PS-Remote Acquire Host Forensics

This playbook allows the user to gather multiple forensic data from a Windows endpoint including network traffic, MFT (Master File Table), and registry export by using the PS Remote automation which enables connecting to a Windows host without the need to install any 3rd-party tools using just native Windows management tools.

Windows Forensics · 11 tasks · 4 inputs · 3 outputs

Details

ID	`PS-Remote Acquire Host Forensics`
From Version	6.0.0
Tasks	11

README

This playbook allows the user to gather multiple forensic data from a Windows endpoint, including network traffic, MFT (Master File Table), and registry export by using the PowerShell Remoting integration that enables connecting to a Windows host using just native Windows management tools. There is no need to install any 3rd-party tools.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

PS-Remote Get Network Traffic
PS-Remote Get Registry
PS-Remote Get MFT

Integrations

This playbook does not use any integrations.

Scripts

SetAndHandleEmpty

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
GetNetworkTraffic	This input specifies whether to capture network traffic on the host.	true	Optional
GetMft	This input specifies whether to acquire the MFT for the host.	true	Optional
GetRegistry	This input specifies whether to export the registry on the host.	true	Optional
Host	A single hostname or IP address for which to export the registry file. For example, testpc01.		Optional

Playbook Outputs

Path	Description	Type
PcapDetails	PCAP file details.	string
RegistryDetails	Registry file details.	string
MftDetails	MFT file details.	string

Playbook Image

PS-Remote Acquire Host Forensics

Inputs

GetNetworkTraffic — This input specifies whether to capture network traffic on the host.
GetMft — This input specifies whether to acquire the MFT for the host.
GetRegistry — This input specifies whether to export the registry on the host.
Host — A single hostname or IP address for which to export the registry file. For example, testpc01.

Outputs

PcapDetails — PCAP file details.
RegistryDetails — Registry file details.
MftDetails — MFT file details.

Flowchart

Source

playbook-PS-Remote_Acquire_Host_Forensics.yml

Download History Raw

id: PS-Remote Acquire Host Forensics
version: -1
name: PS-Remote Acquire Host Forensics
description: This playbook allows the user to gather multiple forensic data from a
  Windows endpoint including network traffic, MFT (Master File Table), and registry
  export by using the PS Remote automation which enables connecting to a Windows host
  without the need to install any 3rd-party tools using just native Windows management
  tools.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 98d812ea-ec8b-476b-8fc6-766548b81b23
    type: start
    task:
      id: 98d812ea-ec8b-476b-8fc6-766548b81b23
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
      - "6"
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 550,
          "y": -170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: b420f60c-eb1b-4ac3-8b35-93972d1ec7b7
    type: playbook
    task:
      id: b420f60c-eb1b-4ac3-8b35-93972d1ec7b7
      version: -1
      name: PS-Remote Get Registry
      description: This playbook leverages the Windows built-in PowerShell and WinRM
        capabilities to connect to a Windows host to acquire and export the registry
        as forensic evidence for further analysis. The capture can be for the entire
        registry or for a specific hive or path.
      playbookName: PS-Remote Get Registry
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      FilePath:
        complex:
          root: inputs.Host
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: c:\
              suffix:
                value:
                  simple: .reg
      Host:
        simple: ${inputs.Host}
      RegistryPath:
        simple: all
      ZipRegistry:
        simple: "true"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1470,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: c213b294-78c2-4142-863f-52ac5a92aeb0
    type: condition
    task:
      id: c213b294-78c2-4142-863f-52ac5a92aeb0
      version: -1
      name: Get network traffic?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.GetNetworkTraffic
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": -430,
          "y": -30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 71c237ba-e4b9-40be-84b1-cbf2c2a75bd2
    type: title
    task:
      id: 71c237ba-e4b9-40be-84b1-cbf2c2a75bd2
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 550,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: b6d8c34c-e60c-4ffd-891d-239a745d2809
    type: condition
    task:
      id: b6d8c34c-e60c-4ffd-891d-239a745d2809
      version: -1
      name: Get MFT?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.GetMft
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 550,
          "y": -20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: d2ce1a98-31b0-4613-8505-ffec66b377d6
    type: condition
    task:
      id: d2ce1a98-31b0-4613-8505-ffec66b377d6
      version: -1
      name: Get registry?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.GetRegistry
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 1340,
          "y": -30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 99ace9d4-ba58-4fb1-81bd-0f5cb3a8369c
    type: playbook
    task:
      id: 99ace9d4-ba58-4fb1-81bd-0f5cb3a8369c
      version: -1
      name: PS-Remote Get Network Traffic
      description: This playbook leverages the Windows built-in PowerShell and WinRM
        capabilities to connect to a Windows host and then use the Netsh tool to create
        an ETL file which is the equivalent of a Wireshark PCAP file by using the PowerShell Remoting
        integration. After receiving the resultant ETL, XSOAR will convert
        the ETL to a PCAP file to be parsed and enriched later.
      playbookName: PS-Remote Get Network Traffic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      ETlTimeToRecord:
        simple: "60"
      EtlFilter: {}
      EtlPath:
        complex:
          root: inputs.Host
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: c:\
              suffix:
                value:
                  simple: .etl
      EtlSizeLimit: {}
      Host:
        simple: ${inputs.Host}
      ZipEtl:
        simple: "true"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -530,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 617d2a7e-00a3-419d-85cc-c4b356293c66
    type: playbook
    task:
      id: 617d2a7e-00a3-419d-85cc-c4b356293c66
      version: -1
      name: PS-Remote Get MFT
      description: This playbook leverages the Windows built-in PowerShell and WinRM
        capabilities to connect to a Windows host to acquire and export the MFT (Master
        File Table) as forensic evidence for further analysis.
      playbookName: PS-Remote Get MFT
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
      - "11"
    scriptarguments:
      FilePath:
        complex:
          root: inputs.Host
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: c:\
              suffix:
                value:
                  simple: .mft
      Host:
        simple: ${inputs.Host}
      VolumeForMft:
        simple: c
      ZipMft:
        simple: "true"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 340,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: fc934299-715b-4167-8f19-9ab015b24659
    type: regular
    task:
      id: fc934299-715b-4167-8f19-9ab015b24659
      version: -1
      name: Set PCAP details
      description: Set a value in the context under the key you entered. If no value is
        entered, the script does nothing.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: PcapDetails
      stringify: {}
      value:
        simple: ${PcapDetails}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -530,
          "y": 380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 5029298e-3a5c-4fdb-8d43-6f75624a4dc9
    type: regular
    task:
      id: 5029298e-3a5c-4fdb-8d43-6f75624a4dc9
      version: -1
      name: Set MFT details
      description: Set a value in the context under the key you entered. If no value is
        entered, the script does nothing.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: MftDetails
      stringify: {}
      value:
        complex:
          root: MftDetails
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 170,
          "y": 380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 7c028be0-a979-46e4-8cc5-e2a3ba93528f
    type: regular
    task:
      id: 7c028be0-a979-46e4-8cc5-e2a3ba93528f
      version: -1
      name: Set registry file details
      description: Set a value in the context under the key you entered. If no value is
        entered, the script does nothing.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: RegistryDetails
      stringify: {}
      value:
        simple: ${RegistryDetails}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1470,
          "y": 380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1095,
        "width": 2380,
        "x": -530,
        "y": -170
      }
    }
  }
inputs:
- key: GetNetworkTraffic
  value:
    simple: "true"
  required: false
  description: This input specifies whether to capture network traffic on the host.
  playbookInputQuery:
- key: GetMft
  value:
    simple: "true"
  required: false
  description: This input specifies whether to acquire the MFT for the host.
  playbookInputQuery:
- key: GetRegistry
  value:
    simple: "true"
  required: false
  description: This input specifies whether to export the registry on the host.
  playbookInputQuery:
- key: Host
  value: {}
  required: false
  description: A single hostname or IP address for which to export the registry file. For example, testpc01.
  playbookInputQuery:
outputs:
- contextPath: PcapDetails
  description: PCAP file details.
  type: string
- contextPath: RegistryDetails
  description: Registry file details.
  type: string
- contextPath: MftDetails
  description: MFT file details.
  type: string
tests:
- No tests (auto formatted)
fromversion: 6.0.0