PS Remote Get File Sample From Path

This playbook leverages the Windows built-in PowerShell and WinRM capabilities to connect to a Windows host to acquire a file as forensic evidence for further analysis.

Windows Forensics · 10 tasks · 4 inputs · 2 outputs

Details

ID	`PS Remote Get File Sample From Path`
From Version	6.0.0
Tasks	10

README

This playbook leverages the Windows built-in PowerShell and WinRM capabilities to connect to a Windows host to acquire a file as forensic evidence for further analysis.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

UnzipFile
IsIntegrationAvailable
AddEvidence
Set

Commands

ps-remote-download-file

Playbook Inputs

Name	Description	Default Value	Required
Host	A single hostname or IP address of the machine on which the file is located. For example, testpc01.		Optional
FilePath	The path on the hostname from which to retrieve the file. For example, c:\tmp\test.txt. If you use the AddHostNameToFile input as true, the file downloaded to XSOAR will contain of the hostname.		Optional
ZipFile	Specify “true” to zip the MFT file before sending it to XSOAR.	true	Optional
AddHostNameToFile	Specify “true” for the name of the downloaded file to contain the hostname or “false” to keep the filename as configured in the FilePath argument.	true	Optional

Playbook Outputs

Path	Description	Type
AcquiredFile	The acquired file details.	string
File	The file to sample.	string

Playbook Image

PS Remote Get File Sample From Path

Inputs

Host — A single hostname or IP address of the machine on which the file is located. For example, testpc01
FilePath — The path on the host from which to retrieve the file. For example, c:\tmp\test.txt. In case you configure the AddHostNameToFile input as true, the file downloaded to XSOAR will contain the hostname.
ZipFile — Specify true to zip the MFT file before sending it to XSOAR.
AddHostNameToFile — Specify true for the downloaded file name to be comprised of the host name or false to keep the file name as configured in the FilePath argument.

Outputs

AcquiredFile — The acquired file details.
File — The file to sample.

Commands used

ps-remote-download-file

Flowchart

Source

playbook-PS-Remote_Get_File_Sample_From_Path.yml

Download History Raw

id: PS Remote Get File Sample From Path
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: PS Remote Get File Sample From Path
description: This playbook leverages the Windows built-in PowerShell and WinRM capabilities to connect to a Windows host to acquire a file as forensic evidence for further analysis.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 2e73d06c-0d0e-4db2-8807-3c8bd9eaaae4
    type: start
    task:
      id: 2e73d06c-0d0e-4db2-8807-3c8bd9eaaae4
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 580,
          "y": 100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: f4bd4312-f73c-4a13-8855-aef60df18da5
    type: condition
    task:
      id: f4bd4312-f73c-4a13-8855-aef60df18da5
      version: -1
      name: Is PowerShell Remoting enabled?
      description: Returns 'yes' if the integration is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "4"
    scriptarguments:
      brandname:
        simple: PowerShell Remoting
    results:
    - brandInstances
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 580,
          "y": 230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 664de072-ce7b-4c00-8572-87b23b878bd5
    type: title
    task:
      id: 664de072-ce7b-4c00-8572-87b23b878bd5
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 580,
          "y": 1830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 671e520f-dba6-49c5-8f9b-bc06dec5fe5e
    type: condition
    task:
      id: 671e520f-dba6-49c5-8f9b-bc06dec5fe5e
      version: -1
      name: Was a host specified?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Host
            iscontext: true
    view: |-
      {
        "position": {
          "x": 330,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 4272bbce-c6b1-43d3-8c21-ef8576e85f8a
    type: regular
    task:
      id: 4272bbce-c6b1-43d3-8c21-ef8576e85f8a
      version: -1
      name: PS-Remote download file
      description: Download a file from the remote endpoint.
      script: '|||ps-remote-download-file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      check_hash:
        simple: "true"
      host:
        simple: ${inputs.Host}
      host_prefix:
        simple: ${inputs.AddHostNameToFile}
      ip: {}
      path:
        simple: ${inputs.FilePath}
      zip_file:
        simple: ${inputs.ZipFile}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 8553f744-373e-48ee-8980-5485d3bf2b92
    type: condition
    task:
      id: 8553f744-373e-48ee-8980-5485d3bf2b92
      version: -1
      name: Was a file path specified?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.FilePath
            iscontext: true
    view: |-
      {
        "position": {
          "x": 180,
          "y": 620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 6b927889-76d4-455c-8b59-ebd5e03d1635
    type: condition
    task:
      id: 6b927889-76d4-455c-8b59-ebd5e03d1635
      version: -1
      name: Was file zipped?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "15"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.ZipFile
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 90,
          "y": 1110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 8738dd2b-a740-44ee-800e-473c070a11a6
    type: regular
    task:
      id: 8738dd2b-a740-44ee-800e-473c070a11a6
      version: -1
      name: Unzip file
      description: Unzip a file using the fileName or entryID to specify a file. Unzipped files will be loaded to the War Room and names will be put into the context.
      scriptName: UnzipFile
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      entryID:
        simple: ${File.EntryID}
      fileName: {}
      lastZipFileInWarroom: {}
      password: {}
      zipTool: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -130,
          "y": 1280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: 71dffd59-498c-491d-83e2-663ba0cf2642
    type: regular
    task:
      id: 71dffd59-498c-491d-83e2-663ba0cf2642
      version: -1
      name: Set acquired file details
      description: Set a value in the context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: AcquiredFile
      stringify: {}
      value:
        complex:
          root: File
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: File.Extension
                iscontext: true
              right:
                value:
                  simple: zip
            - operator: isEmpty
              left:
                value:
                  simple: File.Extension
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 1660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: de8f7975-6c09-486e-8dd3-42a456230a19
    type: regular
    task:
      id: de8f7975-6c09-486e-8dd3-42a456230a19
      version: -1
      name: Mark and tag Acquired File
      description: |
        Adds provided entries to the incident Evidence Board. In a playbook, this can be positioned after a task to add the previous task's entries to the Evidence Board automatically (with no need to provide arguments).
      scriptName: AddEvidence
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      desc:
        simple: An acquired file acquired from a host.
      description:
        simple: An acquired file acquired from a host.
      entryIDs: {}
      occurred: {}
      tags:
        simple: Acquired File
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 1485
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
system: true
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1795,
        "width": 1090,
        "x": -130,
        "y": 100
      }
    }
  }
inputs:
- key: Host
  value: {}
  required: false
  description: A single hostname or IP address of the machine on which the file is located. For example, testpc01
  playbookInputQuery:
- key: FilePath
  value: {}
  required: false
  description: "The path on the host from which to retrieve the file. \nFor example, c:\\tmp\\test.txt.\nIn case you configure the AddHostNameToFile input as true, the file downloaded to XSOAR will contain the hostname."
  playbookInputQuery:
- key: ZipFile
  value:
    simple: "true"
  required: false
  description: Specify true to zip the MFT file before sending it to XSOAR.
  playbookInputQuery:
- key: AddHostNameToFile
  value:
    simple: "true"
  required: false
  description: Specify true for the downloaded file name to be comprised of the host name or false to keep the file name as configured in the FilePath argument.
  playbookInputQuery:
outputs:
- contextPath: AcquiredFile
  description: The acquired file details.
  type: string
- contextPath: File
  description: The file to sample.
  type: string
tests:
- No tests (auto formatted)
fromversion: 6.0.0