MDE - Host Advanced Hunting

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook uses the Microsoft Defender For Endpoint Advanced Hunting feature based on the provided inputs.

Microsoft Defender for Endpoint · 32 tasks · 8 inputs · 23 outputs

Details

IDMDE - Host Advanced Hunting
From Version6.5.0
Tasks32

README

This playbook is part of the ‘Malware Investigation And Response’ pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook uses the Microsoft Defender For Endpoint Advanced Hunting feature based on the provided inputs.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • MDE - Host Advanced Hunting For Powershell Executions
  • MDE - Host Advanced Hunting For Network Activity
  • MDE - Host Advanced Hunting For Persistence

Integrations

  • MicrosoftDefenderAdvancedThreatProtection

Scripts

This playbook does not use any scripts.

Commands

  • microsoft-atp-get-file-info
  • microsoft-atp-advanced-hunting-tampering
  • microsoft-atp-advanced-hunting-lateral-movement-evidence
  • microsoft-atp-advanced-hunting
  • setIncident
  • microsoft-atp-advanced-hunting-privilege-escalation

Playbook Inputs

Name Description Default Value Required
FileSha1 A comma-separated list of file SHA1 hashes to hunt.   Optional
FileSha256 A comma-separated list of file Sha256 hashes to hunt.   Optional
IP A comma-separated list of IPs to hunt.   Optional
DeviceName A comma-separated list of host names to hunt.   Optional
FileName A comma-separated list of file names to hunt.   Optional
DeviceID A comma-separated list of device ID to hunt.   Optional
FileMd5 A comma-separated list of file MD5 hashes to hunt.   Optional
QueryBatch Define the custom queries you would like to run as a part of the ‘MDE - Host Advanced Hunting’ playbook. This input will be passed to the ‘query_batch’ argument in the ‘!microsoft-atp-advanced-hunting’ command. For more information and examples, check the command’s hints.   Optional

Playbook Outputs

Path Description Type
MicrosoftATP.HuntTampering The query results for hunt tampering. unknown
MicrosoftATP.HuntTampering.Result The query results. unknown
MicrosoftATP.HuntPrivilegeEscalation The query results for hunt privilege escalation. unknown
MicrosoftATP.HuntPrivilegeEscalation.Result The query results. unknown
MicrosoftATP.HuntLateralMovementEvidence.Result The query results for hunt lateral movement evidence. unknown
MicrosoftATP.HuntLateralMovementEvidence.Result.network_connections Query results from the Microsoft Defender For Endpoint Advanced Hunting on network connections. unknown
MicrosoftATP.HuntLateralMovementEvidence.Result.smb_connections Query Results from the Microsoft Defender For Endpoint Advanced Hunting on SMB connections. unknown
MicrosoftATP.HuntLateralMovementEvidence.Result.credential_dumping Query results from the Microsoft Defender For Endpoint Advanced Hunting on credential dumping. unknown
MicrosoftATP.HuntLateralMovementEvidence.Result.management_connection Query results from the Microsoft Defender For Endpoint Advanced Hunting on management connections. unknown
MicrosoftATP.HuntPersistenceEvidence Query results from the Microsoft Defender For Endpoint Advanced Hunting for hunt lateral movement evidence. unknown
MicrosoftATP.HuntPersistenceEvidence.Result Query results from the Microsoft Defender For Endpoint Advanced Hunting for hunt persistence evidence. unknown
MicrosoftATP.HuntPersistenceEvidence.Result.scheduled_job Query results from the Microsoft Defender For Endpoint Advanced Hunting for scheduled jobs. unknown
MicrosoftATP.HuntPersistenceEvidence.Result.registry_entry Query results from the Microsoft Defender For Endpoint Advanced Hunting for registry entries. unknown
MicrosoftATP.HuntPersistenceEvidence.Result.startup_folder_changes Query results from the Microsoft Defender For Endpoint Advanced Hunting for startup folder changes. unknown
MicrosoftATP.HuntPersistenceEvidence.Result.new_service_created Query results from the Microsoft Defender For Endpoint Advanced Hunting for created new services. unknown
MicrosoftATP.HuntPersistenceEvidence.Result.service_updated Query results from the Microsoft Defender For Endpoint Advanced Hunting for updated services. unknown
MicrosoftATP.HuntPersistenceEvidence.Result.file_replaced Query results from the Microsoft Defender For Endpoint Advanced Hunting for replaced files. unknown
MicrosoftATP.HuntPersistenceEvidence.Result.new_user Query results from the Microsoft Defender For Endpoint Advanced Hunting for new users. unknown
MicrosoftATP.HuntPersistenceEvidence.Result.new_group Query results from the Microsoft Defender For Endpoint Advanced Hunting for new groups. unknown
MicrosoftATP.HuntPersistenceEvidence.Result.group_user_change Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in group users. unknown
MicrosoftATP.HuntPersistenceEvidence.Result.local_firewall_change Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in the local firewall. unknown
MicrosoftATP.HuntPersistenceEvidence.Result.host_file_change Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in the host file. unknown
MicrosoftATP.File File information from Microsoft ATP. unknown

Playbook Image

MDE - Host Advanced Hunting

Inputs

  • FileSha1 — A comma-separated list of file SHA1 hashes to hunt.
  • FileSha256 — A comma-separated list of file Sha256 hashes to hunt.
  • IP — A comma-separated list of IPs to hunt.
  • DeviceName — A comma-separated list of host names to hunt.
  • FileName — A comma-separated list of file names to hunt.
  • DeviceID — A comma-separated list of device ID to hunt.
  • FileMd5 — A comma-separated list of file MD5 hashes to hunt.
  • QueryBatch — Define the custom queries you would like to run as a part of the 'MDE - Host Advanced Hunting' playbook. This input will be passed to the 'query_batch' argument in the '!microsoft-atp-advanced-hunting' command. For more information and examples, check the command's hints.

Outputs

  • MicrosoftATP.HuntTampering — The query results for hunt tampering.
  • MicrosoftATP.HuntTampering.Result — The query results.
  • MicrosoftATP.HuntPrivilegeEscalation — The query results for hunt privilege escalation.
  • MicrosoftATP.HuntPrivilegeEscalation.Result — The query results.
  • MicrosoftATP.HuntLateralMovementEvidence.Result — The query results for hunt lateral movement evidence.
  • MicrosoftATP.HuntLateralMovementEvidence.Result.network_connections — Query results from the Microsoft Defender For Endpoint Advanced Hunting on network connections.
  • MicrosoftATP.HuntLateralMovementEvidence.Result.smb_connections — Query Results from the Microsoft Defender For Endpoint Advanced Hunting on SMB connections.
  • MicrosoftATP.HuntLateralMovementEvidence.Result.credential_dumping — Query results from the Microsoft Defender For Endpoint Advanced Hunting on credential dumping.
  • MicrosoftATP.HuntLateralMovementEvidence.Result.management_connection — Query results from the Microsoft Defender For Endpoint Advanced Hunting on management connections.
  • MicrosoftATP.HuntPersistenceEvidence — Query results from the Microsoft Defender For Endpoint Advanced Hunting for hunt lateral movement evidence.
  • MicrosoftATP.HuntPersistenceEvidence.Result — Query results from the Microsoft Defender For Endpoint Advanced Hunting for hunt persistence evidence.
  • MicrosoftATP.HuntPersistenceEvidence.Result.scheduled_job — Query results from the Microsoft Defender For Endpoint Advanced Hunting for scheduled jobs.
  • MicrosoftATP.HuntPersistenceEvidence.Result.registry_entry — Query results from the Microsoft Defender For Endpoint Advanced Hunting for registry entries.
  • MicrosoftATP.HuntPersistenceEvidence.Result.startup_folder_changes — Query results from the Microsoft Defender For Endpoint Advanced Hunting for startup folder changes.
  • MicrosoftATP.HuntPersistenceEvidence.Result.new_service_created — Query results from the Microsoft Defender For Endpoint Advanced Hunting for created new services.
  • MicrosoftATP.HuntPersistenceEvidence.Result.service_updated — Query results from the Microsoft Defender For Endpoint Advanced Hunting for updated services.
  • MicrosoftATP.HuntPersistenceEvidence.Result.file_replaced — Query results from the Microsoft Defender For Endpoint Advanced Hunting for replaced files.
  • MicrosoftATP.HuntPersistenceEvidence.Result.new_user — Query results from the Microsoft Defender For Endpoint Advanced Hunting for new users.
  • MicrosoftATP.HuntPersistenceEvidence.Result.new_group — Query results from the Microsoft Defender For Endpoint Advanced Hunting for new groups.
  • MicrosoftATP.HuntPersistenceEvidence.Result.group_user_change — Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in group users.
  • MicrosoftATP.HuntPersistenceEvidence.Result.local_firewall_change — Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in the local firewall.
  • MicrosoftATP.HuntPersistenceEvidence.Result.host_file_change — Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in the host file.
  • MicrosoftATP.File — File information from Microsoft ATP.

Commands used

microsoft-atp-advanced-hunting microsoft-atp-advanced-hunting-lateral-movement-evidence microsoft-atp-advanced-hunting-privilege-escalation microsoft-atp-advanced-hunting-tampering microsoft-atp-get-file-info setIncident

Flowchart

true true true true true true true yes yes Start Start Network Activity Network Activity Privilege Escalation Privilege Escalation PowerShell Analysis PowerShell Analysis Persistence Persistence Mimikatz/Other Lsaas manipulation Mimikatz/Other Lsaas mani... Is the Local Admin Signed to the Device? Is the Local Admin Signed... Defense Evasion Defense Evasion Is there an attempt to disable MS? - microsoft-atp-advanced-hunting-tampering Is there an attempt to di... microsoft-atp-advanced-huntin... Local Admin user was logged in? - microsoft-atp-advanced-hunting-privilege-escalation Local Admin user was logg... microsoft-atp-advanced-huntin... Password manipulation - microsoft-atp-advanced-hunting-lateral-movement-evidence Password manipulation microsoft-atp-advanced-huntin... Done Done Any results? Any results? Raise the severity of the incident and add the "Tempering Action" tag. - setIncident Raise the severity of the... setIncident Add "Credential Dump" tag - setIncident Add "Credential Dump" tag setIncident Any results? Any results? MDE - Host Advanced Hunting For Powershell Executions - MDE - Host Advanced Hunting For Powershell Executions MDE - Host Advanced Hunti... MDE - Host Advanced Hunting F... MDE - Host Advanced Hunting For Persistence - MDE - Host Advanced Hunting For Persistence MDE - Host Advanced Hunti... MDE - Host Advanced Hunting F... MDE - Host Advanced Hunting For Network Activity - MDE - Host Advanced Hunting For Network Activity MDE - Host Advanced Hunti... MDE - Host Advanced Hunting F... Any results? Any results? Add "Local Admin" Tag - setIncident Add "Local Admin" Tag setIncident File Signature Check File Signature Check Gets file information. - microsoft-atp-get-file-info Gets file information. microsoft-atp-get-file-info Any digital signing info? Any digital signing info? Updates the "Signed File" tag and sets the signature incident field. - setIncident Updates the "Signed File"... setIncident Is there a hash? Is there a hash? Check if device information was provided Check if device informati... Custom Batch Queries Custom Batch Queries Run Custom Queries - microsoft-atp-advanced-hunting Run Custom Queries microsoft-atp-advanced-hunting Add "Custom Queries" Tag - setIncident Add "Custom Queries" Tag setIncident Any results? Any results? Are there any batch queries? Are there any batch queries?

Source

playbook-MDE_-_Host_Advanced_Hunting.yml playbook-MDE_-_Host_Advanced_Hunting_For_Network_Activity.yml playbook-MDE_-_Host_Advanced_Hunting_For_Network_Activity_README.md playbook-MDE_-_Host_Advanced_Hunting_For_Persistence.yml playbook-MDE_-_Host_Advanced_Hunting_For_Persistence_README.md playbook-MDE_-_Host_Advanced_Hunting_For_Powershell_Executions.yml playbook-MDE_-_Host_Advanced_Hunting_For_Powershell_Executions_README.md
Download History Raw 
This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook uses the Microsoft Defender For Endpoint Advanced Hunting feature to hunt for host PowerShell executions.

## Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks
* Command-Line Analysis

### Integrations
* MicrosoftDefenderAdvancedThreatProtection

### Scripts
This playbook does not use any scripts.

### Commands
* microsoft-atp-advanced-hunting-process-details
* microsoft-atp-advanced-hunting-network-connections
* microsoft-atp-get-file-related-machines
* setIncident

## Playbook Inputs
---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| DeviceName | A comma-separated list of host names to hunt. | incident.hostnames | Optional |
| FileName | A comma-separated list of file names to hunt. | incident.filenames | Optional |
| DeviceID | A comma-separated list of device IDs to hunt. | incident.agentsid | Optional |
| FileMd5 | A comma-separated list of file MD5 hashes to hunt. | incident.filemd5 | Optional |
| FileSha256 | A comma-separated list of file SHA256 hashes to hunt. | incident.filesha256 | Optional |
| FileSha1 | A comma-separated list of file SHA1 hashes to hunt. | incident.filesha1 | Optional |

## Playbook Outputs
---

| **Path** | **Description** | **Type** |
| --- | --- | --- |
| MicrosoftATP.HuntProcessDetails.Result | The query results for Process Details. | unknown |
| MicrosoftATP.HuntProcessDetails.Result.parent_process | The query results for parent_process query_purposeThe query results. | unknown |
| MicrosoftATP.HuntProcessDetails.Result.grandparent_process | The query results for grandparent_process query_purpose. | unknown |
| MicrosoftATP.HuntProcessDetails.Result.process_details | The query results for process_details query_purpose. | unknown |
| MicrosoftATP.HuntProcessDetails.Result.beaconing_evidence | The query results for beaconing_evidence query_purpose. | unknown |
| MicrosoftATP.HuntProcessDetails.Result.powershell_execution_unsigned_files | The query results for powershell_execution_unsigned_files query_purpose. | unknown |
| MicrosoftATP.HuntProcessDetails.Result.process_excecution_powershell | The query results for process_excecution_powershell query_purpose. | unknown |
| MicrosoftATP.FileMachine.Machines | The Query results for getting a collection of machines with a given file SHA1 hash. | unknown |
| MicrosoftATP.FileMachine.Machines.ID | The machine ID. | unknown |
| MicrosoftATP.FileMachine.Machines.ComputerDNSName | The machine DNS name. | unknown |
| MicrosoftATP.FileMachine.Machines.FirstSeen | The first date and time the machine was observed by Microsoft Defender ATP. | unknown |
| MicrosoftATP.FileMachine.Machines.LastSeen | The last date and time the machine was observed by Microsoft Defender ATP. | unknown |
| MicrosoftATP.FileMachine.Machines.OSPlatform | The operating system platform. | unknown |
| MicrosoftATP.FileMachine.Machines.OSVersion | The operating system version. | unknown |
| MicrosoftATP.FileMachine.Machines.OSBuild | Operating system build number. | unknown |
| MicrosoftATP.FileMachine.Machines.LastIPAddress | The last IP on the machine. | unknown |
| MicrosoftATP.FileMachine.Machines.LastExternalIPAddress | The last machine IP to access the internet. | unknown |
| MicrosoftATP.FileMachine.Machines.HelathStatus | The machine health status. | unknown |
| MicrosoftATP.FileMachine.Machines.RBACGroupID | The machine RBAC group ID. | unknown |
| MicrosoftATP.FileMachine.Machines.RBACGroupName | The machine RBAC group name. | unknown |
| MicrosoftATP.FileMachine.Machines.RiskScore | The machine risk score. | unknown |
| MicrosoftATP.FileMachine.Machines.ExposureLevel | The machine exposure score. | unknown |
| MicrosoftATP.FileMachine.Machines.IsAADJoined | True if machine is AAD joined, False otherwise. | unknown |
| MicrosoftATP.FileMachine.Machines.AADDeviceID | The AAD Device ID. | unknown |
| MicrosoftATP.FileMachine.Machines.MachineTags | Set of machine tags. | unknown |
| MicrosoftATP.Machine | Results for device information. | unknown |
| MicrosoftATP.Machine.OSProcessor | The operating system processor. | unknown |
| MicrosoftATP.FileMachine | Results for File information on a device. | unknown |
| MicrosoftATP.FileMachine.File | The machine related file hash. | unknown |
| MicrosoftATP.HuntNetworkConnections.Result | The query results for Hunt Network Connections. | unknown |
| MicrosoftATP.HuntNetworkConnections.Result.external_addresses | The query results for external_addresses query_purpose. | unknown |
| MicrosoftATP.HuntNetworkConnections.Result.dns_query | The query results for dns_query query_purpose. | unknown |
| MicrosoftATP.HuntNetworkConnections.Result.encoded_commands | The query results for encoded_commands query_purpose. | unknown |
| MatchRegex | The regex found in the command line | unknown |
| Indicators | Indicators extracted from the command line | unknown |
| commandline | The command line | unknown |
| CommandlineVerdict | The command line verdict | unknown |

## Playbook Image
---
![MDE - Host Advanced Hunting For Powershell Executions](../doc_files/MDE_-_Host_Advanced_Hunting_For_Powershell_Executions.png)