Skip to main content

HarfangLab EDR

This Integration is part of the HarfangLab EDR Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.2.0 and later.

HarfangLab EDR Connector, Compatible version 2.13.7+ This integration was integrated and tested with version 2.13.7+ of Hurukai

Configure HarfangLab EDR on Cortex XSOAR#

  1. Navigate to Settings > Integrations > Servers & Services.

  2. Search for HarfangLab EDR.

  3. Click Add instance to create and configure a new integration instance.

    ParameterDescriptionRequired
    API URLTrue
    Fetch incidentsFalse
    Incident typeFalse
    API KeyFalse
    Incidents Fetch IntervalFalse
    Fetch alerts with typeComma-separated list of types of alerts to fetch (sigma, yara, hlai, vt, ransom, ioc, glimps, orion...).False
    Minimum severity of alerts to fetchTrue
    Fetch alerts with status (ACTIVE, CLOSED)False
    Maximum number of incidents to fetch per callFetch maximum <max_fetch> security events and/or threats per call (leave empty if unlimited).False
    First fetch timeStart fetching alerts and/or threats whose creation date is higher than now minus <first_fetch> days.True
    Mirroring DirectionChoose the direction to mirror the detection: Incoming (from HarfangLab EDR to Cortex XSOAR), Outgoing (from Cortex XSOAR to HarfangLab EDR), or Incoming and Outgoing (to/from HarfangLab EDR and Cortex XSOAR).False
    Fetch typesTrue
    Close Mirrored security event or threat in the XSOARWhen selected, closes the XSOAR incident, which is mirrored from the HarfangLab EDR.False
    Close Mirrored security event or threat in HarfangLab EDRWhen selected, closes the HarfangLab EDR security event or threat in the HarfangLab EDR.False
    Trust any certificate (not secure)False
    Use system proxy settingsFalse
  4. Click Test to validate the URLs, token, and connection.

Commands#

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

fetch-incidents#


Allows to retrieve incidents from the HarfangLab EDR API

Base Command#

fetch-incidents

Input#

Argument NameDescriptionRequired

Context Output#

There is no context output for this command.

harfanglab-get-endpoint-info#


Get endpoint information from agent_id

Base Command#

harfanglab-get-endpoint-info

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Optional

Context Output#

PathTypeDescription
Harfanglab.AgentunknownAgent information

Command example#

!harfanglab-get-endpoint-info agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Agent": {
"additional_info": {
"additional_info1": null,
"additional_info2": null,
"additional_info3": null,
"additional_info4": null
},
"avg_cpu": 1,
"avg_memory": 183558144,
"bitness": "x64",
"cpu_count": 2,
"cpu_frequency": 3192,
"distroid": null,
"dnsdomainname": null,
"domain": null,
"domainname": "WORKGROUP",
"driver_enabled": true,
"driver_policy": false,
"effective_policy_id": "e96699ef-3dd9-4718-90ef-c7e5646fd466",
"effective_policy_revision": 5,
"external_ipaddress": "(REDACTED)",
"firstseen": "2022-06-15T06:42:50.008015Z",
"group_count": 0,
"groups": [],
"hostname": "DC-01",
"id": "0fae71cf-ebde-4533-a50c-b3c0290378db",
"installdate": "2022/06/15 06:38:58",
"ipaddress": "(REDACTED)",
"ipmask": "(REDACTED)",
"isolation_policy": false,
"isolation_state": true,
"lastseen": "2022-07-28T07:41:32.197641Z",
"lastseen_error": "2022-07-28T07:47:02.197641Z",
"lastseen_warning": "2022-07-28T07:43:44.197641Z",
"machine_boottime": "2022-06-28T14:18:31Z",
"osbuild": 20348,
"osid": "00454-40000-00001-AA596",
"osmajor": 10,
"osminor": 0,
"osproducttype": "Windows Server 2022 Standard Evaluation",
"ostype": "windows",
"osversion": "10.0.20348",
"policy": {
"binary_download_enabled": true,
"description": "",
"hibou_minimum_level": "critical",
"hibou_mode": 0,
"hibou_skip_signed_ms": false,
"hibou_skip_signed_others": false,
"hlai_minimum_level": "critical",
"hlai_mode": 1,
"hlai_skip_signed_ms": true,
"hlai_skip_signed_others": false,
"id": "e96699ef-3dd9-4718-90ef-c7e5646fd466",
"ioc_mode": 2,
"ioc_ruleset": null,
"loglevel": "ERROR",
"name": "No psexec",
"ransomguard_alert_only": false,
"revision": 5,
"self_protection": false,
"sigma_ruleset": 1,
"sleepjitter": 10,
"sleeptime": 60,
"telemetry_alerts_limit": false,
"telemetry_alerts_limit_value": 1000,
"telemetry_log": true,
"telemetry_log_limit": false,
"telemetry_log_limit_value": 1000,
"telemetry_network": true,
"telemetry_network_limit": false,
"telemetry_network_limit_value": 1000,
"telemetry_process": true,
"telemetry_process_limit": false,
"telemetry_process_limit_value": 1000,
"telemetry_remotethread": true,
"telemetry_remotethread_limit": false,
"telemetry_remotethread_limit_value": 1000,
"tenant": null,
"use_driver": true,
"use_isolation": true,
"use_process_block": true,
"use_ransomguard": true,
"use_sigma": true,
"use_sigma_process_block": false,
"yara_mode": 1,
"yara_ruleset": null,
"yara_skip_signed_ms": true,
"yara_skip_signed_others": false
},
"producttype": "server",
"servicepack": null,
"starttime": "2022-06-28T14:18:47Z",
"status": "online",
"tenant": null,
"total_memory": 2133962752,
"uninstall_status": 0,
"update_experimental": false,
"update_status": 0,
"version": "2.15.0"
}
}
}

Human Readable Output#

Endpoint information for agent_id : 0fae71cf-ebde-4533-a50c-b3c0290378db#

additional_infoavg_cpuavg_memorybitnesscpu_countcpu_frequencydomainnamedriver_enableddriver_policyeffective_policy_ideffective_policy_revisionexternal_ipaddressfirstseengroup_counthostnameidinstalldateipaddressipmaskisolation_policyisolation_statelastseenlastseen_errorlastseen_warningmachine_boottimeosbuildosidosmajorosminorosproducttypeostypeosversionpolicyproducttypestarttimestatustotal_memoryuninstall_statusupdate_experimentalupdate_statusversion
additional_info1: null
additional_info2: null
additional_info3: null
additional_info4: null
1.0183558144.0x6423192WORKGROUPtruefalsee96699ef-3dd9-4718-90ef-c7e5646fd4665(REDACTED)2022-06-15T06:42:50.008015Z0DC-010fae71cf-ebde-4533-a50c-b3c0290378db2022/06/15 06:38:58(REDACTED)(REDACTED)falsetrue2022-07-28T07:41:32.197641Z2022-07-28T07:47:02.197641Z2022-07-28T07:43:44.197641Z2022-06-28T14:18:31Z2034800454-40000-00001-AA596100Windows Server 2022 Standard Evaluationwindows10.0.20348id: e96699ef-3dd9-4718-90ef-c7e5646fd466
tenant: null
name: No psexec
description:
revision: 5
sleeptime: 60
sleepjitter: 10
telemetry_process: true
telemetry_process_limit: false
telemetry_process_limit_value: 1000
telemetry_network: true
telemetry_network_limit: false
telemetry_network_limit_value: 1000
telemetry_log: true
telemetry_log_limit: false
telemetry_log_limit_value: 1000
telemetry_remotethread: true
telemetry_remotethread_limit: false
telemetry_remotethread_limit_value: 1000
telemetry_alerts_limit: false
telemetry_alerts_limit_value: 1000
binary_download_enabled: true
loglevel: ERROR
use_sigma: true
ioc_mode: 2
hlai_mode: 1
hlai_skip_signed_ms: true
hlai_skip_signed_others: false
hlai_minimum_level: critical
hibou_mode: 0
hibou_skip_signed_ms: false
hibou_skip_signed_others: false
hibou_minimum_level: critical
yara_mode: 1
yara_skip_signed_ms: true
yara_skip_signed_others: false
use_driver: true
use_isolation: true
use_ransomguard: true
ransomguard_alert_only: false
self_protection: false
use_process_block: true
use_sigma_process_block: false
sigma_ruleset: 1
yara_ruleset: null
ioc_ruleset: null
server2022-06-28T14:18:47Zonline2133962752.00false02.15.0

harfanglab-endpoint-search#


Search for endpoint information from a hostname

Base Command#

harfanglab-endpoint-search

Input#

Argument NameDescriptionRequired
hostnameEndpoint hostname.Optional

Context Output#

PathTypeDescription
Harfanglab.AgentunknownAgent information.
Harfanglab.Agent.idstringagent id (DEPRECATED)
Harfanglab.statusstringStatus (DEPRECATED)

Command example#

!harfanglab-endpoint-search hostname="DC-01"

Context Example#

{
"Harfanglab": {
"Agent": {
"additional_info": {
"additional_info1": null,
"additional_info2": null,
"additional_info3": null,
"additional_info4": null
},
"avg_cpu": 0.6,
"avg_memory": 125627596,
"bitness": "x64",
"cpu_count": 2,
"cpu_frequency": 3192,
"distroid": null,
"dnsdomainname": null,
"domain": null,
"domainname": "WORKGROUP",
"driver_enabled": true,
"driver_policy": false,
"external_ipaddress": "(REDACTED)",
"firstseen": "2022-06-14T22:23:08.393381Z",
"group_count": 0,
"groups": [],
"hostname": "DC-01",
"id": "706d4524-dc2d-4438-bfef-3b620646db7f",
"installdate": "2022/06/14 21:56:49",
"ipaddress": "(REDACTED)",
"ipmask": "(REDACTED)",
"isolation_policy": false,
"isolation_state": false,
"lastseen": "2022-06-15T06:33:46.544505Z",
"lastseen_error": "2022-06-15T06:39:16.544505Z",
"lastseen_warning": "2022-06-15T06:35:58.544505Z",
"machine_boottime": "2022-06-14T22:00:23Z",
"osbuild": 20348,
"osid": "00454-40000-00001-AA081",
"osmajor": 10,
"osminor": 0,
"osproducttype": "Windows Server 2022 Standard Evaluation",
"ostype": "windows",
"osversion": "10.0.20348",
"policy": {
"binary_download_enabled": true,
"description": "",
"hibou_minimum_level": "critical",
"hibou_mode": 0,
"hibou_skip_signed_ms": false,
"hibou_skip_signed_others": false,
"hlai_minimum_level": "critical",
"hlai_mode": 1,
"hlai_skip_signed_ms": true,
"hlai_skip_signed_others": false,
"id": "e96699ef-3dd9-4718-90ef-c7e5646fd466",
"ioc_mode": 2,
"ioc_ruleset": null,
"loglevel": "ERROR",
"name": "No psexec",
"ransomguard_alert_only": false,
"revision": 5,
"self_protection": false,
"sigma_ruleset": 1,
"sleepjitter": 10,
"sleeptime": 60,
"telemetry_alerts_limit": false,
"telemetry_alerts_limit_value": 1000,
"telemetry_log": true,
"telemetry_log_limit": false,
"telemetry_log_limit_value": 1000,
"telemetry_network": true,
"telemetry_network_limit": false,
"telemetry_network_limit_value": 1000,
"telemetry_process": true,
"telemetry_process_limit": false,
"telemetry_process_limit_value": 1000,
"telemetry_remotethread": true,
"telemetry_remotethread_limit": false,
"telemetry_remotethread_limit_value": 1000,
"tenant": null,
"use_driver": true,
"use_isolation": true,
"use_process_block": true,
"use_ransomguard": true,
"use_sigma": true,
"use_sigma_process_block": false,
"yara_mode": 1,
"yara_ruleset": null,
"yara_skip_signed_ms": true,
"yara_skip_signed_others": false
},
"producttype": "server",
"servicepack": null,
"starttime": "2022-06-14T22:02:32Z",
"status": "offline",
"tenant": null,
"total_memory": 2133962752,
"uninstall_status": 0,
"update_experimental": false,
"update_status": 0,
"version": "2.15.0"
}
}
}

Human Readable Output#

Endpoint information for Hostname : DC-01#

additional_infoavg_cpuavg_memorybitnesscpu_countcpu_frequencydomainnamedriver_enableddriver_policyexternal_ipaddressfirstseengroup_counthostnameidinstalldateipaddressipmaskisolation_policyisolation_statelastseenlastseen_errorlastseen_warningmachine_boottimeosbuildosidosmajorosminorosproducttypeostypeosversionpolicyproducttypestarttimestatustotal_memoryuninstall_statusupdate_experimentalupdate_statusversion
additional_info1: null
additional_info2: null
additional_info3: null
additional_info4: null
1.0183558144.0x6423192WORKGROUPtruefalse(REDACTED)2022-06-15T06:42:50.008015Z0DC-010fae71cf-ebde-4533-a50c-b3c0290378db2022/06/15 06:38:58(REDACTED)(REDACTED)falsetrue2022-07-28T07:41:32.197641Z2022-07-28T07:47:02.197641Z2022-07-28T07:43:44.197641Z2022-06-28T14:18:31Z2034800454-40000-00001-AA596100Windows Server 2022 Standard Evaluationwindows10.0.20348id: e96699ef-3dd9-4718-90ef-c7e5646fd466
tenant: null
name: No psexec
description:
revision: 5
sleeptime: 60
sleepjitter: 10
telemetry_process: true
telemetry_process_limit: false
telemetry_process_limit_value: 1000
telemetry_network: true
telemetry_network_limit: false
telemetry_network_limit_value: 1000
telemetry_log: true
telemetry_log_limit: false
telemetry_log_limit_value: 1000
telemetry_remotethread: true
telemetry_remotethread_limit: false
telemetry_remotethread_limit_value: 1000
telemetry_alerts_limit: false
telemetry_alerts_limit_value: 1000
binary_download_enabled: true
loglevel: ERROR
use_sigma: true
ioc_mode: 2
hlai_mode: 1
hlai_skip_signed_ms: true
hlai_skip_signed_others: false
hlai_minimum_level: critical
hibou_mode: 0
hibou_skip_signed_ms: false
hibou_skip_signed_others: false
hibou_minimum_level: critical
yara_mode: 1
yara_skip_signed_ms: true
yara_skip_signed_others: false
use_driver: true
use_isolation: true
use_ransomguard: true
ransomguard_alert_only: false
self_protection: false
use_process_block: true
use_sigma_process_block: false
sigma_ruleset: 1
yara_ruleset: null
ioc_ruleset: null
server2022-06-28T14:18:47Zonline2133962752.00false02.15.0
additional_info1: null
additional_info2: null
additional_info3: null
additional_info4: null
0.6125627596.0x6423192WORKGROUPtruefalse(REDACTED)2022-06-14T22:23:08.393381Z0DC-01706d4524-dc2d-4438-bfef-3b620646db7f2022/06/14 21:56:49(REDACTED)(REDACTED)falsefalse2022-06-15T06:33:46.544505Z2022-06-15T06:39:16.544505Z2022-06-15T06:35:58.544505Z2022-06-14T22:00:23Z2034800454-40000-00001-AA081100Windows Server 2022 Standard Evaluationwindows10.0.20348id: e96699ef-3dd9-4718-90ef-c7e5646fd466
tenant: null
name: No psexec
description:
revision: 5
sleeptime: 60
sleepjitter: 10
telemetry_process: true
telemetry_process_limit: false
telemetry_process_limit_value: 1000
telemetry_network: true
telemetry_network_limit: false
telemetry_network_limit_value: 1000
telemetry_log: true
telemetry_log_limit: false
telemetry_log_limit_value: 1000
telemetry_remotethread: true
telemetry_remotethread_limit: false
telemetry_remotethread_limit_value: 1000
telemetry_alerts_limit: false
telemetry_alerts_limit_value: 1000
binary_download_enabled: true
loglevel: ERROR
use_sigma: true
ioc_mode: 2
hlai_mode: 1
hlai_skip_signed_ms: true
hlai_skip_signed_others: false
hlai_minimum_level: critical
hibou_mode: 0
hibou_skip_signed_ms: false
hibou_skip_signed_others: false
hibou_minimum_level: critical
yara_mode: 1
yara_skip_signed_ms: true
yara_skip_signed_others: false
use_driver: true
use_isolation: true
use_ransomguard: true
ransomguard_alert_only: false
self_protection: false
use_process_block: true
use_sigma_process_block: false
sigma_ruleset: 1
yara_ruleset: null
ioc_ruleset: null
server2022-06-14T22:02:32Zoffline2133962752.00false02.15.0

harfanglab-api-call#


Perform a generic API call

Base Command#

harfanglab-api-call

Input#

Argument NameDescriptionRequired
api_methodAPI method (GET, POST...).Required
api_endpointAPI endpoint (/api/version, /api/data/alert/alert/Alert/...).Optional
parametersURL parameters.Optional
dataPosted data.Optional

Context Output#

PathTypeDescription
Harfanglab.APIunknownAPI call result

Command example#

!harfanglab-api-call api_method=GET api_endpoint=/api/version

Context Example#

{
"Harfanglab": {
"API": {
"version": "2.29.7"
}
}
}

Human Readable Output#

Results#

version
2.29.7

harfanglab-telemetry-processes#


Search processes

Base Command#

harfanglab-telemetry-processes

Input#

Argument NameDescriptionRequired
hashfilehash to search (md5, sha1, sha256).Optional
hostnameEndpoint hostname.Optional
from_dateStart date (format: YYYY-MM-DDTHH:MM:SS).Optional
to_dateEnd date (format: YYYY-MM-DDTHH:MM:SS).Optional
limitMaximum number of elements to fetch. Default is 100.Optional

Context Output#

PathTypeDescription
Harfanglab.Telemetryprocesses.processesunknownProvides a list of processes
agent.agentidunknownDEPRECATED
current_directoryunknownDEPRECATED
hashes.sha256unknownDEPRECATED

Command example#

!harfanglab-telemetry-processes hostname="DC-01" hash=3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3 limit=5

Context Example#

{
"Harfanglab": {
"Telemetryprocesses": {
"processes": [
{
"commandline": "C:\\Windows\\system32\\sppsvc.exe",
"create date": "2022-07-28T07:28:58.757000Z",
"hostname": "DC-01",
"image name": "C:\\Windows\\System32\\sppsvc.exe",
"integrity level": "System",
"parent commandline": "C:\\Windows\\system32\\services.exe",
"parent image": "C:\\Windows\\System32\\services.exe",
"process name": "sppsvc.exe",
"sha256": "3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3",
"signed": true,
"signer": "Microsoft Windows",
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"commandline": "C:\\Windows\\system32\\sppsvc.exe",
"create date": "2022-07-28T06:58:58.227000Z",
"hostname": "DC-01",
"image name": "C:\\Windows\\System32\\sppsvc.exe",
"integrity level": "System",
"parent commandline": "C:\\Windows\\system32\\services.exe",
"parent image": "C:\\Windows\\System32\\services.exe",
"process name": "sppsvc.exe",
"sha256": "3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3",
"signed": true,
"signer": "Microsoft Windows",
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"commandline": "C:\\Windows\\system32\\sppsvc.exe",
"create date": "2022-07-28T06:28:57.663000Z",
"hostname": "DC-01",
"image name": "C:\\Windows\\System32\\sppsvc.exe",
"integrity level": "System",
"parent commandline": "C:\\Windows\\system32\\services.exe",
"parent image": "C:\\Windows\\System32\\services.exe",
"process name": "sppsvc.exe",
"sha256": "3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3",
"signed": true,
"signer": "Microsoft Windows",
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"commandline": "C:\\Windows\\system32\\sppsvc.exe",
"create date": "2022-07-28T05:58:57.147000Z",
"hostname": "DC-01",
"image name": "C:\\Windows\\System32\\sppsvc.exe",
"integrity level": "System",
"parent commandline": "C:\\Windows\\system32\\services.exe",
"parent image": "C:\\Windows\\System32\\services.exe",
"process name": "sppsvc.exe",
"sha256": "3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3",
"signed": true,
"signer": "Microsoft Windows",
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"commandline": "C:\\Windows\\system32\\sppsvc.exe",
"create date": "2022-07-28T05:28:56.585000Z",
"hostname": "DC-01",
"image name": "C:\\Windows\\System32\\sppsvc.exe",
"integrity level": "System",
"parent commandline": "C:\\Windows\\system32\\services.exe",
"parent image": "C:\\Windows\\System32\\services.exe",
"process name": "sppsvc.exe",
"sha256": "3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3",
"signed": true,
"signer": "Microsoft Windows",
"username": "NT AUTHORITY\\NETWORK SERVICE"
}
]
}
}
}

Human Readable Output#

Processes list#

create datehostnameprocess nameimage namecommandlineintegrity levelparent imageparent commandlineusernamesignedsignersha256
2022-07-28T07:28:58.757000ZDC-01sppsvc.exeC:\Windows\System32\sppsvc.exeC:\Windows\system32\sppsvc.exeSystemC:\Windows\System32\services.exeC:\Windows\system32\services.exeNT AUTHORITY\NETWORK SERVICEtrueMicrosoft Windows3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3
2022-07-28T06:58:58.227000ZDC-01sppsvc.exeC:\Windows\System32\sppsvc.exeC:\Windows\system32\sppsvc.exeSystemC:\Windows\System32\services.exeC:\Windows\system32\services.exeNT AUTHORITY\NETWORK SERVICEtrueMicrosoft Windows3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3
2022-07-28T06:28:57.663000ZDC-01sppsvc.exeC:\Windows\System32\sppsvc.exeC:\Windows\system32\sppsvc.exeSystemC:\Windows\System32\services.exeC:\Windows\system32\services.exeNT AUTHORITY\NETWORK SERVICEtrueMicrosoft Windows3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3
2022-07-28T05:58:57.147000ZDC-01sppsvc.exeC:\Windows\System32\sppsvc.exeC:\Windows\system32\sppsvc.exeSystemC:\Windows\System32\services.exeC:\Windows\system32\services.exeNT AUTHORITY\NETWORK SERVICEtrueMicrosoft Windows3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3
2022-07-28T05:28:56.585000ZDC-01sppsvc.exeC:\Windows\System32\sppsvc.exeC:\Windows\system32\sppsvc.exeSystemC:\Windows\System32\services.exeC:\Windows\system32\services.exeNT AUTHORITY\NETWORK SERVICEtrueMicrosoft Windows3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3

Command example#

!harfanglab-telemetry-processes hostname="DC-01" limit=5

Context Example#

{
"Harfanglab": {
"Telemetryprocesses": {
"processes": [
{
"commandline": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe /ua /installsource scheduler",
"create date": "2022-07-28T07:45:44.942000Z",
"hostname": "DC-01",
"image name": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe",
"integrity level": "System",
"parent commandline": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p",
"parent image": "C:\\Windows\\System32\\svchost.exe",
"process name": "MicrosoftEdgeUpdate.exe",
"sha256": "bef9dbed290af17cf3f30cc43fc0a94cdadc540f171c25df1363b2e852d0a042",
"signed": true,
"signer": "Microsoft Corporation",
"username": "NT AUTHORITY\\SYSTEM"
},
{
"commandline": "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1",
"create date": "2022-07-28T07:45:44.711000Z",
"hostname": "DC-01",
"image name": "C:\\Windows\\System32\\conhost.exe",
"integrity level": "System",
"parent commandline": "C:\\Program Files\\HarfangLab\\hurukai.exe {cf4a9162-2af0-0afe-8c36-45fd3dd29574}",
"parent image": "C:\\Program Files\\HarfangLab\\hurukai.exe",
"process name": "conhost.exe",
"sha256": "6b481d656414c50d8bd0bedcd615aeaf2f5f68576cb6732a9548e0da87729733",
"signed": true,
"signer": "Microsoft Windows",
"username": "NT AUTHORITY\\SYSTEM"
},
{
"commandline": "C:\\Program Files\\HarfangLab\\hurukai.exe {cf4a9162-2af0-0afe-8c36-45fd3dd29574}",
"create date": "2022-07-28T07:45:44.704000Z",
"hostname": "DC-01",
"image name": "C:\\Program Files\\HarfangLab\\hurukai.exe",
"integrity level": "System",
"parent commandline": "C:\\Program Files\\HarfangLab\\hurukai.exe",
"parent image": "C:\\Program Files\\HarfangLab\\hurukai.exe",
"process name": "hurukai.exe",
"sha256": "9d81d385fe2f41e8f4f96d64a37899003b54a644ba67f7197f0cdbd0b71144f0",
"signed": true,
"signer": "HARFANGLAB SAS",
"username": "NT AUTHORITY\\SYSTEM"
},
{
"commandline": "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1",
"create date": "2022-07-28T07:44:40.370000Z",
"hostname": "DC-01",
"image name": "C:\\Windows\\System32\\conhost.exe",
"integrity level": "System",
"parent commandline": "C:\\Program Files\\HarfangLab\\hurukai.exe {e273729b-d2f8-53a9-a10f-a60459dacc23}",
"parent image": "C:\\Program Files\\HarfangLab\\hurukai.exe",
"process name": "conhost.exe",
"sha256": "6b481d656414c50d8bd0bedcd615aeaf2f5f68576cb6732a9548e0da87729733",
"signed": true,
"signer": "Microsoft Windows",
"username": "NT AUTHORITY\\SYSTEM"
},
{
"commandline": "C:\\Program Files\\HarfangLab\\hurukai.exe {e273729b-d2f8-53a9-a10f-a60459dacc23}",
"create date": "2022-07-28T07:44:40.363000Z",
"hostname": "DC-01",
"image name": "C:\\Program Files\\HarfangLab\\hurukai.exe",
"integrity level": "System",
"parent commandline": "C:\\Program Files\\HarfangLab\\hurukai.exe",
"parent image": "C:\\Program Files\\HarfangLab\\hurukai.exe",
"process name": "hurukai.exe",
"sha256": "9d81d385fe2f41e8f4f96d64a37899003b54a644ba67f7197f0cdbd0b71144f0",
"signed": true,
"signer": "HARFANGLAB SAS",
"username": "NT AUTHORITY\\SYSTEM"
}
]
}
}
}

Human Readable Output#

Processes list#

create datehostnameprocess nameimage namecommandlineintegrity levelparent imageparent commandlineusernamesignedsignersha256
2022-07-28T07:45:44.942000ZDC-01MicrosoftEdgeUpdate.exeC:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exeC:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe /ua /installsource schedulerSystemC:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -pNT AUTHORITY\SYSTEMtrueMicrosoft Corporationbef9dbed290af17cf3f30cc43fc0a94cdadc540f171c25df1363b2e852d0a042
2022-07-28T07:45:44.711000ZDC-01conhost.exeC:\Windows\System32\conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1SystemC:\Program Files\HarfangLab\hurukai.exeC:\Program Files\HarfangLab\hurukai.exe {cf4a9162-2af0-0afe-8c36-45fd3dd29574}NT AUTHORITY\SYSTEMtrueMicrosoft Windows6b481d656414c50d8bd0bedcd615aeaf2f5f68576cb6732a9548e0da87729733
2022-07-28T07:45:44.704000ZDC-01hurukai.exeC:\Program Files\HarfangLab\hurukai.exeC:\Program Files\HarfangLab\hurukai.exe {cf4a9162-2af0-0afe-8c36-45fd3dd29574}SystemC:\Program Files\HarfangLab\hurukai.exeC:\Program Files\HarfangLab\hurukai.exeNT AUTHORITY\SYSTEMtrueHARFANGLAB SAS9d81d385fe2f41e8f4f96d64a37899003b54a644ba67f7197f0cdbd0b71144f0
2022-07-28T07:44:40.370000ZDC-01conhost.exeC:\Windows\System32\conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1SystemC:\Program Files\HarfangLab\hurukai.exeC:\Program Files\HarfangLab\hurukai.exe {e273729b-d2f8-53a9-a10f-a60459dacc23}NT AUTHORITY\SYSTEMtrueMicrosoft Windows6b481d656414c50d8bd0bedcd615aeaf2f5f68576cb6732a9548e0da87729733
2022-07-28T07:44:40.363000ZDC-01hurukai.exeC:\Program Files\HarfangLab\hurukai.exeC:\Program Files\HarfangLab\hurukai.exe {e273729b-d2f8-53a9-a10f-a60459dacc23}SystemC:\Program Files\HarfangLab\hurukai.exeC:\Program Files\HarfangLab\hurukai.exeNT AUTHORITY\SYSTEMtrueHARFANGLAB SAS9d81d385fe2f41e8f4f96d64a37899003b54a644ba67f7197f0cdbd0b71144f0

Command example#

!harfanglab-telemetry-processes hash=3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3 limit=5

Context Example#

{
"Harfanglab": {
"Telemetryprocesses": {
"processes": [
{
"commandline": "C:\\Windows\\system32\\sppsvc.exe",
"create date": "2022-07-28T07:46:16.086000Z",
"hostname": "WEBSERVER",
"image name": "C:\\Windows\\System32\\sppsvc.exe",
"integrity level": "System",
"parent commandline": "C:\\Windows\\system32\\services.exe",
"parent image": "C:\\Windows\\System32\\services.exe",
"process name": "sppsvc.exe",
"sha256": "3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3",
"signed": true,
"signer": "Microsoft Windows",
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"commandline": "C:\\Windows\\system32\\sppsvc.exe",
"create date": "2022-07-28T07:29:25.127000Z",
"hostname": "WEBSERVER",
"image name": "C:\\Windows\\System32\\sppsvc.exe",
"integrity level": "System",
"parent commandline": "C:\\Windows\\system32\\services.exe",
"parent image": "C:\\Windows\\System32\\services.exe",
"process name": "sppsvc.exe",
"sha256": "3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3",
"signed": true,
"signer": "Microsoft Windows",
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"commandline": "C:\\Windows\\system32\\sppsvc.exe",
"create date": "2022-07-28T07:28:58.757000Z",
"hostname": "DC-01",
"image name": "C:\\Windows\\System32\\sppsvc.exe",
"integrity level": "System",
"parent commandline": "C:\\Windows\\system32\\services.exe",
"parent image": "C:\\Windows\\System32\\services.exe",
"process name": "sppsvc.exe",
"sha256": "3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3",
"signed": true,
"signer": "Microsoft Windows",
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"commandline": "C:\\Windows\\system32\\sppsvc.exe",
"create date": "2022-07-28T06:59:24.716000Z",
"hostname": "WEBSERVER",
"image name": "C:\\Windows\\System32\\sppsvc.exe",
"integrity level": "System",
"parent commandline": "C:\\Windows\\system32\\services.exe",
"parent image": "C:\\Windows\\System32\\services.exe",
"process name": "sppsvc.exe",
"sha256": "3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3",
"signed": true,
"signer": "Microsoft Windows",
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"commandline": "C:\\Windows\\system32\\sppsvc.exe",
"create date": "2022-07-28T06:58:58.227000Z",
"hostname": "DC-01",
"image name": "C:\\Windows\\System32\\sppsvc.exe",
"integrity level": "System",
"parent commandline": "C:\\Windows\\system32\\services.exe",
"parent image": "C:\\Windows\\System32\\services.exe",
"process name": "sppsvc.exe",
"sha256": "3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3",
"signed": true,
"signer": "Microsoft Windows",
"username": "NT AUTHORITY\\NETWORK SERVICE"
}
]
}
}
}

Human Readable Output#

Processes list#

create datehostnameprocess nameimage namecommandlineintegrity levelparent imageparent commandlineusernamesignedsignersha256
2022-07-28T07:46:16.086000ZWEBSERVERsppsvc.exeC:\Windows\System32\sppsvc.exeC:\Windows\system32\sppsvc.exeSystemC:\Windows\System32\services.exeC:\Windows\system32\services.exeNT AUTHORITY\NETWORK SERVICEtrueMicrosoft Windows3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3
2022-07-28T07:29:25.127000ZWEBSERVERsppsvc.exeC:\Windows\System32\sppsvc.exeC:\Windows\system32\sppsvc.exeSystemC:\Windows\System32\services.exeC:\Windows\system32\services.exeNT AUTHORITY\NETWORK SERVICEtrueMicrosoft Windows3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3
2022-07-28T07:28:58.757000ZDC-01sppsvc.exeC:\Windows\System32\sppsvc.exeC:\Windows\system32\sppsvc.exeSystemC:\Windows\System32\services.exeC:\Windows\system32\services.exeNT AUTHORITY\NETWORK SERVICEtrueMicrosoft Windows3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3
2022-07-28T06:59:24.716000ZWEBSERVERsppsvc.exeC:\Windows\System32\sppsvc.exeC:\Windows\system32\sppsvc.exeSystemC:\Windows\System32\services.exeC:\Windows\system32\services.exeNT AUTHORITY\NETWORK SERVICEtrueMicrosoft Windows3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3
2022-07-28T06:58:58.227000ZDC-01sppsvc.exeC:\Windows\System32\sppsvc.exeC:\Windows\system32\sppsvc.exeSystemC:\Windows\System32\services.exeC:\Windows\system32\services.exeNT AUTHORITY\NETWORK SERVICEtrueMicrosoft Windows3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3

Command example#

!harfanglab-telemetry-processes hostname="DC-01" from_date="2022-07-22T20:26:10" to_date="2022-07-22T20:26:20" limit=5

Context Example#

{
"Harfanglab": {
"Telemetryprocesses": {
"processes": [
{
"commandline": "C:\\Windows\\system32\\sppsvc.exe",
"create date": "2022-07-22T20:26:19.645000Z",
"hostname": "DC-01",
"image name": "C:\\Windows\\System32\\sppsvc.exe",
"integrity level": "System",
"parent commandline": "C:\\Windows\\system32\\services.exe",
"parent image": "C:\\Windows\\System32\\services.exe",
"process name": "sppsvc.exe",
"sha256": "3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3",
"signed": true,
"signer": "Microsoft Windows",
"username": "NT AUTHORITY\\NETWORK SERVICE"
}
]
}
}
}

Human Readable Output#

Processes list#

create datehostnameprocess nameimage namecommandlineintegrity levelparent imageparent commandlineusernamesignedsignersha256
2022-07-22T20:26:19.645000ZDC-01sppsvc.exeC:\Windows\System32\sppsvc.exeC:\Windows\system32\sppsvc.exeSystemC:\Windows\System32\services.exeC:\Windows\system32\services.exeNT AUTHORITY\NETWORK SERVICEtrueMicrosoft Windows3541d189d1bd3341a72769d43bf487eaa3b20e80aa04a54550bbfa9a04360db3

harfanglab-job-pipelist#


Start a job to get the list of pipes from a host (Windows)

Base Command#

harfanglab-job-pipelist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-pipelist agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "getPipeList",
"ID": "974d7732-481b-444e-8f30-37db662d23d5"
}
}
}

Human Readable Output#

{
"Action": "getPipeList",
"ID": "974d7732-481b-444e-8f30-37db662d23d5"
}

harfanglab-job-artifact-downloadfile#


Start a job to download a file from a host (Windows / Linux)

Base Command#

harfanglab-job-artifact-downloadfile

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required
filenamePath of the file to download.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-artifact-downloadfile agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db" filename="C:\\Program Files\\HarfangLab\\agent.ini"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "downloadFile",
"ID": "7c5a2c3c-0455-4b4e-a7ee-acf7737f86f8"
}
}
}

Human Readable Output#

{
"Action": "downloadFile",
"ID": "7c5a2c3c-0455-4b4e-a7ee-acf7737f86f8"
}

harfanglab-job-prefetchlist#


Start a job to get the list of prefetches from a host (Windows)

Base Command#

harfanglab-job-prefetchlist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-prefetchlist agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "getPrefetch",
"ID": "153d0791-7eef-4d7e-b1be-61fec1e5a140"
}
}
}

Human Readable Output#

{
"Action": "getPrefetch",
"ID": "153d0791-7eef-4d7e-b1be-61fec1e5a140"
}

harfanglab-job-runkeylist#


Start a job to get the list of run keys from a host (Windows)

Base Command#

harfanglab-job-runkeylist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-runkeylist agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "getHives",
"ID": "eadc130a-fa7f-41e6-a1bb-e9022b232b32"
}
}
}

Human Readable Output#

{
"Action": "getHives",
"ID": "eadc130a-fa7f-41e6-a1bb-e9022b232b32"
}

harfanglab-job-scheduledtasklist#


Start a job to get the list of scheduled tasks from a host (Windows)

Base Command#

harfanglab-job-scheduledtasklist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-scheduledtasklist agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "getScheduledTasks",
"ID": "e81e3105-5f8e-4caf-9947-b252721b4196"
}
}
}

Human Readable Output#

{
"Action": "getScheduledTasks",
"ID": "e81e3105-5f8e-4caf-9947-b252721b4196"
}

harfanglab-job-driverlist#


Start a job to get the list of drivers from a host (Windows)

Base Command#

harfanglab-job-driverlist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-driverlist agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "getLoadedDriverList",
"ID": "a4ce02be-38f0-4782-8d2d-0da99fd318db"
}
}
}

Human Readable Output#

{
"Action": "getLoadedDriverList",
"ID": "a4ce02be-38f0-4782-8d2d-0da99fd318db"
}

harfanglab-job-servicelist#


Start a job to get the list of services from a host (Windows)

Base Command#

harfanglab-job-servicelist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-servicelist agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "getHives",
"ID": "fcd8d44c-109f-43e9-8b9a-7268121a46a7"
}
}
}

Human Readable Output#

{
"Action": "getHives",
"ID": "fcd8d44c-109f-43e9-8b9a-7268121a46a7"
}

harfanglab-job-processlist#


Start a job to get the list of processes from a host (Windows / Linux)

Base Command#

harfanglab-job-processlist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-processlist agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "getProcessList",
"ID": "45696894-17c5-4304-9198-9084aa1f6847"
}
}
}

Human Readable Output#

{
"Action": "getProcessList",
"ID": "45696894-17c5-4304-9198-9084aa1f6847"
}

harfanglab-job-networkconnectionlist#


Start a job to get the list of network connections from a host (Windows / Linux)

Base Command#

harfanglab-job-networkconnectionlist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-networkconnectionlist agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "getProcessList",
"ID": "ac1cbd6c-ac39-4940-8c4b-85071be7c878"
}
}
}

Human Readable Output#

{
"Action": "getProcessList",
"ID": "ac1cbd6c-ac39-4940-8c4b-85071be7c878"
}

harfanglab-job-networksharelist#


Start a job to get the list of network shares from a host (Windows)

Base Command#

harfanglab-job-networksharelist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-networksharelist agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "getNetworkShare",
"ID": "b663d820-029b-414d-8bf3-5c7b973c7954"
}
}
}

Human Readable Output#

{
"Action": "getNetworkShare",
"ID": "b663d820-029b-414d-8bf3-5c7b973c7954"
}

harfanglab-job-sessionlist#


Start a job to get the list of sessions from a host (Windows)

Base Command#

harfanglab-job-sessionlist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-sessionlist agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "getSessions",
"ID": "2b48e4aa-fa28-4b21-b1a7-f70bde1c59c7"
}
}
}

Human Readable Output#

{
"Action": "getSessions",
"ID": "2b48e4aa-fa28-4b21-b1a7-f70bde1c59c7"
}

harfanglab-job-persistencelist#


Start a job to get the list of persistence items from a host (Linux)

Base Command#

harfanglab-job-persistencelist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-persistencelist agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "persistanceScanner",
"ID": "30a54484-c359-4220-bb5c-6e07c7a9359e"
}
}
}

Human Readable Output#

{
"Action": "persistanceScanner",
"ID": "30a54484-c359-4220-bb5c-6e07c7a9359e"
}

harfanglab-job-ioc#


Start a job to search for IOCs on a host (Windows / Linux)

Base Command#

harfanglab-job-ioc

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required
filenameexact filename to search.Optional
filepathexact filepath to search.Optional
hashfilehash to search (md5, sha1, sha256).Optional
search_in_pathrestrict searchs for filename or filepath or filepath_regex to a given path.Optional
hash_filesizesize of the file associated to the 'hash' parameters (DEPRECATED, rather use the 'filesize' parameter). If known, it will speed up the search process.Optional
filesizesize of the file to search (can be used when searching a file from a hash or from a filename). If known, it will speed up the search process.Optional
registryregex to search in registry (key or value).Optional
filepath_regexsearch a regex on a filepath .Optional

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-ioc agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db" filename="agent.ini"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "IOCScan",
"ID": "0751d384-601a-40a4-afc6-7574f80f72bf"
}
}
}

Human Readable Output#

{
"Action": "IOCScan",
"ID": "0751d384-601a-40a4-afc6-7574f80f72bf"
}

Command example#

!harfanglab-job-ioc agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db" filename="agent.ini" search_in_path="C:\\Program Files"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "IOCScan",
"ID": "56a9b602-e6e5-4130-8b51-861a383f42bc"
}
}
}

Human Readable Output#

{
"Action": "IOCScan",
"ID": "56a9b602-e6e5-4130-8b51-861a383f42bc"
}

Command example#

!harfanglab-job-ioc agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db" filename="agent.ini" filesize=1688

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "IOCScan",
"ID": "1e68fb44-843e-445b-a926-755da0ce2321"
}
}
}

Human Readable Output#

{
"Action": "IOCScan",
"ID": "1e68fb44-843e-445b-a926-755da0ce2321"
}

Command example#

!harfanglab-job-ioc agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db" filepath="C:\\windows\\system32\\calc.exe"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "IOCScan",
"ID": "f78d2479-9651-488f-9b94-e9019b918b26"
}
}
}

Human Readable Output#

{
"Action": "IOCScan",
"ID": "f78d2479-9651-488f-9b94-e9019b918b26"
}

Command example#

!harfanglab-job-ioc agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db" filepath_regex="System32\\\\calc\\.exe"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "IOCScan",
"ID": "cbe0239e-3297-4cbb-a06b-75df2f5608d2"
}
}
}

Human Readable Output#

{
"Action": "IOCScan",
"ID": "cbe0239e-3297-4cbb-a06b-75df2f5608d2"
}

Command example#

!harfanglab-job-ioc agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db" hash=4208893c871d2499f184e3f0f2554da89f451fa9e98d95fc9516c5ae8f2b3bbd filesize=45056

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "IOCScan",
"ID": "574b6d2a-4621-4883-bd0e-7bf603566a94"
}
}
}

Human Readable Output#

{
"Action": "IOCScan",
"ID": "574b6d2a-4621-4883-bd0e-7bf603566a94"
}

Command example#

!harfanglab-job-ioc agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db" registry="DLLPath"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "IOCScan",
"ID": "b69dd316-4c47-479a-bd0f-46bfedd01180"
}
}
}

Human Readable Output#

{
"Action": "IOCScan",
"ID": "b69dd316-4c47-479a-bd0f-46bfedd01180"
}

Command example#

!harfanglab-job-ioc agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db" registry="hmmapi"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "IOCScan",
"ID": "89290f68-33a1-4335-a221-5bc163fa1270"
}
}
}

Human Readable Output#

{
"Action": "IOCScan",
"ID": "89290f68-33a1-4335-a221-5bc163fa1270"
}

harfanglab-job-startuplist#


Start a job to get the list of startup items from a host (Windows)

Base Command#

harfanglab-job-startuplist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-startuplist agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "getStartupFileList",
"ID": "d9d6b338-75ce-4ab6-8223-531e29c07ae6"
}
}
}

Human Readable Output#

{
"Action": "getStartupFileList",
"ID": "d9d6b338-75ce-4ab6-8223-531e29c07ae6"
}

harfanglab-job-wmilist#


Start a job to get the list of WMI items from a host (Windows)

Base Command#

harfanglab-job-wmilist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-wmilist agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "getWMI",
"ID": "e51124be-7720-4a0d-868f-3521a5ce0e9f"
}
}
}

Human Readable Output#

{
"Action": "getWMI",
"ID": "e51124be-7720-4a0d-868f-3521a5ce0e9f"
}

harfanglab-job-artifact-mft#


Start a job to download the MFT from a host (Windows)

Base Command#

harfanglab-job-artifact-mft

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-artifact-mft agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "collectRAWEvidences",
"ID": "57c3da8c-a68f-4f1d-b521-cd811e97f62b"
}
}
}

Human Readable Output#

{
"Action": "collectRAWEvidences",
"ID": "57c3da8c-a68f-4f1d-b521-cd811e97f62b"
}

harfanglab-job-artifact-hives#


Start a job to download the hives from a host (Windows)

Base Command#

harfanglab-job-artifact-hives

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-artifact-hives agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "collectRAWEvidences",
"ID": "36bc0da2-a557-4576-af8e-344d91364c70"
}
}
}

Human Readable Output#

{
"Action": "collectRAWEvidences",
"ID": "36bc0da2-a557-4576-af8e-344d91364c70"
}

harfanglab-job-artifact-evtx#


Start a job to download the event logs from a host (Windows)

Base Command#

harfanglab-job-artifact-evtx

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-artifact-evtx agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "collectRAWEvidences",
"ID": "707ab8c7-e2e9-4921-ad1e-0823def79d83"
}
}
}

Human Readable Output#

{
"Action": "collectRAWEvidences",
"ID": "707ab8c7-e2e9-4921-ad1e-0823def79d83"
}

harfanglab-job-artifact-logs#


Start a job to download Linux log files from a host (Linux)

Base Command#

harfanglab-job-artifact-logs

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-artifact-logs agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "collectRAWEvidences",
"ID": "8989756f-1947-4fd1-9734-8fecb58d6f64"
}
}
}

Human Readable Output#

{
"Action": "collectRAWEvidences",
"ID": "8989756f-1947-4fd1-9734-8fecb58d6f64"
}

harfanglab-job-artifact-filesystem#


Start a job to download Linux filesystem entries from a host (Linux)

Base Command#

harfanglab-job-artifact-filesystem

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-artifact-filesystem agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "collectRAWEvidences",
"ID": "d351e9be-3f0e-4ccc-876f-8b28f208ffa7"
}
}
}

Human Readable Output#

{
"Action": "collectRAWEvidences",
"ID": "d351e9be-3f0e-4ccc-876f-8b28f208ffa7"
}

harfanglab-job-artifact-all#


Start a job to download all artifacts from a host (Windows MFT, Hives, evt/evtx, Prefetch, USN, Linux logs and file list)

Base Command#

harfanglab-job-artifact-all

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-artifact-all agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "collectRAWEvidences",
"ID": "312a3857-935c-4b23-9d58-cc29bb9dda18"
}
}
}

Human Readable Output#

{
"Action": "collectRAWEvidences",
"ID": "312a3857-935c-4b23-9d58-cc29bb9dda18"
}

harfanglab-job-artifact-ramdump#


Start a job to get the entine RAM from a host (Windows / Linux)

Base Command#

harfanglab-job-artifact-ramdump

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
Harfanglab.Job.ActionstringHarfangLab job action

Command example#

!harfanglab-job-artifact-ramdump agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Context Example#

{
"Harfanglab": {
"Job": {
"Action": "memoryDumper",
"ID": "27df9e9b-6201-4efe-9d86-986fe47739ee"
}
}
}

Human Readable Output#

{
"Action": "memoryDumper",
"ID": "27df9e9b-6201-4efe-9d86-986fe47739ee"
}

harfanglab-telemetry-network#


Search network connections

Base Command#

harfanglab-telemetry-network

Input#

Argument NameDescriptionRequired
hostnameEndpoint hostname.Optional
from_dateStart date (format: YYYY-MM-DDTHH:MM:SS).Optional
to_dateEnd date (format: YYYY-MM-DDTHH:MM:SS).Optional
source_addressSource IP address.Optional
source_portSource port.Optional
destination_addressDestination IP address.Optional
destination_portDestination port.Optional
limitMaximum number of elements to fetch. Default is 100.Optional

Context Output#

PathTypeDescription
Harfanglab.Telemetrynetwork.networkunknownProvides a list of network connections

Command example#

!harfanglab-telemetry-network hostname="DC-01" limit=5

Context Example#

{
"Harfanglab": {
"Telemetrynetwork": {
"network": [
{
"create date": "2022-06-29T22:33:42.434000Z",
"destination addr": "(REDACTED)",
"destination port": 443,
"direction": "out",
"hostname": "DC-01",
"image name": "C:\\Windows\\System32\\svchost.exe",
"source address": "(REDACTED)",
"source port": 50000,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"create date": "2022-06-29T22:24:08.088000Z",
"destination addr": "(REDACTED)",
"destination port": 80,
"direction": "out",
"hostname": "DC-01",
"image name": "C:\\Windows\\System32\\svchost.exe",
"source address": "(REDACTED)",
"source port": 49998,
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"create date": "2022-06-29T22:23:08.037000Z",
"destination addr": "(REDACTED)",
"destination port": 443,
"direction": "out",
"hostname": "DC-01",
"image name": "C:\\Windows\\System32\\svchost.exe",
"source address": "(REDACTED)",
"source port": 49997,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"create date": "2022-06-29T22:08:07.550000Z",
"destination addr": "(REDACTED)",
"destination port": 443,
"direction": "out",
"hostname": "DC-01",
"image name": "C:\\Windows\\System32\\svchost.exe",
"source address": "(REDACTED)",
"source port": 49996,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"create date": "2022-06-29T22:04:42.848000Z",
"destination addr": "(REDACTED)",
"destination port": 80,
"direction": "out",
"hostname": "DC-01",
"image name": "C:\\Windows\\System32\\svchost.exe",
"source address": "(REDACTED)",
"source port": 49995,
"username": "NT AUTHORITY\\NETWORK SERVICE"
}
]
}
}
}

Human Readable Output#

Network list#

create datehostnameimage nameusernamesource addresssource portdestination addrdestination portdirection
2022-06-29T22:33:42.434000ZDC-01C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEM(REDACTED)50000(REDACTED)443out
2022-06-29T22:24:08.088000ZDC-01C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICE(REDACTED)49998(REDACTED)80out
2022-06-29T22:23:08.037000ZDC-01C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEM(REDACTED)49997(REDACTED)443out
2022-06-29T22:08:07.550000ZDC-01C:\Windows\System32\svchost.exeNT AUTHORITY\SYSTEM(REDACTED)49996(REDACTED)443out
2022-06-29T22:04:42.848000ZDC-01C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICE(REDACTED)49995(REDACTED)80out

Command example#

!harfanglab-telemetry-network destination_address="(REDACTED)" limit=5

Context Example#

{
"Harfanglab": {
"Telemetrynetwork": {
"network": [
{
"create date": "2022-07-27T14:59:56.114000Z",
"destination addr": "(REDACTED)",
"destination port": 80,
"direction": "out",
"hostname": "WORKSTATION-1879",
"image name": "C:\\Windows\\System32\\svchost.exe",
"source address": "(REDACTED)",
"source port": 62787,
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"create date": "2022-07-27T14:58:43.590000Z",
"destination addr": "(REDACTED)",
"destination port": 80,
"direction": "out",
"hostname": "WORKSTATION-3752",
"image name": "C:\\Windows\\System32\\svchost.exe",
"source address": "(REDACTED)",
"source port": 64593,
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"create date": "2022-07-27T14:49:54.374000Z",
"destination addr": "(REDACTED)",
"destination port": 80,
"direction": "out",
"hostname": "WORKSTATION-6852",
"image name": "C:\\Windows\\System32\\svchost.exe",
"source address": "(REDACTED)",
"source port": 61571,
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"create date": "2022-07-27T14:49:14.813000Z",
"destination addr": "(REDACTED)",
"destination port": 80,
"direction": "out",
"hostname": "WORKSTATION-4321",
"image name": "C:\\Windows\\System32\\svchost.exe",
"source address": "(REDACTED)",
"source port": 61605,
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"create date": "2022-07-27T07:59:49.780000Z",
"destination addr": "(REDACTED)",
"destination port": 80,
"direction": "out",
"hostname": "WORKSTATION-1879",
"image name": "C:\\Windows\\System32\\svchost.exe",
"source address": "(REDACTED)",
"source port": 62472,
"username": "NT AUTHORITY\\NETWORK SERVICE"
}
]
}
}
}

Human Readable Output#

Network list#

create datehostnameimage nameusernamesource addresssource portdestination addrdestination portdirection
2022-07-27T14:59:56.114000ZWORKSTATION-1879C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICE(REDACTED)62787(REDACTED)80out
2022-07-27T14:58:43.590000ZWORKSTATION-3752C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICE(REDACTED)64593(REDACTED)80out
2022-07-27T14:49:54.374000ZWORKSTATION-6852C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICE(REDACTED)61571(REDACTED)80out
2022-07-27T14:49:14.813000ZWORKSTATION-4321C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICE(REDACTED)61605(REDACTED)80out
2022-07-27T07:59:49.780000ZWORKSTATION-1879C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICE(REDACTED)62472(REDACTED)80out

Command example#

!harfanglab-telemetry-network destination_address="(REDACTED)" from_date="2022-07-21T12:34:05" to_date="2022-07-21T12:34:15" limit=5

Context Example#

{
"Harfanglab": {
"Telemetrynetwork": {
"network": [
{
"create date": "2022-07-21T12:34:09.265000Z",
"destination addr": "(REDACTED)",
"destination port": 80,
"direction": "out",
"hostname": "WORKSTATION-4812",
"image name": "C:\\Windows\\System32\\svchost.exe",
"source address": "(REDACTED)",
"source port": 50363,
"username": "NT AUTHORITY\\NETWORK SERVICE"
}
]
}
}
}

Human Readable Output#

Network list#

create datehostnameimage nameusernamesource addresssource portdestination addrdestination portdirection
2022-07-21T12:34:09.265000ZWORKSTATION-4812C:\Windows\System32\svchost.exeNT AUTHORITY\NETWORK SERVICE(REDACTED)50363(REDACTED)80out

harfanglab-telemetry-eventlog#


Search event logs

Base Command#

harfanglab-telemetry-eventlog

Input#

Argument NameDescriptionRequired
hostnameEndpoint hostname.Optional
event_idEvent id.Optional
from_dateStart date (format: YYYY-MM-DDTHH:MM:SS).Optional
to_dateEnd date (format: YYYY-MM-DDTHH:MM:SS).Optional
limitMaximum number of elements to fetch. Default is 100.Optional

Context Output#

PathTypeDescription
Harfanglab.Telemetryeventlog.eventlogunknownProvides a list of event logs

Command example#

!harfanglab-telemetry-eventlog hostname="DC-01" limit=5

Context Example#

{
"Harfanglab": {
"Telemetryeventlog": {
"eventlog": [
{
"create date": "2022-07-28T07:29:29.327000Z",
"event data": {
"Binary": "7300700070007300760063002F0031000000",
"param1": "Software Protection",
"param2": "stopped"
},
"event id": 7036,
"hostname": "DC-01",
"keywords": [
"Classic"
],
"level": "Information",
"log name": "System",
"source name": "Service Control Manager"
},
{
"create date": "2022-07-28T07:29:29.311000Z",
"event data": {
"param1": "2022-11-12T06:42:29Z",
"param2": "RulesEngine"
},
"event id": 16384,
"hostname": "DC-01",
"keywords": [
"Classic"
],
"level": "Information",
"log name": "Application",
"source name": "Microsoft-Windows-Security-SPP"
},
{
"create date": "2022-07-28T07:28:58.905000Z",
"event data": null,
"event id": 16394,
"hostname": "DC-01",
"keywords": [
"Classic"
],
"level": "Information",
"log name": "Application",
"source name": "Microsoft-Windows-Security-SPP"
},
{
"create date": "2022-07-28T07:28:58.795000Z",
"event data": {
"Binary": "7300700070007300760063002F0034000000",
"param1": "Software Protection",
"param2": "running"
},
"event id": 7036,
"hostname": "DC-01",
"keywords": [
"Classic"
],
"level": "Information",
"log name": "System",
"source name": "Service Control Manager"
},
{
"create date": "2022-07-28T07:26:50.139000Z",
"event data": {
"Binary": "540072007500730074006500640049006E007300740061006C006C00650072002F0031000000",
"param1": "Windows Modules Installer",
"param2": "stopped"
},
"event id": 7036,
"hostname": "DC-01",
"keywords": [
"Classic"
],
"level": "Information",
"log name": "System",
"source name": "Service Control Manager"
}
]
}
}
}

Human Readable Output#

Event Log list#

create datehostnameevent idsource namelog namekeywordsevent datalevel
2022-07-28T07:29:29.327000ZDC-017036Service Control ManagerSystemClassicparam1: Software Protection
param2: stopped
Binary: 7300700070007300760063002F0031000000
Information
2022-07-28T07:29:29.311000ZDC-0116384Microsoft-Windows-Security-SPPApplicationClassicparam1: 2022-11-12T06:42:29Z
param2: RulesEngine
Information
2022-07-28T07:28:58.905000ZDC-0116394Microsoft-Windows-Security-SPPApplicationClassicInformation
2022-07-28T07:28:58.795000ZDC-017036Service Control ManagerSystemClassicparam1: Software Protection
param2: running
Binary: 7300700070007300760063002F0034000000
Information
2022-07-28T07:26:50.139000ZDC-017036Service Control ManagerSystemClassicparam1: Windows Modules Installer
param2: stopped
Binary: 540072007500730074006500640049006E007300740061006C006C00650072002F0031000000
Information

Command example#

!harfanglab-telemetry-eventlog hostname="DC-01" event_id=4624 limit=5

Context Example#

{
"Harfanglab": {
"Telemetryeventlog": {
"eventlog": [
{
"create date": "2022-07-28T07:24:48.105000Z",
"event data": {
"AuthenticationPackageName": "Negotiate",
"ElevatedToken": "%%1842",
"ImpersonationLevel": "%%1833",
"IpAddress": "-",
"IpPort": "-",
"KeyLength": "0",
"LmPackageName": "-",
"LogonGuid": "{00000000-0000-0000-0000-000000000000}",
"LogonProcessName": "Advapi ",
"LogonType": "5",
"ProcessId": "0x278",
"ProcessName": "C:\\Windows\\System32\\services.exe",
"RestrictedAdminMode": "-",
"SubjectDomainName": "WORKGROUP",
"SubjectLogonId": "0x3e7",
"SubjectUserName": "DC-01$",
"SubjectUserSid": "S-1-5-18",
"TargetDomainName": "NT AUTHORITY",
"TargetLinkedLogonId": "0x0",
"TargetLogonId": "0x3e7",
"TargetOutboundDomainName": "-",
"TargetOutboundUserName": "-",
"TargetUserName": "SYSTEM",
"TargetUserSid": "S-1-5-18",
"TransmittedServices": "-",
"VirtualAccount": "%%1843",
"WorkstationName": "-"
},
"event id": 4624,
"hostname": "DC-01",
"keywords": [
"Audit Success"
],
"level": "Information",
"log name": "Security",
"source name": "Microsoft-Windows-Security-Auditing"
},
{
"create date": "2022-07-28T06:34:06.425000Z",
"event data": {
"AuthenticationPackageName": "Negotiate",
"ElevatedToken": "%%1842",
"ImpersonationLevel": "%%1833",
"IpAddress": "-",
"IpPort": "-",
"KeyLength": "0",
"LmPackageName": "-",
"LogonGuid": "{00000000-0000-0000-0000-000000000000}",
"LogonProcessName": "Advapi ",
"LogonType": "5",
"ProcessId": "0x278",
"ProcessName": "C:\\Windows\\System32\\services.exe",
"RestrictedAdminMode": "-",
"SubjectDomainName": "WORKGROUP",
"SubjectLogonId": "0x3e7",
"SubjectUserName": "DC-01$",
"SubjectUserSid": "S-1-5-18",
"TargetDomainName": "NT AUTHORITY",
"TargetLinkedLogonId": "0x0",
"TargetLogonId": "0x3e7",
"TargetOutboundDomainName": "-",
"TargetOutboundUserName": "-",
"TargetUserName": "SYSTEM",
"TargetUserSid": "S-1-5-18",
"TransmittedServices": "-",
"VirtualAccount": "%%1843",
"WorkstationName": "-"
},
"event id": 4624,
"hostname": "DC-01",
"keywords": [
"Audit Success"
],
"level": "Information",
"log name": "Security",
"source name": "Microsoft-Windows-Security-Auditing"
},
{
"create date": "2022-07-28T06:24:48.107000Z",
"event data": {
"AuthenticationPackageName": "Negotiate",
"ElevatedToken": "%%1842",
"ImpersonationLevel": "%%1833",
"IpAddress": "-",
"IpPort": "-",
"KeyLength": "0",
"LmPackageName": "-",
"LogonGuid": "{00000000-0000-0000-0000-000000000000}",
"LogonProcessName": "Advapi ",
"LogonType": "5",
"ProcessId": "0x278",
"ProcessName": "C:\\Windows\\System32\\services.exe",
"RestrictedAdminMode": "-",
"SubjectDomainName": "WORKGROUP",
"SubjectLogonId": "0x3e7",
"SubjectUserName": "DC-01$",
"SubjectUserSid": "S-1-5-18",
"TargetDomainName": "NT AUTHORITY",
"TargetLinkedLogonId": "0x0",
"TargetLogonId": "0x3e7",
"TargetOutboundDomainName": "-",
"TargetOutboundUserName": "-",
"TargetUserName": "SYSTEM",
"TargetUserSid": "S-1-5-18",
"TransmittedServices": "-",
"VirtualAccount": "%%1843",
"WorkstationName": "-"
},
"event id": 4624,
"hostname": "DC-01",
"keywords": [
"Audit Success"
],
"level": "Information",
"log name": "Security",
"source name": "Microsoft-Windows-Security-Auditing"
},
{
"create date": "2022-07-28T05:24:47.496000Z",
"event data": {
"AuthenticationPackageName": "Negotiate",
"ElevatedToken": "%%1842",
"ImpersonationLevel": "%%1833",
"IpAddress": "-",
"IpPort": "-",
"KeyLength": "0",
"LmPackageName": "-",
"LogonGuid": "{00000000-0000-0000-0000-000000000000}",
"LogonProcessName": "Advapi ",
"LogonType": "5",
"ProcessId": "0x278",
"ProcessName": "C:\\Windows\\System32\\services.exe",
"RestrictedAdminMode": "-",
"SubjectDomainName": "WORKGROUP",
"SubjectLogonId": "0x3e7",
"SubjectUserName": "DC-01$",
"SubjectUserSid": "S-1-5-18",
"TargetDomainName": "NT AUTHORITY",
"TargetLinkedLogonId": "0x0",
"TargetLogonId": "0x3e7",
"TargetOutboundDomainName": "-",
"TargetOutboundUserName": "-",
"TargetUserName": "SYSTEM",
"TargetUserSid": "S-1-5-18",
"TransmittedServices": "-",
"VirtualAccount": "%%1843",
"WorkstationName": "-"
},
"event id": 4624,
"hostname": "DC-01",
"keywords": [
"Audit Success"
],
"level": "Information",
"log name": "Security",
"source name": "Microsoft-Windows-Security-Auditing"
},
{
"create date": "2022-07-28T04:24:46.833000Z",
"event data": {
"AuthenticationPackageName": "Negotiate",
"ElevatedToken": "%%1842",
"ImpersonationLevel": "%%1833",
"IpAddress": "-",
"IpPort": "-",
"KeyLength": "0",
"LmPackageName": "-",
"LogonGuid": "{00000000-0000-0000-0000-000000000000}",
"LogonProcessName": "Advapi ",
"LogonType": "5",
"ProcessId": "0x278",
"ProcessName": "C:\\Windows\\System32\\services.exe",
"RestrictedAdminMode": "-",
"SubjectDomainName": "WORKGROUP",
"SubjectLogonId": "0x3e7",
"SubjectUserName": "DC-01$",
"SubjectUserSid": "S-1-5-18",
"TargetDomainName": "NT AUTHORITY",
"TargetLinkedLogonId": "0x0",
"TargetLogonId": "0x3e7",
"TargetOutboundDomainName": "-",
"TargetOutboundUserName": "-",
"TargetUserName": "SYSTEM",
"TargetUserSid": "S-1-5-18",
"TransmittedServices": "-",
"VirtualAccount": "%%1843",
"WorkstationName": "-"
},
"event id": 4624,
"hostname": "DC-01",
"keywords": [
"Audit Success"
],
"level": "Information",
"log name": "Security",
"source name": "Microsoft-Windows-Security-Auditing"
}
]
}
}
}

Human Readable Output#

Event Log list#

create datehostnameevent idsource namelog namekeywordsevent datalevel
2022-07-28T07:24:48.105000ZDC-014624Microsoft-Windows-Security-AuditingSecurityAudit SuccessSubjectUserSid: S-1-5-18
SubjectUserName: DC-01$
SubjectDomainName: WORKGROUP
SubjectLogonId: 0x3e7
TargetUserSid: S-1-5-18
TargetUserName: SYSTEM
TargetDomainName: NT AUTHORITY
TargetLogonId: 0x3e7
LogonType: 5
LogonProcessName: Advapi
AuthenticationPackageName: Negotiate
WorkstationName: -
LogonGuid: {00000000-0000-0000-0000-000000000000}
TransmittedServices: -
LmPackageName: -
KeyLength: 0
ProcessId: 0x278
ProcessName: C:\Windows\System32\services.exe
IpAddress: -
IpPort: -
ImpersonationLevel: %%1833
RestrictedAdminMode: -
TargetOutboundUserName: -
TargetOutboundDomainName: -
VirtualAccount: %%1843
TargetLinkedLogonId: 0x0
ElevatedToken: %%1842
Information
2022-07-28T06:34:06.425000ZDC-014624Microsoft-Windows-Security-AuditingSecurityAudit SuccessSubjectUserSid: S-1-5-18
SubjectUserName: DC-01$
SubjectDomainName: WORKGROUP
SubjectLogonId: 0x3e7
TargetUserSid: S-1-5-18
TargetUserName: SYSTEM
TargetDomainName: NT AUTHORITY
TargetLogonId: 0x3e7
LogonType: 5
LogonProcessName: Advapi
AuthenticationPackageName: Negotiate
WorkstationName: -
LogonGuid: {00000000-0000-0000-0000-000000000000}
TransmittedServices: -
LmPackageName: -
KeyLength: 0
ProcessId: 0x278
ProcessName: C:\Windows\System32\services.exe
IpAddress: -
IpPort: -
ImpersonationLevel: %%1833
RestrictedAdminMode: -
TargetOutboundUserName: -
TargetOutboundDomainName: -
VirtualAccount: %%1843
TargetLinkedLogonId: 0x0
ElevatedToken: %%1842
Information
2022-07-28T06:24:48.107000ZDC-014624Microsoft-Windows-Security-AuditingSecurityAudit SuccessSubjectUserSid: S-1-5-18
SubjectUserName: DC-01$
SubjectDomainName: WORKGROUP
SubjectLogonId: 0x3e7
TargetUserSid: S-1-5-18
TargetUserName: SYSTEM
TargetDomainName: NT AUTHORITY
TargetLogonId: 0x3e7
LogonType: 5
LogonProcessName: Advapi
AuthenticationPackageName: Negotiate
WorkstationName: -
LogonGuid: {00000000-0000-0000-0000-000000000000}
TransmittedServices: -
LmPackageName: -
KeyLength: 0
ProcessId: 0x278
ProcessName: C:\Windows\System32\services.exe
IpAddress: -
IpPort: -
ImpersonationLevel: %%1833
RestrictedAdminMode: -
TargetOutboundUserName: -
TargetOutboundDomainName: -
VirtualAccount: %%1843
TargetLinkedLogonId: 0x0
ElevatedToken: %%1842
Information
2022-07-28T05:24:47.496000ZDC-014624Microsoft-Windows-Security-AuditingSecurityAudit SuccessSubjectUserSid: S-1-5-18
SubjectUserName: DC-01$
SubjectDomainName: WORKGROUP
SubjectLogonId: 0x3e7
TargetUserSid: S-1-5-18
TargetUserName: SYSTEM
TargetDomainName: NT AUTHORITY
TargetLogonId: 0x3e7
LogonType: 5
LogonProcessName: Advapi
AuthenticationPackageName: Negotiate
WorkstationName: -
LogonGuid: {00000000-0000-0000-0000-000000000000}
TransmittedServices: -
LmPackageName: -
KeyLength: 0
ProcessId: 0x278
ProcessName: C:\Windows\System32\services.exe
IpAddress: -
IpPort: -
ImpersonationLevel: %%1833
RestrictedAdminMode: -
TargetOutboundUserName: -
TargetOutboundDomainName: -
VirtualAccount: %%1843
TargetLinkedLogonId: 0x0
ElevatedToken: %%1842
Information
2022-07-28T04:24:46.833000ZDC-014624Microsoft-Windows-Security-AuditingSecurityAudit SuccessSubjectUserSid: S-1-5-18
SubjectUserName: DC-01$
SubjectDomainName: WORKGROUP
SubjectLogonId: 0x3e7
TargetUserSid: S-1-5-18
TargetUserName: SYSTEM
TargetDomainName: NT AUTHORITY
TargetLogonId: 0x3e7
LogonType: 5
LogonProcessName: Advapi
AuthenticationPackageName: Negotiate
WorkstationName: -
LogonGuid: {00000000-0000-0000-0000-000000000000}
TransmittedServices: -
LmPackageName: -
KeyLength: 0
ProcessId: 0x278
ProcessName: C:\Windows\System32\services.exe
IpAddress: -
IpPort: -
ImpersonationLevel: %%1833
RestrictedAdminMode: -
TargetOutboundUserName: -
TargetOutboundDomainName: -
VirtualAccount: %%1843
TargetLinkedLogonId: 0x0
ElevatedToken: %%1842
Information

Command example#

!harfanglab-telemetry-eventlog event_id=4624 from_date="2022-07-21T21:25:34" to_date="2022-07-23T21:25:34" limit=5

Context Example#

{
"Harfanglab": {
"Telemetryeventlog": {
"eventlog": [
{
"create date": "2022-07-23T21:25:18.159000Z",
"event data": {
"AuthenticationPackageName": "Negotiate",
"ElevatedToken": "%%1842",
"ImpersonationLevel": "%%1833",
"IpAddress": "-",
"IpPort": "-",
"KeyLength": "0",
"LmPackageName": "-",
"LogonGuid": "{00000000-0000-0000-0000-000000000000}",
"LogonProcessName": "Advapi ",
"LogonType": "5",
"ProcessId": "0x280",
"ProcessName": "C:\\Windows\\System32\\services.exe",
"RestrictedAdminMode": "-",
"SubjectDomainName": "WORKGROUP",
"SubjectLogonId": "0x3e7",
"SubjectUserName": "WORKSTATION-123$",
"SubjectUserSid": "S-1-5-18",
"TargetDomainName": "NT AUTHORITY",
"TargetLinkedLogonId": "0x0",
"TargetLogonId": "0x3e7",
"TargetOutboundDomainName": "-",
"TargetOutboundUserName": "-",
"TargetUserName": "SYSTEM",
"TargetUserSid": "S-1-5-18",
"TransmittedServices": "-",
"VirtualAccount": "%%1843",
"WorkstationName": "-"
},
"event id": 4624,
"hostname": "WORKSTATION-1234",
"keywords": [
"Audit Success"
],
"level": "Information",
"log name": "Security",
"source name": "Microsoft-Windows-Security-Auditing"
},
{
"create date": "2022-07-23T21:25:10.765000Z",
"event data": {
"AuthenticationPackageName": "Negotiate",
"ElevatedToken": "%%1842",
"ImpersonationLevel": "%%1833",
"IpAddress": "-",
"IpPort": "-",
"KeyLength": "0",
"LmPackageName": "-",
"LogonGuid": "{00000000-0000-0000-0000-000000000000}",
"LogonProcessName": "Advapi ",
"LogonType": "5",
"ProcessId": "0x27c",
"ProcessName": "C:\\Windows\\System32\\services.exe",
"RestrictedAdminMode": "-",
"SubjectDomainName": "WORKGROUP",
"SubjectLogonId": "0x3e7",
"SubjectUserName": "WEBSERVER$",
"SubjectUserSid": "S-1-5-18",
"TargetDomainName": "NT AUTHORITY",
"TargetLinkedLogonId": "0x0",
"TargetLogonId": "0x3e7",
"TargetOutboundDomainName": "-",
"TargetOutboundUserName": "-",
"TargetUserName": "SYSTEM",
"TargetUserSid": "S-1-5-18",
"TransmittedServices": "-",
"VirtualAccount": "%%1843",
"WorkstationName": "-"
},
"event id": 4624,
"hostname": "WEBSERVER",
"keywords": [
"Audit Success"
],
"level": "Information",
"log name": "Security",
"source name": "Microsoft-Windows-Security-Auditing"
},
{
"create date": "2022-07-23T21:23:53.410000Z",
"event data": {
"AuthenticationPackageName": "Negotiate",
"ElevatedToken": "%%1842",
"ImpersonationLevel": "%%1833",
"IpAddress": "-",
"IpPort": "-",
"KeyLength": "0",
"LmPackageName": "-",
"LogonGuid": "{00000000-0000-0000-0000-000000000000}",
"LogonProcessName": "Advapi ",
"LogonType": "5",
"ProcessId": "0x278",
"ProcessName": "C:\\Windows\\System32\\services.exe",
"RestrictedAdminMode": "-",
"SubjectDomainName": "WORKGROUP",
"SubjectLogonId": "0x3e7",
"SubjectUserName": "DC-01$",
"SubjectUserSid": "S-1-5-18",
"TargetDomainName": "NT AUTHORITY",
"TargetLinkedLogonId": "0x0",
"TargetLogonId": "0x3e7",
"TargetOutboundDomainName": "-",
"TargetOutboundUserName": "-",
"TargetUserName": "SYSTEM",
"TargetUserSid": "S-1-5-18",
"TransmittedServices": "-",
"VirtualAccount": "%%1843",
"WorkstationName": "-"
},
"event id": 4624,
"hostname": "DC-01",
"keywords": [
"Audit Success"
],
"level": "Information",
"log name": "Security",
"source name": "Microsoft-Windows-Security-Auditing"
},
{
"create date": "2022-07-23T21:18:55.338000Z",
"event data": {
"AuthenticationPackageName": "Negotiate",
"ElevatedToken": "%%1842",
"ImpersonationLevel": "%%1833",
"IpAddress": "-",
"IpPort": "-",
"KeyLength": "0",
"LmPackageName": "-",
"LogonGuid": "{00000000-0000-0000-0000-000000000000}",
"LogonProcessName": "Advapi ",
"LogonType": "5",
"ProcessId": "0x27c",
"ProcessName": "C:\\Windows\\System32\\services.exe",
"RestrictedAdminMode": "-",
"SubjectDomainName": "WORKGROUP",
"SubjectLogonId": "0x3e7",
"SubjectUserName": "WORKSTATION-850$",
"SubjectUserSid": "S-1-5-18",
"TargetDomainName": "NT AUTHORITY",
"TargetLinkedLogonId": "0x0",
"TargetLogonId": "0x3e7",
"TargetOutboundDomainName": "-",
"TargetOutboundUserName": "-",
"TargetUserName": "SYSTEM",
"TargetUserSid": "S-1-5-18",
"TransmittedServices": "-",
"VirtualAccount": "%%1843",
"WorkstationName": "-"
},
"event id": 4624,
"hostname": "WORKSTATION-8501",
"keywords": [
"Audit Success"
],
"level": "Information",
"log name": "Security",
"source name": "Microsoft-Windows-Security-Auditing"
},
{
"create date": "2022-07-23T21:18:53.324000Z",
"event data": {
"AuthenticationPackageName": "Negotiate",
"ElevatedToken": "%%1842",
"ImpersonationLevel": "%%1833",
"IpAddress": "-",
"IpPort": "-",
"KeyLength": "0",
"LmPackageName": "-",
"LogonGuid": "{00000000-0000-0000-0000-000000000000}",
"LogonProcessName": "Advapi ",
"LogonType": "5",
"ProcessId": "0x27c",
"ProcessName": "C:\\Windows\\System32\\services.exe",
"RestrictedAdminMode": "-",
"SubjectDomainName": "WORKGROUP",
"SubjectLogonId": "0x3e7",
"SubjectUserName": "WORKSTATION-850$",
"SubjectUserSid": "S-1-5-18",
"TargetDomainName": "NT AUTHORITY",
"TargetLinkedLogonId": "0x0",
"TargetLogonId": "0x3e7",
"TargetOutboundDomainName": "-",
"TargetOutboundUserName": "-",
"TargetUserName": "SYSTEM",
"TargetUserSid": "S-1-5-18",
"TransmittedServices": "-",
"VirtualAccount": "%%1843",
"WorkstationName": "-"
},
"event id": 4624,
"hostname": "WORKSTATION-8501",
"keywords": [
"Audit Success"
],
"level": "Information",
"log name": "Security",
"source name": "Microsoft-Windows-Security-Auditing"
}
]
}
}
}

Human Readable Output#

Event Log list#

create datehostnameevent idsource namelog namekeywordsevent datalevel
2022-07-23T21:25:18.159000ZWORKSTATION-12344624Microsoft-Windows-Security-AuditingSecurityAudit SuccessSubjectUserSid: S-1-5-18
SubjectUserName: WORKSTATION-123$
SubjectDomainName: WORKGROUP
SubjectLogonId: 0x3e7
TargetUserSid: S-1-5-18
TargetUserName: SYSTEM
TargetDomainName: NT AUTHORITY
TargetLogonId: 0x3e7
LogonType: 5
LogonProcessName: Advapi
AuthenticationPackageName: Negotiate
WorkstationName: -
LogonGuid: {00000000-0000-0000-0000-000000000000}
TransmittedServices: -
LmPackageName: -
KeyLength: 0
ProcessId: 0x280
ProcessName: C:\Windows\System32\services.exe
IpAddress: -
IpPort: -
ImpersonationLevel: %%1833
RestrictedAdminMode: -
TargetOutboundUserName: -
TargetOutboundDomainName: -
VirtualAccount: %%1843
TargetLinkedLogonId: 0x0
ElevatedToken: %%1842
Information
2022-07-23T21:25:10.765000ZWEBSERVER4624Microsoft-Windows-Security-AuditingSecurityAudit SuccessSubjectUserSid: S-1-5-18
SubjectUserName: WEBSERVER$
SubjectDomainName: WORKGROUP
SubjectLogonId: 0x3e7
TargetUserSid: S-1-5-18
TargetUserName: SYSTEM
TargetDomainName: NT AUTHORITY
TargetLogonId: 0x3e7
LogonType: 5
LogonProcessName: Advapi
AuthenticationPackageName: Negotiate
WorkstationName: -
LogonGuid: {00000000-0000-0000-0000-000000000000}
TransmittedServices: -
LmPackageName: -
KeyLength: 0
ProcessId: 0x27c
ProcessName: C:\Windows\System32\services.exe
IpAddress: -
IpPort: -
ImpersonationLevel: %%1833
RestrictedAdminMode: -
TargetOutboundUserName: -
TargetOutboundDomainName: -
VirtualAccount: %%1843
TargetLinkedLogonId: 0x0
ElevatedToken: %%1842
Information
2022-07-23T21:23:53.410000ZDC-014624Microsoft-Windows-Security-AuditingSecurityAudit SuccessSubjectUserSid: S-1-5-18
SubjectUserName: DC-01$
SubjectDomainName: WORKGROUP
SubjectLogonId: 0x3e7
TargetUserSid: S-1-5-18
TargetUserName: SYSTEM
TargetDomainName: NT AUTHORITY
TargetLogonId: 0x3e7
LogonType: 5
LogonProcessName: Advapi
AuthenticationPackageName: Negotiate
WorkstationName: -
LogonGuid: {00000000-0000-0000-0000-000000000000}
TransmittedServices: -
LmPackageName: -
KeyLength: 0
ProcessId: 0x278
ProcessName: C:\Windows\System32\services.exe
IpAddress: -
IpPort: -
ImpersonationLevel: %%1833
RestrictedAdminMode: -
TargetOutboundUserName: -
TargetOutboundDomainName: -
VirtualAccount: %%1843
TargetLinkedLogonId: 0x0
ElevatedToken: %%1842
Information
2022-07-23T21:18:55.338000ZWORKSTATION-85014624Microsoft-Windows-Security-AuditingSecurityAudit SuccessSubjectUserSid: S-1-5-18
SubjectUserName: WORKSTATION-850$
SubjectDomainName: WORKGROUP
SubjectLogonId: 0x3e7
TargetUserSid: S-1-5-18
TargetUserName: SYSTEM
TargetDomainName: NT AUTHORITY
TargetLogonId: 0x3e7
LogonType: 5
LogonProcessName: Advapi
AuthenticationPackageName: Negotiate
WorkstationName: -
LogonGuid: {00000000-0000-0000-0000-000000000000}
TransmittedServices: -
LmPackageName: -
KeyLength: 0
ProcessId: 0x27c
ProcessName: C:\Windows\System32\services.exe
IpAddress: -
IpPort: -
ImpersonationLevel: %%1833
RestrictedAdminMode: -
TargetOutboundUserName: -
TargetOutboundDomainName: -
VirtualAccount: %%1843
TargetLinkedLogonId: 0x0
ElevatedToken: %%1842
Information
2022-07-23T21:18:53.324000ZWORKSTATION-85014624Microsoft-Windows-Security-AuditingSecurityAudit SuccessSubjectUserSid: S-1-5-18
SubjectUserName: WORKSTATION-850$
SubjectDomainName: WORKGROUP
SubjectLogonId: 0x3e7
TargetUserSid: S-1-5-18
TargetUserName: SYSTEM
TargetDomainName: NT AUTHORITY
TargetLogonId: 0x3e7
LogonType: 5
LogonProcessName: Advapi
AuthenticationPackageName: Negotiate
WorkstationName: -
LogonGuid: {00000000-0000-0000-0000-000000000000}
TransmittedServices: -
LmPackageName: -
KeyLength: 0
ProcessId: 0x27c
ProcessName: C:\Windows\System32\services.exe
IpAddress: -
IpPort: -
ImpersonationLevel: %%1833
RestrictedAdminMode: -
TargetOutboundUserName: -
TargetOutboundDomainName: -
VirtualAccount: %%1843
TargetLinkedLogonId: 0x0
ElevatedToken: %%1842
Information

harfanglab-telemetry-binary#


Search for binaries

Base Command#

harfanglab-telemetry-binary

Input#

Argument NameDescriptionRequired
from_dateStart date (format: YYYY-MM-DDTHH:MM:SS).Optional
to_dateEnd date (format: YYYY-MM-DDTHH:MM:SS).Optional
hashfilehash to search (md5, sha1, sha256).Optional
limitMaximum number of elements to fetch. Default is 100.Optional

Context Output#

PathTypeDescription
Harfanglab.Telemetrybinary.binaryunknownProvides a list of binaries with associated download links.

Command example#

!harfanglab-telemetry-binary hash=2577fb22e98a4585bedcccfe7fbb48a8b2e0b5ea4c41408247cba86e89ea2eb5

Context Example#

{
"Harfanglab": {
"Telemetrybinary": {
"binary": [
{
"download link": "https://my_edr_stack:8443/api/data/telemetry/Binary/download/2577fb22e98a4585bedcccfe7fbb48a8b2e0b5ea4c41408247cba86e89ea2eb5/?hl_expiring_key=0123456789abcdef",
"name": "hurukai",
"path": "/opt/hurukai/hurukai",
"sha256": "2577fb22e98a4585bedcccfe7fbb48a8b2e0b5ea4c41408247cba86e89ea2eb5",
"signed": "",
"signer": null,
"size": 5882824
}
]
}
}
}

Human Readable Output#

Binary list#

namepathsizesha256download link
hurukai/opt/hurukai/hurukai58828242577fb22e98a4585bedcccfe7fbb48a8b2e0b5ea4c41408247cba86e89ea2eb5https://my_edr_stack:8443/api/data/telemetry/Binary/download/2577fb22e98a4585bedcccfe7fbb48a8b2e0b5ea4c41408247cba86e89ea2eb5/?hl_expiring_key=0123456789abcdef

harfanglab-telemetry-dns#


Search DNS resolutions

Base Command#

harfanglab-telemetry-dns

Input#

Argument NameDescriptionRequired
hostnameEndpoint hostname.Optional
requested_nameRequested domain name.Optional
query_typeDNS type (A, AAAA, TXT...).Optional
from_dateStart date (format: YYYY-MM-DDTHH:MM:SS).Optional
to_dateEnd date (format: YYYY-MM-DDTHH:MM:SS).Optional
limitMaximum number of elements to fetch. Default is 100.Optional

Context Output#

PathTypeDescription
Harfanglab.TelemetryDNS.resolutionsunknownProvides a list of DNS resolutions

Command example#

!harfanglab-telemetry-dns requested_name=download.windowsupdate.com hostname=webserver

Context Example#

{
"Harfanglab": {
"Telemetrydns": {
"dns": [
{
"IP addresses": [
"XXX.XXX.XXX.XXX"
],
"agentid": "2eabb3d4-2fe4-45c7-ba87-4fc486f37638",
"create date": "2023-07-20T08:14:28.306000Z",
"hostname": "WEBSERVER",
"pid": 5956,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-2fe4-45c7-4417-0026bd8eba8b",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX"
],
"agentid": "2eabb3d4-2fe4-45c7-ba87-4fc486f37638",
"create date": "2023-07-20T08:14:23.768000Z",
"hostname": "WEBSERVER",
"pid": 1296,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-2fe4-45c7-1005-00d36589bf35",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX",
"XXX.XXX.XXX.XXX"
],
"agentid": "2eabb3d4-2fe4-45c7-ba87-4fc486f37638",
"create date": "2023-07-20T04:14:23.397000Z",
"hostname": "WEBSERVER",
"pid": 1296,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-2fe4-45c7-1005-00d36589bf35",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX",
"XXX.XXX.XXX.XXX"
],
"agentid": "524f8ab7-c2c0-4b31-893c-564acb8f857a",
"create date": "2023-07-17T13:03:34.656000Z",
"hostname": "WEBSERVER",
"pid": 1900,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-c2c0-4b31-6c07-000eac642d4f",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX",
"XXX.XXX.XXX.XXX"
],
"agentid": "524f8ab7-c2c0-4b31-893c-564acb8f857a",
"create date": "2023-07-17T13:03:28.608000Z",
"hostname": "WEBSERVER",
"pid": 1276,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-c2c0-4b31-fc04-00c4827455f9",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX"
],
"agentid": "524f8ab7-c2c0-4b31-893c-564acb8f857a",
"create date": "2023-07-16T13:03:36.331000Z",
"hostname": "WEBSERVER",
"pid": 2620,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-c2c0-4b31-3c0a-008126fb9d08",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX"
],
"agentid": "524f8ab7-c2c0-4b31-893c-564acb8f857a",
"create date": "2023-07-16T13:03:28.944000Z",
"hostname": "WEBSERVER",
"pid": 1276,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-c2c0-4b31-fc04-00c4827455f9",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX",
"XXX.XXX.XXX.XXX"
],
"agentid": "524f8ab7-c2c0-4b31-893c-564acb8f857a",
"create date": "2023-07-15T13:03:37.980000Z",
"hostname": "WEBSERVER",
"pid": 5700,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-c2c0-4b31-4416-009d6e609402",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX",
"XXX.XXX.XXX.XXX"
],
"agentid": "524f8ab7-c2c0-4b31-893c-564acb8f857a",
"create date": "2023-07-15T13:03:29.162000Z",
"hostname": "WEBSERVER",
"pid": 1276,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-c2c0-4b31-fc04-00c4827455f9",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX"
],
"agentid": "524f8ab7-c2c0-4b31-893c-564acb8f857a",
"create date": "2023-07-14T13:03:50.310000Z",
"hostname": "WEBSERVER",
"pid": 5908,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-c2c0-4b31-1417-007dde4315d9",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX"
],
"agentid": "524f8ab7-c2c0-4b31-893c-564acb8f857a",
"create date": "2023-07-14T13:03:42.865000Z",
"hostname": "WEBSERVER",
"pid": 1276,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-c2c0-4b31-fc04-00c4827455f9",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX"
],
"agentid": "524f8ab7-c2c0-4b31-893c-564acb8f857a",
"create date": "2023-07-14T02:14:55.276000Z",
"hostname": "WEBSERVER",
"pid": 1276,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-c2c0-4b31-fc04-00c4827455f9",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX",
"XXX.XXX.XXX.XXX"
],
"agentid": "524f8ab7-c2c0-4b31-893c-564acb8f857a",
"create date": "2023-07-13T13:03:34.668000Z",
"hostname": "WEBSERVER",
"pid": 5856,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-c2c0-4b31-e016-008cbea6fa9a",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX",
"XXX.XXX.XXX.XXX"
],
"agentid": "524f8ab7-c2c0-4b31-893c-564acb8f857a",
"create date": "2023-07-13T13:03:29.584000Z",
"hostname": "WEBSERVER",
"pid": 1276,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-c2c0-4b31-fc04-00c4827455f9",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX"
],
"agentid": "524f8ab7-c2c0-4b31-893c-564acb8f857a",
"create date": "2023-07-13T02:14:55.484000Z",
"hostname": "WEBSERVER",
"pid": 1276,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-c2c0-4b31-fc04-00c4827455f9",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX",
"XXX.XXX.XXX.XXX"
],
"agentid": "5011b34e-183f-438a-a44c-a0e32a89719a",
"create date": "2023-07-06T05:33:19.372000Z",
"hostname": "WEBSERVER",
"pid": 4876,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-183f-438a-0c13-005257b88fb6",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX",
"XXX.XXX.XXX.XXX"
],
"agentid": "5011b34e-183f-438a-a44c-a0e32a89719a",
"create date": "2023-07-06T05:33:11.969000Z",
"hostname": "WEBSERVER",
"pid": 1216,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-183f-438a-c004-00cebeddc9bf",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX",
"XXX.XXX.XXX.XXX"
],
"agentid": "5011b34e-183f-438a-a44c-a0e32a89719a",
"create date": "2023-07-04T05:25:43.924000Z",
"hostname": "WEBSERVER",
"pid": 760,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-183f-438a-f802-00e6099364ff",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX",
"XXX.XXX.XXX.XXX"
],
"agentid": "5011b34e-183f-438a-a44c-a0e32a89719a",
"create date": "2023-07-04T05:25:37.176000Z",
"hostname": "WEBSERVER",
"pid": 1296,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-183f-438a-1005-006ae872c8a6",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX"
],
"agentid": "5011b34e-183f-438a-a44c-a0e32a89719a",
"create date": "2023-07-02T05:25:42.501000Z",
"hostname": "WEBSERVER",
"pid": 4252,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-183f-438a-9c10-00a479475cc1",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX"
],
"agentid": "5011b34e-183f-438a-a44c-a0e32a89719a",
"create date": "2023-07-02T05:25:35.173000Z",
"hostname": "WEBSERVER",
"pid": 1296,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-183f-438a-1005-006ae872c8a6",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX",
"XXX.XXX.XXX.XXX"
],
"agentid": "5011b34e-183f-438a-a44c-a0e32a89719a",
"create date": "2023-07-01T11:40:33.272000Z",
"hostname": "WEBSERVER",
"pid": 5656,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-183f-438a-1816-00ba61e017c5",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX",
"XXX.XXX.XXX.XXX"
],
"agentid": "5011b34e-183f-438a-a44c-a0e32a89719a",
"create date": "2023-07-01T11:40:28.846000Z",
"hostname": "WEBSERVER",
"pid": 1296,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-183f-438a-1005-006ae872c8a6",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX",
"XXX.XXX.XXX.XXX"
],
"agentid": "5011b34e-183f-438a-a44c-a0e32a89719a",
"create date": "2023-07-01T03:40:39.204000Z",
"hostname": "WEBSERVER",
"pid": 1296,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-183f-438a-1005-006ae872c8a6",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX",
"XXX.XXX.XXX.XXX"
],
"agentid": "5011b34e-183f-438a-a44c-a0e32a89719a",
"create date": "2023-06-30T23:40:27.344000Z",
"hostname": "WEBSERVER",
"pid": 1296,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-183f-438a-1005-006ae872c8a6",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
},
{
"IP addresses": [
"XXX.XXX.XXX.XXX"
],
"agentid": "5011b34e-183f-438a-a44c-a0e32a89719a",
"create date": "2023-06-30T15:40:28.177000Z",
"hostname": "WEBSERVER",
"pid": 1296,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-183f-438a-1005-006ae872c8a6",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
}
]
}
}
}

Human Readable Output#

{
"IP addresses": [
"XXX.XXX.XXX.XXX"
],
"agentid": "5011b34e-183f-438a-a44c-a0e32a89719a",
"create date": "2023-06-30T15:40:28.177000Z",
"hostname": "WEBSERVER",
"pid": 1296,
"process image path": "C:\\Windows\\System32\\svchost.exe",
"process unique id": "67786071-183f-438a-1005-006ae872c8a6",
"query type": "AAAA",
"requested name": "download.windowsupdate.com",
"tenant": ""
}

harfanglab-telemetry-authentication-windows#


Search Windows authentication telemetry

Base Command#

harfanglab-telemetry-authentication-windows

Input#

Argument NameDescriptionRequired
hostnameEndpoint hostname.Optional
source_addressSource IP address.Optional
successWhether authentication succeeded or not.Optional
source_usernameSource username.Optional
target_usernameTarget username.Optional
logon_titleLogon title.Optional
from_dateStart date (format: YYYY-MM-DDTHH:MM:SS).Optional
to_dateEnd date (format: YYYY-MM-DDTHH:MM:SS).Optional
limitMaximum number of elements to fetch. Default is 100.Optional

Context Output#

PathTypeDescription
Harfanglab.TelemetryWindowsAuthentications.authenticationsunknownProvides a list of Windows authentications

Command example#

!harfanglab-telemetry-authentication-windows limit=5 target_username=vagrant

Context Example#

{
"Harfanglab": {
"Telemetrywindows_authentications": {
"windows_authentications": [
{
"agentid": "147b2639-0427-40f3-9004-95cada686d15",
"event id": 4634,
"event title": "An account was logged off",
"hostname": "DC-01",
"logon process name": null,
"logon title": "Network",
"logon type": 3,
"process name": null,
"source address": null,
"source username": null,
"success": null,
"target username": "vagrant",
"timestamp": "2023-07-21T08:04:04.448200Z"
},
{
"agentid": "2eabb3d4-2fe4-45c7-ba87-4fc486f37638",
"event id": 4634,
"event title": "An account was logged off",
"hostname": "WEBSERVER",
"logon process name": null,
"logon title": "Network",
"logon type": 3,
"process name": null,
"source address": null,
"source username": null,
"success": null,
"target username": "vagrant",
"timestamp": "2023-07-20T12:26:58.076300Z"
},
{
"agentid": "2eabb3d4-2fe4-45c7-ba87-4fc486f37638",
"event id": 4634,
"event title": "An account was logged off",
"hostname": "WEBSERVER",
"logon process name": null,
"logon title": "Unlock",
"logon type": 7,
"process name": null,
"source address": null,
"source username": null,
"success": null,
"target username": "vagrant",
"timestamp": "2023-07-20T06:24:57.315374Z"
},
{
"agentid": "524f8ab7-c2c0-4b31-893c-564acb8f857a",
"event id": 4634,
"event title": "An account was logged off",
"hostname": "WEBSERVER",
"logon process name": null,
"logon title": "Network",
"logon type": 3,
"process name": null,
"source address": null,
"source username": null,
"success": null,
"target username": "vagrant",
"timestamp": "2023-07-17T12:31:14.007910Z"
},
{
"agentid": "524f8ab7-c2c0-4b31-893c-564acb8f857a",
"event id": 4634,
"event title": "An account was logged off",
"hostname": "WEBSERVER",
"logon process name": null,
"logon title": "Unlock",
"logon type": 7,
"process name": null,
"source address": null,
"source username": null,
"success": null,
"target username": "vagrant",
"timestamp": "2023-07-17T05:59:38.968596Z"
}
]
}
}
}

Human Readable Output#

{
"agentid": "524f8ab7-c2c0-4b31-893c-564acb8f857a",
"event id": 4634,
"event title": "An account was logged off",
"hostname": "WEBSERVER",
"logon process name": null,
"logon title": "Unlock",
"logon type": 7,
"process name": null,
"source address": null,
"source username": null,
"success": null,
"target username": "vagrant",
"timestamp": "2023-07-17T05:59:38.968596Z"
}

harfanglab-telemetry-authentication-linux#


Search Linux authentication telemetry

Base Command#

harfanglab-telemetry-authentication-linux

Input#

Argument NameDescriptionRequired
hostnameEndpoint hostname.Optional
source_addressSource IP address.Optional
successWhether authentication succeeded or not.Optional
source_usernameSource username.Optional
target_usernameTarget username.Optional
from_dateStart date (format: YYYY-MM-DDTHH:MM:SS).Optional
to_dateEnd date (format: YYYY-MM-DDTHH:MM:SS).Optional
limitMaximum number of elements to fetch. Default is 100.Optional

Context Output#

PathTypeDescription
Harfanglab.TelemetryLinuxAuthentications.authenticationsunknownProvides a list of Linux authentications

harfanglab-telemetry-authentication-macos#


Search Macos authentication telemetry

Base Command#

harfanglab-telemetry-authentication-macos

Input#

Argument NameDescriptionRequired
hostnameEndpoint hostname.Optional
source_addressSource IP address.Optional
successWhether authentication succeeded or not.Optional
source_usernameSource username.Optional
target_usernameTarget username.Optional
from_dateStart date (format: YYYY-MM-DDTHH:MM:SS).Optional
to_dateEnd date (format: YYYY-MM-DDTHH:MM:SS).Optional
limitMaximum number of elements to fetch. Default is 100.Optional

Context Output#

PathTypeDescription
Harfanglab.TelemetryMacosAuthentications.authenticationsunknownProvides a list of Macos authentications

harfanglab-telemetry-authentication-users#


Get the top N users who successfully authenticated on the host

Base Command#

harfanglab-telemetry-authentication-users

Input#

Argument NameDescriptionRequired
hostnameEndpoint hostname.Required
from_dateStart date (format: YYYY-MM-DDTHH:MM:SS).Optional
to_dateEnd date (format: YYYY-MM-DDTHH:MM:SS).Optional
limitFetch only the top N users who successfully authenticated on the host. Default is 3.Optional

Context Output#

PathTypeDescription
Harfanglab.Authentications.UsersunknownProvides a list of users who successfully authenticated on the host with interactive logon (sorted per decreasing occurrence)

Command example#

!harfanglab-telemetry-authentication-users hostname=CL-Ep2-Win11 limit=4

Context Example#

{
"Harfanglab": {
"Authentications": {
"Users": [
{
"Authentication attempts": 4,
"Username": "CL-EP2-WIN11\\hladmin"
},
{
"Authentication attempts": 2,
"Username": "hladmin"
}
]
}
}
}

Human Readable Output#

Top None authentications#

UsernameAuthentication attempts
CL-EP2-WIN11\hladmin4
hladmin2

harfanglab-telemetry-process-graph#


Get a process graph

Base Command#

harfanglab-telemetry-process-graph

Input#

Argument NameDescriptionRequired
process_uuidProcess UUID.Optional

Context Output#

PathTypeDescription
Harfanglab.ProcessGraphunknownProcess Graph

Command example#

!harfanglab-telemetry-process-graph process_uuid=37d378de-b558-4597-e820-009fa44c4c03

Context Example#

{
"Harfanglab": {
"ProcessGraph": {
"calc_time": 0.2487087131012231,
"current_process_id": "37d378de-b558-4597-e820-009fa44c4c03",
"edges": [
{
"class": "edge-parent",
"source": "37d378de-b558-4597-a025-000bb895a6e4",
"target": "37d378de-b558-4597-e820-009fa44c4c03"
},
{
"class": "edge-parent",
"source": "37d378de-b558-4597-6c19-00c365029657",
"target": "37d378de-b558-4597-a025-000bb895a6e4"
},
{
"class": "edge-parent",
"source": "37d378de-b558-4597-0819-000ba55fbed4",
"target": "37d378de-b558-4597-6c19-00c365029657"
},
{
"class": "edge-parent",
"source": "37d378de-b558-4597-9002-007a09a922ae",
"target": "37d378de-b558-4597-0819-000ba55fbed4"
}
],
"missing_processes": {},
"nodes": [
{
"alertCount": 1,
"childProcessCount": 0,
"childProcessCountConfidence": "exact",
"class": "node",
"connectionCount": 0,
"dnsResolutionCount": 0,
"id": "37d378de-b558-4597-e820-009fa44c4c03",
"injectedThreadCount": 0,
"name": "calc.exe",
"parents": [
"37d378de-b558-4597-a025-000bb895a6e4"
],
"powershellCount": 0,
"signed": true,
"status": "complete",
"type": "exe"
},
{
"alertCount": 0,
"childProcessCount": 3,
"childProcessCountConfidence": "exact",
"class": "node",
"connectionCount": 0,
"dnsResolutionCount": 0,
"id": "37d378de-b558-4597-a025-000bb895a6e4",
"injectedThreadCount": 0,
"name": "cmd.exe",
"parents": [
"37d378de-b558-4597-6c19-00c365029657"
],
"powershellCount": 0,
"signed": true,
"status": "complete",
"type": "exe"
},
{
"alertCount": 0,
"childProcessCount": 5,
"childProcessCountConfidence": "exact",
"class": "node",
"connectionCount": 0,
"dnsResolutionCount": 0,
"id": "37d378de-b558-4597-6c19-00c365029657",
"injectedThreadCount": 0,
"name": "explorer.exe",
"parents": [
"37d378de-b558-4597-0819-000ba55fbed4"
],
"powershellCount": 0,
"signed": true,
"status": "complete",
"type": "exe"
},
{
"alertCount": 0,
"childProcessCount": 1,
"childProcessCountConfidence": "exact",
"class": "node",
"connectionCount": 0,
"dnsResolutionCount": 0,
"id": "37d378de-b558-4597-0819-000ba55fbed4",
"injectedThreadCount": 0,
"name": "userinit.exe",
"parents": [
"37d378de-b558-4597-9002-007a09a922ae"
],
"powershellCount": 0,
"signed": true,
"status": "complete",
"type": "exe"
},
{
"alertCount": 0,
"childProcessCount": 5,
"childProcessCountConfidence": "exact",
"class": "node",
"connectionCount": 0,
"dnsResolutionCount": 0,
"id": "37d378de-b558-4597-9002-007a09a922ae",
"injectedThreadCount": 0,
"name": "winlogon.exe",
"parents": [],
"powershellCount": 0,
"signed": true,
"status": "complete",
"type": "exe"
}
],
"processes": {
"37d378de-b558-4597-0819-000ba55fbed4": {
"@event_create_date": "2023-07-20T08:56:43.923000Z",
"@timestamp": "2023-07-20T08:56:47.885612Z",
"@version": "1",
"agent": {
"agentid": "f93af2e6-b558-4597-bb9f-d8288a510c45",
"domainname": "WORKGROUP",
"hostname": "martin-vbox-win10-first",
"osproducttype": "Windows 10 Enterprise",
"ostype": "windows",
"osversion": "10.0.19041",
"version": "2.29.0rc1-post0"
},
"ancestors": "C:\\Windows\\System32\\winlogon.exe",
"commandline": "C:\\Windows\\system32\\userinit.exe",
"current_directory": "C:\\Windows\\system32\\",
"fake_parent_commandline": "",
"fake_parent_image": "",
"fake_ppid": 0,
"grandparent_commandline": "",
"grandparent_image": "",
"grandparent_integrity_level": "Unknown",
"groups": [
{
"id": "41761a0c-c691-49f4-88a0-188dcdcc5d40",
"name": "le groupe de la marmotte"
}
],
"hashes": {
"md5": "582a919ca5f944aa83895a5c633c122c",
"sha1": "6d0c6aea6bce05166761085b1d612558f81d877a",
"sha256": "eda7ee39d4db8142a1e0788e205e80ae798035d60273e74981e09e98c8d0e740"
},
"id": "oVOEcokBVudtObjXHC6o",
"image_name": "C:\\Windows\\System32\\userinit.exe",
"integrity_level": "Medium",
"log_platform_flag": 0,
"log_type": "process",
"logonid": 182681,
"parent_commandline": "winlogon.exe",
"parent_image": "C:\\Windows\\System32\\winlogon.exe",
"parent_integrity_level": "System",
"parent_unique_id": "37d378de-b558-4597-9002-007a09a922ae",
"pe_imphash": "DE7486657F39757C768DEE3094E10FF8",
"pe_info": {
"company_name": "Microsoft Corporation",
"file_description": "Userinit Logon Application",
"file_version": "10.0.19041.1 (WinBuild.160101.0800)",
"internal_name": "userinit",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "USERINIT.EXE",
"pe_timestamp": "2086-04-07T12:35:36Z",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.1"
},
"pe_timestamp": "2086-04-07T12:35:36Z",
"pe_timestamp_int": 3669021336,
"pid": 6408,
"ppid": 656,
"process_name": "userinit.exe",
"process_unique_id": "37d378de-b558-4597-0819-000ba55fbed4",
"session": 1,
"signature_info": {
"root_info": {
"display_name": "Microsoft Root Certificate Authority 2010",
"issuer_name": "Microsoft Root Certificate Authority 2010",
"serial_number": "28cc3a25bfba44ac449a9b586b4339aa",
"thumbprint": "3b1efd3a66ea28b16697394703a72ca340a05bd5",
"thumbprint_sha256": "df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e"
},
"signed_authenticode": false,
"signed_catalog": true,
"signer_info": {
"display_name": "Microsoft Windows",
"issuer_name": "Microsoft Windows Production PCA 2011",
"serial_number": "330000023241fb59996dcc4dff000000000232",
"thumbprint": "ff82bc38e1da5e596df374c53e3617f7eda36b06",
"thumbprint_sha256": "e866d202865ed3d83c35dff4cde3a2d0fc1d2b17c084e8b26dd0ca28a8c75cfb"
}
},
"signed": true,
"size": 34816,
"tenant": "",
"username": "MARTIN-VBOX-WIN\\root",
"usersid": "S-1-5-21-2977311633-4124872198-649243625-1000"
},
"37d378de-b558-4597-6c19-00c365029657": {
"@event_create_date": "2023-07-20T08:56:44.030000Z",
"@timestamp": "2023-07-20T08:56:47.885767Z",
"@version": "1",
"agent": {
"agentid": "f93af2e6-b558-4597-bb9f-d8288a510c45",
"domainname": "WORKGROUP",
"hostname": "martin-vbox-win10-first",
"osproducttype": "Windows 10 Enterprise",
"ostype": "windows",
"osversion": "10.0.19041",
"version": "2.29.0rc1-post0"
},
"ancestors": "C:\\Windows\\System32\\userinit.exe|C:\\Windows\\System32\\winlogon.exe",
"commandline": "C:\\Windows\\Explorer.EXE",
"current_directory": "C:\\Windows\\system32\\",
"fake_parent_commandline": "",
"fake_parent_image": "",
"fake_ppid": 0,
"grandparent_commandline": "winlogon.exe",
"grandparent_image": "C:\\Windows\\System32\\winlogon.exe",
"grandparent_integrity_level": "System",
"groups": [
{
"id": "41761a0c-c691-49f4-88a0-188dcdcc5d40",
"name": "le groupe de la marmotte"
}
],
"hashes": {
"md5": "fde2638e4a80b507e683d973474168da",
"sha1": "7cdd581ae59dae0564e421d3b46683c7b2c50571",
"sha256": "23165139c2a7d2d75df54b8fbac69fa37462c43ff971b78f8cbf99be2613655e"
},
"id": "pVOEcokBVudtObjXHC6y",
"image_name": "C:\\Windows\\explorer.exe",
"integrity_level": "Medium",
"log_platform_flag": 0,
"log_type": "process",
"logonid": 182681,
"parent_commandline": "C:\\Windows\\system32\\userinit.exe",
"parent_image": "C:\\Windows\\System32\\userinit.exe",
"parent_integrity_level": "Medium",
"parent_unique_id": "37d378de-b558-4597-0819-000ba55fbed4",
"pe_imphash": "1B23FD932A3AEF7DBAACECEC28FAB72F",
"pe_info": {
"company_name": "Microsoft Corporation",
"file_description": "Windows Explorer",
"file_version": "10.0.19041.1 (WinBuild.160101.0800)",
"internal_name": "explorer",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "EXPLORER.EXE",
"pe_timestamp": "2035-04-10T22:40:03Z",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.1"
},
"pe_timestamp": "2035-04-10T22:40:03Z",
"pe_timestamp_int": 2059857603,
"pid": 6508,
"ppid": 6408,
"process_name": "explorer.exe",
"process_unique_id": "37d378de-b558-4597-6c19-00c365029657",
"session": 1,
"signature_info": {
"root_info": {
"display_name": "Microsoft Root Certificate Authority 2010",
"issuer_name": "Microsoft Root Certificate Authority 2010",
"serial_number": "28cc3a25bfba44ac449a9b586b4339aa",
"thumbprint": "3b1efd3a66ea28b16697394703a72ca340a05bd5",
"thumbprint_sha256": "df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e"
},
"signed_authenticode": true,
"signed_catalog": false,
"signer_info": {
"display_name": "Microsoft Windows",
"issuer_name": "Microsoft Windows Production PCA 2011",
"serial_number": "330000023241fb59996dcc4dff000000000232",
"thumbprint": "ff82bc38e1da5e596df374c53e3617f7eda36b06",
"thumbprint_sha256": "e866d202865ed3d83c35dff4cde3a2d0fc1d2b17c084e8b26dd0ca28a8c75cfb"
}
},
"signed": true,
"size": 4478208,
"tenant": "",
"username": "MARTIN-VBOX-WIN\\root",
"usersid": "S-1-5-21-2977311633-4124872198-649243625-1000"
},
"37d378de-b558-4597-9002-007a09a922ae": {
"@event_create_date": "2023-07-20T08:56:37.997000Z",
"@timestamp": "2023-07-20T08:56:44.140309Z",
"@version": "1",
"agent": {
"agentid": "f93af2e6-b558-4597-bb9f-d8288a510c45",
"domainname": "WORKGROUP",
"hostname": "martin-vbox-win10-first",
"osproducttype": "Windows 10 Enterprise",
"ostype": "windows",
"osversion": "10.0.19041",
"version": "2.29.0rc1-post0"
},
"ancestors": "",
"commandline": "winlogon.exe",
"current_directory": "C:\\Windows\\system32\\",
"fake_parent_commandline": "",
"fake_parent_image": "",
"fake_ppid": 0,
"grandparent_commandline": "",
"grandparent_image": "",
"grandparent_integrity_level": "Unknown",
"groups": [
{
"id": "41761a0c-c691-49f4-88a0-188dcdcc5d40",
"name": "le groupe de la marmotte"
}
],
"hashes": {
"md5": "8b9b35206487d39b2d3d076444485ec2",
"sha1": "b136d54bb0b352b2239e08f0b4389d663e413050",
"sha256": "fbc2eb97a177f7cbd6e38f3a6c45471e988b01978724f9790af0377bb5f3bf8d"
},
"id": "f1OEcokBVudtObjXDi6K",
"image_name": "C:\\Windows\\System32\\winlogon.exe",
"integrity_level": "System",
"log_platform_flag": 0,
"log_type": "process",
"logonid": 999,
"parent_commandline": "",
"parent_image": "",
"parent_integrity_level": "Unknown",
"pe_imphash": "B25B459645147727E57D02B17D593731",
"pe_info": {
"company_name": "Microsoft Corporation",
"file_description": "Windows Logon Application",
"file_version": "10.0.19041.1 (WinBuild.160101.0800)",
"internal_name": "winlogon",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "WINLOGON.EXE",
"pe_timestamp": "2077-10-24T01:42:54Z",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.1"
},
"pe_timestamp": "2077-10-24T01:42:54Z",
"pe_timestamp_int": 3402265374,
"pid": 656,
"ppid": 548,
"process_name": "winlogon.exe",
"process_unique_id": "37d378de-b558-4597-9002-007a09a922ae",
"session": 1,
"signature_info": {
"root_info": {
"display_name": "Microsoft Root Certificate Authority 2010",
"issuer_name": "Microsoft Root Certificate Authority 2010",
"serial_number": "28cc3a25bfba44ac449a9b586b4339aa",
"thumbprint": "3b1efd3a66ea28b16697394703a72ca340a05bd5",
"thumbprint_sha256": "df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e"
},
"signed_authenticode": false,
"signed_catalog": true,
"signer_info": {
"display_name": "Microsoft Windows",
"issuer_name": "Microsoft Windows Production PCA 2011",
"serial_number": "330000023241fb59996dcc4dff000000000232",
"thumbprint": "ff82bc38e1da5e596df374c53e3617f7eda36b06",
"thumbprint_sha256": "e866d202865ed3d83c35dff4cde3a2d0fc1d2b17c084e8b26dd0ca28a8c75cfb"
}
},
"signed": true,
"size": 907776,
"tenant": "",
"username": "NT AUTHORITY\\SYSTEM",
"usersid": "S-1-5-18"
},
"37d378de-b558-4597-a025-000bb895a6e4": {
"@event_create_date": "2023-07-20T08:57:01.796000Z",
"@timestamp": "2023-07-20T08:57:00.780435Z",
"@version": "1",
"agent": {
"agentid": "f93af2e6-b558-4597-bb9f-d8288a510c45",
"domainname": "WORKGROUP",
"hostname": "martin-vbox-win10-first",
"osproducttype": "Windows 10 Enterprise",
"ostype": "windows",
"osversion": "10.0.19041",
"version": "2.29.0rc1-post0"
},
"ancestors": "C:\\Windows\\explorer.exe|C:\\Windows\\System32\\userinit.exe|C:\\Windows\\System32\\winlogon.exe",
"commandline": "C:\\Windows\\system32\\cmd.exe",
"current_directory": "C:\\Users\\root\\",
"fake_parent_commandline": "",
"fake_parent_image": "",
"fake_ppid": 0,
"grandparent_commandline": "C:\\Windows\\system32\\userinit.exe",
"grandparent_image": "C:\\Windows\\System32\\userinit.exe",
"grandparent_integrity_level": "Medium",
"groups": [
{
"id": "41761a0c-c691-49f4-88a0-188dcdcc5d40",
"name": "le groupe de la marmotte"
}
],
"hashes": {
"md5": "adf77cd50dc93394a09e82250feb23c9",
"sha1": "984b29de3244f878c8f40c5d936536f948c89a7a",
"sha256": "1b041f4deefb7a3d0ddc0cbe6ffca70ae9c1ff88cbbd09f26492886de649acfd"
},
"id": "CWmEcokB50kODsvATmPi",
"image_name": "C:\\Windows\\System32\\cmd.exe",
"integrity_level": "Medium",
"log_platform_flag": 0,
"log_type": "process",
"logonid": 182681,
"parent_commandline": "C:\\Windows\\Explorer.EXE",
"parent_image": "C:\\Windows\\explorer.exe",
"parent_integrity_level": "Medium",
"parent_unique_id": "37d378de-b558-4597-6c19-00c365029657",
"pe_imphash": "272245E2988E1E430500B852C4FB5E18",
"pe_info": {
"company_name": "Microsoft Corporation",
"file_description": "Windows Command Processor",
"file_version": "10.0.19041.1 (WinBuild.160101.0800)",
"internal_name": "cmd",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "Cmd.Exe",
"pe_timestamp": "1986-06-08T12:13:58Z",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.1"
},
"pe_timestamp": "1986-06-08T12:13:58Z",
"pe_timestamp_int": 518616838,
"pid": 9632,
"ppid": 6508,
"process_name": "cmd.exe",
"process_unique_id": "37d378de-b558-4597-a025-000bb895a6e4",
"session": 1,
"signature_info": {
"root_info": {
"display_name": "Microsoft Root Certificate Authority 2010",
"issuer_name": "Microsoft Root Certificate Authority 2010",
"serial_number": "28cc3a25bfba44ac449a9b586b4339aa",
"thumbprint": "3b1efd3a66ea28b16697394703a72ca340a05bd5",
"thumbprint_sha256": "df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e"
},
"signed_authenticode": false,
"signed_catalog": true,
"signer_info": {
"display_name": "Microsoft Windows",
"issuer_name": "Microsoft Windows Production PCA 2011",
"serial_number": "330000023241fb59996dcc4dff000000000232",
"thumbprint": "ff82bc38e1da5e596df374c53e3617f7eda36b06",
"thumbprint_sha256": "e866d202865ed3d83c35dff4cde3a2d0fc1d2b17c084e8b26dd0ca28a8c75cfb"
}
},
"signed": true,
"size": 289792,
"tenant": "",
"username": "MARTIN-VBOX-WIN\\root",
"usersid": "S-1-5-21-2977311633-4124872198-649243625-1000"
},
"37d378de-b558-4597-e820-009fa44c4c03": {
"@event_create_date": "2023-07-20T08:57:52.366000Z",
"@timestamp": "2023-07-20T08:57:55.730865Z",
"@version": "1",
"agent": {
"agentid": "f93af2e6-b558-4597-bb9f-d8288a510c45",
"domainname": "WORKGROUP",
"hostname": "martin-vbox-win10-first",
"osproducttype": "Windows 10 Enterprise",
"ostype": "windows",
"osversion": "10.0.19041",
"version": "2.29.0rc1-post0"
},
"ancestors": "C:\\Windows\\System32\\cmd.exe|C:\\Windows\\explorer.exe|C:\\Windows\\System32\\userinit.exe|C:\\Windows\\System32\\winlogon.exe",
"commandline": "calc.exe",
"current_directory": "C:\\Users\\root\\",
"fake_parent_commandline": "",
"fake_parent_image": "",
"fake_ppid": 0,
"grandparent_commandline": "C:\\Windows\\Explorer.EXE",
"grandparent_image": "C:\\Windows\\explorer.exe",
"grandparent_integrity_level": "Medium",
"groups": [
{
"id": "41761a0c-c691-49f4-88a0-188dcdcc5d40",
"name": "le groupe de la marmotte"
}
],
"hashes": {
"md5": "5da8c98136d98dfec4716edd79c7145f",
"sha1": "ed13af4a0a754b8daee4929134d2ff15ebe053cd",
"sha256": "58189cbd4e6dc0c7d8e66b6a6f75652fc9f4afc7ce0eba7d67d8c3feb0d5381f"
},
"id": "TlOFcokBVudtObjXJS96",
"image_name": "C:\\Windows\\System32\\calc.exe",
"integrity_level": "Medium",
"log_platform_flag": 0,
"log_type": "process",
"logonid": 182681,
"parent_commandline": "C:\\Windows\\system32\\cmd.exe",
"parent_image": "C:\\Windows\\System32\\cmd.exe",
"parent_integrity_level": "Medium",
"parent_unique_id": "37d378de-b558-4597-a025-000bb895a6e4",
"pe_imphash": "8EEAA9499666119D13B3F44ECD77A729",
"pe_info": {
"company_name": "Microsoft Corporation",
"file_description": "Windows Calculator",
"file_version": "10.0.19041.1 (WinBuild.160101.0800)",
"internal_name": "CALC",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "CALC.EXE",
"pe_timestamp": "1971-09-24T16:02:24Z",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.1"
},
"pe_timestamp": "1971-09-24T16:02:24Z",
"pe_timestamp_int": 54576144,
"pid": 8424,
"ppid": 9632,
"process_name": "calc.exe",
"process_unique_id": "37d378de-b558-4597-e820-009fa44c4c03",
"session": 1,
"signature_info": {
"root_info": {
"display_name": "Microsoft Root Certificate Authority 2010",
"issuer_name": "Microsoft Root Certificate Authority 2010",
"serial_number": "28cc3a25bfba44ac449a9b586b4339aa",
"thumbprint": "3b1efd3a66ea28b16697394703a72ca340a05bd5",
"thumbprint_sha256": "df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e"
},
"signed_authenticode": false,
"signed_catalog": true,
"signer_info": {
"display_name": "Microsoft Windows",
"issuer_name": "Microsoft Windows Production PCA 2011",
"serial_number": "330000023241fb59996dcc4dff000000000232",
"thumbprint": "ff82bc38e1da5e596df374c53e3617f7eda36b06",
"thumbprint_sha256": "e866d202865ed3d83c35dff4cde3a2d0fc1d2b17c084e8b26dd0ca28a8c75cfb"
}
},
"signed": true,
"size": 27648,
"tenant": "",
"username": "MARTIN-VBOX-WIN\\root",
"usersid": "S-1-5-21-2977311633-4124872198-649243625-1000"
}
},
"remote_threads": []
}
}
}

Human Readable Output#

{
"calc_time": 0.2487087131012231,
"current_process_id": "37d378de-b558-4597-e820-009fa44c4c03",
"edges": [
{
"class": "edge-parent",
"source": "37d378de-b558-4597-a025-000bb895a6e4",
"target": "37d378de-b558-4597-e820-009fa44c4c03"
},
{
"class": "edge-parent",
"source": "37d378de-b558-4597-6c19-00c365029657",
"target": "37d378de-b558-4597-a025-000bb895a6e4"
},
{
"class": "edge-parent",
"source": "37d378de-b558-4597-0819-000ba55fbed4",
"target": "37d378de-b558-4597-6c19-00c365029657"
},
{
"class": "edge-parent",
"source": "37d378de-b558-4597-9002-007a09a922ae",
"target": "37d378de-b558-4597-0819-000ba55fbed4"
}
],
"missing_processes": {},
"nodes": [
{
"alertCount": 1,
"childProcessCount": 0,
"childProcessCountConfidence": "exact",
"class": "node",
"connectionCount": 0,
"dnsResolutionCount": 0,
"id": "37d378de-b558-4597-e820-009fa44c4c03",
"injectedThreadCount": 0,
"name": "calc.exe",
"parents": [
"37d378de-b558-4597-a025-000bb895a6e4"
],
"powershellCount": 0,
"signed": true,
"status": "complete",
"type": "exe"
},
{
"alertCount": 0,
"childProcessCount": 3,
"childProcessCountConfidence": "exact",
"class": "node",
"connectionCount": 0,
"dnsResolutionCount": 0,
"id": "37d378de-b558-4597-a025-000bb895a6e4",
"injectedThreadCount": 0,
"name": "cmd.exe",
"parents": [
"37d378de-b558-4597-6c19-00c365029657"
],
"powershellCount": 0,
"signed": true,
"status": "complete",
"type": "exe"
},
{
"alertCount": 0,
"childProcessCount": 5,
"childProcessCountConfidence": "exact",
"class": "node",
"connectionCount": 0,
"dnsResolutionCount": 0,
"id": "37d378de-b558-4597-6c19-00c365029657",
"injectedThreadCount": 0,
"name": "explorer.exe",
"parents": [
"37d378de-b558-4597-0819-000ba55fbed4"
],
"powershellCount": 0,
"signed": true,
"status": "complete",
"type": "exe"
},
{
"alertCount": 0,
"childProcessCount": 1,
"childProcessCountConfidence": "exact",
"class": "node",
"connectionCount": 0,
"dnsResolutionCount": 0,
"id": "37d378de-b558-4597-0819-000ba55fbed4",
"injectedThreadCount": 0,
"name": "userinit.exe",
"parents": [
"37d378de-b558-4597-9002-007a09a922ae"
],
"powershellCount": 0,
"signed": true,
"status": "complete",
"type": "exe"
},
{
"alertCount": 0,
"childProcessCount": 5,
"childProcessCountConfidence": "exact",
"class": "node",
"connectionCount": 0,
"dnsResolutionCount": 0,
"id": "37d378de-b558-4597-9002-007a09a922ae",
"injectedThreadCount": 0,
"name": "winlogon.exe",
"parents": [],
"powershellCount": 0,
"signed": true,
"status": "complete",
"type": "exe"
}
],
"processes": {
"37d378de-b558-4597-0819-000ba55fbed4": {
"@event_create_date": "2023-07-20T08:56:43.923000Z",
"@timestamp": "2023-07-20T08:56:47.885612Z",
"@version": "1",
"agent": {
"agentid": "f93af2e6-b558-4597-bb9f-d8288a510c45",
"domainname": "WORKGROUP",
"hostname": "martin-vbox-win10-first",
"osproducttype": "Windows 10 Enterprise",
"ostype": "windows",
"osversion": "10.0.19041",
"version": "2.29.0rc1-post0"
},
"ancestors": "C:\\Windows\\System32\\winlogon.exe",
"commandline": "C:\\Windows\\system32\\userinit.exe",
"current_directory": "C:\\Windows\\system32\\",
"fake_parent_commandline": "",
"fake_parent_image": "",
"fake_ppid": 0,
"grandparent_commandline": "",
"grandparent_image": "",
"grandparent_integrity_level": "Unknown",
"groups": [
{
"id": "41761a0c-c691-49f4-88a0-188dcdcc5d40",
"name": "le groupe de la marmotte"
}
],
"hashes": {
"md5": "582a919ca5f944aa83895a5c633c122c",
"sha1": "6d0c6aea6bce05166761085b1d612558f81d877a",
"sha256": "eda7ee39d4db8142a1e0788e205e80ae798035d60273e74981e09e98c8d0e740"
},
"id": "oVOEcokBVudtObjXHC6o",
"image_name": "C:\\Windows\\System32\\userinit.exe",
"integrity_level": "Medium",
"log_platform_flag": 0,
"log_type": "process",
"logonid": 182681,
"parent_commandline": "winlogon.exe",
"parent_image": "C:\\Windows\\System32\\winlogon.exe",
"parent_integrity_level": "System",
"parent_unique_id": "37d378de-b558-4597-9002-007a09a922ae",
"pe_imphash": "DE7486657F39757C768DEE3094E10FF8",
"pe_info": {
"company_name": "Microsoft Corporation",
"file_description": "Userinit Logon Application",
"file_version": "10.0.19041.1 (WinBuild.160101.0800)",
"internal_name": "userinit",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "USERINIT.EXE",
"pe_timestamp": "2086-04-07T12:35:36Z",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.1"
},
"pe_timestamp": "2086-04-07T12:35:36Z",
"pe_timestamp_int": 3669021336,
"pid": 6408,
"ppid": 656,
"process_name": "userinit.exe",
"process_unique_id": "37d378de-b558-4597-0819-000ba55fbed4",
"session": 1,
"signature_info": {
"root_info": {
"display_name": "Microsoft Root Certificate Authority 2010",
"issuer_name": "Microsoft Root Certificate Authority 2010",
"serial_number": "28cc3a25bfba44ac449a9b586b4339aa",
"thumbprint": "3b1efd3a66ea28b16697394703a72ca340a05bd5",
"thumbprint_sha256": "df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e"
},
"signed_authenticode": false,
"signed_catalog": true,
"signer_info": {
"display_name": "Microsoft Windows",
"issuer_name": "Microsoft Windows Production PCA 2011",
"serial_number": "330000023241fb59996dcc4dff000000000232",
"thumbprint": "ff82bc38e1da5e596df374c53e3617f7eda36b06",
"thumbprint_sha256": "e866d202865ed3d83c35dff4cde3a2d0fc1d2b17c084e8b26dd0ca28a8c75cfb"
}
},
"signed": true,
"size": 34816,
"tenant": "",
"username": "MARTIN-VBOX-WIN\\root",
"usersid": "S-1-5-21-2977311633-4124872198-649243625-1000"
},
"37d378de-b558-4597-6c19-00c365029657": {
"@event_create_date": "2023-07-20T08:56:44.030000Z",
"@timestamp": "2023-07-20T08:56:47.885767Z",
"@version": "1",
"agent": {
"agentid": "f93af2e6-b558-4597-bb9f-d8288a510c45",
"domainname": "WORKGROUP",
"hostname": "martin-vbox-win10-first",
"osproducttype": "Windows 10 Enterprise",
"ostype": "windows",
"osversion": "10.0.19041",
"version": "2.29.0rc1-post0"
},
"ancestors": "C:\\Windows\\System32\\userinit.exe|C:\\Windows\\System32\\winlogon.exe",
"commandline": "C:\\Windows\\Explorer.EXE",
"current_directory": "C:\\Windows\\system32\\",
"fake_parent_commandline": "",
"fake_parent_image": "",
"fake_ppid": 0,
"grandparent_commandline": "winlogon.exe",
"grandparent_image": "C:\\Windows\\System32\\winlogon.exe",
"grandparent_integrity_level": "System",
"groups": [
{
"id": "41761a0c-c691-49f4-88a0-188dcdcc5d40",
"name": "le groupe de la marmotte"
}
],
"hashes": {
"md5": "fde2638e4a80b507e683d973474168da",
"sha1": "7cdd581ae59dae0564e421d3b46683c7b2c50571",
"sha256": "23165139c2a7d2d75df54b8fbac69fa37462c43ff971b78f8cbf99be2613655e"
},
"id": "pVOEcokBVudtObjXHC6y",
"image_name": "C:\\Windows\\explorer.exe",
"integrity_level": "Medium",
"log_platform_flag": 0,
"log_type": "process",
"logonid": 182681,
"parent_commandline": "C:\\Windows\\system32\\userinit.exe",
"parent_image": "C:\\Windows\\System32\\userinit.exe",
"parent_integrity_level": "Medium",
"parent_unique_id": "37d378de-b558-4597-0819-000ba55fbed4",
"pe_imphash": "1B23FD932A3AEF7DBAACECEC28FAB72F",
"pe_info": {
"company_name": "Microsoft Corporation",
"file_description": "Windows Explorer",
"file_version": "10.0.19041.1 (WinBuild.160101.0800)",
"internal_name": "explorer",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "EXPLORER.EXE",
"pe_timestamp": "2035-04-10T22:40:03Z",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.1"
},
"pe_timestamp": "2035-04-10T22:40:03Z",
"pe_timestamp_int": 2059857603,
"pid": 6508,
"ppid": 6408,
"process_name": "explorer.exe",
"process_unique_id": "37d378de-b558-4597-6c19-00c365029657",
"session": 1,
"signature_info": {
"root_info": {
"display_name": "Microsoft Root Certificate Authority 2010",
"issuer_name": "Microsoft Root Certificate Authority 2010",
"serial_number": "28cc3a25bfba44ac449a9b586b4339aa",
"thumbprint": "3b1efd3a66ea28b16697394703a72ca340a05bd5",
"thumbprint_sha256": "df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e"
},
"signed_authenticode": true,
"signed_catalog": false,
"signer_info": {
"display_name": "Microsoft Windows",
"issuer_name": "Microsoft Windows Production PCA 2011",
"serial_number": "330000023241fb59996dcc4dff000000000232",
"thumbprint": "ff82bc38e1da5e596df374c53e3617f7eda36b06",
"thumbprint_sha256": "e866d202865ed3d83c35dff4cde3a2d0fc1d2b17c084e8b26dd0ca28a8c75cfb"
}
},
"signed": true,
"size": 4478208,
"tenant": "",
"username": "MARTIN-VBOX-WIN\\root",
"usersid": "S-1-5-21-2977311633-4124872198-649243625-1000"
},
"37d378de-b558-4597-9002-007a09a922ae": {
"@event_create_date": "2023-07-20T08:56:37.997000Z",
"@timestamp": "2023-07-20T08:56:44.140309Z",
"@version": "1",
"agent": {
"agentid": "f93af2e6-b558-4597-bb9f-d8288a510c45",
"domainname": "WORKGROUP",
"hostname": "martin-vbox-win10-first",
"osproducttype": "Windows 10 Enterprise",
"ostype": "windows",
"osversion": "10.0.19041",
"version": "2.29.0rc1-post0"
},
"ancestors": "",
"commandline": "winlogon.exe",
"current_directory": "C:\\Windows\\system32\\",
"fake_parent_commandline": "",
"fake_parent_image": "",
"fake_ppid": 0,
"grandparent_commandline": "",
"grandparent_image": "",
"grandparent_integrity_level": "Unknown",
"groups": [
{
"id": "41761a0c-c691-49f4-88a0-188dcdcc5d40",
"name": "le groupe de la marmotte"
}
],
"hashes": {
"md5": "8b9b35206487d39b2d3d076444485ec2",
"sha1": "b136d54bb0b352b2239e08f0b4389d663e413050",
"sha256": "fbc2eb97a177f7cbd6e38f3a6c45471e988b01978724f9790af0377bb5f3bf8d"
},
"id": "f1OEcokBVudtObjXDi6K",
"image_name": "C:\\Windows\\System32\\winlogon.exe",
"integrity_level": "System",
"log_platform_flag": 0,
"log_type": "process",
"logonid": 999,
"parent_commandline": "",
"parent_image": "",
"parent_integrity_level": "Unknown",
"pe_imphash": "B25B459645147727E57D02B17D593731",
"pe_info": {
"company_name": "Microsoft Corporation",
"file_description": "Windows Logon Application",
"file_version": "10.0.19041.1 (WinBuild.160101.0800)",
"internal_name": "winlogon",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "WINLOGON.EXE",
"pe_timestamp": "2077-10-24T01:42:54Z",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.1"
},
"pe_timestamp": "2077-10-24T01:42:54Z",
"pe_timestamp_int": 3402265374,
"pid": 656,
"ppid": 548,
"process_name": "winlogon.exe",
"process_unique_id": "37d378de-b558-4597-9002-007a09a922ae",
"session": 1,
"signature_info": {
"root_info": {
"display_name": "Microsoft Root Certificate Authority 2010",
"issuer_name": "Microsoft Root Certificate Authority 2010",
"serial_number": "28cc3a25bfba44ac449a9b586b4339aa",
"thumbprint": "3b1efd3a66ea28b16697394703a72ca340a05bd5",
"thumbprint_sha256": "df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e"
},
"signed_authenticode": false,
"signed_catalog": true,
"signer_info": {
"display_name": "Microsoft Windows",
"issuer_name": "Microsoft Windows Production PCA 2011",
"serial_number": "330000023241fb59996dcc4dff000000000232",
"thumbprint": "ff82bc38e1da5e596df374c53e3617f7eda36b06",
"thumbprint_sha256": "e866d202865ed3d83c35dff4cde3a2d0fc1d2b17c084e8b26dd0ca28a8c75cfb"
}
},
"signed": true,
"size": 907776,
"tenant": "",
"username": "NT AUTHORITY\\SYSTEM",
"usersid": "S-1-5-18"
},
"37d378de-b558-4597-a025-000bb895a6e4": {
"@event_create_date": "2023-07-20T08:57:01.796000Z",
"@timestamp": "2023-07-20T08:57:00.780435Z",
"@version": "1",
"agent": {
"agentid": "f93af2e6-b558-4597-bb9f-d8288a510c45",
"domainname": "WORKGROUP",
"hostname": "martin-vbox-win10-first",
"osproducttype": "Windows 10 Enterprise",
"ostype": "windows",
"osversion": "10.0.19041",
"version": "2.29.0rc1-post0"
},
"ancestors": "C:\\Windows\\explorer.exe|C:\\Windows\\System32\\userinit.exe|C:\\Windows\\System32\\winlogon.exe",
"commandline": "C:\\Windows\\system32\\cmd.exe",
"current_directory": "C:\\Users\\root\\",
"fake_parent_commandline": "",
"fake_parent_image": "",
"fake_ppid": 0,
"grandparent_commandline": "C:\\Windows\\system32\\userinit.exe",
"grandparent_image": "C:\\Windows\\System32\\userinit.exe",
"grandparent_integrity_level": "Medium",
"groups": [
{
"id": "41761a0c-c691-49f4-88a0-188dcdcc5d40",
"name": "le groupe de la marmotte"
}
],
"hashes": {
"md5": "adf77cd50dc93394a09e82250feb23c9",
"sha1": "984b29de3244f878c8f40c5d936536f948c89a7a",
"sha256": "1b041f4deefb7a3d0ddc0cbe6ffca70ae9c1ff88cbbd09f26492886de649acfd"
},
"id": "CWmEcokB50kODsvATmPi",
"image_name": "C:\\Windows\\System32\\cmd.exe",
"integrity_level": "Medium",
"log_platform_flag": 0,
"log_type": "process",
"logonid": 182681,
"parent_commandline": "C:\\Windows\\Explorer.EXE",
"parent_image": "C:\\Windows\\explorer.exe",
"parent_integrity_level": "Medium",
"parent_unique_id": "37d378de-b558-4597-6c19-00c365029657",
"pe_imphash": "272245E2988E1E430500B852C4FB5E18",
"pe_info": {
"company_name": "Microsoft Corporation",
"file_description": "Windows Command Processor",
"file_version": "10.0.19041.1 (WinBuild.160101.0800)",
"internal_name": "cmd",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "Cmd.Exe",
"pe_timestamp": "1986-06-08T12:13:58Z",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.1"
},
"pe_timestamp": "1986-06-08T12:13:58Z",
"pe_timestamp_int": 518616838,
"pid": 9632,
"ppid": 6508,
"process_name": "cmd.exe",
"process_unique_id": "37d378de-b558-4597-a025-000bb895a6e4",
"session": 1,
"signature_info": {
"root_info": {
"display_name": "Microsoft Root Certificate Authority 2010",
"issuer_name": "Microsoft Root Certificate Authority 2010",
"serial_number": "28cc3a25bfba44ac449a9b586b4339aa",
"thumbprint": "3b1efd3a66ea28b16697394703a72ca340a05bd5",
"thumbprint_sha256": "df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e"
},
"signed_authenticode": false,
"signed_catalog": true,
"signer_info": {
"display_name": "Microsoft Windows",
"issuer_name": "Microsoft Windows Production PCA 2011",
"serial_number": "330000023241fb59996dcc4dff000000000232",
"thumbprint": "ff82bc38e1da5e596df374c53e3617f7eda36b06",
"thumbprint_sha256": "e866d202865ed3d83c35dff4cde3a2d0fc1d2b17c084e8b26dd0ca28a8c75cfb"
}
},
"signed": true,
"size": 289792,
"tenant": "",
"username": "MARTIN-VBOX-WIN\\root",
"usersid": "S-1-5-21-2977311633-4124872198-649243625-1000"
},
"37d378de-b558-4597-e820-009fa44c4c03": {
"@event_create_date": "2023-07-20T08:57:52.366000Z",
"@timestamp": "2023-07-20T08:57:55.730865Z",
"@version": "1",
"agent": {
"agentid": "f93af2e6-b558-4597-bb9f-d8288a510c45",
"domainname": "WORKGROUP",
"hostname": "martin-vbox-win10-first",
"osproducttype": "Windows 10 Enterprise",
"ostype": "windows",
"osversion": "10.0.19041",
"version": "2.29.0rc1-post0"
},
"ancestors": "C:\\Windows\\System32\\cmd.exe|C:\\Windows\\explorer.exe|C:\\Windows\\System32\\userinit.exe|C:\\Windows\\System32\\winlogon.exe",
"commandline": "calc.exe",
"current_directory": "C:\\Users\\root\\",
"fake_parent_commandline": "",
"fake_parent_image": "",
"fake_ppid": 0,
"grandparent_commandline": "C:\\Windows\\Explorer.EXE",
"grandparent_image": "C:\\Windows\\explorer.exe",
"grandparent_integrity_level": "Medium",
"groups": [
{
"id": "41761a0c-c691-49f4-88a0-188dcdcc5d40",
"name": "le groupe de la marmotte"
}
],
"hashes": {
"md5": "5da8c98136d98dfec4716edd79c7145f",
"sha1": "ed13af4a0a754b8daee4929134d2ff15ebe053cd",
"sha256": "58189cbd4e6dc0c7d8e66b6a6f75652fc9f4afc7ce0eba7d67d8c3feb0d5381f"
},
"id": "TlOFcokBVudtObjXJS96",
"image_name": "C:\\Windows\\System32\\calc.exe",
"integrity_level": "Medium",
"log_platform_flag": 0,
"log_type": "process",
"logonid": 182681,
"parent_commandline": "C:\\Windows\\system32\\cmd.exe",
"parent_image": "C:\\Windows\\System32\\cmd.exe",
"parent_integrity_level": "Medium",
"parent_unique_id": "37d378de-b558-4597-a025-000bb895a6e4",
"pe_imphash": "8EEAA9499666119D13B3F44ECD77A729",
"pe_info": {
"company_name": "Microsoft Corporation",
"file_description": "Windows Calculator",
"file_version": "10.0.19041.1 (WinBuild.160101.0800)",
"internal_name": "CALC",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "CALC.EXE",
"pe_timestamp": "1971-09-24T16:02:24Z",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.1"
},
"pe_timestamp": "1971-09-24T16:02:24Z",
"pe_timestamp_int": 54576144,
"pid": 8424,
"ppid": 9632,
"process_name": "calc.exe",
"process_unique_id": "37d378de-b558-4597-e820-009fa44c4c03",
"session": 1,
"signature_info": {
"root_info": {
"display_name": "Microsoft Root Certificate Authority 2010",
"issuer_name": "Microsoft Root Certificate Authority 2010",
"serial_number": "28cc3a25bfba44ac449a9b586b4339aa",
"thumbprint": "3b1efd3a66ea28b16697394703a72ca340a05bd5",
"thumbprint_sha256": "df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e"
},
"signed_authenticode": false,
"signed_catalog": true,
"signer_info": {
"display_name": "Microsoft Windows",
"issuer_name": "Microsoft Windows Production PCA 2011",
"serial_number": "330000023241fb59996dcc4dff000000000232",
"thumbprint": "ff82bc38e1da5e596df374c53e3617f7eda36b06",
"thumbprint_sha256": "e866d202865ed3d83c35dff4cde3a2d0fc1d2b17c084e8b26dd0ca28a8c75cfb"
}
},
"signed": true,
"size": 27648,
"tenant": "",
"username": "MARTIN-VBOX-WIN\\root",
"usersid": "S-1-5-21-2977311633-4124872198-649243625-1000"
}
},
"remote_threads": []
}

harfanglab-job-info#


Get job status information

Base Command#

harfanglab-job-info

Input#

Argument NameDescriptionRequired
idsComa-separated list of job ids.Required

Context Output#

PathTypeDescription
Harfanglab.Job.InfounknownJob Status

Command example#

!harfanglab-job-info ids="ba28f05f-e3c8-4eec-ab6a-01d639c14f2e,70b2cd7b-8a57-4a6c-aa7e-e392676fa7ac"

Context Example#

{
"Harfanglab": {
"Job": {
"Info": [
{
"Creation date": "2022-07-19 19:47:00",
"ID": "ba28f05f-e3c8-4eec-ab6a-01d639c14f2e",
"Status": "finished"
},
{
"Creation date": "2022-07-07 13:39:02",
"ID": "70b2cd7b-8a57-4a6c-aa7e-e392676fa7ac",
"Status": "finished"
}
]
}
}
}

Human Readable Output#

Jobs Info#

IDStatusCreation date
ba28f05f-e3c8-4eec-ab6a-01d639c14f2efinished2022-07-19 19:47:00
70b2cd7b-8a57-4a6c-aa7e-e392676fa7acfinished2022-07-07 13:39:02

harfanglab-result-pipelist#


Get a hostname's list of pipes from job results

Base Command#

harfanglab-result-pipelist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.Pipe.dataunknownProvides a list of named pipes

Command example#

!harfanglab-result-pipelist job_id="f6cba4b2-e4a1-41b7-bdc0-0dcb6815d3ad"

Context Example#

{
"Harfanglab": {
"Pipe": {
"data": [
"atsvc",
"Ctx_WinStation_API_service",
"epmapper",
"eventlog",
"hlab-1560-f60834ea319cb1cf",
"InitShutdown",
"lsass",
"LSM_API_service",
"ntsvcs",
"PIPE_EVENTROOT\\CIMV2SCM EVENT PROVIDER",
"scerpc",
"SessEnvPublicRpc",
"spoolss",
"srvsvc",
"TermSrv_API_service",
"trkwks",
"VBoxTrayIPC-vagrant",
"W32TIME_ALT",
"Winsock2\\CatalogChangeListener-1f8-0",
"Winsock2\\CatalogChangeListener-278-0",
"Winsock2\\CatalogChangeListener-284-0",
"Winsock2\\CatalogChangeListener-2c4-0",
"Winsock2\\CatalogChangeListener-2f0-0",
"Winsock2\\CatalogChangeListener-35c-0",
"Winsock2\\CatalogChangeListener-414-0",
"Winsock2\\CatalogChangeListener-528-0",
"wkssvc"
]
}
}
}

Human Readable Output#

Pipe List#

name
atsvc
Ctx_WinStation_API_service
epmapper
eventlog
hlab-1560-f60834ea319cb1cf
InitShutdown
lsass
LSM_API_service
ntsvcs
PIPE_EVENTROOT\CIMV2SCM EVENT PROVIDER
scerpc
SessEnvPublicRpc
spoolss
srvsvc
TermSrv_API_service
trkwks
VBoxTrayIPC-vagrant
W32TIME_ALT
Winsock2\CatalogChangeListener-1f8-0
Winsock2\CatalogChangeListener-278-0
Winsock2\CatalogChangeListener-284-0
Winsock2\CatalogChangeListener-2c4-0
Winsock2\CatalogChangeListener-2f0-0
Winsock2\CatalogChangeListener-35c-0
Winsock2\CatalogChangeListener-414-0
Winsock2\CatalogChangeListener-528-0
wkssvc

harfanglab-result-prefetchlist#


Get a hostname's list of prefetches from job results

Base Command#

harfanglab-result-prefetchlist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.Prefetch.dataunknownProvides a list of prefetch files

Command example#

!harfanglab-result-prefetchlist job_id="16834054-574b-4dc4-8981-9e6bb93e4529"

Context Example#

{
"Harfanglab": {
"Prefetch": {
"data": []
}
}
}

Human Readable Output#

Prefetch List#

No entries.

harfanglab-result-runkeylist#


Get a hostname's list of run keys from job results

Base Command#

harfanglab-result-runkeylist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.RunKey.dataunknownProvides a list of Run Keys

Command example#

!harfanglab-result-runkeylist job_id="704cac37-57df-4b70-8227-4a770b724108"

Context Example#

{
"Harfanglab": {
"RunKey": {
"data": [
{
"fullpath": "C:\\Windows\\system32\\SecurityHealthSystray.exe",
"md5": "37eea8b4d205b2300e79a9e96f2f7a46",
"name": "SecurityHealth",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\VBoxTray.exe",
"md5": "3c21ed6871650bc8635729b9abbb6f21",
"name": "VBoxTray",
"signed": true
}
]
}
}
}

Human Readable Output#

RunKey List#

namefullpathsignedmd5
SecurityHealthC:\Windows\system32\SecurityHealthSystray.exetrue37eea8b4d205b2300e79a9e96f2f7a46
VBoxTrayC:\Windows\system32\VBoxTray.exetrue3c21ed6871650bc8635729b9abbb6f21

harfanglab-result-scheduledtasklist#


Get a hostname's list of scheduled tasks from job results

Base Command#

harfanglab-result-scheduledtasklist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Optional

Context Output#

PathTypeDescription
Harfanglab.ScheduledTask.dataunknownProvides a list of scheduled tasks

Command example#

!harfanglab-result-scheduledtasklist job_id="f22b531a-b078-44fc-8d23-d06725548934"

Context Example#

{
"Harfanglab": {
"ScheduledTask": {
"data": [
{
"fullpath": "C:\\Windows\\System32\\mscoree.dll",
"md5": "7ddb05ec3be80b951478e594294c0361",
"name": ".NET Framework NGEN v4.0.30319",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\mscoree.dll",
"md5": "7ddb05ec3be80b951478e594294c0361",
"name": ".NET Framework NGEN v4.0.30319 64",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\mscoree.dll",
"md5": "7ddb05ec3be80b951478e594294c0361",
"name": ".NET Framework NGEN v4.0.30319 64 Critical",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\mscoree.dll",
"md5": "7ddb05ec3be80b951478e594294c0361",
"name": ".NET Framework NGEN v4.0.30319 Critical",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\rundll32.exe",
"md5": "f5b2d37bed0d2b15957736c23b9f547f",
"name": "Account Cleanup",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\msdrm.dll",
"md5": "a4bffcd7b94bd687b3084bc6c7483a2c",
"name": "AD RMS Rights Policy Template Management (Automated)",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\msdrm.dll",
"md5": "a4bffcd7b94bd687b3084bc6c7483a2c",
"name": "AD RMS Rights Policy Template Management (Manual)",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\ngctasks.dll",
"md5": "41fe9b51f30b9ff1a8fe4d724d6c7940",
"name": "AikCertEnrollTask",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\energytask.dll",
"md5": "6b5151a0c751cbf6f01994ab1eb6cde8",
"name": "AnalyzeSystem",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\apphostregistrationverifier.exe",
"md5": "54b1076b71917ed737760b4feba9eeae",
"name": "appuriverifierdaily",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\apphostregistrationverifier.exe",
"md5": "54b1076b71917ed737760b4feba9eeae",
"name": "appuriverifierinstall",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\dsregcmd.exe",
"md5": "f4c8c7def69c3fcaf375db9a7710fd35",
"name": "Automatic-Device-Join",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\cscui.dll",
"md5": "14eef80c58f9c7bffdbc5cb4867d5824",
"name": "Background Synchronization",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\rundll32.exe",
"md5": "f5b2d37bed0d2b15957736c23b9f547f",
"name": "BfeOnServiceStartTypeChange",
"signed": true
},
{
"fullpath": "",
"md5": null,
"name": "BgTaskRegistrationMaintenanceTask",
"signed": false
},
{
"fullpath": "C:\\Windows\\System32\\edptask.dll",
"md5": "45ed986a4271a0f5d9a27161af5a76ee",
"name": "BitLocker Encrypt All Drives",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\edptask.dll",
"md5": "45ed986a4271a0f5d9a27161af5a76ee",
"name": "BitLocker MDM policy Refresh",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\wininet.dll",
"md5": "7f361d95066553e70da7a5329a429254",
"name": "CacheTask",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\mscms.dll",
"md5": "77f81e7a53a7192fefebd9db113709d5",
"name": "Calibration Loader",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\cscript.exe",
"md5": "60ddaf328f6469c00a3fa14aaafed361",
"name": "CleanupOldPerfLogs",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\rundll32.exe",
"md5": "f5b2d37bed0d2b15957736c23b9f547f",
"name": "CleanupTemporaryState",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\cmd.exe",
"md5": "e7a6b1f51efb405287a8048cfa4690f4",
"name": "Collection",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\cmd.exe",
"md5": "e7a6b1f51efb405287a8048cfa4690f4",
"name": "Configuration",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\wsqmcons.exe",
"md5": "0d229f8045fb12b584143ac82cbd1dcd",
"name": "Consolidator",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\shell32.dll",
"md5": "49cf1d96abbacab759a043253677219f",
"name": "CreateObjectTask",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\CloudExperienceHostBroker.exe",
"md5": "8b4432582d6c68e5296e7f8cc8a3b8bc",
"name": "CreateObjectTask",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\ngctasks.dll",
"md5": "41fe9b51f30b9ff1a8fe4d724d6c7940",
"name": "CryptoPolicyTask",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\discan.dll",
"md5": "db01ce5db38cdc5f30537c129afc577c",
"name": "Data Integrity Check And Scan",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\discan.dll",
"md5": "db01ce5db38cdc5f30537c129afc577c",
"name": "Data Integrity Scan",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\discan.dll",
"md5": "db01ce5db38cdc5f30537c129afc577c",
"name": "Data Integrity Scan for Crash Recovery",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\devicecensus.exe",
"md5": "2a33b4af5c4a152eed1c53bd39e99534",
"name": "Device",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\pnppolicy.dll",
"md5": "c9b1ab4b3f3f77e6513ce26b50215bc4",
"name": "Device Install Group Policy",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\pnpui.dll",
"md5": "303788cfdf6ca3f929badd3be92ed879",
"name": "Device Install Reboot Required",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\devicecensus.exe",
"md5": "2a33b4af5c4a152eed1c53bd39e99534",
"name": "Device User",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\dsregtask.dll",
"md5": "f64089d434bb3fb387f51d7525c56ea4",
"name": "Device-Sync",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\disksnapshot.exe",
"md5": "5536352f520d36eb7079647214ac9fa0",
"name": "Diagnostics",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\directxdatabaseupdater.exe",
"md5": "26e02368365619d57d7a32cc37de35e1",
"name": "DirectXDatabaseUpdater",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\dstokenclean.exe",
"md5": "8c9493c2c59e6a7f667ea3355620ce48",
"name": "DsSvcCleanup",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\dxgiadaptercache.exe",
"md5": "fbcff8772630726ef5f00f26a3bcb437",
"name": "DXGIAdapterCache",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\edptask.dll",
"md5": "45ed986a4271a0f5d9a27161af5a76ee",
"name": "EDP App Launch Task",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\edptask.dll",
"md5": "45ed986a4271a0f5d9a27161af5a76ee",
"name": "EDP Auth Task",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\edptask.dll",
"md5": "45ed986a4271a0f5d9a27161af5a76ee",
"name": "EDP Inaccessible Credentials Task",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\AppLockerCsp.dll",
"md5": "20b0cc726f9d3fcf3b659f6a132e1e00",
"name": "EDP Policy Manager",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\MitigationConfiguration.dll",
"md5": "0a9e147ff4d7f8212f0de006c52d865b",
"name": "ExploitGuard MDM policy Refresh",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\TimeSyncTask.dll",
"md5": "c42636381538cbf55ac6ad954519f1f0",
"name": "ForceSynchronizeTime",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\gathernetworkinfo.vbs",
"md5": "da4d4261a43de7e851a9378ed0668eb9",
"name": "GatherNetworkInfo",
"signed": true
},
{
"fullpath": "",
"md5": null,
"name": "HiveUploadTask",
"signed": false
},
{
"fullpath": "C:\\Windows\\System32\\srchadmin.dll",
"md5": "945162746b51b6082425edac70cd3774",
"name": "IndexerAutomaticMaintenance",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\LanguageComponentsInstaller.dll",
"md5": "742c212ba7f256577168aeee2b00fb7c",
"name": "Installation",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\wdc.dll",
"md5": "7939c5b180bd8153f670f8231a401c75",
"name": "Interactive",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\ngctasks.dll",
"md5": "41fe9b51f30b9ff1a8fe4d724d6c7940",
"name": "KeyPreGenTask",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\clipup.exe",
"md5": "2220d1075b5e7e90ba4f4f8a0e701e45",
"name": "License Validation",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\InputCloudStore.dll",
"md5": "13208dbfbbcfbad9cd0e6ab59f72bdec",
"name": "LocalUserSyncDataAvailable",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\sc.exe",
"md5": "6fb10cd439b40d92935f8f6a0c99670a",
"name": "LoginCheck",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\cscui.dll",
"md5": "14eef80c58f9c7bffdbc5cb4867d5824",
"name": "Logon Synchronization",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\lpremove.exe",
"md5": "2140dccdd4dab65241c309df02ce09a2",
"name": "LPRemove",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\rundll32.exe",
"md5": "f5b2d37bed0d2b15957736c23b9f547f",
"name": "MaintenanceTasks",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\mapstoasttask.dll",
"md5": "24c2e7e8b529023ee167dd68164cced7",
"name": "MapsToastTask",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\mapsupdatetask.dll",
"md5": "984960ba9e02bb161f0315f37eb9bde2",
"name": "MapsUpdateTask",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\DeviceSetupManagerAPI.dll",
"md5": "bb7755132e04b89f006522fa69ed8f38",
"name": "Metadata Refresh",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\compattelrunner.exe",
"md5": "003339d6b38472f62b5da9c5d31f24ea",
"name": "Microsoft Compatibility Appraiser",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\rundll32.exe",
"md5": "f5b2d37bed0d2b15957736c23b9f547f",
"name": "Microsoft-Windows-DiskDiagnosticDataCollector",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\dfdwiz.exe",
"md5": "be2d2340e25e4a5700381c8097af152b",
"name": "Microsoft-Windows-DiskDiagnosticResolver",
"signed": true
},
{
"fullpath": "c:\\program files (x86)\\microsoft\\edgeupdate\\microsoftedgeupdate.exe",
"md5": "8661fbb97161096be503cd295aa46409",
"name": "MicrosoftEdgeUpdateTaskMachineCore1d867a83717e5b7",
"signed": true
},
{
"fullpath": "c:\\program files (x86)\\microsoft\\edgeupdate\\microsoftedgeupdate.exe",
"md5": "8661fbb97161096be503cd295aa46409",
"name": "MicrosoftEdgeUpdateTaskMachineUA",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\rasmbmgr.dll",
"md5": "c657bc27aae838fc3a295d51ac20a953",
"name": "MobilityManager",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\InputCloudStore.dll",
"md5": "13208dbfbbcfbad9cd0e6ab59f72bdec",
"name": "MouseSyncDataAvailable",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\MsCtfMonitor.dll",
"md5": "f545384f0b0ca857197904a6092b3f16",
"name": "MsCtfMonitor",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\locationnotificationwindows.exe",
"md5": "a259819d5f8de86ff28546f4ded16f35",
"name": "Notifications",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\MBMediaManager.dll",
"md5": "c1ce23565a9cadef865aedd6c041a2c4",
"name": "OobeDiscovery",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\rundll32.exe",
"md5": "f5b2d37bed0d2b15957736c23b9f547f",
"name": "PcaPatchDbTask",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\InputCloudStore.dll",
"md5": "13208dbfbbcfbad9cd0e6ab59f72bdec",
"name": "PenSyncDataAvailable",
"signed": true
},
{
"fullpath": "",
"md5": null,
"name": "PerformRemediation",
"signed": false
},
{
"fullpath": "C:\\Windows\\system32\\appidpolicyconverter.exe",
"md5": "69a6bef4903650d20c12cbeff41367b0",
"name": "PolicyConverter",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\rundll32.exe",
"md5": "f5b2d37bed0d2b15957736c23b9f547f",
"name": "Pre-staged app cleanup",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\pstask.dll",
"md5": "796fb59bbf6e037b8a0c7646e6ea7a9e",
"name": "ProactiveScan",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\MemoryDiagnostic.dll",
"md5": "8354fde902ba277b46c92175466438ef",
"name": "ProcessMemoryDiagnosticEvents",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\compattelrunner.exe",
"md5": "003339d6b38472f62b5da9c5d31f24ea",
"name": "ProgramDataUpdater",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\srmclient.dll",
"md5": "b2037c5822de4fc8107d952b55d7f107",
"name": "Property Definition Sync",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\rundll32.exe",
"md5": "f5b2d37bed0d2b15957736c23b9f547f",
"name": "Proxy",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\wermgr.exe",
"md5": "ada54642a633e778222008de627b5db5",
"name": "QueueReporting",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\fcon.dll",
"md5": "3f6291e0a27897796b7f91d6402578e3",
"name": "ReconcileFeatures",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\dsregcmd.exe",
"md5": "f4c8c7def69c3fcaf375db9a7710fd35",
"name": "Recovery-Check",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\wosc.dll",
"md5": "feed4b9d117a6a512d93ca4e2c060419",
"name": "RefreshCache",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\regidle.dll",
"md5": "f4608228b68515fe0ea440e1865f77c6",
"name": "RegIdleBackup",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\sc.exe",
"md5": "6fb10cd439b40d92935f8f6a0c99670a",
"name": "Registration",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\usoclient.exe",
"md5": "e4fd0a267e8d740f62e3ddf99917cbcc",
"name": "Report policies",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\wdi.dll",
"md5": "90bec7af03968f67bca4a1da50b042db",
"name": "ResolutionHost",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\MemoryDiagnostic.dll",
"md5": "8354fde902ba277b46c92175466438ef",
"name": "RunFullMemoryDiagnostic",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\InstallServiceTasks.dll",
"md5": "855ebaa8373521bd3d39f282d36a2ba3",
"name": "ScanForUpdates",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\InstallServiceTasks.dll",
"md5": "855ebaa8373521bd3d39f282d36a2ba3",
"name": "ScanForUpdatesAsUser",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\usoclient.exe",
"md5": "e4fd0a267e8d740f62e3ddf99917cbcc",
"name": "Schedule Maintenance Work",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\usoclient.exe",
"md5": "e4fd0a267e8d740f62e3ddf99917cbcc",
"name": "Schedule Scan",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\usoclient.exe",
"md5": "e4fd0a267e8d740f62e3ddf99917cbcc",
"name": "Schedule Scan Static Task",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\usoclient.exe",
"md5": "e4fd0a267e8d740f62e3ddf99917cbcc",
"name": "Schedule Wake To Work",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\usoclient.exe",
"md5": "e4fd0a267e8d740f62e3ddf99917cbcc",
"name": "Schedule Work",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\sdiagschd.dll",
"md5": "c7ceb5a1f22da23b718712cb252df58a",
"name": "Scheduled",
"signed": true
},
{
"fullpath": "c:\\windows\\system32\\sc.exe",
"md5": "6fb10cd439b40d92935f8f6a0c99670a",
"name": "Scheduled Start",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\defrag.exe",
"md5": "2e190d98b46b93e62f68841216addd31",
"name": "ScheduledDefrag",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\sdndiagnosticstask.exe",
"md5": "f56edf564602897934978c3a27ffa65b",
"name": "SDN Diagnostics Task",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\TpmTasks.dll",
"md5": "e10d2a03386c5056b0453f37b5ed5a66",
"name": "Secure-Boot-Update",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\srvinitconfig.exe",
"md5": "4273af0631f9c5d86bef8fb1687320b0",
"name": "Server Initial Configuration Task",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\rundll32.exe",
"md5": "f5b2d37bed0d2b15957736c23b9f547f",
"name": "Server Manager Performance Monitor",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\servermanagerlauncher.exe",
"md5": "548f7e09b5824e7c66a5e3174f8abe38",
"name": "ServerManager",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\oobe\\SetupCleanupTask.dll",
"md5": "6f06af96d37e95e4361943ad96152db4",
"name": "SetupCleanupTask",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\cleanmgr.exe",
"md5": "1a52c127fd0638bc2724765969c60b18",
"name": "SilentCleanup",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\InstallServiceTasks.dll",
"md5": "855ebaa8373521bd3d39f282d36a2ba3",
"name": "SmartRetry",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\spaceagent.exe",
"md5": "0468be9a2369f777c26944e5a55aa357",
"name": "SpaceAgentTask",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\spaceman.exe",
"md5": "fede04bb5054ee911cd363c2c5e9eae4",
"name": "SpaceManagerTask",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\speech_onecore\\common\\speechmodeldownload.exe",
"md5": "0198cb2290a8ba095c79494c70fdd24d",
"name": "SpeechModelDownloadTask",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\TpmTasks.dll",
"md5": "e10d2a03386c5056b0453f37b5ed5a66",
"name": "Sqm-Tasks",
"signed": true
},
{
"fullpath": "",
"md5": null,
"name": "StartComponentCleanup",
"signed": false
},
{
"fullpath": "C:\\Windows\\system32\\rundll32.exe",
"md5": "f5b2d37bed0d2b15957736c23b9f547f",
"name": "StartupAppTask",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\TieringEngineService.exe",
"md5": "a86dc1b6dc847669ef04a290fe53dd00",
"name": "Storage Tiers Management Initialization",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\defrag.exe",
"md5": "2e190d98b46b93e62f68841216addd31",
"name": "Storage Tiers Optimization",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\edptask.dll",
"md5": "45ed986a4271a0f5d9a27161af5a76ee",
"name": "StorageCardEncryption Task",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\StorageUsage.dll",
"md5": "03cc10ff04282f400550980f7db446e3",
"name": "StorageSense",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\sppcext.dll",
"md5": "9caaf31c430fb739eb183b8465e57527",
"name": "SvcRestartTask",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\sppcext.dll",
"md5": "9caaf31c430fb739eb183b8465e57527",
"name": "SvcRestartTaskLogon",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\sppcext.dll",
"md5": "9caaf31c430fb739eb183b8465e57527",
"name": "SvcRestartTaskNetwork",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\CoreGlobConfig.dll",
"md5": "12d3ccc0bb2e767fbfb939d9f67f292a",
"name": "Synchronize Language Settings",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\sc.exe",
"md5": "6fb10cd439b40d92935f8f6a0c99670a",
"name": "SynchronizeTime",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\tzsync.exe",
"md5": "5f35acc7c00591d50552ef7bbf02c99a",
"name": "SynchronizeTimeZone",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\bcdboot.exe",
"md5": "5db087d20a396ca780e453a6aefcbac4",
"name": "SyspartRepair",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drvinst.exe",
"md5": "99d71c1a835ade7bbe8914e1c99abc62",
"name": "Sysprep Generalize Drivers",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\PlaySndSrv.dll",
"md5": "9e29f169c3709059eec0927218fc012e",
"name": "SystemSoundsService",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\dimsjob.dll",
"md5": "051ec97c93e31707f84f334af2b130d7",
"name": "SystemTask",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\TempSignedLicenseExchangeTask.dll",
"md5": "4ec2e7dd80dc186e27d8ff7c75f39d22",
"name": "TempSignedLicenseExchange",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\InputCloudStore.dll",
"md5": "13208dbfbbcfbad9cd0e6ab59f72bdec",
"name": "TouchpadSyncDataAvailable",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\TpmTasks.dll",
"md5": "e10d2a03386c5056b0453f37b5ed5a66",
"name": "Tpm-HASCertRetr",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\TpmTasks.dll",
"md5": "e10d2a03386c5056b0453f37b5ed5a66",
"name": "Tpm-Maintenance",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\LanguageComponentsInstaller.dll",
"md5": "742c212ba7f256577168aeee2b00fb7c",
"name": "Uninstallation",
"signed": true
},
{
"fullpath": "C:\\Windows\\SYSTEM32\\bthudtask.exe",
"md5": "8b5a37ab9140906cd4d0eba1af316fd5",
"name": "UninstallDeviceTask",
"signed": true
},
{
"fullpath": "C:\\Program Files\\windows media player\\wmpnscfg.exe",
"md5": "ec604a0d8a27976ab136a489d9b6aa76",
"name": "UpdateLibrary",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\Windows.UI.Immersive.dll",
"md5": "9317b7ddf5e59f1baf3f5b8c4024e39d",
"name": "UpdateUserPictureTask",
"signed": true
},
{
"fullpath": "C:\\Windows\\SYSTEM32\\sc.exe",
"md5": "6fb10cd439b40d92935f8f6a0c99670a",
"name": "UPnPHostConfig",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\fcon.dll",
"md5": "3f6291e0a27897796b7f91d6402578e3",
"name": "UsageDataFlushing",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\fcon.dll",
"md5": "3f6291e0a27897796b7f91d6402578e3",
"name": "UsageDataReporting",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\usbceip.dll",
"md5": "8a4a3dfe0a2ef540717ce4812934691a",
"name": "UsbCeip",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\dimsjob.dll",
"md5": "051ec97c93e31707f84f334af2b130d7",
"name": "UserTask",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\dimsjob.dll",
"md5": "051ec97c93e31707f84f334af2b130d7",
"name": "UserTask-Roam",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\musnotification.exe",
"md5": "409ec93d1e08911f7e4ac299adc3d9b4",
"name": "USO_UxBroker",
"signed": true
},
{
"fullpath": "",
"md5": null,
"name": "UUS Failover Task",
"signed": false
},
{
"fullpath": "C:\\Windows\\system32\\appidcertstorecheck.exe",
"md5": "1af4f5e1fb76259d44d5f205e983ab38",
"name": "VerifiedPublisherCertStoreCheck",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\ReAgentTask.dll",
"md5": "235c3d1680f80ed563d02bc5a1f79844",
"name": "VerifyWinRE",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\InstallServiceTasks.dll",
"md5": "855ebaa8373521bd3d39f282d36a2ba3",
"name": "WakeUpAndContinueUpdates",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\InstallServiceTasks.dll",
"md5": "855ebaa8373521bd3d39f282d36a2ba3",
"name": "WakeUpAndScanForUpdates",
"signed": true
},
{
"fullpath": "c:\\programdata\\microsoft\\windows defender\\platform\\4.18.2205.7-0\\mpcmdrun.exe",
"md5": "d79162b9fb1e6f6916d21af592f15d8c",
"name": "Windows Defender Cache Maintenance",
"signed": true
},
{
"fullpath": "c:\\programdata\\microsoft\\windows defender\\platform\\4.18.2205.7-0\\mpcmdrun.exe",
"md5": "d79162b9fb1e6f6916d21af592f15d8c",
"name": "Windows Defender Cleanup",
"signed": true
},
{
"fullpath": "c:\\programdata\\microsoft\\windows defender\\platform\\4.18.2205.7-0\\mpcmdrun.exe",
"md5": "d79162b9fb1e6f6916d21af592f15d8c",
"name": "Windows Defender Scheduled Scan",
"signed": true
},
{
"fullpath": "c:\\programdata\\microsoft\\windows defender\\platform\\4.18.2205.7-0\\mpcmdrun.exe",
"md5": "d79162b9fb1e6f6916d21af592f15d8c",
"name": "Windows Defender Verification",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\windowsactiondialog.exe",
"md5": "9187a7c2fc4ad2a8ea9962885b79ecee",
"name": "WindowsActionDialog",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\WinSATAPI.dll",
"md5": "d07b133ea6ab62ddb0b095fd3c621c0f",
"name": "WinSAT",
"signed": true
}
]
}
}
}

Human Readable Output#

Scheduled Task List#

namefullpathsignedmd5
.NET Framework NGEN v4.0.30319C:\Windows\System32\mscoree.dlltrue7ddb05ec3be80b951478e594294c0361
.NET Framework NGEN v4.0.30319 64C:\Windows\System32\mscoree.dlltrue7ddb05ec3be80b951478e594294c0361
.NET Framework NGEN v4.0.30319 64 CriticalC:\Windows\System32\mscoree.dlltrue7ddb05ec3be80b951478e594294c0361
.NET Framework NGEN v4.0.30319 CriticalC:\Windows\System32\mscoree.dlltrue7ddb05ec3be80b951478e594294c0361
Account CleanupC:\Windows\system32\rundll32.exetruef5b2d37bed0d2b15957736c23b9f547f
AD RMS Rights Policy Template Management (Automated)C:\Windows\system32\msdrm.dlltruea4bffcd7b94bd687b3084bc6c7483a2c
AD RMS Rights Policy Template Management (Manual)C:\Windows\system32\msdrm.dlltruea4bffcd7b94bd687b3084bc6c7483a2c
AikCertEnrollTaskC:\Windows\system32\ngctasks.dlltrue41fe9b51f30b9ff1a8fe4d724d6c7940
AnalyzeSystemC:\Windows\System32\energytask.dlltrue6b5151a0c751cbf6f01994ab1eb6cde8
appuriverifierdailyC:\Windows\system32\apphostregistrationverifier.exetrue54b1076b71917ed737760b4feba9eeae
appuriverifierinstallC:\Windows\system32\apphostregistrationverifier.exetrue54b1076b71917ed737760b4feba9eeae
Automatic-Device-JoinC:\Windows\system32\dsregcmd.exetruef4c8c7def69c3fcaf375db9a7710fd35
Background SynchronizationC:\Windows\System32\cscui.dlltrue14eef80c58f9c7bffdbc5cb4867d5824
BfeOnServiceStartTypeChangeC:\Windows\system32\rundll32.exetruef5b2d37bed0d2b15957736c23b9f547f
BgTaskRegistrationMaintenanceTaskfalse
BitLocker Encrypt All DrivesC:\Windows\System32\edptask.dlltrue45ed986a4271a0f5d9a27161af5a76ee
BitLocker MDM policy RefreshC:\Windows\System32\edptask.dlltrue45ed986a4271a0f5d9a27161af5a76ee
CacheTaskC:\Windows\system32\wininet.dlltrue7f361d95066553e70da7a5329a429254
Calibration LoaderC:\Windows\System32\mscms.dlltrue77f81e7a53a7192fefebd9db113709d5
CleanupOldPerfLogsC:\Windows\system32\cscript.exetrue60ddaf328f6469c00a3fa14aaafed361
CleanupTemporaryStateC:\Windows\system32\rundll32.exetruef5b2d37bed0d2b15957736c23b9f547f
CollectionC:\Windows\system32\cmd.exetruee7a6b1f51efb405287a8048cfa4690f4
ConfigurationC:\Windows\system32\cmd.exetruee7a6b1f51efb405287a8048cfa4690f4
ConsolidatorC:\Windows\system32\wsqmcons.exetrue0d229f8045fb12b584143ac82cbd1dcd
CreateObjectTaskC:\Windows\system32\shell32.dlltrue49cf1d96abbacab759a043253677219f
CreateObjectTaskC:\Windows\System32\CloudExperienceHostBroker.exetrue8b4432582d6c68e5296e7f8cc8a3b8bc
CryptoPolicyTaskC:\Windows\system32\ngctasks.dlltrue41fe9b51f30b9ff1a8fe4d724d6c7940
Data Integrity Check And ScanC:\Windows\System32\discan.dlltruedb01ce5db38cdc5f30537c129afc577c
Data Integrity ScanC:\Windows\System32\discan.dlltruedb01ce5db38cdc5f30537c129afc577c
Data Integrity Scan for Crash RecoveryC:\Windows\System32\discan.dlltruedb01ce5db38cdc5f30537c129afc577c
DeviceC:\Windows\system32\devicecensus.exetrue2a33b4af5c4a152eed1c53bd39e99534
Device Install Group PolicyC:\Windows\System32\pnppolicy.dlltruec9b1ab4b3f3f77e6513ce26b50215bc4
Device Install Reboot RequiredC:\Windows\System32\pnpui.dlltrue303788cfdf6ca3f929badd3be92ed879
Device UserC:\Windows\system32\devicecensus.exetrue2a33b4af5c4a152eed1c53bd39e99534
Device-SyncC:\Windows\System32\dsregtask.dlltruef64089d434bb3fb387f51d7525c56ea4
DiagnosticsC:\Windows\system32\disksnapshot.exetrue5536352f520d36eb7079647214ac9fa0
DirectXDatabaseUpdaterC:\Windows\system32\directxdatabaseupdater.exetrue26e02368365619d57d7a32cc37de35e1
DsSvcCleanupC:\Windows\system32\dstokenclean.exetrue8c9493c2c59e6a7f667ea3355620ce48
DXGIAdapterCacheC:\Windows\system32\dxgiadaptercache.exetruefbcff8772630726ef5f00f26a3bcb437
EDP App Launch TaskC:\Windows\System32\edptask.dlltrue45ed986a4271a0f5d9a27161af5a76ee
EDP Auth TaskC:\Windows\System32\edptask.dlltrue45ed986a4271a0f5d9a27161af5a76ee
EDP Inaccessible Credentials TaskC:\Windows\System32\edptask.dlltrue45ed986a4271a0f5d9a27161af5a76ee
EDP Policy ManagerC:\Windows\System32\AppLockerCsp.dlltrue20b0cc726f9d3fcf3b659f6a132e1e00
ExploitGuard MDM policy RefreshC:\Windows\System32\MitigationConfiguration.dlltrue0a9e147ff4d7f8212f0de006c52d865b
ForceSynchronizeTimeC:\Windows\system32\TimeSyncTask.dlltruec42636381538cbf55ac6ad954519f1f0
GatherNetworkInfoC:\Windows\system32\gathernetworkinfo.vbstrueda4d4261a43de7e851a9378ed0668eb9
HiveUploadTaskfalse
IndexerAutomaticMaintenanceC:\Windows\System32\srchadmin.dlltrue945162746b51b6082425edac70cd3774
InstallationC:\Windows\System32\LanguageComponentsInstaller.dlltrue742c212ba7f256577168aeee2b00fb7c
InteractiveC:\Windows\system32\wdc.dlltrue7939c5b180bd8153f670f8231a401c75
KeyPreGenTaskC:\Windows\system32\ngctasks.dlltrue41fe9b51f30b9ff1a8fe4d724d6c7940
License ValidationC:\Windows\system32\clipup.exetrue2220d1075b5e7e90ba4f4f8a0e701e45
LocalUserSyncDataAvailableC:\Windows\System32\InputCloudStore.dlltrue13208dbfbbcfbad9cd0e6ab59f72bdec
LoginCheckC:\Windows\system32\sc.exetrue6fb10cd439b40d92935f8f6a0c99670a
Logon SynchronizationC:\Windows\System32\cscui.dlltrue14eef80c58f9c7bffdbc5cb4867d5824
LPRemoveC:\Windows\system32\lpremove.exetrue2140dccdd4dab65241c309df02ce09a2
MaintenanceTasksC:\Windows\system32\rundll32.exetruef5b2d37bed0d2b15957736c23b9f547f
MapsToastTaskC:\Windows\System32\mapstoasttask.dlltrue24c2e7e8b529023ee167dd68164cced7
MapsUpdateTaskC:\Windows\System32\mapsupdatetask.dlltrue984960ba9e02bb161f0315f37eb9bde2
Metadata RefreshC:\Windows\System32\DeviceSetupManagerAPI.dlltruebb7755132e04b89f006522fa69ed8f38
Microsoft Compatibility AppraiserC:\Windows\system32\compattelrunner.exetrue003339d6b38472f62b5da9c5d31f24ea
Microsoft-Windows-DiskDiagnosticDataCollectorC:\Windows\system32\rundll32.exetruef5b2d37bed0d2b15957736c23b9f547f
Microsoft-Windows-DiskDiagnosticResolverC:\Windows\system32\dfdwiz.exetruebe2d2340e25e4a5700381c8097af152b
MicrosoftEdgeUpdateTaskMachineCore1d867a83717e5b7c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exetrue8661fbb97161096be503cd295aa46409
MicrosoftEdgeUpdateTaskMachineUAc:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exetrue8661fbb97161096be503cd295aa46409
MobilityManagerC:\Windows\system32\rasmbmgr.dlltruec657bc27aae838fc3a295d51ac20a953
MouseSyncDataAvailableC:\Windows\System32\InputCloudStore.dlltrue13208dbfbbcfbad9cd0e6ab59f72bdec
MsCtfMonitorC:\Windows\system32\MsCtfMonitor.dlltruef545384f0b0ca857197904a6092b3f16
NotificationsC:\Windows\system32\locationnotificationwindows.exetruea259819d5f8de86ff28546f4ded16f35
OobeDiscoveryC:\Windows\System32\MBMediaManager.dlltruec1ce23565a9cadef865aedd6c041a2c4
PcaPatchDbTaskC:\Windows\system32\rundll32.exetruef5b2d37bed0d2b15957736c23b9f547f
PenSyncDataAvailableC:\Windows\System32\InputCloudStore.dlltrue13208dbfbbcfbad9cd0e6ab59f72bdec
PerformRemediationfalse
PolicyConverterC:\Windows\system32\appidpolicyconverter.exetrue69a6bef4903650d20c12cbeff41367b0
Pre-staged app cleanupC:\Windows\system32\rundll32.exetruef5b2d37bed0d2b15957736c23b9f547f
ProactiveScanC:\Windows\System32\pstask.dlltrue796fb59bbf6e037b8a0c7646e6ea7a9e
ProcessMemoryDiagnosticEventsC:\Windows\System32\MemoryDiagnostic.dlltrue8354fde902ba277b46c92175466438ef
ProgramDataUpdaterC:\Windows\system32\compattelrunner.exetrue003339d6b38472f62b5da9c5d31f24ea
Property Definition SyncC:\Windows\System32\srmclient.dlltrueb2037c5822de4fc8107d952b55d7f107
ProxyC:\Windows\system32\rundll32.exetruef5b2d37bed0d2b15957736c23b9f547f
QueueReportingC:\Windows\system32\wermgr.exetrueada54642a633e778222008de627b5db5
ReconcileFeaturesC:\Windows\System32\fcon.dlltrue3f6291e0a27897796b7f91d6402578e3
Recovery-CheckC:\Windows\system32\dsregcmd.exetruef4c8c7def69c3fcaf375db9a7710fd35
RefreshCacheC:\Windows\System32\wosc.dlltruefeed4b9d117a6a512d93ca4e2c060419
RegIdleBackupC:\Windows\System32\regidle.dlltruef4608228b68515fe0ea440e1865f77c6
RegistrationC:\Windows\system32\sc.exetrue6fb10cd439b40d92935f8f6a0c99670a
Report policiesC:\Windows\system32\usoclient.exetruee4fd0a267e8d740f62e3ddf99917cbcc
ResolutionHostC:\Windows\System32\wdi.dlltrue90bec7af03968f67bca4a1da50b042db
RunFullMemoryDiagnosticC:\Windows\System32\MemoryDiagnostic.dlltrue8354fde902ba277b46c92175466438ef
ScanForUpdatesC:\Windows\System32\InstallServiceTasks.dlltrue855ebaa8373521bd3d39f282d36a2ba3
ScanForUpdatesAsUserC:\Windows\System32\InstallServiceTasks.dlltrue855ebaa8373521bd3d39f282d36a2ba3
Schedule Maintenance WorkC:\Windows\system32\usoclient.exetruee4fd0a267e8d740f62e3ddf99917cbcc
Schedule ScanC:\Windows\system32\usoclient.exetruee4fd0a267e8d740f62e3ddf99917cbcc
Schedule Scan Static TaskC:\Windows\system32\usoclient.exetruee4fd0a267e8d740f62e3ddf99917cbcc
Schedule Wake To WorkC:\Windows\system32\usoclient.exetruee4fd0a267e8d740f62e3ddf99917cbcc
Schedule WorkC:\Windows\system32\usoclient.exetruee4fd0a267e8d740f62e3ddf99917cbcc
ScheduledC:\Windows\System32\sdiagschd.dlltruec7ceb5a1f22da23b718712cb252df58a
Scheduled Startc:\windows\system32\sc.exetrue6fb10cd439b40d92935f8f6a0c99670a
ScheduledDefragC:\Windows\system32\defrag.exetrue2e190d98b46b93e62f68841216addd31
SDN Diagnostics TaskC:\Windows\system32\sdndiagnosticstask.exetruef56edf564602897934978c3a27ffa65b
Secure-Boot-UpdateC:\Windows\system32\TpmTasks.dlltruee10d2a03386c5056b0453f37b5ed5a66
Server Initial Configuration TaskC:\Windows\system32\srvinitconfig.exetrue4273af0631f9c5d86bef8fb1687320b0
Server Manager Performance MonitorC:\Windows\system32\rundll32.exetruef5b2d37bed0d2b15957736c23b9f547f
ServerManagerC:\Windows\system32\servermanagerlauncher.exetrue548f7e09b5824e7c66a5e3174f8abe38
SetupCleanupTaskC:\Windows\system32\oobe\SetupCleanupTask.dlltrue6f06af96d37e95e4361943ad96152db4
SilentCleanupC:\Windows\system32\cleanmgr.exetrue1a52c127fd0638bc2724765969c60b18
SmartRetryC:\Windows\System32\InstallServiceTasks.dlltrue855ebaa8373521bd3d39f282d36a2ba3
SpaceAgentTaskC:\Windows\system32\spaceagent.exetrue0468be9a2369f777c26944e5a55aa357
SpaceManagerTaskC:\Windows\system32\spaceman.exetruefede04bb5054ee911cd363c2c5e9eae4
SpeechModelDownloadTaskC:\Windows\system32\speech_onecore\common\speechmodeldownload.exetrue0198cb2290a8ba095c79494c70fdd24d
Sqm-TasksC:\Windows\system32\TpmTasks.dlltruee10d2a03386c5056b0453f37b5ed5a66
StartComponentCleanupfalse
StartupAppTaskC:\Windows\system32\rundll32.exetruef5b2d37bed0d2b15957736c23b9f547f
Storage Tiers Management InitializationC:\Windows\System32\TieringEngineService.exetruea86dc1b6dc847669ef04a290fe53dd00
Storage Tiers OptimizationC:\Windows\system32\defrag.exetrue2e190d98b46b93e62f68841216addd31
StorageCardEncryption TaskC:\Windows\System32\edptask.dlltrue45ed986a4271a0f5d9a27161af5a76ee
StorageSenseC:\Windows\system32\StorageUsage.dlltrue03cc10ff04282f400550980f7db446e3
SvcRestartTaskC:\Windows\System32\sppcext.dlltrue9caaf31c430fb739eb183b8465e57527
SvcRestartTaskLogonC:\Windows\System32\sppcext.dlltrue9caaf31c430fb739eb183b8465e57527
SvcRestartTaskNetworkC:\Windows\System32\sppcext.dlltrue9caaf31c430fb739eb183b8465e57527
Synchronize Language SettingsC:\Windows\System32\CoreGlobConfig.dlltrue12d3ccc0bb2e767fbfb939d9f67f292a
SynchronizeTimeC:\Windows\system32\sc.exetrue6fb10cd439b40d92935f8f6a0c99670a
SynchronizeTimeZoneC:\Windows\system32\tzsync.exetrue5f35acc7c00591d50552ef7bbf02c99a
SyspartRepairC:\Windows\system32\bcdboot.exetrue5db087d20a396ca780e453a6aefcbac4
Sysprep Generalize DriversC:\Windows\system32\drvinst.exetrue99d71c1a835ade7bbe8914e1c99abc62
SystemSoundsServiceC:\Windows\System32\PlaySndSrv.dlltrue9e29f169c3709059eec0927218fc012e
SystemTaskC:\Windows\system32\dimsjob.dlltrue051ec97c93e31707f84f334af2b130d7
TempSignedLicenseExchangeC:\Windows\System32\TempSignedLicenseExchangeTask.dlltrue4ec2e7dd80dc186e27d8ff7c75f39d22
TouchpadSyncDataAvailableC:\Windows\System32\InputCloudStore.dlltrue13208dbfbbcfbad9cd0e6ab59f72bdec
Tpm-HASCertRetrC:\Windows\system32\TpmTasks.dlltruee10d2a03386c5056b0453f37b5ed5a66
Tpm-MaintenanceC:\Windows\system32\TpmTasks.dlltruee10d2a03386c5056b0453f37b5ed5a66
UninstallationC:\Windows\System32\LanguageComponentsInstaller.dlltrue742c212ba7f256577168aeee2b00fb7c
UninstallDeviceTaskC:\Windows\SYSTEM32\bthudtask.exetrue8b5a37ab9140906cd4d0eba1af316fd5
UpdateLibraryC:\Program Files\windows media player\wmpnscfg.exetrueec604a0d8a27976ab136a489d9b6aa76
UpdateUserPictureTaskC:\Windows\System32\Windows.UI.Immersive.dlltrue9317b7ddf5e59f1baf3f5b8c4024e39d
UPnPHostConfigC:\Windows\SYSTEM32\sc.exetrue6fb10cd439b40d92935f8f6a0c99670a
UsageDataFlushingC:\Windows\System32\fcon.dlltrue3f6291e0a27897796b7f91d6402578e3
UsageDataReportingC:\Windows\System32\fcon.dlltrue3f6291e0a27897796b7f91d6402578e3
UsbCeipC:\Windows\System32\usbceip.dlltrue8a4a3dfe0a2ef540717ce4812934691a
UserTaskC:\Windows\system32\dimsjob.dlltrue051ec97c93e31707f84f334af2b130d7
UserTask-RoamC:\Windows\system32\dimsjob.dlltrue051ec97c93e31707f84f334af2b130d7
USO_UxBrokerC:\Windows\system32\musnotification.exetrue409ec93d1e08911f7e4ac299adc3d9b4
UUS Failover Taskfalse
VerifiedPublisherCertStoreCheckC:\Windows\system32\appidcertstorecheck.exetrue1af4f5e1fb76259d44d5f205e983ab38
VerifyWinREC:\Windows\System32\ReAgentTask.dlltrue235c3d1680f80ed563d02bc5a1f79844
WakeUpAndContinueUpdatesC:\Windows\System32\InstallServiceTasks.dlltrue855ebaa8373521bd3d39f282d36a2ba3
WakeUpAndScanForUpdatesC:\Windows\System32\InstallServiceTasks.dlltrue855ebaa8373521bd3d39f282d36a2ba3
Windows Defender Cache Maintenancec:\programdata\microsoft\windows defender\platform\4.18.2205.7-0\mpcmdrun.exetrued79162b9fb1e6f6916d21af592f15d8c
Windows Defender Cleanupc:\programdata\microsoft\windows defender\platform\4.18.2205.7-0\mpcmdrun.exetrued79162b9fb1e6f6916d21af592f15d8c
Windows Defender Scheduled Scanc:\programdata\microsoft\windows defender\platform\4.18.2205.7-0\mpcmdrun.exetrued79162b9fb1e6f6916d21af592f15d8c
Windows Defender Verificationc:\programdata\microsoft\windows defender\platform\4.18.2205.7-0\mpcmdrun.exetrued79162b9fb1e6f6916d21af592f15d8c
WindowsActionDialogC:\Windows\system32\windowsactiondialog.exetrue9187a7c2fc4ad2a8ea9962885b79ecee
WinSATC:\Windows\system32\WinSATAPI.dlltrued07b133ea6ab62ddb0b095fd3c621c0f

harfanglab-result-driverlist#


Get a hostname's loaded drivers from job results

Base Command#

harfanglab-result-driverlist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Optional

Context Output#

PathTypeDescription
Harfanglab.Driver.dataunknownProvides a list of loaded drivers

Command example#

!harfanglab-result-driverlist job_id="d93fdb8c-2877-4625-a6a4-7d8642f7a02b"

Context Example#

{
"Harfanglab": {
"Driver": {
"data": [
{
"fullpath": "C:\\Windows\\system32\\ntoskrnl.exe",
"md5": "10936de9161009cdf20e17450dcfff58",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\kd.dll",
"md5": "f5b674dcfe06dfa32e5fb9517694bd77",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\bootvid.dll",
"md5": "daff4f9258fbcc0d4abfb9a371f88394",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\mcupdate_genuineintel.dll",
"md5": "16835b10a6ed1e1765cb98e7f1bffcf5",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\pshed.dll",
"md5": "cc711005573cbc5609fe47601ea154c1",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\clfs.sys",
"md5": "e1276c5405944c290a27c9c5544e8318",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\hal.dll",
"md5": "62cfc8986445a2b985ec45c804f592ab",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\tm.sys",
"md5": "37ea0b86cdad032f9f8a08ae11b22e1c",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\fltmgr.sys",
"md5": "a5da65b212ef41444f5c663bd0bc733e",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\cmimcext.sys",
"md5": "1aca7b86dbe10d1394ae5988ec47980d",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\clipsp.sys",
"md5": "f65ed58b117b336f4d9b3ce34f19e1bd",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\werkernel.sys",
"md5": "3e21a039ebcce4e00fbbdd36580101ca",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\msrpc.sys",
"md5": "20cbe52b050fa5438428158323e4b0c2",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\ksecdd.sys",
"md5": "9dacc16c05894f8db0b93fb60fcc2341",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\ntosext.sys",
"md5": "6a9dabe311bcd5604eb0797d27d4e172",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\cng.sys",
"md5": "395e313507ca049e185ea3f6356fefdb",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\wdf01000.sys",
"md5": "252710b80261fc7a470765da230f4582",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\ci.dll",
"md5": "c8e44390ab50e3468999dade07dbbda5",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\driverstore\\filerepository\\prm.inf_amd64_5a6e1bc540be827c\\prm.sys",
"md5": "12b48cb3274927c57bf770dea9476011",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\acpiex.sys",
"md5": "0c2a19fce98cd5279174f70ecde10173",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\wpprecorder.sys",
"md5": "47daa15532c855eeb6adb76949b920b8",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\acpi.sys",
"md5": "128242662d8f677e8d243dffe4c30acf",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\wdfldr.sys",
"md5": "ca1fcc04b07ee6d8e77c67d1cc875db4",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\mssecflt.sys",
"md5": "e4c24f3d6d7968a7f98df30644fbf4c5",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\sgrmagent.sys",
"md5": "e81fdb11bb9dc3b743d07402ab0d6850",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\windowstrustedrtproxy.sys",
"md5": "0b728612a0aec70533a641fbec23d01a",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\ndis.sys",
"md5": "020222b426ce45d4081826902f1496d2",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\intelpep.sys",
"md5": "4217aa0ec9a2fa258de03b098d83bc71",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\windowstrustedrt.sys",
"md5": "74240ace203c61bd4f4b6081654884c0",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\intelpmt.sys",
"md5": "698ad8b52eaaaeeb7a5cad5c28db5af5",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\wmilib.sys",
"md5": "4a6b76cd34c968938c97a2e344d024a7",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\pcw.sys",
"md5": "5f0c91ebcc8fd380306628283d0ad28d",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\netio.sys",
"md5": "989cbf82a9e67583104ab6ede987d531",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\msisadrv.sys",
"md5": "af9787af0870c3349336c641a9deb816",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\vdrvroot.sys",
"md5": "504a71b5d24a6975a1d771c44ccf86fd",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\cea.sys",
"md5": "69a9e9d542f71928a2cd4b504779c3ec",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\partmgr.sys",
"md5": "f68d2066b9f1a4fdb95613770c55c338",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\spaceport.sys",
"md5": "7d38fe01b3309a01119b19b1a807673b",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\pci.sys",
"md5": "62e81f2f53126ec6e5149667de967897",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\pdc.sys",
"md5": "5b34708a130a4aba61fabb66d3153aad",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\mountmgr.sys",
"md5": "531d3c5a7749a2c912ea6a0e5cb67c75",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\ataport.sys",
"md5": "17fa3eb00ff97f25819f8f8e1c6085ab",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\volmgr.sys",
"md5": "0bc9e7b4865ed2227cccc05f1dbc6f52",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\pciidex.sys",
"md5": "bdca300aebaa8acf7d1d44d59d2afd6d",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\storahci.sys",
"md5": "ed739b05ba3210ea45b0ad74e4df167b",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\volmgrx.sys",
"md5": "f7da6b4c3238121c132213e30b7651b2",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\intelide.sys",
"md5": "32f91cbd0b66b168082c0472e22c8c89",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\atapi.sys",
"md5": "6db20deaa154aee9122d8aee5541f5c7",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\storport.sys",
"md5": "284bffa1e8be61a158c6a5fd674f3515",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\ehstorclass.sys",
"md5": "5a27edc058ead20f9b71c440a6f5c764",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\wd\\wdfilter.sys",
"md5": "98e9a26bbd42e644bf797710f9f65dce",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\wof.sys",
"md5": "06ea9914a709a459075122981df85d37",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\ntfs.sys",
"md5": "dd4cee5428499ccd02013ce6a591b600",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\ksecpkg.sys",
"md5": "ad9063eeb2a5179acd11bb1754023c30",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\vboxguest.sys",
"md5": "873c8107cc6f4a8339b66eeb9fa2d2e1",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\fs_rec.sys",
"md5": "b778af9c823c027d4e3f2de30eeccc60",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\tcpip.sys",
"md5": "8a13f21e7fb8f78a3d01bb952f691242",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\fwpkclnt.sys",
"md5": "2edef18a931f8346a504ae1383473cf1",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\wfplwfs.sys",
"md5": "2aad68e852436e0a7363377c91e0302d",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\cdrom.sys",
"md5": "f8598f378ec752af85fa3f642a870906",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\classpnp.sys",
"md5": "1314a382832de7861a0f7dfaad4f88be",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\disk.sys",
"md5": "ba90cfc0d444bb5468fd050073ea5386",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\volume.sys",
"md5": "05fac0dd1370c68530f0a72caf64a27b",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\volsnap.sys",
"md5": "8e0d28114d41d67b95c71d5cd17e86c0",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\crashdmp.sys",
"md5": "75c7c14ea63bc131708c08d3569054ee",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\mup.sys",
"md5": "265830023853939fcbf87ba954f3146a",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\watchdog.sys",
"md5": "1d763e1c86f2f275af87c426164460a9",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\filecrypt.sys",
"md5": "087265c07e4364fd44d213b7b3fd57b3",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\null.sys",
"md5": "85ab11a2f4fb94b9fb6a2d889d83fcac",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\dxgkrnl.sys",
"md5": "2e247733503fa28483e871dba19519b9",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\tbs.sys",
"md5": "4bba2bddbd2a8982d195e12d6ea9e246",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\driverstore\\filerepository\\basicdisplay.inf_amd64_7e9cb61920ccc040\\basicdisplay.sys",
"md5": "9e94d724c1dc4cca719be07eb1020dee",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\msfs.sys",
"md5": "82560bdaf351cd8917f01b5d7a1c03a4",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\tdi.sys",
"md5": "49999ea1cdb93b73daea66e5a173d065",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\driverstore\\filerepository\\basicrender.inf_amd64_1c03174c7c755975\\basicrender.sys",
"md5": "5e1ea96e7fd6ac5d1ba7c56e4b33e100",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\npfs.sys",
"md5": "3f4f4c10e7b81bc4b2d5c4c7e2c268a0",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\afd.sys",
"md5": "d5e687f3cb3f33b2554037332c7ffd26",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\cimfs.sys",
"md5": "c77761c2f092d133329ffa7e5756c216",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\tdx.sys",
"md5": "7fd3d3e74c586e48b1fe6a26d9041a5a",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\netbt.sys",
"md5": "3937adb725a18a0dac7ae7c1e0efd2e4",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\afunix.sys",
"md5": "6904a360dcc3b90a798cde109f25ebb4",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\ndiscap.sys",
"md5": "5c5dab38e24c46cc9e2ac793541780ed",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\npsvctrig.sys",
"md5": "e6d73640ffe28611bebcf1af11ef18dc",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\pacer.sys",
"md5": "39b1cf32f9c62caa14516259823d0291",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\vboxsf.sys",
"md5": "9c5fa56ec9fa228e31484df1e41364d3",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\mssmbios.sys",
"md5": "530d7c0b3e2fc916fb0da8fc8d4b6ef6",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\netbios.sys",
"md5": "9085e8233201b963ce447dc645670670",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\rdbss.sys",
"md5": "2e7eb447308f9c60e98a0c0c99ba4c78",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\nsiproxy.sys",
"md5": "3a66f37dde3f8338cbd639b0106e38ca",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\bam.sys",
"md5": "41f732bba9521ceb0c834d2b3fbb5090",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\i8042prt.sys",
"md5": "8bc4c8d32cea74b3c27a77330ba1ff28",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\dfsc.sys",
"md5": "7317e6235f0f1b1e6fa5a6d2cf9ba724",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\fastfat.sys",
"md5": "f145863ca528a8975a72b8cdf3ec20e8",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\ahcache.sys",
"md5": "bfb562fd6102dc1729425c4c3cd450e5",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\driverstore\\filerepository\\compositebus.inf_amd64_130dea07a2ae55eb\\compositebus.sys",
"md5": "564ac50963890f9b3ab0052c249dbc21",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\kdnic.sys",
"md5": "d8ac3b58add59eeb8674787347795806",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\kbdclass.sys",
"md5": "27947916ad55bfdb88c6f2e00ac4d90b",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\vboxmouse.sys",
"md5": "0b922b41369b9779a4e71d68efc02275",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\driverstore\\filerepository\\umbus.inf_amd64_f529037a77b144c5\\umbus.sys",
"md5": "65aa6b0661c1eedbe80667b39bebc784",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\mouclass.sys",
"md5": "0c34c0630a233c0f62fcdd4d13af0d47",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\cmbatt.sys",
"md5": "bff879e5bb87092532be8229528c2100",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\ndisvirtualbus.sys",
"md5": "a686524719ece3235adae3e30214a2db",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\battc.sys",
"md5": "503867acfd527cf7a315bdcb6f1062c5",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\vboxwddm.sys",
"md5": "66ed4d8224cfe448ba9dad324b564f35",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\e1g6032e.sys",
"md5": "cced99682127e8582e5f716ece775ef8",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\intelppm.sys",
"md5": "786f77d638ff941977956898ebcb758e",
"signed": true
},
{
"fullpath": "",
"md5": null,
"signed": false
},
{
"fullpath": "C:\\Windows\\system32\\driverstore\\filerepository\\swenum.inf_amd64_a8eddc34aa14df5f\\swenum.sys",
"md5": "0d8210a54c87102db6f0406b1c265a9c",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\ks.sys",
"md5": "7114a4394561a321bcd145be2e3737d5",
"signed": true
},
{
"fullpath": "",
"md5": null,
"signed": false
},
{
"fullpath": "C:\\Windows\\system32\\win32kfull.sys",
"md5": "40de0513a189152f1c21a63d657e2804",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\win32kbase.sys",
"md5": "a6869afa4c477af83f232c32a5daa9e7",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\win32k.sys",
"md5": "436e4df36ac1549d2eb3f8eac53df074",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\rdpbus.sys",
"md5": "d1edd6604ed1a6e2bc45134c307d3e82",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\hidparse.sys",
"md5": "d9a8063a2c30bd2f4815d973d9711d22",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\monitor.sys",
"md5": "b8f452f5baa586406a190c647c1443e4",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\wcifs.sys",
"md5": "f6eac3ea92f216a48495ea0fe645dcbf",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\storqosflt.sys",
"md5": "966997d2b3ebe8ea30ec42101dbe5768",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\dxgmms2.sys",
"md5": "98ce225ae17a6d67ae1e5d2869fdf7f7",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\cdd.dll",
"md5": "1c12e169adb6dc8b3cedc0a09bd1188f",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\cldflt.sys",
"md5": "ce5e59e0b763ec8495c9a623519d55ee",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\rdpvideominiport.sys",
"md5": "26fa006e8dc780d58158f58cf11fe3a3",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\mrxsmb.sys",
"md5": "b0186ea7f1979d9f02da0ae11542d39d",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\msquic.sys",
"md5": "afb57e498cd26284e9603353fb9104ad",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\mslldp.sys",
"md5": "d69790cc30e3717431067b1a43a679f1",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\bowser.sys",
"md5": "1349bea208c0f48534cfde0e8a64c3a4",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\lltdio.sys",
"md5": "38c53c38731190ba73b39cbd3befe14a",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\bindflt.sys",
"md5": "103737c5c139bfa688ea52c3f1fdf8cc",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\rdpdr.sys",
"md5": "e63147974f4fc014742c5471c7bc516d",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\http.sys",
"md5": "0db27d34c898a592dcf7e4a5eeacc2be",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\srvnet.sys",
"md5": "fdfcf9c6d6bec82925b2e52926acbbb2",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\mrxsmb20.sys",
"md5": "40f91604967e771021b89a54ddb74131",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\peauth.sys",
"md5": "e8789b5f24aa80994be1e2b27992af7c",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\srv2.sys",
"md5": "ccfe129cbdea8b8c6051d11c6c694230",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\rspndr.sys",
"md5": "e66e50a0a3344a377838ef8b965a7f88",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\mpsdrv.sys",
"md5": "fb4d94870b1f42d93feb8a85b590fd4a",
"signed": true
},
{
"fullpath": "c:\\programdata\\microsoft\\windows defender\\definition updates\\{265c6876-acfd-4597-b853-b3e54112bc77}\\mpksldrv.sys",
"md5": "6f2f14025a606b924e77ad29aa68d231",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\hlprotect.sys",
"md5": "44480d8a012a7249bc390cbcdb687fee",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\tcpipreg.sys",
"md5": "6a7338ae6e83bf75f2057b7b1242f81b",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\condrv.sys",
"md5": "122c522158f2499cee46e1d2e2b59787",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\mmcss.sys",
"md5": "a10c637165ab63671f5ea554109d008c",
"signed": true
},
{
"fullpath": "C:\\Windows\\system32\\drivers\\terminpt.sys",
"md5": "a073581102fca9e17a1a4a5a40542d5c",
"signed": true
}
]
}
}
}

Human Readable Output#

Driver List#

fullpathsignedmd5
C:\Windows\system32\ntoskrnl.exetrue10936de9161009cdf20e17450dcfff58
C:\Windows\system32\kd.dlltruef5b674dcfe06dfa32e5fb9517694bd77
C:\Windows\system32\bootvid.dlltruedaff4f9258fbcc0d4abfb9a371f88394
C:\Windows\system32\mcupdate_genuineintel.dlltrue16835b10a6ed1e1765cb98e7f1bffcf5
C:\Windows\system32\pshed.dlltruecc711005573cbc5609fe47601ea154c1
C:\Windows\system32\drivers\clfs.systruee1276c5405944c290a27c9c5544e8318
C:\Windows\system32\hal.dlltrue62cfc8986445a2b985ec45c804f592ab
C:\Windows\system32\drivers\tm.systrue37ea0b86cdad032f9f8a08ae11b22e1c
C:\Windows\system32\drivers\fltmgr.systruea5da65b212ef41444f5c663bd0bc733e
C:\Windows\system32\drivers\cmimcext.systrue1aca7b86dbe10d1394ae5988ec47980d
C:\Windows\system32\drivers\clipsp.systruef65ed58b117b336f4d9b3ce34f19e1bd
C:\Windows\system32\drivers\werkernel.systrue3e21a039ebcce4e00fbbdd36580101ca
C:\Windows\system32\drivers\msrpc.systrue20cbe52b050fa5438428158323e4b0c2
C:\Windows\system32\drivers\ksecdd.systrue9dacc16c05894f8db0b93fb60fcc2341
C:\Windows\system32\drivers\ntosext.systrue6a9dabe311bcd5604eb0797d27d4e172
C:\Windows\system32\drivers\cng.systrue395e313507ca049e185ea3f6356fefdb
C:\Windows\system32\drivers\wdf01000.systrue252710b80261fc7a470765da230f4582
C:\Windows\system32\ci.dlltruec8e44390ab50e3468999dade07dbbda5
C:\Windows\system32\driverstore\filerepository\prm.inf_amd64_5a6e1bc540be827c\prm.systrue12b48cb3274927c57bf770dea9476011
C:\Windows\system32\drivers\acpiex.systrue0c2a19fce98cd5279174f70ecde10173
C:\Windows\system32\drivers\wpprecorder.systrue47daa15532c855eeb6adb76949b920b8
C:\Windows\system32\drivers\acpi.systrue128242662d8f677e8d243dffe4c30acf
C:\Windows\system32\drivers\wdfldr.systrueca1fcc04b07ee6d8e77c67d1cc875db4
C:\Windows\system32\drivers\mssecflt.systruee4c24f3d6d7968a7f98df30644fbf4c5
C:\Windows\system32\drivers\sgrmagent.systruee81fdb11bb9dc3b743d07402ab0d6850
C:\Windows\system32\drivers\windowstrustedrtproxy.systrue0b728612a0aec70533a641fbec23d01a
C:\Windows\system32\drivers\ndis.systrue020222b426ce45d4081826902f1496d2
C:\Windows\system32\drivers\intelpep.systrue4217aa0ec9a2fa258de03b098d83bc71
C:\Windows\system32\drivers\windowstrustedrt.systrue74240ace203c61bd4f4b6081654884c0
C:\Windows\system32\drivers\intelpmt.systrue698ad8b52eaaaeeb7a5cad5c28db5af5
C:\Windows\system32\drivers\wmilib.systrue4a6b76cd34c968938c97a2e344d024a7
C:\Windows\system32\drivers\pcw.systrue5f0c91ebcc8fd380306628283d0ad28d
C:\Windows\system32\drivers\netio.systrue989cbf82a9e67583104ab6ede987d531
C:\Windows\system32\drivers\msisadrv.systrueaf9787af0870c3349336c641a9deb816
C:\Windows\system32\drivers\vdrvroot.systrue504a71b5d24a6975a1d771c44ccf86fd
C:\Windows\system32\drivers\cea.systrue69a9e9d542f71928a2cd4b504779c3ec
C:\Windows\system32\drivers\partmgr.systruef68d2066b9f1a4fdb95613770c55c338
C:\Windows\system32\drivers\spaceport.systrue7d38fe01b3309a01119b19b1a807673b
C:\Windows\system32\drivers\pci.systrue62e81f2f53126ec6e5149667de967897
C:\Windows\system32\drivers\pdc.systrue5b34708a130a4aba61fabb66d3153aad
C:\Windows\system32\drivers\mountmgr.systrue531d3c5a7749a2c912ea6a0e5cb67c75
C:\Windows\system32\drivers\ataport.systrue17fa3eb00ff97f25819f8f8e1c6085ab
C:\Windows\system32\drivers\volmgr.systrue0bc9e7b4865ed2227cccc05f1dbc6f52
C:\Windows\system32\drivers\pciidex.systruebdca300aebaa8acf7d1d44d59d2afd6d
C:\Windows\system32\drivers\storahci.systrueed739b05ba3210ea45b0ad74e4df167b
C:\Windows\system32\drivers\volmgrx.systruef7da6b4c3238121c132213e30b7651b2
C:\Windows\system32\drivers\intelide.systrue32f91cbd0b66b168082c0472e22c8c89
C:\Windows\system32\drivers\atapi.systrue6db20deaa154aee9122d8aee5541f5c7
C:\Windows\system32\drivers\storport.systrue284bffa1e8be61a158c6a5fd674f3515
C:\Windows\system32\drivers\ehstorclass.systrue5a27edc058ead20f9b71c440a6f5c764
C:\Windows\system32\drivers\wd\wdfilter.systrue98e9a26bbd42e644bf797710f9f65dce
C:\Windows\system32\drivers\wof.systrue06ea9914a709a459075122981df85d37
C:\Windows\system32\drivers\ntfs.systruedd4cee5428499ccd02013ce6a591b600
C:\Windows\system32\drivers\ksecpkg.systruead9063eeb2a5179acd11bb1754023c30
C:\Windows\system32\drivers\vboxguest.systrue873c8107cc6f4a8339b66eeb9fa2d2e1
C:\Windows\system32\drivers\fs_rec.systrueb778af9c823c027d4e3f2de30eeccc60
C:\Windows\system32\drivers\tcpip.systrue8a13f21e7fb8f78a3d01bb952f691242
C:\Windows\system32\drivers\fwpkclnt.systrue2edef18a931f8346a504ae1383473cf1
C:\Windows\system32\drivers\wfplwfs.systrue2aad68e852436e0a7363377c91e0302d
C:\Windows\system32\drivers\cdrom.systruef8598f378ec752af85fa3f642a870906
C:\Windows\system32\drivers\classpnp.systrue1314a382832de7861a0f7dfaad4f88be
C:\Windows\system32\drivers\disk.systrueba90cfc0d444bb5468fd050073ea5386
C:\Windows\system32\drivers\volume.systrue05fac0dd1370c68530f0a72caf64a27b
C:\Windows\system32\drivers\volsnap.systrue8e0d28114d41d67b95c71d5cd17e86c0
C:\Windows\system32\drivers\crashdmp.systrue75c7c14ea63bc131708c08d3569054ee
C:\Windows\system32\drivers\mup.systrue265830023853939fcbf87ba954f3146a
C:\Windows\system32\drivers\watchdog.systrue1d763e1c86f2f275af87c426164460a9
C:\Windows\system32\drivers\filecrypt.systrue087265c07e4364fd44d213b7b3fd57b3
C:\Windows\system32\drivers\null.systrue85ab11a2f4fb94b9fb6a2d889d83fcac
C:\Windows\system32\drivers\dxgkrnl.systrue2e247733503fa28483e871dba19519b9
C:\Windows\system32\drivers\tbs.systrue4bba2bddbd2a8982d195e12d6ea9e246
C:\Windows\system32\driverstore\filerepository\basicdisplay.inf_amd64_7e9cb61920ccc040\basicdisplay.systrue9e94d724c1dc4cca719be07eb1020dee
C:\Windows\system32\drivers\msfs.systrue82560bdaf351cd8917f01b5d7a1c03a4
C:\Windows\system32\drivers\tdi.systrue49999ea1cdb93b73daea66e5a173d065
C:\Windows\system32\driverstore\filerepository\basicrender.inf_amd64_1c03174c7c755975\basicrender.systrue5e1ea96e7fd6ac5d1ba7c56e4b33e100
C:\Windows\system32\drivers\npfs.systrue3f4f4c10e7b81bc4b2d5c4c7e2c268a0
C:\Windows\system32\drivers\afd.systrued5e687f3cb3f33b2554037332c7ffd26
C:\Windows\system32\drivers\cimfs.systruec77761c2f092d133329ffa7e5756c216
C:\Windows\system32\drivers\tdx.systrue7fd3d3e74c586e48b1fe6a26d9041a5a
C:\Windows\system32\drivers\netbt.systrue3937adb725a18a0dac7ae7c1e0efd2e4
C:\Windows\system32\drivers\afunix.systrue6904a360dcc3b90a798cde109f25ebb4
C:\Windows\system32\drivers\ndiscap.systrue5c5dab38e24c46cc9e2ac793541780ed
C:\Windows\system32\drivers\npsvctrig.systruee6d73640ffe28611bebcf1af11ef18dc
C:\Windows\system32\drivers\pacer.systrue39b1cf32f9c62caa14516259823d0291
C:\Windows\system32\drivers\vboxsf.systrue9c5fa56ec9fa228e31484df1e41364d3
C:\Windows\system32\drivers\mssmbios.systrue530d7c0b3e2fc916fb0da8fc8d4b6ef6
C:\Windows\system32\drivers\netbios.systrue9085e8233201b963ce447dc645670670
C:\Windows\system32\drivers\rdbss.systrue2e7eb447308f9c60e98a0c0c99ba4c78
C:\Windows\system32\drivers\nsiproxy.systrue3a66f37dde3f8338cbd639b0106e38ca
C:\Windows\system32\drivers\bam.systrue41f732bba9521ceb0c834d2b3fbb5090
C:\Windows\system32\drivers\i8042prt.systrue8bc4c8d32cea74b3c27a77330ba1ff28
C:\Windows\system32\drivers\dfsc.systrue7317e6235f0f1b1e6fa5a6d2cf9ba724
C:\Windows\system32\drivers\fastfat.systruef145863ca528a8975a72b8cdf3ec20e8
C:\Windows\system32\drivers\ahcache.systruebfb562fd6102dc1729425c4c3cd450e5
C:\Windows\system32\driverstore\filerepository\compositebus.inf_amd64_130dea07a2ae55eb\compositebus.systrue564ac50963890f9b3ab0052c249dbc21
C:\Windows\system32\drivers\kdnic.systrued8ac3b58add59eeb8674787347795806
C:\Windows\system32\drivers\kbdclass.systrue27947916ad55bfdb88c6f2e00ac4d90b
C:\Windows\system32\drivers\vboxmouse.systrue0b922b41369b9779a4e71d68efc02275
C:\Windows\system32\driverstore\filerepository\umbus.inf_amd64_f529037a77b144c5\umbus.systrue65aa6b0661c1eedbe80667b39bebc784
C:\Windows\system32\drivers\mouclass.systrue0c34c0630a233c0f62fcdd4d13af0d47
C:\Windows\system32\drivers\cmbatt.systruebff879e5bb87092532be8229528c2100
C:\Windows\system32\drivers\ndisvirtualbus.systruea686524719ece3235adae3e30214a2db
C:\Windows\system32\drivers\battc.systrue503867acfd527cf7a315bdcb6f1062c5
C:\Windows\system32\drivers\vboxwddm.systrue66ed4d8224cfe448ba9dad324b564f35
C:\Windows\system32\drivers\e1g6032e.systruecced99682127e8582e5f716ece775ef8
C:\Windows\system32\drivers\intelppm.systrue786f77d638ff941977956898ebcb758e
false
C:\Windows\system32\driverstore\filerepository\swenum.inf_amd64_a8eddc34aa14df5f\swenum.systrue0d8210a54c87102db6f0406b1c265a9c
C:\Windows\system32\drivers\ks.systrue7114a4394561a321bcd145be2e3737d5
false
C:\Windows\system32\win32kfull.systrue40de0513a189152f1c21a63d657e2804
C:\Windows\system32\win32kbase.systruea6869afa4c477af83f232c32a5daa9e7
C:\Windows\system32\win32k.systrue436e4df36ac1549d2eb3f8eac53df074
C:\Windows\system32\drivers\rdpbus.systrued1edd6604ed1a6e2bc45134c307d3e82
C:\Windows\system32\drivers\hidparse.systrued9a8063a2c30bd2f4815d973d9711d22
C:\Windows\system32\drivers\monitor.systrueb8f452f5baa586406a190c647c1443e4
C:\Windows\system32\drivers\wcifs.systruef6eac3ea92f216a48495ea0fe645dcbf
C:\Windows\system32\drivers\storqosflt.systrue966997d2b3ebe8ea30ec42101dbe5768
C:\Windows\system32\drivers\dxgmms2.systrue98ce225ae17a6d67ae1e5d2869fdf7f7
C:\Windows\system32\cdd.dlltrue1c12e169adb6dc8b3cedc0a09bd1188f
C:\Windows\system32\drivers\cldflt.systruece5e59e0b763ec8495c9a623519d55ee
C:\Windows\system32\drivers\rdpvideominiport.systrue26fa006e8dc780d58158f58cf11fe3a3
C:\Windows\system32\drivers\mrxsmb.systrueb0186ea7f1979d9f02da0ae11542d39d
C:\Windows\system32\drivers\msquic.systrueafb57e498cd26284e9603353fb9104ad
C:\Windows\system32\drivers\mslldp.systrued69790cc30e3717431067b1a43a679f1
C:\Windows\system32\drivers\bowser.systrue1349bea208c0f48534cfde0e8a64c3a4
C:\Windows\system32\drivers\lltdio.systrue38c53c38731190ba73b39cbd3befe14a
C:\Windows\system32\drivers\bindflt.systrue103737c5c139bfa688ea52c3f1fdf8cc
C:\Windows\system32\drivers\rdpdr.systruee63147974f4fc014742c5471c7bc516d
C:\Windows\system32\drivers\http.systrue0db27d34c898a592dcf7e4a5eeacc2be
C:\Windows\system32\drivers\srvnet.systruefdfcf9c6d6bec82925b2e52926acbbb2
C:\Windows\system32\drivers\mrxsmb20.systrue40f91604967e771021b89a54ddb74131
C:\Windows\system32\drivers\peauth.systruee8789b5f24aa80994be1e2b27992af7c
C:\Windows\system32\drivers\srv2.systrueccfe129cbdea8b8c6051d11c6c694230
C:\Windows\system32\drivers\rspndr.systruee66e50a0a3344a377838ef8b965a7f88
C:\Windows\system32\drivers\mpsdrv.systruefb4d94870b1f42d93feb8a85b590fd4a
c:\programdata\microsoft\windows defender\definition updates{265c6876-acfd-4597-b853-b3e54112bc77}\mpksldrv.systrue6f2f14025a606b924e77ad29aa68d231
C:\Windows\system32\drivers\hlprotect.systrue44480d8a012a7249bc390cbcdb687fee
C:\Windows\system32\drivers\tcpipreg.systrue6a7338ae6e83bf75f2057b7b1242f81b
C:\Windows\system32\drivers\condrv.systrue122c522158f2499cee46e1d2e2b59787
C:\Windows\system32\drivers\mmcss.systruea10c637165ab63671f5ea554109d008c
C:\Windows\system32\drivers\terminpt.systruea073581102fca9e17a1a4a5a40542d5c

harfanglab-result-servicelist#


Get a hostname's list of services from job results

Base Command#

harfanglab-result-servicelist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Optional

Context Output#

PathTypeDescription
Harfanglab.Service.dataunknownProvides a list of services

Command example#

!harfanglab-result-servicelist job_id="bde92340-27da-4009-b310-5b7fa6e4fcb9"

Context Example#

{
"Harfanglab": {
"Service": {
"data": [
{
"fullpath": "C:\\Windows\\System32\\drivers\\1394ohci.sys",
"image path": "\\SystemRoot\\System32\\drivers\\1394ohci.sys",
"md5": "809badbedd63ae4481fd65b8b20e8c0b",
"name": "1394ohci",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\drivers\\1394ohci.sys",
"image path": "\\SystemRoot\\System32\\drivers\\1394ohci.sys",
"md5": "809badbedd63ae4481fd65b8b20e8c0b",
"name": "1394ohci",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\drivers\\3ware.sys",
"image path": "System32\\drivers\\3ware.sys",
"md5": "0652580a777f9d77aa409d8595cec672",
"name": "3ware",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\drivers\\3ware.sys",
"image path": "System32\\drivers\\3ware.sys",
"md5": "0652580a777f9d77aa409d8595cec672",
"name": "3ware",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\drivers\\ACPI.sys",
"image path": "System32\\drivers\\ACPI.sys",
"md5": "128242662d8f677e8d243dffe4c30acf",
"name": "ACPI",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\drivers\\ACPI.sys",
"image path": "System32\\drivers\\ACPI.sys",
"md5": "128242662d8f677e8d243dffe4c30acf",
"name": "ACPI",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\drivers\\AcpiDev.sys",
"image path": "\\SystemRoot\\System32\\drivers\\AcpiDev.sys",
"md5": "ac827e39be44984a28abc64b44b47445",
"name": "AcpiDev",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\drivers\\AcpiDev.sys",
"image path": "\\SystemRoot\\System32\\drivers\\AcpiDev.sys",
"md5": "ac827e39be44984a28abc64b44b47445",
"name": "AcpiDev",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\Drivers\\acpiex.sys",
"image path": "System32\\Drivers\\acpiex.sys",
"md5": "0c2a19fce98cd5279174f70ecde10173",
"name": "acpiex",
"signed": true
},
{
"fullpath": "C:\\Windows\\System32\\Drivers\\acpiex.sys",
"image path": "System32\\Drivers\\acpiex.sys",
"md5": "0c2a19fce98cd5279174f70ecde10173",
"name": "acpiex",
"signed": true
}
]
}
}
}

Human Readable Output#

Scheduled Task List#

namefullpathsignedmd5
1394ohciC:\Windows\System32\drivers\1394ohci.systrue809badbedd63ae4481fd65b8b20e8c0b
1394ohciC:\Windows\System32\drivers\1394ohci.systrue809badbedd63ae4481fd65b8b20e8c0b
3wareC:\Windows\System32\drivers\3ware.systrue0652580a777f9d77aa409d8595cec672
3wareC:\Windows\System32\drivers\3ware.systrue0652580a777f9d77aa409d8595cec672
ACPIC:\Windows\System32\drivers\ACPI.systrue128242662d8f677e8d243dffe4c30acf
ACPIC:\Windows\System32\drivers\ACPI.systrue128242662d8f677e8d243dffe4c30acf
AcpiDevC:\Windows\System32\drivers\AcpiDev.systrueac827e39be44984a28abc64b44b47445
AcpiDevC:\Windows\System32\drivers\AcpiDev.systrueac827e39be44984a28abc64b44b47445
acpiexC:\Windows\System32\Drivers\acpiex.systrue0c2a19fce98cd5279174f70ecde10173
acpiexC:\Windows\System32\Drivers\acpiex.systrue0c2a19fce98cd5279174f70ecde10173

harfanglab-result-processlist#


Get a hostname's list of processes from job results

Base Command#

harfanglab-result-processlist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.Process.dataunknownProvides a list of processes

Command example#

!harfanglab-result-processlist job_id="db793a9d-6d86-4fbf-8ee5-8836f04e14ff"

Context Example#

{
"Harfanglab": {
"Process": {
"data": [
{
"cmdline": "AggregatorHost.exe",
"fullpath": "C:\\Windows\\System32\\AggregatorHost.exe",
"integrity": "System",
"md5": "391ed483154f77cfdad1e2e0f9ce2001",
"name": "AggregatorHost.exe",
"pid": 2588,
"ppid": 1428,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "\\??\\C:\\Windows\\system32\\conhost.exe 0x4",
"fullpath": "C:\\Windows\\System32\\conhost.exe",
"integrity": "System",
"md5": "b03d74d481d9d64047625bec2d64a0ce",
"name": "conhost.exe",
"pid": 4812,
"ppid": 4800,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "%SystemRoot%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16",
"fullpath": "C:\\Windows\\System32\\csrss.exe",
"integrity": "Unknown",
"md5": "a6c9ee45bff7c5e696b07ec41af84541",
"name": "csrss.exe",
"pid": 436,
"ppid": 428,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "%SystemRoot%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16",
"fullpath": "C:\\Windows\\System32\\csrss.exe",
"integrity": "Unknown",
"md5": "a6c9ee45bff7c5e696b07ec41af84541",
"name": "csrss.exe",
"pid": 512,
"ppid": 496,
"session": 1,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "%SystemRoot%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16",
"fullpath": "C:\\Windows\\System32\\csrss.exe",
"integrity": "Unknown",
"md5": "a6c9ee45bff7c5e696b07ec41af84541",
"name": "csrss.exe",
"pid": 4648,
"ppid": 3972,
"session": 3,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "ctfmon.exe",
"fullpath": "C:\\Windows\\System32\\ctfmon.exe",
"integrity": "High",
"md5": "91e5e0722b281024e60d5768ab948794",
"name": "ctfmon.exe",
"pid": 3220,
"ppid": 772,
"session": 1,
"signed": true,
"username": "DC-01\\vagrant"
},
{
"cmdline": "C:\\Windows\\system32\\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}",
"fullpath": "C:\\Windows\\System32\\dllhost.exe",
"integrity": "High",
"md5": "61b7ccf84d2b4251bd263e75cd103f89",
"name": "dllhost.exe",
"pid": 268,
"ppid": 752,
"session": 1,
"signed": true,
"username": "DC-01\\vagrant"
},
{
"cmdline": "dwm.exe",
"fullpath": "C:\\Windows\\System32\\dwm.exe",
"integrity": "System",
"md5": "66f552d20dcf3377279c20a119e0e72f",
"name": "dwm.exe",
"pid": 948,
"ppid": 588,
"session": 1,
"signed": true,
"username": "Window Manager\\DWM-1"
},
{
"cmdline": "dwm.exe",
"fullpath": "C:\\Windows\\System32\\dwm.exe",
"integrity": "System",
"md5": "66f552d20dcf3377279c20a119e0e72f",
"name": "dwm.exe",
"pid": 4740,
"ppid": 1592,
"session": 3,
"signed": true,
"username": "Window Manager\\DWM-3"
},
{
"cmdline": "C:\\Windows\\Explorer.EXE",
"fullpath": "C:\\Windows\\explorer.exe",
"integrity": "High",
"md5": "7761d5917fa1adc297a5ce0cf1e242eb",
"name": "explorer.exe",
"pid": 616,
"ppid": 3940,
"session": 1,
"signed": true,
"username": "DC-01\\vagrant"
},
{
"cmdline": "fontdrvhost.exe",
"fullpath": "C:\\Windows\\System32\\fontdrvhost.exe",
"integrity": "Low",
"md5": "dd24bac3913d47f9b35a8718aeed3cbe",
"name": "fontdrvhost.exe",
"pid": 776,
"ppid": 588,
"session": 1,
"signed": true,
"username": "Font Driver Host\\UMFD-1"
},
{
"cmdline": "fontdrvhost.exe",
"fullpath": "C:\\Windows\\System32\\fontdrvhost.exe",
"integrity": "Low",
"md5": "dd24bac3913d47f9b35a8718aeed3cbe",
"name": "fontdrvhost.exe",
"pid": 780,
"ppid": 504,
"session": 0,
"signed": true,
"username": "Font Driver Host\\UMFD-0"
},
{
"cmdline": "fontdrvhost.exe",
"fullpath": "C:\\Windows\\System32\\fontdrvhost.exe",
"integrity": "Low",
"md5": "dd24bac3913d47f9b35a8718aeed3cbe",
"name": "fontdrvhost.exe",
"pid": 1580,
"ppid": 1592,
"session": 3,
"signed": true,
"username": "Font Driver Host\\UMFD-3"
},
{
"cmdline": "C:\\Program Files\\HarfangLab\\hurukai.exe {1c38b8b3-2cb1-1ea6-5f44-6c2c93ab812c}",
"fullpath": "C:\\Program Files\\HarfangLab\\hurukai.exe",
"integrity": "System",
"md5": "05049f1cadb8af2b6893e1ead33351c9",
"name": "hurukai.exe",
"pid": 4800,
"ppid": 1560,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "C:\\Program Files\\HarfangLab\\hurukai.exe",
"fullpath": "C:\\Program Files\\HarfangLab\\hurukai.exe",
"integrity": "System",
"md5": "05049f1cadb8af2b6893e1ead33351c9",
"name": "hurukai.exe",
"pid": 1560,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "LogonUI.exe /flags:0x0 /state0:0xa14bc855 /state1:0x41c64e6d",
"fullpath": "C:\\Windows\\System32\\LogonUI.exe",
"integrity": "System",
"md5": "6cd47ca4515b2f81b5ca1e6ca9a323cc",
"name": "LogonUI.exe",
"pid": 4368,
"ppid": 588,
"session": 1,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "LogonUI.exe /flags:0x2 /state0:0xa14fa855 /state1:0x41c64e6d",
"fullpath": "C:\\Windows\\System32\\LogonUI.exe",
"integrity": "System",
"md5": "6cd47ca4515b2f81b5ca1e6ca9a323cc",
"name": "LogonUI.exe",
"pid": 2968,
"ppid": 1592,
"session": 3,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "C:\\Windows\\system32\\lsass.exe",
"fullpath": "C:\\Windows\\System32\\lsass.exe",
"integrity": "System",
"md5": "6da2fcc580c720c16612057e83f47f04",
"name": "lsass.exe",
"pid": 644,
"ppid": 504,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "C:\\Windows\\System32\\msdtc.exe",
"fullpath": "C:\\Windows\\System32\\msdtc.exe",
"integrity": "System",
"md5": "bd7be47340ba4888b9b47ad323ff51d3",
"name": "msdtc.exe",
"pid": 3516,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"cmdline": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2205.7-0\\MsMpEng.exe",
"fullpath": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2205.7-0\\MsMpEng.exe",
"integrity": "Unknown",
"md5": "a7dca32f82ec2569865f447416a7cf1a",
"name": "MsMpEng.exe",
"pid": 2104,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "rdpclip",
"fullpath": "C:\\Windows\\System32\\rdpclip.exe",
"integrity": "High",
"md5": "ab8027b4bc3a3cd5b25070b08274fbed",
"name": "rdpclip.exe",
"pid": 4888,
"ppid": 392,
"session": 1,
"signed": true,
"username": "DC-01\\vagrant"
},
{
"cmdline": "C:\\Windows\\regedit.exe",
"fullpath": "C:\\Windows\\regedit.exe",
"integrity": "High",
"md5": "fea68fb10d62cbadf484dc1d2f44ed11",
"name": "regedit.exe",
"pid": 4160,
"ppid": 616,
"session": 1,
"signed": true,
"username": "DC-01\\vagrant"
},
{
"cmdline": "",
"fullpath": "",
"integrity": "Unknown",
"md5": null,
"name": "Registry",
"pid": 100,
"ppid": 4,
"session": 0,
"signed": false,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "C:\\Windows\\System32\\RuntimeBroker.exe -Embedding",
"fullpath": "C:\\Windows\\System32\\RuntimeBroker.exe",
"integrity": "High",
"md5": "1541969ef9db9aae4e89b749d427cdea",
"name": "RuntimeBroker.exe",
"pid": 1280,
"ppid": 752,
"session": 1,
"signed": true,
"username": "DC-01\\vagrant"
},
{
"cmdline": "C:\\Windows\\System32\\RuntimeBroker.exe -Embedding",
"fullpath": "C:\\Windows\\System32\\RuntimeBroker.exe",
"integrity": "High",
"md5": "1541969ef9db9aae4e89b749d427cdea",
"name": "RuntimeBroker.exe",
"pid": 2712,
"ppid": 752,
"session": 1,
"signed": true,
"username": "DC-01\\vagrant"
},
{
"cmdline": "C:\\Windows\\System32\\RuntimeBroker.exe -Embedding",
"fullpath": "C:\\Windows\\System32\\RuntimeBroker.exe",
"integrity": "High",
"md5": "1541969ef9db9aae4e89b749d427cdea",
"name": "RuntimeBroker.exe",
"pid": 3288,
"ppid": 752,
"session": 1,
"signed": true,
"username": "DC-01\\vagrant"
},
{
"cmdline": "C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\SearchApp.exe -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca",
"fullpath": "C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\SearchApp.exe",
"integrity": "Low",
"md5": "efde01e2986731e39c1c2e0f5a1dbd06",
"name": "SearchApp.exe",
"pid": 2548,
"ppid": 752,
"session": 1,
"signed": true,
"username": "DC-01\\vagrant"
},
{
"cmdline": "C:\\Windows\\system32\\services.exe",
"fullpath": "C:\\Windows\\System32\\services.exe",
"integrity": "Unknown",
"md5": "042c0e965c5db03dbf911e4c6a319ce8",
"name": "services.exe",
"pid": 632,
"ppid": 504,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "sihost.exe",
"fullpath": "C:\\Windows\\System32\\sihost.exe",
"integrity": "High",
"md5": "45cfb07366fe59573369e66029b12cea",
"name": "sihost.exe",
"pid": 1272,
"ppid": 1320,
"session": 1,
"signed": true,
"username": "DC-01\\vagrant"
},
{
"cmdline": "\\SystemRoot\\System32\\smss.exe",
"fullpath": "C:\\Windows\\System32\\smss.exe",
"integrity": "Unknown",
"md5": "44962fd12f0d29b0713bb5e14653194a",
"name": "smss.exe",
"pid": 340,
"ppid": 4,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "C:\\Windows\\System32\\spoolsv.exe",
"fullpath": "C:\\Windows\\System32\\spoolsv.exe",
"integrity": "System",
"md5": "55bb3facc6ef795f6f1d8cc656bcb779",
"name": "spoolsv.exe",
"pid": 1044,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "C:\\Program Files\\OpenSSH-Win64\\sshd.exe",
"fullpath": "C:\\Program Files\\OpenSSH-Win64\\sshd.exe",
"integrity": "System",
"md5": "331ba0e529810ef718dd3efbd1242302",
"name": "sshd.exe",
"pid": 1520,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\StartMenuExperienceHost.exe -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca",
"fullpath": "C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\StartMenuExperienceHost.exe",
"integrity": "Low",
"md5": "c6b9db31748cf4bf854639dd55d6f45b",
"name": "StartMenuExperienceHost.exe",
"pid": 3664,
"ppid": 752,
"session": 1,
"signed": true,
"username": "DC-01\\vagrant"
},
{
"cmdline": "C:\\Windows\\System32\\svchost.exe -k termsvcs",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "System",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 392,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"cmdline": "C:\\Windows\\system32\\svchost.exe -k LocalServiceNoNetwork -p",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "System",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 516,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\LOCAL SERVICE"
},
{
"cmdline": "C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "High",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 600,
"ppid": 632,
"session": 1,
"signed": true,
"username": "DC-01\\vagrant"
},
{
"cmdline": "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted -p",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "System",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 708,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\LOCAL SERVICE"
},
{
"cmdline": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "System",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 1320,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "System",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 752,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted -p",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "System",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 772,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "C:\\Windows\\system32\\svchost.exe -k RPCSS -p",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "System",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 860,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"cmdline": "C:\\Windows\\system32\\svchost.exe -k wusvcs -p",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "Unknown",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 3976,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "C:\\Windows\\system32\\svchost.exe -k ClipboardSvcGroup -p",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "High",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 4052,
"ppid": 632,
"session": 1,
"signed": true,
"username": "DC-01\\vagrant"
},
{
"cmdline": "C:\\Windows\\System32\\svchost.exe -k utcsvc -p",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "System",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 1428,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "C:\\Windows\\system32\\svchost.exe -k LocalService -p",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "System",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 1140,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\LOCAL SERVICE"
},
{
"cmdline": "C:\\Windows\\System32\\svchost.exe -k NetworkService -p",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "System",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 1436,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"cmdline": "C:\\Windows\\system32\\svchost.exe -k netsvcs",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "System",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 1496,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "C:\\Windows\\system32\\svchost.exe -k LocalServiceNetworkRestricted -p",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "System",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 1608,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\LOCAL SERVICE"
},
{
"cmdline": "C:\\Windows\\system32\\svchost.exe -k LocalServiceNoNetworkFirewall -p",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "System",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 1676,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\LOCAL SERVICE"
},
{
"cmdline": "C:\\Windows\\System32\\svchost.exe -k smbsvcs",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "System",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 2060,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "C:\\Windows\\system32\\svchost.exe -k LocalService",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "System",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 2088,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\LOCAL SERVICE"
},
{
"cmdline": "C:\\Windows\\system32\\svchost.exe -k appmodel -p",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "System",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 2208,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "C:\\Windows\\system32\\svchost.exe -k NetworkServiceNetworkRestricted -p",
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"integrity": "System",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"name": "svchost.exe",
"pid": 2720,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"cmdline": "",
"fullpath": "",
"integrity": "System",
"md5": null,
"name": "System",
"pid": 4,
"ppid": 0,
"session": 0,
"signed": false,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "",
"fullpath": "",
"integrity": "System",
"md5": null,
"name": "System Idle Process",
"pid": 0,
"ppid": 0,
"session": 0,
"signed": false,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}",
"fullpath": "C:\\Windows\\System32\\taskhostw.exe",
"integrity": "High",
"md5": "5487316514f4ada7e6e0bd9eaa2256e7",
"name": "taskhostw.exe",
"pid": 1708,
"ppid": 1320,
"session": 1,
"signed": true,
"username": "DC-01\\vagrant"
},
{
"cmdline": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\TextInputHost.exe -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca",
"fullpath": "C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\TextInputHost.exe",
"integrity": "Low",
"md5": "44028011959b9998f95be738a3389efb",
"name": "TextInputHost.exe",
"pid": 1864,
"ppid": 752,
"session": 1,
"signed": true,
"username": "DC-01\\vagrant"
},
{
"cmdline": "C:\\Windows\\System32\\VBoxService.exe",
"fullpath": "C:\\Windows\\System32\\VBoxService.exe",
"integrity": "System",
"md5": "5ac35aca951acd0732752095bbc366be",
"name": "VBoxService.exe",
"pid": 1352,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "C:\\Windows\\System32\\VBoxTray.exe",
"fullpath": "C:\\Windows\\System32\\VBoxTray.exe",
"integrity": "High",
"md5": "3c21ed6871650bc8635729b9abbb6f21",
"name": "VBoxTray.exe",
"pid": 4240,
"ppid": 616,
"session": 1,
"signed": true,
"username": "DC-01\\vagrant"
},
{
"cmdline": "wininit.exe",
"fullpath": "C:\\Windows\\System32\\wininit.exe",
"integrity": "Unknown",
"md5": "e7bbde1ff6b1c3c883771e145fb6c396",
"name": "wininit.exe",
"pid": 504,
"ppid": 428,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "winlogon.exe",
"fullpath": "C:\\Windows\\System32\\winlogon.exe",
"integrity": "System",
"md5": "aef3170240ef485d6bff04ac9d210906",
"name": "winlogon.exe",
"pid": 588,
"ppid": 496,
"session": 1,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "winlogon.exe",
"fullpath": "C:\\Windows\\System32\\winlogon.exe",
"integrity": "System",
"md5": "aef3170240ef485d6bff04ac9d210906",
"name": "winlogon.exe",
"pid": 1592,
"ppid": 3972,
"session": 3,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
},
{
"cmdline": "C:\\Windows\\system32\\wlms\\wlms.exe",
"fullpath": "C:\\Windows\\System32\\wlms\\wlms.exe",
"integrity": "System",
"md5": "e723cfc8e88f9eb378f1043aaf3df92e",
"name": "wlms.exe",
"pid": 2140,
"ppid": 632,
"session": 0,
"signed": true,
"username": "NT AUTHORITY\\SYSTEM"
}
]
}
}
}

Human Readable Output#

Process List#

namesessionusernameintegritypidppidcmdlinefullpathsignedmd5
AggregatorHost.exe0NT AUTHORITY\SYSTEMSystem25881428AggregatorHost.exeC:\Windows\System32\AggregatorHost.exetrue391ed483154f77cfdad1e2e0f9ce2001
conhost.exe0NT AUTHORITY\SYSTEMSystem48124800\??\C:\Windows\system32\conhost.exe 0x4C:\Windows\System32\conhost.exetrueb03d74d481d9d64047625bec2d64a0ce
csrss.exe0NT AUTHORITY\SYSTEMUnknown436428%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16C:\Windows\System32\csrss.exetruea6c9ee45bff7c5e696b07ec41af84541
csrss.exe1NT AUTHORITY\SYSTEMUnknown512496%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16C:\Windows\System32\csrss.exetruea6c9ee45bff7c5e696b07ec41af84541
csrss.exe3NT AUTHORITY\SYSTEMUnknown46483972%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16C:\Windows\System32\csrss.exetruea6c9ee45bff7c5e696b07ec41af84541
ctfmon.exe1DC-01\vagrantHigh3220772ctfmon.exeC:\Windows\System32\ctfmon.exetrue91e5e0722b281024e60d5768ab948794
dllhost.exe1DC-01\vagrantHigh268752C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}C:\Windows\System32\dllhost.exetrue61b7ccf84d2b4251bd263e75cd103f89
dwm.exe1Window Manager\DWM-1System948588dwm.exeC:\Windows\System32\dwm.exetrue66f552d20dcf3377279c20a119e0e72f
dwm.exe3Window Manager\DWM-3System47401592dwm.exeC:\Windows\System32\dwm.exetrue66f552d20dcf3377279c20a119e0e72f
explorer.exe1DC-01\vagrantHigh6163940C:\Windows\Explorer.EXEC:\Windows\explorer.exetrue7761d5917fa1adc297a5ce0cf1e242eb
fontdrvhost.exe1Font Driver Host\UMFD-1Low776588fontdrvhost.exeC:\Windows\System32\fontdrvhost.exetruedd24bac3913d47f9b35a8718aeed3cbe
fontdrvhost.exe0Font Driver Host\UMFD-0Low780504fontdrvhost.exeC:\Windows\System32\fontdrvhost.exetruedd24bac3913d47f9b35a8718aeed3cbe
fontdrvhost.exe3Font Driver Host\UMFD-3Low15801592fontdrvhost.exeC:\Windows\System32\fontdrvhost.exetruedd24bac3913d47f9b35a8718aeed3cbe
hurukai.exe0NT AUTHORITY\SYSTEMSystem48001560C:\Program Files\HarfangLab\hurukai.exe {1c38b8b3-2cb1-1ea6-5f44-6c2c93ab812c}C:\Program Files\HarfangLab\hurukai.exetrue05049f1cadb8af2b6893e1ead33351c9
hurukai.exe0NT AUTHORITY\SYSTEMSystem1560632C:\Program Files\HarfangLab\hurukai.exeC:\Program Files\HarfangLab\hurukai.exetrue05049f1cadb8af2b6893e1ead33351c9
LogonUI.exe1NT AUTHORITY\SYSTEMSystem4368588LogonUI.exe /flags:0x0 /state0:0xa14bc855 /state1:0x41c64e6dC:\Windows\System32\LogonUI.exetrue6cd47ca4515b2f81b5ca1e6ca9a323cc
LogonUI.exe3NT AUTHORITY\SYSTEMSystem29681592LogonUI.exe /flags:0x2 /state0:0xa14fa855 /state1:0x41c64e6dC:\Windows\System32\LogonUI.exetrue6cd47ca4515b2f81b5ca1e6ca9a323cc
lsass.exe0NT AUTHORITY\SYSTEMSystem644504C:\Windows\system32\lsass.exeC:\Windows\System32\lsass.exetrue6da2fcc580c720c16612057e83f47f04
msdtc.exe0NT AUTHORITY\NETWORK SERVICESystem3516632C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exetruebd7be47340ba4888b9b47ad323ff51d3
MsMpEng.exe0NT AUTHORITY\SYSTEMUnknown2104632C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2205.7-0\MsMpEng.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2205.7-0\MsMpEng.exetruea7dca32f82ec2569865f447416a7cf1a
rdpclip.exe1DC-01\vagrantHigh4888392rdpclipC:\Windows\System32\rdpclip.exetrueab8027b4bc3a3cd5b25070b08274fbed
regedit.exe1DC-01\vagrantHigh4160616C:\Windows\regedit.exeC:\Windows\regedit.exetruefea68fb10d62cbadf484dc1d2f44ed11
Registry0NT AUTHORITY\SYSTEMUnknown1004false
RuntimeBroker.exe1DC-01\vagrantHigh1280752C:\Windows\System32\RuntimeBroker.exe -EmbeddingC:\Windows\System32\RuntimeBroker.exetrue1541969ef9db9aae4e89b749d427cdea
RuntimeBroker.exe1DC-01\vagrantHigh2712752C:\Windows\System32\RuntimeBroker.exe -EmbeddingC:\Windows\System32\RuntimeBroker.exetrue1541969ef9db9aae4e89b749d427cdea
RuntimeBroker.exe1DC-01\vagrantHigh3288752C:\Windows\System32\RuntimeBroker.exe -EmbeddingC:\Windows\System32\RuntimeBroker.exetrue1541969ef9db9aae4e89b749d427cdea
SearchApp.exe1DC-01\vagrantLow2548752C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exetrueefde01e2986731e39c1c2e0f5a1dbd06
services.exe0NT AUTHORITY\SYSTEMUnknown632504C:\Windows\system32\services.exeC:\Windows\System32\services.exetrue042c0e965c5db03dbf911e4c6a319ce8
sihost.exe1DC-01\vagrantHigh12721320sihost.exeC:\Windows\System32\sihost.exetrue45cfb07366fe59573369e66029b12cea
smss.exe0NT AUTHORITY\SYSTEMUnknown3404\SystemRoot\System32\smss.exeC:\Windows\System32\smss.exetrue44962fd12f0d29b0713bb5e14653194a
spoolsv.exe0NT AUTHORITY\SYSTEMSystem1044632C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exetrue55bb3facc6ef795f6f1d8cc656bcb779
sshd.exe0NT AUTHORITY\SYSTEMSystem1520632C:\Program Files\OpenSSH-Win64\sshd.exeC:\Program Files\OpenSSH-Win64\sshd.exetrue331ba0e529810ef718dd3efbd1242302
StartMenuExperienceHost.exe1DC-01\vagrantLow3664752C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mcaC:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exetruec6b9db31748cf4bf854639dd55d6f45b
svchost.exe0NT AUTHORITY\NETWORK SERVICESystem392632C:\Windows\System32\svchost.exe -k termsvcsC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
svchost.exe0NT AUTHORITY\LOCAL SERVICESystem516632C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -pC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
svchost.exe1DC-01\vagrantHigh600632C:\Windows\system32\svchost.exe -k UnistackSvcGroupC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
svchost.exe0NT AUTHORITY\LOCAL SERVICESystem708632C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -pC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
svchost.exe0NT AUTHORITY\SYSTEMSystem1320632C:\Windows\system32\svchost.exe -k netsvcs -pC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
svchost.exe0NT AUTHORITY\SYSTEMSystem752632C:\Windows\system32\svchost.exe -k DcomLaunch -pC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
svchost.exe0NT AUTHORITY\SYSTEMSystem772632C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -pC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
svchost.exe0NT AUTHORITY\NETWORK SERVICESystem860632C:\Windows\system32\svchost.exe -k RPCSS -pC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
svchost.exe0NT AUTHORITY\SYSTEMUnknown3976632C:\Windows\system32\svchost.exe -k wusvcs -pC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
svchost.exe1DC-01\vagrantHigh4052632C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -pC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
svchost.exe0NT AUTHORITY\SYSTEMSystem1428632C:\Windows\System32\svchost.exe -k utcsvc -pC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
svchost.exe0NT AUTHORITY\LOCAL SERVICESystem1140632C:\Windows\system32\svchost.exe -k LocalService -pC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
svchost.exe0NT AUTHORITY\NETWORK SERVICESystem1436632C:\Windows\System32\svchost.exe -k NetworkService -pC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
svchost.exe0NT AUTHORITY\SYSTEMSystem1496632C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
svchost.exe0NT AUTHORITY\LOCAL SERVICESystem1608632C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -pC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
svchost.exe0NT AUTHORITY\LOCAL SERVICESystem1676632C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -pC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
svchost.exe0NT AUTHORITY\SYSTEMSystem2060632C:\Windows\System32\svchost.exe -k smbsvcsC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
svchost.exe0NT AUTHORITY\LOCAL SERVICESystem2088632C:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
svchost.exe0NT AUTHORITY\SYSTEMSystem2208632C:\Windows\system32\svchost.exe -k appmodel -pC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
svchost.exe0NT AUTHORITY\NETWORK SERVICESystem2720632C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -pC:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
System0NT AUTHORITY\SYSTEMSystem40false
System Idle Process0NT AUTHORITY\SYSTEMSystem00false
taskhostw.exe1DC-01\vagrantHigh17081320taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}C:\Windows\System32\taskhostw.exetrue5487316514f4ada7e6e0bd9eaa2256e7
TextInputHost.exe1DC-01\vagrantLow1864752C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exetrue44028011959b9998f95be738a3389efb
VBoxService.exe0NT AUTHORITY\SYSTEMSystem1352632C:\Windows\System32\VBoxService.exeC:\Windows\System32\VBoxService.exetrue5ac35aca951acd0732752095bbc366be
VBoxTray.exe1DC-01\vagrantHigh4240616C:\Windows\System32\VBoxTray.exeC:\Windows\System32\VBoxTray.exetrue3c21ed6871650bc8635729b9abbb6f21
wininit.exe0NT AUTHORITY\SYSTEMUnknown504428wininit.exeC:\Windows\System32\wininit.exetruee7bbde1ff6b1c3c883771e145fb6c396
winlogon.exe1NT AUTHORITY\SYSTEMSystem588496winlogon.exeC:\Windows\System32\winlogon.exetrueaef3170240ef485d6bff04ac9d210906
winlogon.exe3NT AUTHORITY\SYSTEMSystem15923972winlogon.exeC:\Windows\System32\winlogon.exetrueaef3170240ef485d6bff04ac9d210906
wlms.exe0NT AUTHORITY\SYSTEMSystem2140632C:\Windows\system32\wlms\wlms.exeC:\Windows\System32\wlms\wlms.exetruee723cfc8e88f9eb378f1043aaf3df92e

harfanglab-result-networkconnectionlist#


Get a hostname's network connections from job results

Base Command#

harfanglab-result-networkconnectionlist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.NetworkConnection.dataunknownProvides a list of active network connections

Command example#

!harfanglab-result-networkconnectionlist job_id="da31761f-003d-4abb-ab42-3d1737d75e7c"

Context Example#

{
"Harfanglab": {
"NetworkConnection": {
"data": [
{
"dst_addr": "(REDACTED)",
"dst_port": 443,
"fullpath": "C:\\Program Files\\HarfangLab\\hurukai.exe",
"md5": "05049f1cadb8af2b6893e1ead33351c9",
"protocol": "TCP",
"signed": true,
"src_addr": "(REDACTED)",
"src_port": 55267,
"state": "ESTABLISHED",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\lsass.exe",
"md5": "6da2fcc580c720c16612057e83f47f04",
"protocol": "TCP",
"signed": true,
"src_addr": "::",
"src_port": 49664,
"state": "LISTEN",
"version": "IPv6"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\lsass.exe",
"md5": "6da2fcc580c720c16612057e83f47f04",
"protocol": "TCP",
"signed": true,
"src_addr": "(REDACTED)",
"src_port": 49664,
"state": "LISTEN",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\services.exe",
"md5": "042c0e965c5db03dbf911e4c6a319ce8",
"protocol": "TCP",
"signed": true,
"src_addr": "(REDACTED)",
"src_port": 49669,
"state": "LISTEN",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\services.exe",
"md5": "042c0e965c5db03dbf911e4c6a319ce8",
"protocol": "TCP",
"signed": true,
"src_addr": "::",
"src_port": 49669,
"state": "LISTEN",
"version": "IPv6"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\spoolsv.exe",
"md5": "55bb3facc6ef795f6f1d8cc656bcb779",
"protocol": "TCP",
"signed": true,
"src_addr": "(REDACTED)",
"src_port": 49668,
"state": "LISTEN",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\spoolsv.exe",
"md5": "55bb3facc6ef795f6f1d8cc656bcb779",
"protocol": "TCP",
"signed": true,
"src_addr": "::",
"src_port": 49668,
"state": "LISTEN",
"version": "IPv6"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Program Files\\OpenSSH-Win64\\sshd.exe",
"md5": "331ba0e529810ef718dd3efbd1242302",
"protocol": "TCP",
"signed": true,
"src_addr": "(REDACTED)",
"src_port": 22,
"state": "LISTEN",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Program Files\\OpenSSH-Win64\\sshd.exe",
"md5": "331ba0e529810ef718dd3efbd1242302",
"protocol": "TCP",
"signed": true,
"src_addr": "::",
"src_port": 22,
"state": "LISTEN",
"version": "IPv6"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"protocol": "TCP",
"signed": true,
"src_addr": "(REDACTED)",
"src_port": 3389,
"state": "LISTEN",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"protocol": "TCP",
"signed": true,
"src_addr": "::",
"src_port": 3389,
"state": "LISTEN",
"version": "IPv6"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"protocol": "UDP",
"signed": true,
"src_addr": "::",
"src_port": 3389,
"state": "NONE",
"version": "IPv6"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"protocol": "UDP",
"signed": true,
"src_addr": "(REDACTED)",
"src_port": 3389,
"state": "NONE",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"protocol": "TCP",
"signed": true,
"src_addr": "::",
"src_port": 135,
"state": "LISTEN",
"version": "IPv6"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"protocol": "TCP",
"signed": true,
"src_addr": "(REDACTED)",
"src_port": 135,
"state": "LISTEN",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"protocol": "UDP",
"signed": true,
"src_addr": "(REDACTED)",
"src_port": 52239,
"state": "NONE",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"protocol": "TCP",
"signed": true,
"src_addr": "::",
"src_port": 49667,
"state": "LISTEN",
"version": "IPv6"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"protocol": "TCP",
"signed": true,
"src_addr": "(REDACTED)",
"src_port": 49667,
"state": "LISTEN",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"protocol": "TCP",
"signed": true,
"src_addr": "(REDACTED)",
"src_port": 49666,
"state": "LISTEN",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"protocol": "TCP",
"signed": true,
"src_addr": "::",
"src_port": 49666,
"state": "LISTEN",
"version": "IPv6"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"protocol": "UDP",
"signed": true,
"src_addr": "(REDACTED)",
"src_port": 5355,
"state": "NONE",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"protocol": "UDP",
"signed": true,
"src_addr": "::",
"src_port": 5355,
"state": "NONE",
"version": "IPv6"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"protocol": "UDP",
"signed": true,
"src_addr": "(REDACTED)",
"src_port": 5353,
"state": "NONE",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"protocol": "UDP",
"signed": true,
"src_addr": "::",
"src_port": 5353,
"state": "NONE",
"version": "IPv6"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"protocol": "UDP",
"signed": true,
"src_addr": "::",
"src_port": 64686,
"state": "NONE",
"version": "IPv6"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"protocol": "UDP",
"signed": true,
"src_addr": "(REDACTED)",
"src_port": 64686,
"state": "NONE",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"protocol": "UDP",
"signed": true,
"src_addr": "(REDACTED)",
"src_port": 123,
"state": "NONE",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\svchost.exe",
"md5": "dc32aba4669eafb22fcacd5ec836a107",
"protocol": "UDP",
"signed": true,
"src_addr": "::",
"src_port": 123,
"state": "NONE",
"version": "IPv6"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "",
"md5": null,
"protocol": "TCP",
"signed": false,
"src_addr": "(REDACTED)",
"src_port": 139,
"state": "LISTEN",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "",
"md5": null,
"protocol": "TCP",
"signed": false,
"src_addr": "(REDACTED)",
"src_port": 47001,
"state": "LISTEN",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "",
"md5": null,
"protocol": "TCP",
"signed": false,
"src_addr": "::",
"src_port": 47001,
"state": "LISTEN",
"version": "IPv6"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "",
"md5": null,
"protocol": "UDP",
"signed": false,
"src_addr": "(REDACTED)",
"src_port": 138,
"state": "NONE",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "",
"md5": null,
"protocol": "TCP",
"signed": false,
"src_addr": "(REDACTED)",
"src_port": 139,
"state": "LISTEN",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "",
"md5": null,
"protocol": "UDP",
"signed": false,
"src_addr": "(REDACTED)",
"src_port": 138,
"state": "NONE",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "",
"md5": null,
"protocol": "TCP",
"signed": false,
"src_addr": "::",
"src_port": 445,
"state": "LISTEN",
"version": "IPv6"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "",
"md5": null,
"protocol": "TCP",
"signed": false,
"src_addr": "(REDACTED)",
"src_port": 5985,
"state": "LISTEN",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "",
"md5": null,
"protocol": "TCP",
"signed": false,
"src_addr": "::",
"src_port": 5985,
"state": "LISTEN",
"version": "IPv6"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "",
"md5": null,
"protocol": "UDP",
"signed": false,
"src_addr": "(REDACTED)",
"src_port": 137,
"state": "NONE",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "",
"md5": null,
"protocol": "TCP",
"signed": false,
"src_addr": "(REDACTED)",
"src_port": 445,
"state": "LISTEN",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "",
"md5": null,
"protocol": "UDP",
"signed": false,
"src_addr": "(REDACTED)",
"src_port": 137,
"state": "NONE",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\wininit.exe",
"md5": "e7bbde1ff6b1c3c883771e145fb6c396",
"protocol": "TCP",
"signed": true,
"src_addr": "(REDACTED)",
"src_port": 49665,
"state": "LISTEN",
"version": "IPv4"
},
{
"dst_addr": null,
"dst_port": null,
"fullpath": "C:\\Windows\\System32\\wininit.exe",
"md5": "e7bbde1ff6b1c3c883771e145fb6c396",
"protocol": "TCP",
"signed": true,
"src_addr": "::",
"src_port": 49665,
"state": "LISTEN",
"version": "IPv6"
}
]
}
}
}

Human Readable Output#

Network Connection List#

stateprotocolversionsrc_addrsrc_portdst_addrdst_portfullpathsignedmd5
ESTABLISHEDTCPIPv4(REDACTED)55267(REDACTED)443C:\Program Files\HarfangLab\hurukai.exetrue05049f1cadb8af2b6893e1ead33351c9
LISTENTCPIPv6::49664C:\Windows\System32\lsass.exetrue6da2fcc580c720c16612057e83f47f04
LISTENTCPIPv4(REDACTED)49664C:\Windows\System32\lsass.exetrue6da2fcc580c720c16612057e83f47f04
LISTENTCPIPv4(REDACTED)49669C:\Windows\System32\services.exetrue042c0e965c5db03dbf911e4c6a319ce8
LISTENTCPIPv6::49669C:\Windows\System32\services.exetrue042c0e965c5db03dbf911e4c6a319ce8
LISTENTCPIPv4(REDACTED)49668C:\Windows\System32\spoolsv.exetrue55bb3facc6ef795f6f1d8cc656bcb779
LISTENTCPIPv6::49668C:\Windows\System32\spoolsv.exetrue55bb3facc6ef795f6f1d8cc656bcb779
LISTENTCPIPv4(REDACTED)22C:\Program Files\OpenSSH-Win64\sshd.exetrue331ba0e529810ef718dd3efbd1242302
LISTENTCPIPv6::22C:\Program Files\OpenSSH-Win64\sshd.exetrue331ba0e529810ef718dd3efbd1242302
LISTENTCPIPv4(REDACTED)3389C:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
LISTENTCPIPv6::3389C:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
NONEUDPIPv6::3389C:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
NONEUDPIPv4(REDACTED)3389C:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
LISTENTCPIPv6::135C:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
LISTENTCPIPv4(REDACTED)135C:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
NONEUDPIPv4(REDACTED)52239C:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
LISTENTCPIPv6::49667C:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
LISTENTCPIPv4(REDACTED)49667C:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
LISTENTCPIPv4(REDACTED)49666C:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
LISTENTCPIPv6::49666C:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
NONEUDPIPv4(REDACTED)5355C:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
NONEUDPIPv6::5355C:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
NONEUDPIPv4(REDACTED)5353C:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
NONEUDPIPv6::5353C:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
NONEUDPIPv6::64686C:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
NONEUDPIPv4(REDACTED)64686C:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
NONEUDPIPv4(REDACTED)123C:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
NONEUDPIPv6::123C:\Windows\System32\svchost.exetruedc32aba4669eafb22fcacd5ec836a107
LISTENTCPIPv4(REDACTED)139false
LISTENTCPIPv4(REDACTED)47001false
LISTENTCPIPv6::47001false
NONEUDPIPv4(REDACTED)138false
LISTENTCPIPv4(REDACTED)139false
NONEUDPIPv4(REDACTED)138false
LISTENTCPIPv6::445false
LISTENTCPIPv4(REDACTED)5985false
LISTENTCPIPv6::5985false
NONEUDPIPv4(REDACTED)137false
LISTENTCPIPv4(REDACTED)445false
NONEUDPIPv4(REDACTED)137false
LISTENTCPIPv4(REDACTED)49665C:\Windows\System32\wininit.exetruee7bbde1ff6b1c3c883771e145fb6c396
LISTENTCPIPv6::49665C:\Windows\System32\wininit.exetruee7bbde1ff6b1c3c883771e145fb6c396

harfanglab-result-networksharelist#


Get a hostname's network shares from job results

Base Command#

harfanglab-result-networksharelist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.NetworkShare.dataunknownProvides a list of network shares

Command example#

!harfanglab-result-networksharelist job_id="3ec3821f-278b-4cf1-8fb8-11f4a1c431d5"

Context Example#

{
"Harfanglab": {
"NetworkShare": {
"data": [
{
"Caption": "Remote Admin",
"Description": "Remote Admin",
"Hostname": "DC-01",
"Name": "ADMIN$",
"Path": "C:\\Windows",
"Share type": "Disk Drive Admin",
"Share type val": 2147483648,
"Status": "OK"
},
{
"Caption": "Default share",
"Description": "Default share",
"Hostname": "DC-01",
"Name": "C$",
"Path": "C:\\",
"Share type": "Disk Drive Admin",
"Share type val": 2147483648,
"Status": "OK"
},
{
"Caption": "Remote IPC",
"Description": "Remote IPC",
"Hostname": "DC-01",
"Name": "IPC$",
"Path": "",
"Share type": "IPC Admin",
"Share type val": 2147483651,
"Status": "OK"
}
]
}
}
}

Human Readable Output#

Network Share List#

NameCaptionDescriptionPathStatusShare type valShare typeHostname
ADMIN$Remote AdminRemote AdminC:\WindowsOK2147483648Disk Drive AdminDC-01
C$Default shareDefault shareC:\ OK2147483648Disk Drive AdminDC-01
IPC$Remote IPCRemote IPCOK2147483651IPC AdminDC-01

harfanglab-result-sessionlist#


Get a hostname's sessions from job results

Base Command#

harfanglab-result-sessionlist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.Session.dataunknownProvides a list of active sessions

Command example#

!harfanglab-result-sessionlist job_id="01819f9a-44f5-42b6-9e1a-4efc3fadd48d"

Context Example#

{
"Harfanglab": {
"Session": {
"data": [
{
"Authentication package": "NTLM",
"Hostname": "DC-01",
"Logon Id": 999,
"Logon type": 0,
"Logon type str": "System",
"Session start time": "2022-06-28T14:18:30.944000Z"
},
{
"Authentication package": "Negotiate",
"Hostname": "DC-01",
"Logon Id": 997,
"Logon type": 5,
"Logon type str": "Service",
"Session start time": "2022-06-28T14:18:31.992000Z"
},
{
"Authentication package": "NTLM",
"Hostname": "DC-01",
"Logon Id": 356056507,
"Logon type": 2,
"Logon type str": "Interactive",
"Session start time": "2022-07-22T16:08:46.373000Z"
},
{
"Authentication package": "NTLM",
"Hostname": "DC-01",
"Logon Id": 272595,
"Logon type": 3,
"Logon type str": "Network",
"Session start time": "2022-06-28T14:19:19.447000Z"
},
{
"Authentication package": "Negotiate",
"Hostname": "DC-01",
"Logon Id": 996,
"Logon type": 5,
"Logon type str": "Service",
"Session start time": "2022-06-28T14:18:31.507000Z"
},
{
"Authentication package": "NTLM",
"Hostname": "DC-01",
"Logon Id": 232421,
"Logon type": 3,
"Logon type str": "Network",
"Session start time": "2022-06-28T14:18:54.600000Z"
},
{
"Authentication package": "NTLM",
"Hostname": "DC-01",
"Logon Id": 121005166,
"Logon type": 3,
"Logon type str": "Network",
"Session start time": "2022-07-06T19:36:41.698000Z"
},
{
"Authentication package": "Negotiate",
"Hostname": "DC-01",
"Logon Id": 370611950,
"Logon type": 2,
"Logon type str": "Interactive",
"Session start time": "2022-07-23T06:15:19.172000Z"
},
{
"Authentication package": "Negotiate",
"Hostname": "DC-01",
"Logon Id": 370621180,
"Logon type": 2,
"Logon type str": "Interactive",
"Session start time": "2022-07-23T06:15:19.391000Z"
},
{
"Authentication package": "NTLM",
"Hostname": "DC-01",
"Logon Id": 188264,
"Logon type": 3,
"Logon type str": "Network",
"Session start time": "2022-06-28T14:18:44.527000Z"
},
{
"Authentication package": "Negotiate",
"Hostname": "DC-01",
"Logon Id": 24600,
"Logon type": 2,
"Logon type str": "Interactive",
"Session start time": "2022-06-28T14:18:31.273000Z"
},
{
"Authentication package": "Negotiate",
"Hostname": "DC-01",
"Logon Id": 24615,
"Logon type": 2,
"Logon type str": "Interactive",
"Session start time": "2022-06-28T14:18:31.273000Z"
},
{
"Authentication package": "Negotiate",
"Hostname": "DC-01",
"Logon Id": 42936,
"Logon type": 2,
"Logon type str": "Interactive",
"Session start time": "2022-06-28T14:18:31.789000Z"
}
]
}
}
}

Human Readable Output#

Session List#

Logon IdAuthentication packageLogon typeLogon type strSession start timeHostname
999NTLM0System2022-06-28T14:18:30.944000ZDC-01
997Negotiate5Service2022-06-28T14:18:31.992000ZDC-01
356056507NTLM2Interactive2022-07-22T16:08:46.373000ZDC-01
272595NTLM3Network2022-06-28T14:19:19.447000ZDC-01
996Negotiate5Service2022-06-28T14:18:31.507000ZDC-01
232421NTLM3Network2022-06-28T14:18:54.600000ZDC-01
121005166NTLM3Network2022-07-06T19:36:41.698000ZDC-01
370611950Negotiate2Interactive2022-07-23T06:15:19.172000ZDC-01
370621180Negotiate2Interactive2022-07-23T06:15:19.391000ZDC-01
188264NTLM3Network2022-06-28T14:18:44.527000ZDC-01
24600Negotiate2Interactive2022-06-28T14:18:31.273000ZDC-01
24615Negotiate2Interactive2022-06-28T14:18:31.273000ZDC-01
42936Negotiate2Interactive2022-06-28T14:18:31.789000ZDC-01

harfanglab-result-persistencelist#


Get a hostname's persistence items from job results

Base Command#

harfanglab-result-persistencelist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.Persistence.dataunknownProvides a list of persistence means

Command example#

!harfanglab-result-persistencelist job_id="8ee99c61-9c0e-4cfb-89ea-4aba01cbf1ed"

Context Example#

{
"Harfanglab": {
"Persistence": {
"data": []
}
}
}

Human Readable Output#

Linux persistence list#

No entries.

harfanglab-result-ioc#


Get the list of items matching IOCs searched in an IOC job

Base Command#

harfanglab-result-ioc

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.IOC.dataunknownProvides a list of matching elements

Command example#

!harfanglab-result-ioc job_id="1680a62a-7a9c-456d-ae89-75788daa94e8"

Context Example#

{
"Harfanglab": {
"IOC": {
"data": [
{
"fullpath": "C:\\Program Files\\HarfangLab\\agent.ini",
"md5": "f43c1ddce185d649e61deb4f3dfcf7c8",
"registry_key": null,
"registry_path": null,
"registry_value": null,
"search_value": "agent.ini",
"signed": false,
"type": "filename"
}
]
}
}
}

Human Readable Output#

IOC Found List#

typesearch_valuefullpathsignedmd5
filenameagent.iniC:\Program Files\HarfangLab\agent.inifalsef43c1ddce185d649e61deb4f3dfcf7c8

harfanglab-result-startuplist#


Get a hostname's startup items from job results

Base Command#

harfanglab-result-startuplist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.Startup.dataunknownProvides a list of startup files

Command example#

!harfanglab-result-startuplist job_id="f1fac880-ade0-44c3-837f-486517565909"

Context Example#

{
"Harfanglab": {
"Startup": {
"data": []
}
}
}

Human Readable Output#

Startup List#

No entries.

harfanglab-result-wmilist#


Get a hostname's WMI items from job results

Base Command#

harfanglab-result-wmilist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.Wmi.dataunknownProvides a list of WMI items

Command example#

!harfanglab-result-wmilist job_id="5219bfca-4a8b-4913-813f-446d88e28d99"

Context Example#

{
"Harfanglab": {
"Wmi": {
"data": []
}
}
}

Human Readable Output#

WMI List#

No entries.

harfanglab-result-artifact-mft#


Get a hostname's MFT from job results

Base Command#

harfanglab-result-artifact-mft

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.Artifact.MFTunknownProvides a link to download the raw MFT

Command example#

!harfanglab-result-artifact-mft job_id="10fae902-ddb0-48b8-bbd9-aa94e92f9222"

Context Example#

{
"Harfanglab": {
"Artifact": {
"MFT": [
{
"@timestamp": "2022-07-25T08:27:57.309000Z",
"@version": "1",
"agent": {
"agentid": "0fae71cf-ebde-4533-a50c-b3c0290378db",
"domainname": "WORKGROUP",
"hostname": "DC-01",
"osproducttype": "Windows Server 2022 Standard Evaluation",
"ostype": "windows",
"osversion": "10.0.20348",
"version": "2.15.0"
},
"artefact_type": "raw evidences",
"date": "2022-07-25T08:20:39.253407Z",
"download_link": "https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/uDV4NIIB3S3Gj-GSVFRk/download/?hl_expiring_key=0123456789abcdef",
"download_status": 0,
"id": "uDV4NIIB3S3Gj-GSVFRk",
"item_status": 0,
"job_id": "10fae902-ddb0-48b8-bbd9-aa94e92f9222",
"job_instance_id": "6862bf05-7694-459b-9b29-e68214ddd45e",
"log_type": "investigation",
"msg": "got 0 hives, 1 mft, 0 USN, 0 prefetch, 0 logs files",
"size": 206045184,
"tenant": ""
}
],
"data": "https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/uDV4NIIB3S3Gj-GSVFRk/download/?hl_expiring_key=0123456789abcdef"
}
}
}

Human Readable Output#

MFT download list#

hostnamemsgsizedownload link
DC-01got 0 hives, 1 mft, 0 USN, 0 prefetch, 0 logs files206045184https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/uDV4NIIB3S3Gj-GSVFRk/download/?hl_expiring_key=0123456789abcdef

harfanglab-result-artifact-hives#


Get a hostname's hives from job results

Base Command#

harfanglab-result-artifact-hives

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.Artifact.HIVESunknownProvides a link to download the raw hives

Command example#

!harfanglab-result-artifact-hives job_id="8a0b77e2-6c55-4bfb-89c5-377c2a3b6bf4"

Context Example#

{
"Harfanglab": {
"Artifact": {
"HIVES": [
{
"@timestamp": "2022-07-25T08:26:01.894000Z",
"@version": "1",
"agent": {
"agentid": "0fae71cf-ebde-4533-a50c-b3c0290378db",
"domainname": "WORKGROUP",
"hostname": "DC-01",
"osproducttype": "Windows Server 2022 Standard Evaluation",
"ostype": "windows",
"osversion": "10.0.20348",
"version": "2.15.0"
},
"artefact_type": "raw evidences",
"date": "2022-07-25T08:20:37.429526Z",
"download_link": "https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/jDV2NIIB3S3Gj-GSkVSP/download/?hl_expiring_key=0123456789abcdef",
"download_status": 0,
"id": "jDV2NIIB3S3Gj-GSkVSP",
"item_status": 0,
"job_id": "8a0b77e2-6c55-4bfb-89c5-377c2a3b6bf4",
"job_instance_id": "94bdf98c-f4d0-4ea9-814d-807898704bb0",
"log_type": "investigation",
"msg": "got 11 hives, 0 mft, 0 USN, 0 prefetch, 0 logs files",
"size": 91324416,
"tenant": ""
}
],
"data": "https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/jDV2NIIB3S3Gj-GSkVSP/download/?hl_expiring_key=0123456789abcdef"
}
}
}

Human Readable Output#

HIVES download list#

hostnamemsgsizedownload link
DC-01got 11 hives, 0 mft, 0 USN, 0 prefetch, 0 logs files91324416https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/jDV2NIIB3S3Gj-GSkVSP/download/?hl_expiring_key=0123456789abcdef

harfanglab-result-artifact-evtx#


Get a hostname's log files from job results

Base Command#

harfanglab-result-artifact-evtx

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Optional

Context Output#

PathTypeDescription
Harfanglab.Artifact.EVTXunknownProvides a link to download the evt/evtx files

Command example#

!harfanglab-result-artifact-evtx job_id="43f4c7bf-ed15-4b1b-8b14-d71f48ad9077"

Context Example#

{
"Harfanglab": {
"Artifact": {
"EVTX": [
{
"@timestamp": "2022-07-25T08:24:15.006000Z",
"@version": "1",
"agent": {
"agentid": "0fae71cf-ebde-4533-a50c-b3c0290378db",
"domainname": "WORKGROUP",
"hostname": "DC-01",
"osproducttype": "Windows Server 2022 Standard Evaluation",
"ostype": "windows",
"osversion": "10.0.20348",
"version": "2.15.0"
},
"artefact_type": "raw evidences",
"date": "2022-07-25T08:20:35.586738Z",
"download_link": "https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/SjV0NIIB3S3Gj-GS8FQF/download/?hl_expiring_key=0123456789abcdef",
"download_status": 0,
"id": "SjV0NIIB3S3Gj-GS8FQF",
"item_status": 0,
"job_id": "43f4c7bf-ed15-4b1b-8b14-d71f48ad9077",
"job_instance_id": "c952971d-89ca-4b81-99f9-a5cacdff320e",
"log_type": "investigation",
"msg": "got 0 hives, 0 mft, 0 USN, 0 prefetch, 133 logs files",
"size": 400969728,
"tenant": ""
}
],
"data": "https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/SjV0NIIB3S3Gj-GS8FQF/download/?hl_expiring_key=0123456789abcdef"
}
}
}

Human Readable Output#

EVTX download list#

hostnamemsgsizedownload link
DC-01got 0 hives, 0 mft, 0 USN, 0 prefetch, 133 logs files400969728https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/SjV0NIIB3S3Gj-GS8FQF/download/?hl_expiring_key=0123456789abcdef

harfanglab-result-artifact-logs#


Get a hostname's log files from job results

Base Command#

harfanglab-result-artifact-logs

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Optional

Context Output#

PathTypeDescription
Harfanglab.Artifact.LOGSunknownProvides a link to download the log files

Command example#

!harfanglab-result-artifact-logs job_id="eb957909-57cb-4f20-ad76-dc47aab5496f"

Context Example#

{
"Harfanglab": {
"Artifact": {
"LOGS": [
{
"@timestamp": "2022-07-25T08:26:43.106000Z",
"@version": "1",
"agent": {
"agentid": "0fae71cf-ebde-4533-a50c-b3c0290378db",
"domainname": "WORKGROUP",
"hostname": "DC-01",
"osproducttype": "Windows Server 2022 Standard Evaluation",
"ostype": "windows",
"osversion": "10.0.20348",
"version": "2.15.0"
},
"artefact_type": "raw evidences",
"date": "2022-07-25T08:20:38.433613Z",
"download_link": "https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/mzV3NIIB3S3Gj-GSMlSI/download/?hl_expiring_key=0123456789abcdef",
"download_status": 1,
"id": "mzV3NIIB3S3Gj-GSMlSI",
"item_status": 0,
"job_id": "eb957909-57cb-4f20-ad76-dc47aab5496f",
"job_instance_id": "c75a801d-82ab-4695-9bb3-0c4852b69e8b",
"log_type": "investigation",
"msg": "got 0 hives, 0 mft, 0 USN, 0 prefetch, 0 logs files, 0 linux filesystem parse",
"size": 0,
"tenant": ""
}
],
"data": "https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/mzV3NIIB3S3Gj-GSMlSI/download/?hl_expiring_key=0123456789abcdef"
}
}
}

Human Readable Output#

LOGS download list#

hostnamemsgsizedownload link
DC-01got 0 hives, 0 mft, 0 USN, 0 prefetch, 0 logs files, 0 linux filesystem parse0https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/mzV3NIIB3S3Gj-GSMlSI/download/?hl_expiring_key=0123456789abcdef

harfanglab-result-artifact-filesystem#


Get a hostname's filesystem entries from job results

Base Command#

harfanglab-result-artifact-filesystem

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Optional

Context Output#

PathTypeDescription
Harfanglab.Artifact.FSunknownProvides a link to download the CSV file with filesystem entries

Command example#

!harfanglab-result-artifact-filesystem job_id="210b72f7-7ee5-4e89-b3fb-8106e7a57bf7"

Context Example#

{
"Harfanglab": {
"Artifact": {
"FS": [
{
"@timestamp": "2022-07-25T08:24:53.428000Z",
"@version": "1",
"agent": {
"agentid": "0fae71cf-ebde-4533-a50c-b3c0290378db",
"domainname": "WORKGROUP",
"hostname": "DC-01",
"osproducttype": "Windows Server 2022 Standard Evaluation",
"ostype": "windows",
"osversion": "10.0.20348",
"version": "2.15.0"
},
"artefact_type": "raw evidences",
"date": "2022-07-25T08:20:36.474594Z",
"download_link": "https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/ajV1NIIB3S3Gj-GShlQa/download/?hl_expiring_key=0123456789abcdef",
"download_status": 1,
"id": "ajV1NIIB3S3Gj-GShlQa",
"item_status": 0,
"job_id": "210b72f7-7ee5-4e89-b3fb-8106e7a57bf7",
"job_instance_id": "3399ad6d-d997-4a2a-96cd-6210bc490934",
"log_type": "investigation",
"msg": "got 0 hives, 0 mft, 0 USN, 0 prefetch, 0 logs files, 0 linux filesystem parse",
"size": 0,
"tenant": ""
}
],
"data": "https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/ajV1NIIB3S3Gj-GShlQa/download/?hl_expiring_key=0123456789abcdef"
}
}
}

Human Readable Output#

FS download list#

hostnamemsgsizedownload link
DC-01got 0 hives, 0 mft, 0 USN, 0 prefetch, 0 logs files, 0 linux filesystem parse0https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/ajV1NIIB3S3Gj-GShlQa/download/?hl_expiring_key=0123456789abcdef

harfanglab-result-artifact-all#


Get all artifacts from a hostname from job results

Base Command#

harfanglab-result-artifact-all

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Optional

Context Output#

PathTypeDescription
Harfanglab.Artifact.ALLunknownProvides a link to download an archive with all raw artifacts

Command example#

!harfanglab-result-artifact-all job_id="affe8871-c838-4c17-b5cb-fa30b6aeacfc"

Context Example#

{
"Harfanglab": {
"Artifact": {
"ALL": [
{
"@timestamp": "2022-07-25T08:21:47.781000Z",
"@version": "1",
"agent": {
"agentid": "0fae71cf-ebde-4533-a50c-b3c0290378db",
"domainname": "WORKGROUP",
"hostname": "DC-01",
"osproducttype": "Windows Server 2022 Standard Evaluation",
"ostype": "windows",
"osversion": "10.0.20348",
"version": "2.15.0"
},
"artefact_type": "raw evidences",
"date": "2022-07-25T08:20:33.821824Z",
"download_link": "https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/HDVyNIIB3S3Gj-GSsFTu/download/?hl_expiring_key=0123456789abcdef",
"download_status": 0,
"id": "HDVyNIIB3S3Gj-GSsFTu",
"item_status": 0,
"job_id": "affe8871-c838-4c17-b5cb-fa30b6aeacfc",
"job_instance_id": "c0036698-5dc0-4111-9b7e-81d56bfc588e",
"log_type": "investigation",
"msg": "got 11 hives, 1 mft, 1 USN, 0 prefetch, 133 logs files",
"size": 734616576,
"tenant": ""
}
],
"data": "https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/HDVyNIIB3S3Gj-GSsFTu/download/?hl_expiring_key=0123456789abcdef"
}
}
}

Human Readable Output#

ALL download list#

hostnamemsgsizedownload link
DC-01got 11 hives, 1 mft, 1 USN, 0 prefetch, 133 logs files734616576https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/HDVyNIIB3S3Gj-GSsFTu/download/?hl_expiring_key=0123456789abcdef

harfanglab-result-artifact-downloadfile#


Get a hostname's file from job results

Base Command#

harfanglab-result-artifact-downloadfile

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.DownloadFile.dataunknownProvides a link to download the file

Command example#

!harfanglab-result-artifact-downloadfile job_id="aa83c9e9-91de-4f6f-b2f3-f01c936c4ee6"

Context Example#

{
"Harfanglab": {
"DownloadFile": {
"data": [
{
"download link": "https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/MTVzNIIB3S3Gj-GSxFQ5/download/?hl_expiring_key=0123456789abcdef",
"hostname": "DC-01",
"msg": "1 file(s) downloaded",
"size": 1688
}
]
}
}
}

Human Readable Output#

file download list#

hostnamemsgsizedownload link
DC-011 file(s) downloaded1688https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/MTVzNIIB3S3Gj-GSxFQ5/download/?hl_expiring_key=0123456789abcdef

harfanglab-result-artifact-ramdump#


Get a hostname's RAM dump from job results

Base Command#

harfanglab-result-artifact-ramdump

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.Ramdump.dataunknownProvides a link to download the raw RAM dump

Command example#

!harfanglab-result-artifact-ramdump job_id="539456d8-872c-4e60-a28b-210ffcd4c7c4"

Context Example#

{
"Harfanglab": {
"Ramdump": {
"data": [
{
"download link": "https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/_TV7NIIB3S3Gj-GSBVTv/download/?hl_expiring_key=0123456789abcdef",
"hostname": "DC-01",
"msg": "1 file(s) downloaded",
"size": 1080819582
}
]
}
}
}

Human Readable Output#

Ramdump list#

hostnamemsgsizedownload link
DC-011 file(s) downloaded1080819582https://my_edr_stack:8443/api/data/investigation/artefact/Artefact/_TV7NIIB3S3Gj-GSBVTv/download/?hl_expiring_key=0123456789abcdef

harfanglab-hunt-search-hash#


Command used to search a hash IOC in database

Base Command#

harfanglab-hunt-search-hash

Input#

Argument NameDescriptionRequired
hashfilehash to search (md5, sha1, sha256).Required

Context Output#

PathTypeDescription
Harfanglab.HashunknownProvides statistics associated to currently running processes and previously executed processes associated to hash

Command example#

!harfanglab-hunt-search-hash hash=2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3

Context Example#

{
"Harfanglab": {
"Hash": {
"curr_running": 0,
"hash": "2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3",
"prev_runned": 8994
}
}
}

Human Readable Output#

Hash search results#

curr_runninghashprev_runned
02198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a38994

harfanglab-hunt-search-running-process-hash#


Command used to search running process associated with Hash

Base Command#

harfanglab-hunt-search-running-process-hash

Input#

Argument NameDescriptionRequired
hashfilehash to search (sha256).Required

Context Output#

PathTypeDescription
Harfanglab.HuntRunningProcessSearch.dataunknownList of all systems where processes associated to hash are running

Command example#

!harfanglab-hunt-search-running-process-hash hash=2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3

Context Example#

{
"Harfanglab": {
"HuntRunningProcessSearch": {
"data": []
}
}
}

Human Readable Output#

War room overview#

No entries.

harfanglab-hunt-search-runned-process-hash#


Command used to search runned process associated with Hash

Base Command#

harfanglab-hunt-search-runned-process-hash

Input#

Argument NameDescriptionRequired
hashfilehash to search (sha256).Required

Context Output#

PathTypeDescription
Harfanglab.HuntRunnedProcessSearch.dataunknownList of all systems where processes associated to hash have been previously running

Command example#

!harfanglab-hunt-search-runned-process-hash hash=2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3

Context Example#

{
"Harfanglab": {
"HuntRunnedProcessSearch": {
"data": [
{
"binary_info": {
"company_name": "Microsoft Corporation",
"file_description": "WMI Provider Host",
"file_version": "10.0.19041.546 (WinBuild.160101.0800)",
"internal_name": "Wmiprvse.exe",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "Wmiprvse.exe",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.546"
},
"create_time": "2019-10-16T23:45:21Z",
"domain": "WORKGROUP",
"hash": "2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3",
"hostname": "WORKSTATION-4812",
"os": "Windows 10 Enterprise Evaluation",
"os_version": "10.0.19041",
"path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
"username": "NT AUTHORITY\\LOCAL SERVICE"
},
{
"binary_info": {
"company_name": "Microsoft Corporation",
"file_description": "WMI Provider Host",
"file_version": "10.0.19041.546 (WinBuild.160101.0800)",
"internal_name": "Wmiprvse.exe",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "Wmiprvse.exe",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.546"
},
"create_time": "2019-10-16T23:45:21Z",
"domain": "WORKGROUP",
"hash": "2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3",
"hostname": "WORKSTATION-4812",
"os": "Windows 10 Enterprise Evaluation",
"os_version": "10.0.19041",
"path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"binary_info": {
"company_name": "Microsoft Corporation",
"file_description": "WMI Provider Host",
"file_version": "10.0.19041.546 (WinBuild.160101.0800)",
"internal_name": "Wmiprvse.exe",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "Wmiprvse.exe",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.546"
},
"create_time": "2019-10-16T23:45:21Z",
"domain": "WORKGROUP",
"hash": "2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3",
"hostname": "WORKSTATION-1234",
"os": "Windows 10 Enterprise Evaluation",
"os_version": "10.0.19041",
"path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
"username": "NT AUTHORITY\\LOCAL SERVICE"
},
{
"binary_info": {
"company_name": "Microsoft Corporation",
"file_description": "WMI Provider Host",
"file_version": "10.0.19041.546 (WinBuild.160101.0800)",
"internal_name": "Wmiprvse.exe",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "Wmiprvse.exe",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.546"
},
"create_time": "2019-10-16T23:45:21Z",
"domain": "WORKGROUP",
"hash": "2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3",
"hostname": "WORKSTATION-1234",
"os": "Windows 10 Enterprise Evaluation",
"os_version": "10.0.19041",
"path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"binary_info": {
"company_name": "Microsoft Corporation",
"file_description": "WMI Provider Host",
"file_version": "10.0.19041.546 (WinBuild.160101.0800)",
"internal_name": "Wmiprvse.exe",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "Wmiprvse.exe",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.546"
},
"create_time": "2019-10-16T23:45:21Z",
"domain": "WORKGROUP",
"hash": "2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3",
"hostname": "WORKSTATION-8501",
"os": "Windows 10 Enterprise Evaluation",
"os_version": "10.0.19041",
"path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
"username": "NT AUTHORITY\\LOCAL SERVICE"
},
{
"binary_info": {
"company_name": "Microsoft Corporation",
"file_description": "WMI Provider Host",
"file_version": "10.0.19041.546 (WinBuild.160101.0800)",
"internal_name": "Wmiprvse.exe",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "Wmiprvse.exe",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.546"
},
"create_time": "2019-10-16T23:45:21Z",
"domain": "WORKGROUP",
"hash": "2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3",
"hostname": "WORKSTATION-8501",
"os": "Windows 10 Enterprise Evaluation",
"os_version": "10.0.19041",
"path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"binary_info": {
"company_name": "Microsoft Corporation",
"file_description": "WMI Provider Host",
"file_version": "10.0.19041.546 (WinBuild.160101.0800)",
"internal_name": "Wmiprvse.exe",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "Wmiprvse.exe",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.546"
},
"create_time": "2019-10-16T23:45:21Z",
"domain": "WORKGROUP",
"hash": "2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3",
"hostname": "WORKSTATION-6852",
"os": "Windows 10 Enterprise Evaluation",
"os_version": "10.0.19041",
"path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
"username": "NT AUTHORITY\\LOCAL SERVICE"
},
{
"binary_info": {
"company_name": "Microsoft Corporation",
"file_description": "WMI Provider Host",
"file_version": "10.0.19041.546 (WinBuild.160101.0800)",
"internal_name": "Wmiprvse.exe",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "Wmiprvse.exe",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.546"
},
"create_time": "2019-10-16T23:45:21Z",
"domain": "WORKGROUP",
"hash": "2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3",
"hostname": "WORKSTATION-6852",
"os": "Windows 10 Enterprise Evaluation",
"os_version": "10.0.19041",
"path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
"username": "NT AUTHORITY\\NETWORK SERVICE"
},
{
"binary_info": {
"company_name": "Microsoft Corporation",
"file_description": "WMI Provider Host",
"file_version": "10.0.19041.546 (WinBuild.160101.0800)",
"internal_name": "Wmiprvse.exe",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "Wmiprvse.exe",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.546"
},
"create_time": "2019-10-16T23:45:21Z",
"domain": "WORKGROUP",
"hash": "2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3",
"hostname": "WORKSTATION-3752",
"os": "Windows 10 Enterprise Evaluation",
"os_version": "10.0.19041",
"path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
"username": "NT AUTHORITY\\LOCAL SERVICE"
},
{
"binary_info": {
"company_name": "Microsoft Corporation",
"file_description": "WMI Provider Host",
"file_version": "10.0.19041.546 (WinBuild.160101.0800)",
"internal_name": "Wmiprvse.exe",
"legal_copyright": "\u00a9 Microsoft Corporation. All rights reserved.",
"original_filename": "Wmiprvse.exe",
"product_name": "Microsoft\u00ae Windows\u00ae Operating System",
"product_version": "10.0.19041.546"
},
"create_time": "2019-10-16T23:45:21Z",
"domain": "WORKGROUP",
"hash": "2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3",
"hostname": "WORKSTATION-3752",
"os": "Windows 10 Enterprise Evaluation",
"os_version": "10.0.19041",
"path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
"username": "NT AUTHORITY\\NETWORK SERVICE"
}
]
}
}
}

Human Readable Output#

War room overview#

HostnameDomainUsernameOSBinary PathCreate timestamp
WORKSTATION-4812WORKGROUPNT AUTHORITY\LOCAL SERVICEWindows 10 Enterprise Evaluation 10.0.19041C:\Windows\System32\wbem\WmiPrvSE.exe2019-10-16T23:45:21Z
WORKSTATION-4812WORKGROUPNT AUTHORITY\NETWORK SERVICEWindows 10 Enterprise Evaluation 10.0.19041C:\Windows\System32\wbem\WmiPrvSE.exe2019-10-16T23:45:21Z
WORKSTATION-1234WORKGROUPNT AUTHORITY\LOCAL SERVICEWindows 10 Enterprise Evaluation 10.0.19041C:\Windows\System32\wbem\WmiPrvSE.exe2019-10-16T23:45:21Z
WORKSTATION-1234WORKGROUPNT AUTHORITY\NETWORK SERVICEWindows 10 Enterprise Evaluation 10.0.19041C:\Windows\System32\wbem\WmiPrvSE.exe2019-10-16T23:45:21Z
WORKSTATION-8501WORKGROUPNT AUTHORITY\LOCAL SERVICEWindows 10 Enterprise Evaluation 10.0.19041C:\Windows\System32\wbem\WmiPrvSE.exe2019-10-16T23:45:21Z
WORKSTATION-8501WORKGROUPNT AUTHORITY\NETWORK SERVICEWindows 10 Enterprise Evaluation 10.0.19041C:\Windows\System32\wbem\WmiPrvSE.exe2019-10-16T23:45:21Z
WORKSTATION-6852WORKGROUPNT AUTHORITY\LOCAL SERVICEWindows 10 Enterprise Evaluation 10.0.19041C:\Windows\System32\wbem\WmiPrvSE.exe2019-10-16T23:45:21Z
WORKSTATION-6852WORKGROUPNT AUTHORITY\NETWORK SERVICEWindows 10 Enterprise Evaluation 10.0.19041C:\Windows\System32\wbem\WmiPrvSE.exe2019-10-16T23:45:21Z
WORKSTATION-3752WORKGROUPNT AUTHORITY\LOCAL SERVICEWindows 10 Enterprise Evaluation 10.0.19041C:\Windows\System32\wbem\WmiPrvSE.exe2019-10-16T23:45:21Z
WORKSTATION-3752WORKGROUPNT AUTHORITY\NETWORK SERVICEWindows 10 Enterprise Evaluation 10.0.19041C:\Windows\System32\wbem\WmiPrvSE.exe2019-10-16T23:45:21Z

harfanglab-isolate-endpoint#


Command used to isolate an endpoint from the network while remaining connected to the EDR manager

Base Command#

harfanglab-isolate-endpoint

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

There is no context output for this command.

Command example#

!harfanglab-isolate-endpoint agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Human Readable Output#

{
"Message": "",
"Status": false
}

harfanglab-deisolate-endpoint#


Command used to deisolate an endpoint and reconnect it to the network

Base Command#

harfanglab-deisolate-endpoint

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

There is no context output for this command.

Command example#

!harfanglab-deisolate-endpoint agent_id="0fae71cf-ebde-4533-a50c-b3c0290378db"

Human Readable Output#

{
"Message": "Agent deisolation successfully requested",
"Status": true
}

harfanglab-change-security-event-status#


Command used to change the status of a security event

Base Command#

harfanglab-change-security-event-status

Input#

Argument NameDescriptionRequired
security_event_idSecurity event id.Required
statusNew status of the security event id (New, Investigating, False Positive, Closed).Required

Context Output#

There is no context output for this command.

Command example#

!harfanglab-change-security-event-status security_event_id="QCzd2IEB3S3Gj-GS6z9S" status=Investigating

Human Readable Output#

{
"Message": "Status for security event QCzd2IEB3S3Gj-GS6z9S changed to Investigating"
}

harfanglab-assign-policy-to-agent#


Assign a policy to an agent

Base Command#

harfanglab-assign-policy-to-agent

Input#

Argument NameDescriptionRequired
agentidAgent identifier.Required
policyPolicy name.Required

Context Output#

There is no context output for this command.

Command example#

!harfanglab-assign-policy-to-agent agentid=0fae71cf-ebde-4533-a50c-b3c0290378db policy="No psexec"

Human Readable Output#

{
"Message": "Policy No psexec successfully assigned to agent 0fae71cf-ebde-4533-a50c-b3c0290378db"
}

harfanglab-add-ioc-to-source#


Add an IOC to a Threat Intelligence source

Base Command#

harfanglab-add-ioc-to-source

Input#

Argument NameDescriptionRequired
ioc_valueIOC value.Required
ioc_typeIOC type (hash, filename, filepath).Required
ioc_commentComment associated to IOC.Optional
ioc_statusIOC status (stable, testing).Required
source_nameIOC Source Name.Required

Context Output#

There is no context output for this command.

Command example#

!harfanglab-add-ioc-to-source ioc_value=0004ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab ioc_type=hash ioc_status=stable source_name="Industrial Spy"

Human Readable Output#

{
"Message": "IOC 0004ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab of type hash added to source Industrial Spy with stable status"
}

harfanglab-delete-ioc-from-source#


Delete an IOC from a Threat Intelligence source

Base Command#

harfanglab-delete-ioc-from-source

Input#

Argument NameDescriptionRequired
ioc_valueIOC value.Required
source_nameIOC Source Name.Required

Context Output#

There is no context output for this command.

Command example#

!harfanglab-delete-ioc-from-source ioc_value=0004ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab source_name="Industrial Spy"

Human Readable Output#

{
"Message": "IOC 0004ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab removed from source Industrial Spy"
}

harfanglab-whitelist-add#


Add a whitelist

Base Command#

harfanglab-whitelist-add

Input#

Argument NameDescriptionRequired
commentComment associated to the whitelist.Optional
targetDetection engine associated to the whitelist (all, sigma, yara, hlai, vt, ransom, orion, glimps, cape, driver).Optional
sigma_rule_idUUID of the targeted sigma rule (for sigma whitelist).Optional
fieldField used for checking the criterion.Optional
case_insensitiveWhether checking must be case sensitive or not.Optional
operatorOperator used for the criterion (eq, contains, regex).Optional
valueValue used for the criterion.Optional

Context Output#

PathTypeDescription
Harfanglab.WhitelistsunknownWhitelists

Command example#

!harfanglab-whitelist-add target=all field=process.hashes.sha256 operator=eq value=dcaabeb77b7e02eb31269f1ee0dcbb30e92233c2a26ba22a3be02fcf01bd2514 comment="Example of whitelist for all detection engines" case_insensitive=true

Context Example#

{
"Harfanglab": {
"Whitelists": {
"comment": "Example of whitelist for all detection engines",
"creation_date": "2023-07-21T15:41:57.515693Z",
"criteria": [
{
"case_insensitive": true,
"field": "process.hashes.sha256",
"id": 3004,
"operator": "eq",
"value": "dcaabeb77b7e02eb31269f1ee0dcbb30e92233c2a26ba22a3be02fcf01bd2514"
}
],
"enabled": true,
"id": 2519,
"last_modifier": {
"id": 191,
"username": "Harfanglab_Tech"
},
"last_update": "2023-07-21T15:41:57.515666Z",
"orphan": false,
"provided_by_hlab": false,
"sigma_rule_id": null,
"target": "all"
}
}
}

Human Readable Output#

{
"comment": "Example of whitelist for all detection engines",
"creation_date": "2023-07-21T15:41:57.515693Z",
"criteria": [
{
"case_insensitive": true,
"field": "process.hashes.sha256",
"id": 3004,
"operator": "eq",
"value": "dcaabeb77b7e02eb31269f1ee0dcbb30e92233c2a26ba22a3be02fcf01bd2514"
}
],
"enabled": true,
"id": 2519,
"last_modifier": {
"id": 191,
"username": "Harfanglab_Tech"
},
"last_update": "2023-07-21T15:41:57.515666Z",
"orphan": false,
"provided_by_hlab": false,
"sigma_rule_id": null,
"target": "all"
}

harfanglab-whitelist-add-criterion#


Add a criterion to an existing whitelist

Base Command#

harfanglab-whitelist-add-criterion

Input#

Argument NameDescriptionRequired
idWhitelist id.Optional
fieldField used for checking the criterion.Optional
case_insensitiveWhether checking must be case sensitive or not.Optional
operatorOperator used for the criterion (eq, contains, regex).Optional
valueValue used for the criterion.Optional

Context Output#

PathTypeDescription
Harfanglab.WhitelistsunknownWhitelists

Command example#

!harfanglab-whitelist-add-criterion id=2518 field=process.commandline operator=contains value=cmd.exe

Context Example#

{
"Harfanglab": {
"Whitelists": {
"comment": "Example of whitelist for all detection engines",
"creation_date": "2023-07-21T15:41:20.320846Z",
"criteria": [
{
"case_insensitive": true,
"field": "process.hashes.sha256",
"id": 3003,
"operator": "eq",
"value": "dcaabeb77b7e02eb31269f1ee0dcbb30e92233c2a26ba22a3be02fcf01bd2515"
},
{
"case_insensitive": true,
"field": "process.commandline",
"id": 3005,
"operator": "contains",
"value": "cmd.exe"
}
],
"enabled": true,
"id": 2518,
"last_modifier": {
"id": 191,
"username": "Harfanglab_Tech"
},
"last_update": "2023-07-21T15:41:58.736445Z",
"orphan": false,
"provided_by_hlab": false,
"sigma_rule_id": null,
"sigma_rule_name": null,
"target": "all"
}
}
}

Human Readable Output#

{
"comment": "Example of whitelist for all detection engines",
"creation_date": "2023-07-21T15:41:20.320846Z",
"criteria": [
{
"case_insensitive": true,
"field": "process.hashes.sha256",
"id": 3003,
"operator": "eq",
"value": "dcaabeb77b7e02eb31269f1ee0dcbb30e92233c2a26ba22a3be02fcf01bd2515"
},
{
"case_insensitive": true,
"field": "process.commandline",
"id": 3005,
"operator": "contains",
"value": "cmd.exe"
}
],
"enabled": true,
"id": 2518,
"last_modifier": {
"id": 191,
"username": "Harfanglab_Tech"
},
"last_update": "2023-07-21T15:41:58.736445Z",
"orphan": false,
"provided_by_hlab": false,
"sigma_rule_id": null,
"sigma_rule_name": null,
"target": "all"
}

harfanglab-whitelist-search#


Search whitelists from a keyword

Base Command#

harfanglab-whitelist-search

Input#

Argument NameDescriptionRequired
keywordKeyword to search whitelist.Optional
provided_by_hlabBoolean indicating whether to search in whitelists provided by HarfangLab or not.Optional

Context Output#

PathTypeDescription
Harfanglab.WhitelistsunknownWhitelists

Command example#

!harfanglab-whitelist-search keyword=cmd.exe

Context Example#

{
"Harfanglab": {
"Whitelists": {
"comment": "Example of whitelist for all detection engines",
"creation_date": "2023-07-21T15:41:20.320846Z",
"criteria": [
{
"case_insensitive": true,
"field": "process.hashes.sha256",
"id": 3003,
"operator": "eq",
"value": "dcaabeb77b7e02eb31269f1ee0dcbb30e92233c2a26ba22a3be02fcf01bd2515"
},
{
"case_insensitive": true,
"field": "process.commandline",
"id": 3005,
"operator": "contains",
"value": "cmd.exe"
}
],
"criteria_str": "process.hashes.sha256 eq dcaabeb77b7e02eb31269f1ee0dcbb30e92233c2a26ba22a3be02fcf01bd2515, process.commandline contains cmd.exe",
"enabled": true,
"id": 2518,
"last_modifier": {
"id": 191,
"username": "Harfanglab_Tech"
},
"last_update": "2023-07-21T15:41:58.736445Z",
"orphan": false,
"provided_by_hlab": false,
"sigma_rule_id": null,
"sigma_rule_name": null,
"target": "all"
}
}
}

Human Readable Output#

{
"count": 1,
"next": null,
"previous": null,
"results": [
{
"comment": "Example of whitelist for all detection engines",
"creation_date": "2023-07-21T15:41:20.320846Z",
"criteria": [
{
"case_insensitive": true,
"field": "process.hashes.sha256",
"id": 3003,
"operator": "eq",
"value": "dcaabeb77b7e02eb31269f1ee0dcbb30e92233c2a26ba22a3be02fcf01bd2515"
},
{
"case_insensitive": true,
"field": "process.commandline",
"id": 3005,
"operator": "contains",
"value": "cmd.exe"
}
],
"criteria_str": "process.hashes.sha256 eq dcaabeb77b7e02eb31269f1ee0dcbb30e92233c2a26ba22a3be02fcf01bd2515, process.commandline contains cmd.exe",
"enabled": true,
"id": 2518,
"last_modifier": {
"id": 191,
"username": "Harfanglab_Tech"
},
"last_update": "2023-07-21T15:41:58.736445Z",
"orphan": false,
"provided_by_hlab": false,
"sigma_rule_id": null,
"sigma_rule_name": null,
"target": "all"
}
]
}

harfanglab-whitelist-delete#


Delete a whitelist

Base Command#

harfanglab-whitelist-delete

Input#

Argument NameDescriptionRequired
idWhitelist identifier.Optional

Context Output#

There is no context output for this command.

Command example#

!harfanglab-whitelist-delete id=2518

Human Readable Output#

None

harfanglab-endpoint-search#


Search for endpoint information from a hostname

Base Command#

harfanglab-endpoint-search

Input#

Argument NameDescriptionRequired
hostnameEndpoint hostname.Optional

Context Output#

PathTypeDescription
Harfanglab.AgentunknownAgent information
Harfanglab.Agent.idstringagent id (DEPRECATED)
Harfanglab.statusstringStatus (DEPRECATED)