MDE - Host Advanced Hunting

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook uses the Microsoft Defender For Endpoint Advanced Hunting feature based on the provided inputs.

Microsoft Defender for Endpoint · 32 tasks · 8 inputs · 23 outputs

Details

ID	`MDE - Host Advanced Hunting`
From Version	6.5.0
Tasks	32

README

This playbook is part of the ‘Malware Investigation And Response’ pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook uses the Microsoft Defender For Endpoint Advanced Hunting feature based on the provided inputs.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

MDE - Host Advanced Hunting For Powershell Executions
MDE - Host Advanced Hunting For Network Activity
MDE - Host Advanced Hunting For Persistence

Integrations

MicrosoftDefenderAdvancedThreatProtection

Scripts

This playbook does not use any scripts.

Commands

microsoft-atp-get-file-info
microsoft-atp-advanced-hunting-tampering
microsoft-atp-advanced-hunting-lateral-movement-evidence
microsoft-atp-advanced-hunting
setIncident
microsoft-atp-advanced-hunting-privilege-escalation

Playbook Inputs

Name	Description	Required
FileSha1	A comma-separated list of file SHA1 hashes to hunt.	Optional
FileSha256	A comma-separated list of file Sha256 hashes to hunt.	Optional
IP	A comma-separated list of IPs to hunt.	Optional
DeviceName	A comma-separated list of host names to hunt.	Optional
FileName	A comma-separated list of file names to hunt.	Optional
DeviceID	A comma-separated list of device ID to hunt.	Optional
FileMd5	A comma-separated list of file MD5 hashes to hunt.	Optional
QueryBatch	Define the custom queries you would like to run as a part of the ‘MDE - Host Advanced Hunting’ playbook. This input will be passed to the ‘query_batch’ argument in the ‘!microsoft-atp-advanced-hunting’ command. For more information and examples, check the command’s hints.	Optional

Playbook Outputs

Path	Description	Type
MicrosoftATP.HuntTampering	The query results for hunt tampering.	unknown
MicrosoftATP.HuntTampering.Result	The query results.	unknown
MicrosoftATP.HuntPrivilegeEscalation	The query results for hunt privilege escalation.	unknown
MicrosoftATP.HuntPrivilegeEscalation.Result	The query results.	unknown
MicrosoftATP.HuntLateralMovementEvidence.Result	The query results for hunt lateral movement evidence.	unknown
MicrosoftATP.HuntLateralMovementEvidence.Result.network_connections	Query results from the Microsoft Defender For Endpoint Advanced Hunting on network connections.	unknown
MicrosoftATP.HuntLateralMovementEvidence.Result.smb_connections	Query Results from the Microsoft Defender For Endpoint Advanced Hunting on SMB connections.	unknown
MicrosoftATP.HuntLateralMovementEvidence.Result.credential_dumping	Query results from the Microsoft Defender For Endpoint Advanced Hunting on credential dumping.	unknown
MicrosoftATP.HuntLateralMovementEvidence.Result.management_connection	Query results from the Microsoft Defender For Endpoint Advanced Hunting on management connections.	unknown
MicrosoftATP.HuntPersistenceEvidence	Query results from the Microsoft Defender For Endpoint Advanced Hunting for hunt lateral movement evidence.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result	Query results from the Microsoft Defender For Endpoint Advanced Hunting for hunt persistence evidence.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.scheduled_job	Query results from the Microsoft Defender For Endpoint Advanced Hunting for scheduled jobs.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.registry_entry	Query results from the Microsoft Defender For Endpoint Advanced Hunting for registry entries.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.startup_folder_changes	Query results from the Microsoft Defender For Endpoint Advanced Hunting for startup folder changes.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.new_service_created	Query results from the Microsoft Defender For Endpoint Advanced Hunting for created new services.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.service_updated	Query results from the Microsoft Defender For Endpoint Advanced Hunting for updated services.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.file_replaced	Query results from the Microsoft Defender For Endpoint Advanced Hunting for replaced files.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.new_user	Query results from the Microsoft Defender For Endpoint Advanced Hunting for new users.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.new_group	Query results from the Microsoft Defender For Endpoint Advanced Hunting for new groups.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.group_user_change	Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in group users.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.local_firewall_change	Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in the local firewall.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.host_file_change	Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in the host file.	unknown
MicrosoftATP.File	File information from Microsoft ATP.	unknown

Playbook Image

MDE - Host Advanced Hunting

Inputs

FileSha1 — A comma-separated list of file SHA1 hashes to hunt.
FileSha256 — A comma-separated list of file Sha256 hashes to hunt.
IP — A comma-separated list of IPs to hunt.
DeviceName — A comma-separated list of host names to hunt.
FileName — A comma-separated list of file names to hunt.
DeviceID — A comma-separated list of device ID to hunt.
FileMd5 — A comma-separated list of file MD5 hashes to hunt.
QueryBatch — Define the custom queries you would like to run as a part of the 'MDE - Host Advanced Hunting' playbook. This input will be passed to the 'query_batch' argument in the '!microsoft-atp-advanced-hunting' command. For more information and examples, check the command's hints.

Outputs

MicrosoftATP.HuntTampering — The query results for hunt tampering.
MicrosoftATP.HuntTampering.Result — The query results.
MicrosoftATP.HuntPrivilegeEscalation — The query results for hunt privilege escalation.
MicrosoftATP.HuntPrivilegeEscalation.Result — The query results.
MicrosoftATP.HuntLateralMovementEvidence.Result — The query results for hunt lateral movement evidence.
MicrosoftATP.HuntLateralMovementEvidence.Result.network_connections — Query results from the Microsoft Defender For Endpoint Advanced Hunting on network connections.
MicrosoftATP.HuntLateralMovementEvidence.Result.smb_connections — Query Results from the Microsoft Defender For Endpoint Advanced Hunting on SMB connections.
MicrosoftATP.HuntLateralMovementEvidence.Result.credential_dumping — Query results from the Microsoft Defender For Endpoint Advanced Hunting on credential dumping.
MicrosoftATP.HuntLateralMovementEvidence.Result.management_connection — Query results from the Microsoft Defender For Endpoint Advanced Hunting on management connections.
MicrosoftATP.HuntPersistenceEvidence — Query results from the Microsoft Defender For Endpoint Advanced Hunting for hunt lateral movement evidence.
MicrosoftATP.HuntPersistenceEvidence.Result — Query results from the Microsoft Defender For Endpoint Advanced Hunting for hunt persistence evidence.
MicrosoftATP.HuntPersistenceEvidence.Result.scheduled_job — Query results from the Microsoft Defender For Endpoint Advanced Hunting for scheduled jobs.
MicrosoftATP.HuntPersistenceEvidence.Result.registry_entry — Query results from the Microsoft Defender For Endpoint Advanced Hunting for registry entries.
MicrosoftATP.HuntPersistenceEvidence.Result.startup_folder_changes — Query results from the Microsoft Defender For Endpoint Advanced Hunting for startup folder changes.
MicrosoftATP.HuntPersistenceEvidence.Result.new_service_created — Query results from the Microsoft Defender For Endpoint Advanced Hunting for created new services.
MicrosoftATP.HuntPersistenceEvidence.Result.service_updated — Query results from the Microsoft Defender For Endpoint Advanced Hunting for updated services.
MicrosoftATP.HuntPersistenceEvidence.Result.file_replaced — Query results from the Microsoft Defender For Endpoint Advanced Hunting for replaced files.
MicrosoftATP.HuntPersistenceEvidence.Result.new_user — Query results from the Microsoft Defender For Endpoint Advanced Hunting for new users.
MicrosoftATP.HuntPersistenceEvidence.Result.new_group — Query results from the Microsoft Defender For Endpoint Advanced Hunting for new groups.
MicrosoftATP.HuntPersistenceEvidence.Result.group_user_change — Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in group users.
MicrosoftATP.HuntPersistenceEvidence.Result.local_firewall_change — Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in the local firewall.
MicrosoftATP.HuntPersistenceEvidence.Result.host_file_change — Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in the host file.
MicrosoftATP.File — File information from Microsoft ATP.

Commands used

microsoft-atp-advanced-hunting microsoft-atp-advanced-hunting-lateral-movement-evidence microsoft-atp-advanced-hunting-privilege-escalation microsoft-atp-advanced-hunting-tampering microsoft-atp-get-file-info setIncident

Flowchart

Source

playbook-MDE_-_Host_Advanced_Hunting.yml playbook-MDE_-_Host_Advanced_Hunting_For_Network_Activity.yml playbook-MDE_-_Host_Advanced_Hunting_For_Network_Activity_README.md playbook-MDE_-_Host_Advanced_Hunting_For_Persistence.yml playbook-MDE_-_Host_Advanced_Hunting_For_Persistence_README.md playbook-MDE_-_Host_Advanced_Hunting_For_Powershell_Executions.yml playbook-MDE_-_Host_Advanced_Hunting_For_Powershell_Executions_README.md

Download History Raw

contentitemexportablefields:
  contentitemfields: {}
description: |-
  This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
  This playbook uses the Microsoft Defender For Endpoint Advanced Hunting feature to hunt for host persistence evidence.
id: MDE - Host Advanced Hunting For Persistence
inputs:
- description: A comma-separated list of file SHA256 hashes to hunt.
  key: FileSha256
  playbookInputQuery:
  required: false
  value:
    complex:
      accessor: filesha256
      root: incident
      transformers:
      - operator: uniq
- description: A comma-separated list of host names to hunt.
  key: DeviceName
  playbookInputQuery:
  required: false
  value:
    complex:
      accessor: hostnames
      root: incident
      transformers:
      - operator: uniq
- description: A comma-separated list of file names to hunt.
  key: FileName
  playbookInputQuery:
  required: false
  value:
    complex:
      accessor: filenames
      root: incident
      transformers:
      - operator: uniq
- description: A comma-separated list of a device IDs to hunt.
  key: DeviceID
  playbookInputQuery:
  required: false
  value:
    complex:
      accessor: agentsid
      root: incident
      transformers:
      - operator: uniq
name: MDE - Host Advanced Hunting For Persistence
outputs:
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result
  description: The query results for Hunt Persistence Evidence.
  type: unknown
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.scheduled_job
  description: The query results for scheduled_job query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.registry_entry
  description: The query results for registry_entry query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.startup_folder_changes
  description: The query results for startup_folder_changes query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.new_service_created
  description: The query results for new_service_created query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.service_updated
  description: The query results for service_updated query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.file_replaced
  description: The query results for file_replaced query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.new_user
  description: The query results for new_user query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.new_group
  description: The query results for new_group query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.group_user_change
  description: The query results for group_user_change query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.local_firewall_change
  description: The query results for local_firewall_change query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.host_file_change
  description: The query results for host_file_change query_purpose.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '7'
      - '35'
      - '38'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 24940e01-e9da-47ee-822a-5cd70d3072d3
      iscommand: false
      name: ''
      version: -1
      description: ''
    taskid: 24940e01-e9da-47ee-822a-5cd70d3072d3
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": -150,
          "y": 410
        }
      }
  '1':
    id: '1'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '3'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: d24e08b0-bd1d-4306-82e4-db6d1df8c714
      iscommand: false
      name: Scheduled Tasks
      type: title
      version: -1
      description: ''
    taskid: d24e08b0-bd1d-4306-82e4-db6d1df8c714
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": -1250,
          "y": 760
        }
      }
  '2':
    id: '2'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '11'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 83a60811-47a6-4387-894a-4563b6f0c1a4
      iscommand: false
      name: Registry modification
      type: title
      version: -1
      description: ''
    taskid: 83a60811-47a6-4387-894a-4563b6f0c1a4
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": -390,
          "y": 760
        }
      }
  '3':
    evidencedata:
      customfields: {}
      description:
        simple: Checking if there were any created scheduled tasks on the investigated device - Microsoft Defender For Endpoint
      tags:
        simple: Created Scheduled Tasks
    id: '3'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '32'
    note: false
    quietmode: 0
    scriptarguments:
      device_id:
        simple: ${inputs.DeviceID}
      query_operation:
        simple: and
      query_purpose:
        simple: scheduled_job
      sha256:
        simple: ${inputs.FileSha256}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Is there evidence of persistence? By selecting a “query_purpose” argument, a designated query template will be used.
      id: e3374fdd-88b7-402c-8be2-73812e2b0178
      iscommand: true
      name: Is the file created any Scheduled Tasks?
      script: '|||microsoft-atp-advanced-hunting-persistence-evidence'
      type: regular
      version: -1
    taskid: e3374fdd-88b7-402c-8be2-73812e2b0178
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -1250,
          "y": 895
        }
      }
  '4':
    evidencedata:
      customfields: {}
      description:
        simple: Results on Startup User Creation query in Advanced Hunting feature - Microsoft Defender For Endpoint
      tags:
        simple: User Creation
    id: '4'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '23'
    note: false
    quietmode: 0
    scriptarguments:
      device_id:
        simple: ${inputs.DeviceID}
      device_name:
        simple: ${inputs.DeviceName}
      query_purpose:
        simple: new_user
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Is there evidence of persistence? By selecting a “query_purpose” argument, a designated query template will be used.
      id: bcc66ee2-d143-45af-8926-1d49b3de1ec7
      iscommand: true
      name: A new user was created on the system?
      script: '|||microsoft-atp-advanced-hunting-persistence-evidence'
      type: regular
      version: -1
    taskid: bcc66ee2-d143-45af-8926-1d49b3de1ec7
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 510,
          "y": 895
        }
      }
  '5':
    evidencedata:
      customfields: {}
      description:
        simple: Results on User's Group Modification query in Advanced Hunting feature - Microsoft Defender For Endpoint
      tags:
        simple: User's Group Modification
    id: '5'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '12'
    note: false
    quietmode: 0
    scriptarguments:
      device_id:
        simple: ${inputs.DeviceID}
      device_name:
        simple: ${inputs.DeviceName}
      query_purpose:
        simple: group_user_change
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Is there evidence of persistence? By selecting a “query_purpose” argument, a designated query template will be used.
      id: 47877086-f011-47bb-89c9-b383dd13552b
      iscommand: true
      name: Object (User or Group) Was Added To A Group?
      script: '|||microsoft-atp-advanced-hunting-persistence-evidence'
      type: regular
      version: -1
    taskid: 47877086-f011-47bb-89c9-b383dd13552b
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 80,
          "y": 895
        }
      }
  '6':
    evidencedata:
      customfields: {}
      description:
        simple: Results on Local Group Creation query in Advanced Hunting feature - Microsoft Defender For Endpoint
      tags:
        simple: Local Group Creation
    id: '6'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '20'
    note: false
    quietmode: 0
    scriptarguments:
      device_id:
        simple: ${inputs.DeviceID}
      device_name:
        simple: ${inputs.DeviceName}
      query_purpose:
        simple: new_group
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Is there evidence of persistence? By selecting a “query_purpose” argument, a designated query template will be used.
      id: 480d3d03-048b-4d46-8981-f11ded805547
      iscommand: true
      name: Local Group Was Created?
      script: '|||microsoft-atp-advanced-hunting-persistence-evidence'
      type: regular
      version: -1
    taskid: 480d3d03-048b-4d46-8981-f11ded805547
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 940,
          "y": 895
        }
      }
  '7':
    id: '7'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '36'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: a41e366f-9ae5-46cb-89ae-c76c8ed01786
      iscommand: false
      name: New/Exisiting Users
      type: title
      version: -1
      description: ''
    taskid: a41e366f-9ae5-46cb-89ae-c76c8ed01786
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 510,
          "y": 560
        }
      }
  '9':
    id: '9'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '10'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 864d7d3c-6440-4865-8796-b000321b3be2
      iscommand: false
      name: Startup Folder
      type: title
      version: -1
      description: ''
    taskid: 864d7d3c-6440-4865-8796-b000321b3be2
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": -810,
          "y": 760
        }
      }
  '10':
    evidencedata:
      customfields: {}
      description:
        simple: Results on Startup Folder Modification query in Advanced Hunting feature - Microsoft Defender For Endpoint
      tags:
        simple: Startup Folder Modification
    id: '10'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '29'
    note: false
    quietmode: 0
    scriptarguments:
      device_id:
        simple: ${inputs.DeviceID}
      query_operation:
        simple: and
      query_purpose:
        simple: startup_folder_changes
      sha256:
        simple: ${inputs.FileSha256}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Is there evidence of persistence? By selecting a “query_purpose” argument, a designated query template will be used.
      id: 316e0b7f-9a15-41c6-8da9-e4ba6f269a9b
      iscommand: true
      name: Startup Folder Modification
      script: '|||microsoft-atp-advanced-hunting-persistence-evidence'
      type: regular
      version: -1
    taskid: 316e0b7f-9a15-41c6-8da9-e4ba6f269a9b
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -810,
          "y": 895
        }
      }
  '11':
    evidencedata:
      customfields: {}
      description:
        simple: Checking if there any registry modifications on the investigated device - Microsoft Defender For Endpoint
      tags:
        simple: Registry Modification
    id: '11'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '26'
    note: false
    quietmode: 0
    scriptarguments:
      device_id:
        simple: ${inputs.DeviceID}
      process_cmd:
        simple: ${inputs.FileName}
      query_operation:
        simple: and
      query_purpose:
        simple: registry_entry
      sha256:
        simple: ${inputs.FileSha256}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Is there evidence of persistence? By selecting a “query_purpose” argument, a designated query template will be used.
      id: 3df4ea06-4253-4ff6-89f6-b8dbd2c3343a
      iscommand: true
      name: 'Check If Any Registry Values Were Modified '
      script: '|||microsoft-atp-advanced-hunting-persistence-evidence'
      type: regular
      version: -1
    taskid: 3df4ea06-4253-4ff6-89f6-b8dbd2c3343a
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -390,
          "y": 895
        }
      }
  '12':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: MicrosoftATP.HuntPersistenceEvidence.Result.group_user_change
          operator: isNotEmpty
          right:
            value: {}
      label: yes
    id: '12'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '18'
      yes:
      - '13'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Any results?
      id: 4fc1e709-e62d-4d32-8511-0407c5d72f97
      iscommand: false
      name: Any results?
      type: condition
      version: -1
    taskid: 4fc1e709-e62d-4d32-8511-0407c5d72f97
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 80,
          "y": 1060
        }
      }
  '13':
    id: '13'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '18'
    note: false
    quietmode: 0
    scriptarguments:
      appendTags:
        simple: 'true'
      severity:
        simple: High
      tags:
        simple: User's Group Modification
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: d1edae94-6a1d-494c-869a-42275e68ad4a
      iscommand: true
      name: Add 'User's Group Modification' Tag And Set Severity to High
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: d1edae94-6a1d-494c-869a-42275e68ad4a
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 290,
          "y": 1240
        }
      }
  '18':
    id: '18'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: b3a3d8fc-b4a7-4454-8d71-11949c98c554
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: b3a3d8fc-b4a7-4454-8d71-11949c98c554
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 80,
          "y": 1430
        }
      }
  '20':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: MicrosoftATP.HuntPersistenceEvidence.Result.new_group
          operator: isNotEmpty
          right:
            value: {}
      label: yes
    id: '20'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '22'
      yes:
      - '21'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Any results?
      id: 25bf6692-ea9e-4694-865a-34eb7d2f885a
      iscommand: false
      name: Any results?
      type: condition
      version: -1
    taskid: 25bf6692-ea9e-4694-865a-34eb7d2f885a
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 940,
          "y": 1060
        }
      }
  '21':
    id: '21'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '22'
    note: false
    quietmode: 0
    scriptarguments:
      appendTags:
        simple: 'true'
      severity:
        simple: High
      tags:
        simple: Local Group Creation
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 0a2941cf-dbaf-460a-83b3-dbb42cca5179
      iscommand: true
      name: Add 'Local Group Creation' Tag And Set Severity to High
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 0a2941cf-dbaf-460a-83b3-dbb42cca5179
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1150,
          "y": 1240
        }
      }
  '22':
    id: '22'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: cd98dfd1-bf9a-4b09-8365-1c3e81fc585b
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: cd98dfd1-bf9a-4b09-8365-1c3e81fc585b
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 940,
          "y": 1430
        }
      }
  '23':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: MicrosoftATP.HuntPersistenceEvidence.Result.new_user
          operator: isNotEmpty
          right:
            value: {}
      label: yes
    id: '23'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '25'
      yes:
      - '24'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Any results?
      id: c7909e61-e6e8-40e1-830b-39a15b154fd0
      iscommand: false
      name: Any results?
      type: condition
      version: -1
    taskid: c7909e61-e6e8-40e1-830b-39a15b154fd0
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 510,
          "y": 1060
        }
      }
  '24':
    id: '24'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '25'
    note: false
    quietmode: 0
    scriptarguments:
      appendTags:
        simple: 'true'
      severity:
        simple: High
      tags:
        simple: User Creation
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: ccc605cc-19c7-4b6b-8955-854fb89b619e
      iscommand: true
      name: Add 'User Creation' Tag And Set Severity to High
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: ccc605cc-19c7-4b6b-8955-854fb89b619e
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 720,
          "y": 1240
        }
      }
  '25':
    id: '25'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: a15f7a25-eb71-4521-89f2-ff0185283d85
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: a15f7a25-eb71-4521-89f2-ff0185283d85
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 510,
          "y": 1430
        }
      }
  '26':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: MicrosoftATP.HuntPersistenceEvidence.Result.registry_entry
          operator: isNotEmpty
          right:
            value: {}
      label: yes
    id: '26'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '28'
      yes:
      - '27'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Any results?
      id: c78f32fc-6e71-460f-8efa-0b5ae87a3d0e
      iscommand: false
      name: Any results?
      type: condition
      version: -1
    taskid: c78f32fc-6e71-460f-8efa-0b5ae87a3d0e
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": -390,
          "y": 1060
        }
      }
  '27':
    id: '27'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '28'
    note: false
    quietmode: 0
    scriptarguments:
      appendTags:
        simple: 'true'
      severity:
        simple: High
      tags:
        simple: Registry Modification
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 7a846c10-e815-41fe-8c96-9ed18e8ae64d
      iscommand: true
      name: Add 'Registry Modification' Tag And Set Severity to High
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 7a846c10-e815-41fe-8c96-9ed18e8ae64d
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -600,
          "y": 1240
        }
      }
  '28':
    id: '28'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: de2ba71f-e4a7-434d-8de2-62299f069fb5
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: de2ba71f-e4a7-434d-8de2-62299f069fb5
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": -400,
          "y": 1430
        }
      }
  '29':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: MicrosoftATP.HuntPersistenceEvidence.Result.startup_folder_changes
          operator: isNotEmpty
          right:
            value: {}
      label: yes
    id: '29'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '31'
      yes:
      - '30'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Any results?
      id: 1d39a97c-b11e-4e1c-8599-67446bba05ce
      iscommand: false
      name: Any results?
      type: condition
      version: -1
    taskid: 1d39a97c-b11e-4e1c-8599-67446bba05ce
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": -810,
          "y": 1060
        }
      }
  '30':
    id: '30'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '31'
    note: false
    quietmode: 0
    scriptarguments:
      appendTags:
        simple: 'true'
      severity:
        simple: High
      tags:
        simple: Startup Folder Modification
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: a0439dcc-c0db-4002-882b-55591f836f82
      iscommand: true
      name: Add 'Startup Folder Modification' Tag And Set Severity to High
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: a0439dcc-c0db-4002-882b-55591f836f82
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -1030,
          "y": 1240
        }
      }
  '31':
    id: '31'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: fa542469-cf3c-4d5d-81f7-60522c4b0e68
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: fa542469-cf3c-4d5d-81f7-60522c4b0e68
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": -810,
          "y": 1430
        }
      }
  '32':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: MicrosoftATP.HuntPersistenceEvidence.Result.scheduled_job
          operator: isNotEmpty
          right:
            value: {}
      label: yes
    id: '32'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '34'
      yes:
      - '33'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Any results?
      id: c944b0db-041c-4401-8757-c215fbc3454f
      iscommand: false
      name: Any results?
      type: condition
      version: -1
    taskid: c944b0db-041c-4401-8757-c215fbc3454f
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": -1250,
          "y": 1060
        }
      }
  '33':
    id: '33'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '34'
    note: false
    quietmode: 0
    scriptarguments:
      appendTags:
        simple: 'true'
      severity:
        simple: High
      tags:
        simple: Created Scheduled Tasks
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: bf9ecc1a-6f23-4d08-8998-7f2a35c6817d
      iscommand: true
      name: Add 'Created Scheduled Tasks' Tag And Set Severity to High
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: bf9ecc1a-6f23-4d08-8998-7f2a35c6817d
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -1470,
          "y": 1240
        }
      }
  '34':
    id: '34'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 35bbe118-5033-432b-81e8-ae3127a0354f
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 35bbe118-5033-432b-81e8-ae3127a0354f
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": -1250,
          "y": 1430
        }
      }
  '35':
    id: '35'
    taskid: 8f574f0b-2536-4e7f-8774-d47638a31a18
    type: condition
    task:
      id: 8f574f0b-2536-4e7f-8774-d47638a31a18
      version: -1
      name: Are DeviceID and FileSha256 provided?
      description: Are DeviceID and FileName provided?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '37'
      yes:
      - '1'
      - '9'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.FileSha256
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.DeviceID
            iscontext: true
    view: |-
      {
        "position": {
          "x": -1030,
          "y": 560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '36':
    id: '36'
    taskid: bbb0d25f-0066-44d1-8681-750b44b27537
    type: condition
    task:
      id: bbb0d25f-0066-44d1-8681-750b44b27537
      version: -1
      name: Check if device information was provided
      description: Check if device information was provided
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '37'
      yes:
      - '5'
      - '4'
      - '6'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.DeviceName
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: inputs.DeviceID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 510,
          "y": 705
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '37':
    id: '37'
    taskid: 39ba3590-03ff-438b-8c0c-89fedafcea4e
    type: title
    task:
      id: 39ba3590-03ff-438b-8c0c-89fedafcea4e
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -150,
          "y": 1550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '38':
    id: '38'
    taskid: a961402d-d334-4d17-8051-01b0d961b593
    type: condition
    task:
      id: a961402d-d334-4d17-8051-01b0d961b593
      version: -1
      name: Are DeviceID,FileName and FileSha256 provided?
      description: Are DeviceID and FileName provided?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '37'
      yes:
      - '2'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.FileSha256
            iscontext: true
          right:
            value: {}
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.DeviceID
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.FileName
            iscontext: true
    view: |-
      {
        "position": {
          "x": -280,
          "y": 560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
version: -1
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1205,
        "width": 3000,
        "x": -1470,
        "y": 410
      }
    }
  }
tests:
- No tests (auto formatted)
fromversion: 6.5.0
system: true