MDE - Search and Compare Process Executions

This playbook is a generic playbook that receives a process name and a command-line argument. It uses the "Microsoft Defender For Endpoint" integration to search for the given process executions and compares the command-line argument from the results to the command-line argument received from the playbook input. Note: Under the "Processes", input the playbook should receive an array that contains the following keys: - value: *process name* - commands: *command-line arguments*

Microsoft Defender for Endpoint · 10 tasks · 3 inputs · 2 outputs

Details

ID	`MDE - Search and Compare Process Executions`
From Version	6.9.0
Tasks	10

README

This playbook is a generic playbook that receives a process name and a command-line argument. It uses the “Microsoft Defender For Endpoint” integration to search for the given process executions and compares the command-line argument from the results to the command-line argument received from the playbook input.

Note: Under the “Processes” input, the playbook should receive an array that contains the following keys:

value: process name
commands: command-line arguments

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

MicrosoftDefenderAdvancedThreatProtection

Scripts

DeleteContext
StringSimilarity
Set

Commands

microsoft-atp-advanced-hunting

Playbook Inputs

Name	Description	Default Value	Required
Processes			Optional
HuntingTimeFrame	Time in relative date or range format (for example: “1 day”, “3 weeks ago”, “between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00”). The default is the last 24 hours.	7 days	Optional
StringSimilarityThreshold	StringSimilarity automation threshold. A number between 0 and 1, where 1 represents the most similar results of string comparisons. The automation will output only the results with a similarity score equal to or greater than the specified threshold.	0.5	Optional

Playbook Outputs

Path	Description	Type
StringSimilarity	StringSimilarity results.	unknown
Findings	Suspicious process executions found.	unknown

Playbook Image

MDE - Search and Compare Process Executions

Inputs

Processes — Process name to search and command-line argument to compare. This input should receive an array that contains the following keys: - value: *process name* - commands: *command-line arguments*
HuntingTimeFrame — Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.
StringSimilarityThreshold — StringSimilarity automation threshold. A number between 0 and 1, where 1 represents the most similar results of string comparisons. The automation will output only the results with a similarity score equal to or greater than the specified threshold.

Outputs

StringSimilarity — StringSimilarity automation results
Findings — Suspicious process executions found

Commands used

microsoft-atp-advanced-hunting

Flowchart

Source

playbook-MDE_-_Search_and_Compare_Process_Executions.yml

Download History Raw

id: MDE - Search and Compare Process Executions
version: -1
name: MDE - Search and Compare Process Executions
description: |-
  This playbook is a generic playbook that receives a process name and a command-line argument. It uses the "Microsoft Defender For Endpoint" integration to search for the given process executions and compares the command-line argument from the results to the command-line argument received from the playbook input.

  Note: Under the "Processes", input the playbook should receive an array that contains the following keys:
  - value: *process name*
  - commands: *command-line arguments*
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: e7bf5297-5a54-4574-83fe-5c1618cf5a63
    type: start
    task:
      id: e7bf5297-5a54-4574-83fe-5c1618cf5a63
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -80
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: f8ea3c73-999e-4fb8-8d5c-f8d5c77d6261
    type: regular
    task:
      id: f8ea3c73-999e-4fb8-8d5c-f8d5c77d6261
      version: -1
      name: Set process to search
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      key:
        simple: ProcessToSearch
      value:
        complex:
          root: inputs.Processes
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 750,
          "y": 220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 8e8900e6-0785-4f98-87c5-98450d4ed4d2
    type: title
    task:
      id: 8e8900e6-0785-4f98-87c5-98450d4ed4d2
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 8b5a962a-1c0d-4c3d-8a5b-5ecc285127a3
    type: regular
    task:
      id: 8b5a962a-1c0d-4c3d-8a5b-5ecc285127a3
      version: -1
      name: Delete context
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      key:
        simple: PaloAltoNetworksXQL
      subplaybook:
        simple: "yes"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 750,
          "y": 1210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 2fb5edd4-3c63-4766-8dff-920aa2027c2f
    type: condition
    task:
      id: 2fb5edd4-3c63-4766-8dff-920aa2027c2f
      version: -1
      name: Has query results?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: MicrosoftATP.Hunt.Result
                accessor: cmd
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 750,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 324684ef-232e-4b5d-8c51-7b1c7a3e8cd1
    type: regular
    task:
      id: 324684ef-232e-4b5d-8c51-7b1c7a3e8cd1
      version: -1
      name: Compare query results to given command-line patterns
      description: This automation calculates the similarity ratio between text and a list of strings and outputs a decimal value between 0.0 and 1.0 (1.0 if the sequences are identical, and 0.0 if they don't have anything in common).
      scriptName: StringSimilarity
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      similarity_threshold:
        complex:
          root: inputs.StringSimilarityThreshold
      similiarity_threshold:
        complex:
          root: inputs.StringSimilarityThreshold
      string_A:
        complex:
          root: MicrosoftATP.Hunt.Result
          accessor: cmd
          transformers:
          - operator: uniq
      string_B:
        complex:
          root: ProcessToSearch
          accessor: commands
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1090,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 2498307c-2d8d-46b4-8512-0deb6c4874ca
    type: condition
    task:
      id: 2498307c-2d8d-46b4-8512-0deb6c4874ca
      version: -1
      name: execution is suspicious?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "16"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              complex:
                root: StringSimilarity
                accessor: StringA
            iscontext: true
          right:
            value:
              complex:
                root: MicrosoftATP.Hunt.Result
                accessor: cmd
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1090,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: f59e5022-18a8-4494-8c38-9da693895ffb
    type: regular
    task:
      id: f59e5022-18a8-4494-8c38-9da693895ffb
      version: -1
      name: Set findings
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Findings
      value:
        complex:
          root: MicrosoftATP.Hunt.Result
          filters:
          - - operator: in
              left:
                value:
                  simple: MicrosoftATP.Hunt.Result.cmd
                iscontext: true
              right:
                value:
                  simple: StringSimilarity.StringA
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1090,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Tool Usage Found
      output:
        complex:
          root: PaloAltoNetworksXQL.GenericQuery.results
          filters:
          - - operator: in
              left:
                value:
                  simple: PaloAltoNetworksXQL.GenericQuery.results.cmd
                iscontext: true
              right:
                value:
                  simple: StringSimilarity.string_A
                iscontext: true
              ignorecase: true
          accessor: processname
    - incidentfield: Affected Hosts
      output:
        complex:
          root: PaloAltoNetworksXQL.GenericQuery.results
          filters:
          - - operator: in
              left:
                value:
                  simple: PaloAltoNetworksXQL.GenericQuery.results.cmd
                iscontext: true
              right:
                value:
                  simple: StringSimilarity.string_A
                iscontext: true
              ignorecase: true
          accessor: hostname
    - incidentfield: Affected Users
      output:
        complex:
          root: PaloAltoNetworksXQL.GenericQuery.results
          filters:
          - - operator: in
              left:
                value:
                  simple: PaloAltoNetworksXQL.GenericQuery.results.cmd
                iscontext: true
              right:
                value:
                  simple: StringSimilarity.string_A
                iscontext: true
              ignorecase: true
          accessor: username
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 7c1f96f3-88f9-48c1-8a1b-19aa0336f469
    type: condition
    task:
      id: 7c1f96f3-88f9-48c1-8a1b-19aa0336f469
      version: -1
      name: Defender For Endpoint Enabled?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Microsoft Defender Advanced Threat Protection
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 21256e50-9f6a-4691-814d-682ef546cc1f
    type: regular
    task:
      id: 21256e50-9f6a-4691-814d-682ef546cc1f
      version: -1
      name: Execute query to search given process executions
      description: 'Allows you to run programmatic queries like in Microsoft Defender ATP Portal (https://securitycenter.windows.com/hunting). Limitations: You can only run a query on data from the last 30 days. The results include a maximum of 10,000 rows. The number of executions is limited (up to 15 calls per minute, 15 minutes of running time every hour and 4 hours of running time a day).'
      script: '|||microsoft-atp-advanced-hunting'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      query:
        complex:
          root: ProcessToSearch
          accessor: value
          transformers:
          - operator: StringifyArray
          - operator: replace
            args:
              limit: {}
              replaceWith: {}
              toReplace:
                value:
                  simple: '['
          - operator: replace
            args:
              limit: {}
              replaceWith: {}
              toReplace:
                value:
                  simple: ']'
          - operator: concat
            args:
              prefix:
                value:
                  simple: |-
                    DeviceProcessEvents
                    | where FileName in~ (
              suffix:
                value:
                  simple: |-
                    )
                    | project-rename processname=FileName, cmd=ProcessCommandLine, hostname=DeviceName, username=AccountName, _time=ProcessCreationTime
                    | project processname, cmd, hostname, username, _time
      time_range:
        complex:
          root: inputs.HuntingTimeFrame
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 750,
          "y": 380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "13_6_#default#": 0.47,
      "15_16_yes": 0.44
    },
    "paper": {
      "dimensions": {
        "height": 1525,
        "width": 1020,
        "x": 450,
        "y": -80
      }
    }
  }
inputs:
- key: Processes
  value: {}
  required: false
  description: |-
    Process name to search and command-line argument to compare. This input should receive an array that contains the following keys:
    - value: *process name*
    - commands: *command-line arguments*
  playbookInputQuery:
- key: HuntingTimeFrame
  value:
    simple: 7 days
  required: false
  description: 'Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.'
  playbookInputQuery:
- key: StringSimilarityThreshold
  value:
    simple: "0.5"
  required: false
  description: 'StringSimilarity automation threshold. A number between 0 and 1, where 1 represents the most similar results of string comparisons. The automation will output only the results with a similarity score equal to or greater than the specified threshold.'
  playbookInputQuery:
outputs:
- contextPath: StringSimilarity
  description: StringSimilarity automation results
  type: unknown
- contextPath: Findings
  description: Suspicious process executions found
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.9.0