MDE - Search And Block Software

This playbook will search a file or process activity of a software by a given image file name using Microsoft Defender For Endpoint. The analyst can then choose the files to block.

Microsoft Defender for Endpoint · 19 tasks · 4 inputs · 0 outputs

Inputs

  • Filename — File name to search
  • TimeFrame — Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.
  • Defender Indicator Title — The indicator alert title in Defender.
  • Indicator Expiration — DateTime string indicating when the indicator expires. Format: (<number> <time unit>, e.g., 12 hours, 7 days).

Commands used

microsoft-atp-advanced-hunting microsoft-atp-sc-indicator-create

Flowchart

yes yes Yes - Choose specific files yes yes yes Start Start Has query results? Has query results? Done Done delete context - XDR Results - DeleteContext delete context - XDR Results DeleteContext Has software name and timeframe from input? Has software name and tim... Execute KQL query to search software - microsoft-atp-advanced-hunting Execute KQL query to sear... microsoft-atp-advanced-hunting Would you like to block the files found? Would you like to block t... Block the files? Block the files? Choose specific files to block Choose specific files to ... Set Indicators To Block - Set Set Indicators To Block Set delete context - Indicators To block - DeleteContext delete context - Indicato... DeleteContext Set Indicators To Block - Process - Set Set Indicators To Block -... Set Has relevant files to block? Has relevant files to block? Set query results to layout - JsonToTable Set query results to layout JsonToTable Delete context - markdown - DeleteContext Delete context - markdown DeleteContext Block indicators - microsoft-atp-sc-indicator-create Block indicators microsoft-atp-sc-indicator-cr... Is Defender For Endpoint enabled? Is Defender For Endpoint ... Delete context to avoid duplications - customquerymarkdown - DeleteContext Delete context to avoid d... DeleteContext Delete context to avoid duplications - MicrosoftATP - DeleteContext Delete context to avoid d... DeleteContext