PS-Remote Get MFT

This playbook leverages the Windows built-in PowerShell and WinRM capabilities to connect to a Windows host to acquire and export the MFT (Master File Table) as forensic evidence for further analysis.

Windows Forensics · 12 tasks · 5 inputs · 1 output

Details

ID	`PS-Remote Get MFT`
From Version	6.0.0
Tasks	12

README

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

UnzipFile
AddEvidence
Set
Sleep

Commands

ps-remote-export-mft
ps-remote-download-file

Playbook Inputs

Name	Description	Default Value	Required
Host	A single hostname or IP address from which to export the registry file. For example, testpc01.		Optional
FilePath	The path on the hostname on which to create the MFT file. The default path will be c:\mft.mft. If the AddHostNameToFile input is “true”, the file downloaded to XSOAR will contain the hostname.	c:\mft.mft	Optional
VolumeForMft	The volume for which to create the MFT. The default is c.	c	Optional
ZipMft	Specify “true” to zip the MFT file before sending it to XSOAR.	true	Optional
AddHostNameToFile	Specify “true” for the downloaded filename to be comprised of the hostname, or “false” to keep the filename as configured in the FilePath argument.	true	Optional

Playbook Outputs

Path	Description	Type
MftDetails	The MFT file details.	string

Playbook Image

PS-Remote Get MFT

Inputs

Host — A single hostname or IP address from which to export the registry file. For example, testpc01.
FilePath — The path on the host on which to create the MFT file. The default path will be c:\mft.mft. If you the AddHostNameToFile input os "true", the file downloaded to XSOAR will contain the hostname.
VolumeForMft — Specify the volume for which to create the MFT. The default is c.
ZipMft — Specify "true" to zip the MFT file before sending it to XSOAR.
AddHostNameToFile — Specify "true" for the downloaded filename to contain the hostname, or "false" to keep the file name as configured in the FilePath argument.

Outputs

MftDetails — The MFT file details.

Commands used

ps-remote-download-file ps-remote-export-mft setEntriesTags

Flowchart

Source

playbook-PS-Remote_Get_MFT.yml

Download History Raw

id: PS-Remote Get MFT
version: -1
name: PS-Remote Get MFT
description: This playbook leverages the Windows built-in PowerShell and WinRM capabilities
  to connect to a Windows host to acquire and export the MFT (Master File Table) as
  forensic evidence for further analysis.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 2e73d06c-0d0e-4db2-8807-3c8bd9eaaae4
    type: start
    task:
      id: 2e73d06c-0d0e-4db2-8807-3c8bd9eaaae4
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 570,
          "y": 80
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 3d412b04-16a0-4b5f-8b0f-08eb4e46478c
    type: condition
    task:
      id: 3d412b04-16a0-4b5f-8b0f-08eb4e46478c
      version: -1
      name: Is PowerShell Remoting enabled?
      description: Returns 'yes' if the integration brand is available. Otherwise
        returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "4"
    scriptarguments:
      brandname:
        simple: PowerShell Remoting
    results:
    - brandInstances
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 570,
          "y": 230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 664de072-ce7b-4c00-8572-87b23b878bd5
    type: title
    task:
      id: 664de072-ce7b-4c00-8572-87b23b878bd5
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 570,
          "y": 2110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 671e520f-dba6-49c5-8f9b-bc06dec5fe5e
    type: condition
    task:
      id: 671e520f-dba6-49c5-8f9b-bc06dec5fe5e
      version: -1
      name: Was a host specified?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Host
            iscontext: true
    view: |-
      {
        "position": {
          "x": 330,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: f34edc43-9c6f-4489-8fbd-eab2e5f74c14
    type: regular
    task:
      id: f34edc43-9c6f-4489-8fbd-eab2e5f74c14
      version: -1
      name: PS-Remote export MFT
      description: Extract master file table from volume.
      script: '|||ps-remote-export-mft'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      csv_output: {}
      host:
        simple: ${inputs.Host}
      ip: {}
      output_path:
        simple: ${inputs.FilePath}
      volume:
        simple: ${inputs.VolumeForMft}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 40,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: c2b26a24-e487-4505-8ee2-5f4bb7f1f54b
    type: regular
    task:
      id: c2b26a24-e487-4505-8ee2-5f4bb7f1f54b
      version: -1
      name: PS-Remote download file
      description: Download a file from the remote endpoint.
      script: '|||ps-remote-download-file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      check_hash:
        simple: "true"
      host:
        simple: ${inputs.Host}
      host_prefix:
        simple: ${inputs.AddHostNameToFile}
      ip: {}
      path:
        simple: ${inputs.FilePath}
      zip_file:
        simple: ${inputs.ZipMft}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 40,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 6cd97deb-540a-48e6-8959-2af17a02788f
    type: condition
    task:
      id: 6cd97deb-540a-48e6-8959-2af17a02788f
      version: -1
      name: Was an MFT file path specified?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.FilePath
            iscontext: true
    view: |-
      {
        "position": {
          "x": 180,
          "y": 620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: 36ec8072-289b-4b06-8d5b-526be956e01a
    type: regular
    task:
      id: 36ec8072-289b-4b06-8d5b-526be956e01a
      version: -1
      name: Sleep
      description: Sleep for X seconds.
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      seconds:
        simple: "30"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 40,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 75a21419-baec-4995-8985-d22747adcf3f
    type: condition
    task:
      id: 75a21419-baec-4995-8985-d22747adcf3f
      version: -1
      name: Was file zipped?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "15"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.ZipMft
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 40,
          "y": 1430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 0edb3fc1-2f10-40ab-844f-b9132750f91b
    type: regular
    task:
      id: 0edb3fc1-2f10-40ab-844f-b9132750f91b
      version: -1
      name: Unzip file
      description: Unzip a file using the fileName or entryID to specify a file. Unzipped
        files will be loaded to the War Room and names will be put into the context.
      scriptName: UnzipFile
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      entryID:
        simple: ${File.EntryID}
      fileName: {}
      lastZipFileInWarroom: {}
      password: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -380,
          "y": 1600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: efe81ba7-8f3c-4fba-8d53-ea617e6f30b3
    type: regular
    task:
      id: efe81ba7-8f3c-4fba-8d53-ea617e6f30b3
      version: -1
      name: Set MFT details
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: MftDetails
      stringify: {}
      value:
        complex:
          root: File
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: File.Extension
                iscontext: true
              right:
                value:
                  simple: mft
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 40,
          "y": 1940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: d7db312d-7719-42d6-8819-d4fa97fb6e37
    type: regular
    task:
      id: d7db312d-7719-42d6-8819-d4fa97fb6e37
      version: -1
      name: Mark and tag MFT
      description: commands.local.cmd.entriesTags.set
      script: Builtin|||setEntriesTags
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      entryIDs:
        complex:
          root: File
          accessor: EntryID
          transformers:
          - operator: LastArrayElement
      entryTags:
        simple: MFT
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 40,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 2095,
        "width": 1330,
        "x": -380,
        "y": 80
      }
    }
  }
inputs:
- key: Host
  value: {}
  required: false
  description: A single hostname or IP address from which to export the registry file. For example, testpc01.
  playbookInputQuery: null
- key: FilePath
  value:
    simple: c:\mft.mft
  required: false
  description: |-
    The path on the host on which to create the MFT file. The default path will be c:\mft.mft.
    If you the AddHostNameToFile input os "true", the file downloaded to XSOAR will contain the hostname.
  playbookInputQuery: null
- key: VolumeForMft
  value:
    simple: c
  required: false
  description: |
    Specify the volume for which to create the MFT. The default is c.
  playbookInputQuery: null
- key: ZipMft
  value:
    simple: "true"
  required: false
  description: Specify "true" to zip the MFT file before sending it to XSOAR.
  playbookInputQuery: null
- key: AddHostNameToFile
  value:
    simple: "true"
  required: false
  description: Specify "true" for the downloaded filename to contain the hostname, or "false" to keep the file name as configured in the FilePath argument.
  playbookInputQuery: null
outputs:
- contextPath: MftDetails
  description: The MFT file details.
  type: string
tests:
- No tests (auto formatted)
fromversion: 6.0.0