MDE - Host Advanced Hunting

contentitemexportablefields:
  contentitemfields: {}
description: |-
  This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
  This playbook uses the Microsoft Defender For Endpoint Advanced Hunting feature based on the provided inputs.
id: MDE - Host Advanced Hunting
inputs:
- description: A comma-separated list of file SHA1 hashes to hunt.
  key: FileSha1
  playbookInputQuery:
  required: false
  value: {}
- description: A comma-separated list of file Sha256 hashes to hunt.
  key: FileSha256
  playbookInputQuery:
  required: false
  value: {}
- description: A comma-separated list of IPs to hunt.
  key: IP
  playbookInputQuery:
  required: false
  value: {}
- description: A comma-separated list of host names to hunt.
  key: DeviceName
  playbookInputQuery:
  required: false
  value: {}
- description: A comma-separated list of file names to hunt.
  key: FileName
  playbookInputQuery:
  required: false
  value: {}
- description: A comma-separated list of device ID to hunt.
  key: DeviceID
  playbookInputQuery:
  required: false
  value: {}
- description: A comma-separated list of file MD5 hashes to hunt.
  key: FileMd5
  playbookInputQuery:
  required: false
  value: {}
- key: QueryBatch
  value: {}
  required: false
  description: Define the custom queries you would like to run as a part of the 'MDE - Host Advanced Hunting' playbook.  This input will be passed to the 'query_batch' argument in the '!microsoft-atp-advanced-hunting' command. For more information and examples, check the command's hints.
  playbookInputQuery:
name: MDE - Host Advanced Hunting
outputs:
- contextPath: MicrosoftATP.HuntTampering
  description: The query results for hunt tampering.
  type: unknown
- contextPath: MicrosoftATP.HuntTampering.Result
  description: The query results.
- contextPath: MicrosoftATP.HuntPrivilegeEscalation
  description: The query results for hunt privilege escalation.
  type: unknown
- contextPath: MicrosoftATP.HuntPrivilegeEscalation.Result
  description: The query results.
- contextPath: MicrosoftATP.HuntLateralMovementEvidence.Result
  description: The query results for hunt lateral movement evidence.
  type: unknown
- contextPath: MicrosoftATP.HuntLateralMovementEvidence.Result.network_connections
  description: Query results from the Microsoft Defender For Endpoint Advanced Hunting on network connections.
- contextPath: MicrosoftATP.HuntLateralMovementEvidence.Result.smb_connections
  description: Query Results from the Microsoft Defender For Endpoint Advanced Hunting on SMB connections.
- contextPath: MicrosoftATP.HuntLateralMovementEvidence.Result.credential_dumping
  description: Query results from the Microsoft Defender For Endpoint Advanced Hunting on credential dumping.
- contextPath: MicrosoftATP.HuntLateralMovementEvidence.Result.management_connection
  description: Query results from the Microsoft Defender For Endpoint Advanced Hunting on management connections.
- contextPath: MicrosoftATP.HuntPersistenceEvidence
  description: Query results from the Microsoft Defender For Endpoint Advanced Hunting for hunt lateral movement evidence.
  type: unknown
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result
  description: Query results from the Microsoft Defender For Endpoint Advanced Hunting for hunt persistence evidence.
  type: unknown
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.scheduled_job
  description: Query results from the Microsoft Defender For Endpoint Advanced Hunting for scheduled jobs.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.registry_entry
  description: Query results from the Microsoft Defender For Endpoint Advanced Hunting for registry entries.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.startup_folder_changes
  description: Query results from the Microsoft Defender For Endpoint Advanced Hunting for startup folder changes.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.new_service_created
  description: Query results from the Microsoft Defender For Endpoint Advanced Hunting for created new services.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.service_updated
  description: Query results from the Microsoft Defender For Endpoint Advanced Hunting for updated services.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.file_replaced
  description: Query results from the Microsoft Defender For Endpoint Advanced Hunting for replaced files.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.new_user
  description: Query results from the Microsoft Defender For Endpoint Advanced Hunting for new users.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.new_group
  description: Query results from the Microsoft Defender For Endpoint Advanced Hunting for new groups.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.group_user_change
  description: Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in group users.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.local_firewall_change
  description: Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in the local firewall.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.host_file_change
  description: Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in the host file.
- contextPath: MicrosoftATP.File
  description: File information from Microsoft ATP.
  type: unknown
starttaskid: '0'
tasks:
  '0':
    id: '0'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '3'
      - '17'
      - '13'
      - '85'
      - '90'
      - "91"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: e1f36156-43d0-496d-8e38-8c3e0b9acd38
      iscommand: false
      name: ''
      version: -1
      description: ''
    taskid: e1f36156-43d0-496d-8e38-8c3e0b9acd38
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": -320,
          "y": 60
        }
      }
    continueonerrortype: ""
  '3':
    id: '3'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '82'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 80881684-437d-4f3f-8f5a-08635fc83ec6
      iscommand: false
      name: Network Activity
      type: title
      version: -1
      description: ''
    taskid: 80881684-437d-4f3f-8f5a-08635fc83ec6
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1000,
          "y": 210
        }
      }
    continueonerrortype: ""
  '9':
    id: '9'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '26'
      - '27'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 77275ae0-24c8-4b95-8a3c-2f126e3e28af
      iscommand: false
      name: Privilege Escalation
      type: title
      version: -1
      description: ''
    taskid: 77275ae0-24c8-4b95-8a3c-2f126e3e28af
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": -1010,
          "y": 420
        }
      }
    continueonerrortype: ""
  '13':
    id: '13'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '80'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: fc4c5cfd-ec21-4e0a-86fa-37e98199aea8
      iscommand: false
      name: PowerShell Analysis
      type: title
      version: -1
      description: ''
    taskid: fc4c5cfd-ec21-4e0a-86fa-37e98199aea8
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 560,
          "y": 210
        }
      }
    continueonerrortype: ""
  '17':
    id: '17'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '81'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Finds sandbox reports by providing an FQL filter and paging details.
      id: b0532ae0-413b-47ec-866f-ba24eb3ccb6a
      iscommand: false
      name: Persistence
      type: title
      version: -1
    taskid: b0532ae0-413b-47ec-866f-ba24eb3ccb6a
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 130,
          "y": 210
        }
      }
    continueonerrortype: ""
  '26':
    id: '26'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '38'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 2a614f24-f7ad-4297-8d4a-42cceb520fe3
      iscommand: false
      name: Mimikatz/Other Lsaas manipulation
      type: title
      version: -1
      description: ''
    taskid: 2a614f24-f7ad-4297-8d4a-42cceb520fe3
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": -1220,
          "y": 570
        }
      }
    continueonerrortype: ""
  '27':
    id: '27'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '37'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 76fa906f-09b2-4504-8c7b-fa9b08b11910
      iscommand: false
      name: Is the Local Admin Signed to the Device?
      type: title
      version: -1
      description: ''
    taskid: 76fa906f-09b2-4504-8c7b-fa9b08b11910
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": -780,
          "y": 570
        }
      }
    continueonerrortype: ""
  '28':
    id: '28'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '29'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: a01ea774-9fa9-4b88-8baa-c75302acab66
      iscommand: false
      name: Defense Evasion
      type: title
      version: -1
      description: ''
    taskid: a01ea774-9fa9-4b88-8baa-c75302acab66
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": -1670,
          "y": 420
        }
      }
    continueonerrortype: ""
  '29':
    evidencedata:
      customfields: {}
      description:
        simple: Results on Tempering Activity query in Advanced Hunting feature - Microsoft Defender For Endpoint
      tags:
        simple: Tempering Action
    id: '29'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '49'
    note: false
    quietmode: 0
    scriptarguments:
      device_id:
        simple: ${inputs.DeviceID}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Detects any evidence of MDE agent/sensor manipulation.
      id: 9cdcffbf-a41a-4aa1-84be-3749d6507a06
      iscommand: true
      name: Is there an attempt to disable MS?
      script: '|||microsoft-atp-advanced-hunting-tampering'
      type: regular
      version: -1
    taskid: 9cdcffbf-a41a-4aa1-84be-3749d6507a06
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -1670,
          "y": 715
        }
      }
    continueonerrortype: ""
  '37':
    evidencedata:
      customfields: {}
      description:
        simple: Results on Local Admin query in Advanced Hunting feature - Microsoft Defender For Endpoint
      tags:
        simple: Local Admin
    id: '37'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '83'
    note: false
    quietmode: 0
    scriptarguments:
      device_id:
        simple: ${inputs.DeviceID}
      device_name:
        simple: ${inputs.DeviceName}
      query_operation:
        simple: or
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Is there evidence for privilege escalation?
      id: d586a7ba-cae8-4eb5-87f7-340c05f4880e
      iscommand: true
      name: Local Admin user was logged in?
      script: '|||microsoft-atp-advanced-hunting-privilege-escalation'
      type: regular
      version: -1
    taskid: d586a7ba-cae8-4eb5-87f7-340c05f4880e
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -780,
          "y": 715
        }
      }
    continueonerrortype: ""
  '38':
    evidencedata:
      customfields: {}
      description:
        simple: Results on Credential Dump query in Advanced Hunting feature - Microsoft Defender For Endpoint
      tags:
        simple: Credential Dump
    id: '38'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '54'
    note: false
    quietmode: 0
    scriptarguments:
      device_id:
        simple: ${inputs.DeviceID}
      device_name:
        simple: ${inputs.DeviceName}
      query_purpose:
        simple: credential_dumping
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Is there evidence of attempted lateral movement? By selecting a “query_purpose” argument, a designated query template will be used.
      id: d78da24b-058f-4a6d-8527-4c64f52fd4fb
      iscommand: true
      name: Password manipulation
      script: '|||microsoft-atp-advanced-hunting-lateral-movement-evidence'
      type: regular
      version: -1
    taskid: d78da24b-058f-4a6d-8527-4c64f52fd4fb
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -1220,
          "y": 715
        }
      }
    continueonerrortype: ""
  '40':
    id: '40'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 90714257-1b61-4033-8da6-89bc2ff4b75c
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 90714257-1b61-4033-8da6-89bc2ff4b75c
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 560,
          "y": 1280
        }
      }
    continueonerrortype: ""
  '49':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: MicrosoftATP.HuntTampering.Result
          operator: isNotEmpty
          right:
            value: {}
      label: yes
    id: '49'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '40'
      yes:
      - '50'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Any results
      id: 98aff37a-37d5-49df-8e7c-66face7cc480
      iscommand: false
      name: Any results?
      type: condition
      version: -1
    taskid: 98aff37a-37d5-49df-8e7c-66face7cc480
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": -1670,
          "y": 915
        }
      }
    continueonerrortype: ""
  '50':
    id: '50'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '40'
    note: false
    quietmode: 0
    scriptarguments:
      appendTags:
        simple: 'true'
      severity:
        simple: High
      tags:
        simple: Tempering Action
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 6a4a3f16-815d-42bb-8fb2-350acde766aa
      iscommand: true
      name: Raise the severity of the incident and add the "Tempering Action" tag.
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 6a4a3f16-815d-42bb-8fb2-350acde766aa
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -1920,
          "y": 1100
        }
      }
    continueonerrortype: ""
  '53':
    id: '53'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '40'
    note: false
    quietmode: 0
    scriptarguments:
      appendTags:
        simple: 'true'
      tags:
        simple: Credential Dump
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 34269eb1-ede9-4203-801a-33448974015c
      iscommand: true
      name: Add "Credential Dump" tag
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 34269eb1-ede9-4203-801a-33448974015c
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -1450,
          "y": 1100
        }
      }
    continueonerrortype: ""
  '54':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: MicrosoftATP.HuntLateralMovementEvidence.Result.credential_dumping
          operator: isNotEmpty
          right:
            value: {}
      label: yes
    id: '54'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '40'
      yes:
      - '53'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Any results?
      id: 22bb1d45-e100-44bc-82ee-7b203b41fda7
      iscommand: false
      name: Any results?
      type: condition
      version: -1
    taskid: 22bb1d45-e100-44bc-82ee-7b203b41fda7
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": -1220,
          "y": 915
        }
      }
    continueonerrortype: ""
  '80':
    id: '80'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '40'
    note: false
    quietmode: 0
    scriptarguments:
      DeviceID:
        complex:
          root: inputs.DeviceID
          transformers:
          - operator: uniq
      DeviceName:
        complex:
          root: inputs.DeviceName
          transformers:
          - operator: uniq
      FileMd5:
        complex:
          root: inputs.FileMd5
          transformers:
          - operator: uniq
      FileName:
        complex:
          root: inputs.FileName
          transformers:
          - operator: uniq
      FileSha1:
        complex:
          root: inputs.FileSha1
          transformers:
          - operator: uniq
      FileSha256:
        complex:
          root: inputs.FileSha256
          transformers:
          - operator: uniq
      IP:
        complex:
          root: inputs.IP
          transformers:
          - operator: uniq
    separatecontext: true
    skipunavailable: false
    task:
      brand: ''
      id: e8cd08d7-1da1-4612-86b0-b219262d8398
      iscommand: false
      name: MDE - Host Advanced Hunting For Powershell Executions
      type: playbook
      version: -1
      description: 'This playbook uses the Microsoft Defender For Endpoint Advanced Hunting feature to hunt for host PowerShell executions.'
      playbookName: MDE - Host Advanced Hunting For Powershell Executions
    taskid: e8cd08d7-1da1-4612-86b0-b219262d8398
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 560,
          "y": 505
        }
      }
    continueonerrortype: ""
  '81':
    id: '81'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '40'
    note: false
    quietmode: 0
    scriptarguments:
      DeviceID:
        complex:
          root: inputs.DeviceID
          transformers:
          - operator: uniq
      DeviceName:
        complex:
          root: inputs.DeviceName
          transformers:
          - operator: uniq
      FileName:
        complex:
          root: inputs.FileName
          transformers:
          - operator: uniq
      FileSha1:
        complex:
          root: inputs.FileSha1
          transformers:
          - operator: uniq
      FileSha256:
        complex:
          root: inputs.FileSha256
          transformers:
          - operator: uniq
      IP:
        complex:
          root: inputs.IP
          transformers:
          - operator: uniq
      FileMd5:
        complex:
          root: inputs.FileMd5
          transformers:
          - operator: uniq
    separatecontext: true
    skipunavailable: false
    task:
      brand: ''
      description: This playbook uses the Microsoft Defender For Endpoint Advanced Hunting feature to hunt for host persistence evidence.
      id: 1b17ebad-cdd4-4e5b-8c33-d009cc922a8d
      iscommand: false
      name: MDE - Host Advanced Hunting For Persistence
      type: playbook
      version: -1
      playbookName: MDE - Host Advanced Hunting For Persistence
    taskid: 1b17ebad-cdd4-4e5b-8c33-d009cc922a8d
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 130,
          "y": 505
        }
      }
    continueonerrortype: ""
  '82':
    id: '82'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '40'
    note: false
    quietmode: 0
    scriptarguments:
      DeviceID:
        complex:
          root: inputs.DeviceID
          transformers:
          - operator: uniq
      DeviceName:
        complex:
          root: inputs.DeviceName
          transformers:
          - operator: uniq
      FileMd5:
        complex:
          root: inputs.FileMd5
          transformers:
          - operator: uniq
      FileName:
        complex:
          root: inputs.FileName
          transformers:
          - operator: uniq
      FileSha1:
        complex:
          root: inputs.FileSha1
          transformers:
          - operator: uniq
      FileSha256:
        complex:
          root: inputs.FileSha256
          transformers:
          - operator: uniq
      IP:
        complex:
          root: inputs.IP
          transformers:
          - operator: uniq
    separatecontext: true
    skipunavailable: false
    task:
      brand: ''
      id: 61945bd1-c7fd-4fd6-809a-bbfcd32b2f79
      iscommand: false
      name: MDE - Host Advanced Hunting For Network Activity
      type: playbook
      version: -1
      description: 'This playbook uses the Microsoft Defender For Endpoint Advanced Hunting feature to hunt for host network activity.'
      playbookName: MDE - Host Advanced Hunting For Network Activity
    taskid: 61945bd1-c7fd-4fd6-809a-bbfcd32b2f79
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 1000,
          "y": 505
        }
      }
    continueonerrortype: ""
  '83':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: MicrosoftATP.HuntPrivilegeEscalation.Result
          operator: isNotEmpty
          right:
            value: {}
      label: yes
    id: '83'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '40'
      yes:
      - '84'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Any results?
      id: 9f356086-d122-4912-8b9d-cc8f985b8c89
      iscommand: false
      name: Any results?
      type: condition
      version: -1
    taskid: 9f356086-d122-4912-8b9d-cc8f985b8c89
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": -780,
          "y": 915
        }
      }
    continueonerrortype: ""
  '84':
    id: '84'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '40'
    note: false
    quietmode: 0
    scriptarguments:
      appendTags:
        simple: 'true'
      tags:
        simple: Local Admin
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 923a4c23-ff07-41eb-8060-1d5dfe3975e7
      iscommand: true
      name: Add "Local Admin" Tag
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 923a4c23-ff07-41eb-8060-1d5dfe3975e7
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -1000,
          "y": 1100
        }
      }
    continueonerrortype: ""
  '85':
    id: '85'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '89'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 93201884-f8ac-48db-81bb-d350f685faf3
      iscommand: false
      name: File Signature Check
      type: title
      version: -1
      description: ''
    taskid: 93201884-f8ac-48db-81bb-d350f685faf3
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": -320,
          "y": 210
        }
      }
    continueonerrortype: ""
  '86':
    evidencedata:
      customfields: {}
      description:
        simple: Results on File Information by SHA1 - Microsoft Defender For Endpoint
      tags:
        simple: File Information by SHA1
    id: '86'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '87'
    note: false
    quietmode: 0
    scriptarguments:
      hash:
        complex:
          root: inputs.FileSha1
          transformers:
          - args:
              item:
                iscontext: true
                value:
                  simple: inputs.FileSha256
            operator: append
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Retrieves file info by a file hash (Sha1 or Sha256). Note, if the given hash is not part of the results, it was not found.
      id: 07cfc5b0-5d48-4604-80c3-d1c511b3b188
      iscommand: true
      name: Gets file information.
      script: '|||microsoft-atp-get-file-info'
      type: regular
      version: -1
    taskid: 07cfc5b0-5d48-4604-80c3-d1c511b3b188
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -320,
          "y": 715
        }
      }
    continueonerrortype: ""
  '87':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: MicrosoftATP.File.Signer
          operator: isNotEmpty
          right:
            value: {}
      label: yes
    id: '87'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '40'
      yes:
      - '88'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Any digital signing info?
      id: c5c560ec-0485-4d28-8c0f-91156eeaa22b
      iscommand: false
      name: Any digital signing info?
      type: condition
      version: -1
    taskid: c5c560ec-0485-4d28-8c0f-91156eeaa22b
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": -320,
          "y": 915
        }
      }
    continueonerrortype: ""
  '88':
    id: '88'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '40'
    note: false
    quietmode: 0
    scriptarguments:
      appendTags:
        simple: 'true'
      signature:
        simple: ${MicrosoftATP.File.Signer}
      tags:
        simple: Signed File
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 09efc76c-787c-4434-826e-fa6d4445aa76
      iscommand: true
      name: Updates the "Signed File" tag and sets the signature incident field.
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 09efc76c-787c-4434-826e-fa6d4445aa76
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -90,
          "y": 1090
        }
      }
    continueonerrortype: ""
  '89':
    id: '89'
    taskid: 0a3ba1a2-67eb-4d83-8e17-962c519073d4
    type: condition
    task:
      id: 0a3ba1a2-67eb-4d83-8e17-962c519073d4
      version: -1
      name: Is there a hash?
      description: Is there a hash?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '40'
      yes:
      - '86'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.FileSha1
            iscontext: true
          right:
            value: {}
        - operator: isNotEmpty
          left:
            value:
              simple: inputs.FileSha256
            iscontext: true
    view: |-
      {
        "position": {
          "x": -320,
          "y": 505
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '90':
    id: '90'
    taskid: 87ffe3f4-08ba-45e7-8232-46393f0dfca2
    type: condition
    task:
      id: 87ffe3f4-08ba-45e7-8232-46393f0dfca2
      version: -1
      name: Check if device information was provided
      description: Check if device information was provided.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '40'
      yes:
      - '9'
      - '28'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.DeviceName
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: inputs.DeviceID
            iscontext: true
    view: |-
      {
        "position": {
          "x": -1010,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "91":
    id: "91"
    taskid: 5d0575ec-de5f-4e07-809a-7752524442c8
    type: title
    task:
      id: 5d0575ec-de5f-4e07-809a-7752524442c8
      version: -1
      name: Custom Batch Queries
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "95"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1430,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "92":
    id: "92"
    taskid: 840d2674-b2d8-459f-8bf9-631f804f0323
    type: regular
    task:
      id: 840d2674-b2d8-459f-8bf9-631f804f0323
      version: -1
      name: Run Custom Queries
      description: 'Allows you to run programmatic queries like in Microsoft Defender ATP Portal (https://securitycenter.windows.com/hunting). Limitations: You can only run a query on data from the last 30 days. The results include a maximum of 10,000 rows. The number of executions is limited (up to 15 calls per minute, 15 minutes of running time every hour and 4 hours of running time a day).'
      script: '|||microsoft-atp-advanced-hunting'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "94"
    scriptarguments:
      extend-context:
        simple: MicrosoftATP.Hunt.Result.customQueries=
      query_batch:
        complex:
          root: inputs.QueryBatch
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1430,
          "y": 715
        }
      }
    note: false
    evidencedata:
      description:
        simple: Results for the custom batch queries in Advanced Hunting feature - Microsoft Defender For Endpoint.
      tags:
        simple: Custom Queries
      customfields: {}
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "93":
    id: "93"
    taskid: 830501f5-c63f-41c3-8cea-9f34b8217078
    type: regular
    task:
      id: 830501f5-c63f-41c3-8cea-9f34b8217078
      version: -1
      name: Add "Custom Queries" Tag
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      appendTags:
        simple: "true"
      tags:
        simple: Custom Queries
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1430,
          "y": 1110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "94":
    id: "94"
    taskid: cfdda55a-4b15-4b32-80c6-801d5109c806
    type: condition
    task:
      id: cfdda55a-4b15-4b32-80c6-801d5109c806
      version: -1
      name: Any results?
      description: Any results?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "40"
      "yes":
      - "93"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: MicrosoftATP.Hunt.Result.customQueries
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1430,
          "y": 925
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "95":
    id: "95"
    taskid: ef864f21-de9b-4e97-83fc-af2f028f865a
    type: condition
    task:
      id: ef864f21-de9b-4e97-83fc-af2f028f865a
      version: -1
      name: Are there any batch queries?
      description: Are there any batch queries?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "40"
      "yes":
      - "92"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.QueryBatch
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1430,
          "y": 505
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
version: -1
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1285,
        "width": 3730,
        "x": -1920,
        "y": 60
      }
    }
  }
tests:
- Microsoft Defender Advanced Threat Protection - Test
fromversion: 6.5.0
system: true