PS-Remote Get Network Traffic
This playbook leverages the Windows built-in PowerShell and WinRM capabilities to connect to a Windows host. It then connectst to the Netsh tool to create an ETL file which is the equivalent of a Wireshark PCAP file by using the PS-Remote integration. After receiving the resultant ETL, XSOAR will be able to convert the ETL to a PCAP file to be parsed and enriched later. Review the Microsoft documentation for how to use ETL filters (https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj129382(v=ws.11)#using-filters-to-limit-etl-trace-file-details).
Windows Forensics · 12 tasks · 7 inputs · 1 output
Inputs
Host— A single hostname or IP address from which to create the ETL file. For example, testpc01.EtlSizeLimit— The maximum file size for the ETL. Once the file has reached this size, the capture will stop. For example, 10MB. The default size is 10MB.EtlPath— The path on the hostname on which to create the ETL file. The default path will be c:\etl.etl. If the AddHostNameToFile input is "true", the file downloaded to XSOAR will contain the hostname.EtlFilter— The filter to apply when creating the ETL file. For example, IPv4.Address=1.1.1.1 to capture traffic just from the 1.1.1.1 IP address. If no filter is specified, all traffic will be recorded.ETlTimeToRecord— The time to record in seconds.ZipEtl— Specify "true" to zip the ETL file before sending it to XSOAR.AddHostNameToFile— Specify "true" for the downloaded filename to contain the hostname, or "false" to keep the filename as configured in the FilePath argument.
Outputs
PcapDetails— The PCAP file details.
Commands used
ps-remote-download-file
ps-remote-etl-create-start
ps-remote-etl-create-stop