RDP Bitmap Cache - Detect and Hunt

## Playbook: Automated Collection and Forensic Analysis of RDP Sessions Cache Data This playbook automates the collection and forensic analysis of RDP sessions cache data. It involves the following steps: ### Step 1: Collect Cache Files and Convert to Image The first step is to collect the cache files from RDP sessions and convert them into an image format. ### Step 2: Extract Readable Text from the Image Once the cache files are converted into an image, the playbook extracts readable text from the image to facilitate analysis. ### Step 3: Build Indicators of Compromise (IOCs) from Text In this step, the extracted text is used to build indicators of compromise (IOCs) for further investigation and threat hunting. ### Step 4: Enrich Extracted Indicators for Further Hunting Finally, the playbook enriches the extracted indicators by adding additional context and information, enhancing their usefulness for further hunting and analysis. > Note: It is important to customize and adapt this playbook to fit specific use cases and environments. Additionally, ensure compliance with legal and privacy requirements when collecting and analyzing data. Feel free to modify and enhance this playbook according to your requirements.

RDPCacheHunting · 38 tasks · 10 inputs · 0 outputs

Inputs

  • ShouldCollectRDPCache — When set to True, will use XDR to get RDP cache files from the endpoints, but set to False will try and use existing cache file from context
  • EndpointIDs — A comma seperated list of endpoint ID's to retrieve cache files from
  • FilePath — The path of the file to retrieve or use wildcard for multiple files. For example: C:\the\path\to\cache_file.bin C:\the\path\to\*
  • Hostname — Hostname of the machine on which the file is located for PS remote it can also be an IP address.
  • min_score — StringSifter - Limit output to strings with score >= min-score.
  • limit — StringSifter - Limit output to the top limit ranked strings.
  • similarity_threshold — StringSimilarity - The similarity threshold to show results for, a value between 0 < x >1
  • QRadarTimeFrame — The time frame for the Qradar hunting query
  • SplunkEarliestTime — The earliest time for the Splunk hunting query.
  • SplunkLatestTime — The latest time for the Splunk hunting query.

Commands used

extractIndicators image-ocr-extract-text lolbas-get-indicators rasterize-image rasterize-pdf setIncident splunk-search xdr-file-retrieve

Flowchart

yes yes yes Start Start OCR from original - image-ocr-extract-text OCR from original image-ocr-extract-text Parse RDP cache files - BMCTool Parse RDP cache files BMCTool Suspicious tools hunting - StringSimilarity Suspicious tools hunting StringSimilarity Suspicious strings hunting - StringSifter Suspicious strings hunting StringSifter Process RDP Cache Files Process RDP Cache Files Extract Indicators Extract Indicators Extract indicators from the OCR output - extractIndicators Extract indicators from t... extractIndicators Threat Hunting Threat Hunting Set Layout Set Layout Set String Sifter results in the layout - SetGridField Set String Sifter results... SetGridField Done Done Set strings similarity results in the layout - SetGridField Set strings similarity re... SetGridField Threat Hunting - Generic - Threat Hunting - Generic Threat Hunting - Generic Threat Hunting - Generic Hunt RDP IoCs - Exe + Path - splunk-search Hunt RDP IoCs - Exe + Path splunk-search Set the Technical Details tab in the layout - setIncident Set the Technical Details... setIncident Was the file retrieved successfully? Was the file retrieved su... No Files to Process No Files to Process Should collect RDP cache files? Should collect RDP cache ... Retrieve File from Endpoint - Generic V3 - Retrieve File from Endpoint - Generic V3 Retrieve File from Endpoi... Retrieve File from Endpoint -... Get Cache Files Get Cache Files Get RDP cache files - xdr-file-retrieve Get RDP cache files xdr-file-retrieve Prepare RDP cache image for OCR Prepare RDP cache image f... Preprocess Grayscale Image - PreProcessImage Preprocess Grayscale Image PreProcessImage Preprocess Sharpened Image - PreProcessImage Preprocess Sharpened Image PreProcessImage OCR text extraction OCR text extraction Display RDP Cache image Display RDP Cache image Rasterize the PDF file - rasterize-pdf Rasterize the PDF file rasterize-pdf Convert the PNG file to PDF - rasterize-image Convert the PNG file to PDF rasterize-image Set string similarity score - Set Set string similarity score Set Set Stringsifter score - Set Set Stringsifter score Set Unzip files - UnzipFile Unzip files UnzipFile Manual file submission Manual file submission Preprocess original Image - PreProcessImage Preprocess original Image PreProcessImage OCR from sharpened - image-ocr-extract-text OCR from sharpened image-ocr-extract-text OCR from grayscale - image-ocr-extract-text OCR from grayscale image-ocr-extract-text Getting a list of lolbins to hunt - lolbas-get-indicators Getting a list of lolbins... lolbas-get-indicators Is LOLBAS Feed integration enabled? - IsIntegrationAvailable Is LOLBAS Feed integratio... IsIntegrationAvailable