileName and FileSha256 provided? Are DeviceID,FileName and...