D2

Uses Demisto's d2 agent to collect data from an endpoint for IR purposes.

Input:

• Hostname (default: ${Endpoint.Hostname})
• OS (default: windows)
• Credentials (default: Admin)
• Path (default: None)

Returns a file sample to the war-room from a path on an endpoint using Demisto Dissolvable Agent (D2)

Input:

• Credentials - credentials to use when trying to deploy Demisto Dissolvable Agent (D2) (default: Admin)
• ${Endpoint.Hostname} - deploy agent on target endpoint
• ${File.Path} - file's path to collect

For phishing incidents, iterate on all attachments and run PE dump on each

Assign a 'Mailbox Import Export' management role to a user. This script runs through the agent on a Windows machine, pulls and executes a PowerShell script - which talks to the Exchange server.

Use the D2 agent to carry the winpmem binary to a system and return the memory dump file to the war room. This usually takes a while, depending on amount of RAM in the target system.

Common code that will be merged into each D2 agent script when it runs

Get a File from using a D2 agent

Execute PE Dump on a file that is under /tmp somewhere. Used internally by StaticAnalyze

Used by the server-side script "Autoruns".
Uses d2 agent on endpoint to run SysInternals Autoruns.

Collect values for the given registry path from all Windows systems in this investigation.

Assign a 'Mailbox Import Export' management role to a user. This script runs through the agent on a Windows machine, pulls and executes a PowerShell script - which talks to the Exchange server.

Show local accounts

Execute the command and pack the output back to server

Collect Autoruns items from an endpoint and hashes for each item.
Uses a d2 agent to run SysInternals Autoruns.

Drop a file to a target system by providing its path on the server. Use CopyFileD2 instead in most cases.
This is a utility agent script to be used inside server scripts. See CopyFileD2 for an example.

Show system information

Show local accounts

Use the D2 agent to execute Rekall on a system (usually a forensics workstation) and analyze a memory dump file located on that system.

Perform a short probe of the specified system's registry - retrieve and display the values of a list of interesting keys

Show running processes

Copy a log file. Works on Windows and Unix (differently - take a peek at the script itself to see how).

Get active users from a D2 agent and parsed them into context

Use the D2 agent to retrieve the value of the given registry key.

Check the given registry path against a small block list (score 3), allow list (score 1), and suspicious list (score 2). If the key matches neither, returns an answer of 0.

Search mails in office-365

Copy a file from an entry to the destination path on the specified system. This uses the dissolvable agent's HTTPS communication channel rather than scp or other out-of-band methods.
Example usage: !CopyFileD2 destpath=/home/sansforensics/collectedbinaries/inv8_suspiciousPE1.exe.evil entryid=21@8 system=Analyst1

Get a file from a system using D2 agent.

Removes the Demisto D2 agent from the system using d2_remove command.

Show system services

Run a D2 built-in command on a D2 agent