D2

Uses Demisto's d2 agent to collect data from an endpoint for IR purposes.

Input:

• Hostname (default: ${Endpoint.Hostname})
• OS (default: windows)
• Credentials (default: Admin)
• Path (default: None)

Returns a file sample to the war-room from a path on an endpoint using Demisto Dissolvable Agent (D2)

Input:

• Credentials - credentials to use when trying to deploy Demisto Dissolvable Agent (D2) (default: Admin)
• ${Endpoint.Hostname} - deploy agent on target endpoint
• ${File.Path} - file's path to collect

Perform a short probe of the specified system's registry - retrieve and display the values of a list of interesting keys

Drop a file to a target system by providing its path on the server. Use CopyFileD2 instead in most cases.
This is a utility agent script to be used inside server scripts. See CopyFileD2 for an example.

Collect values for the given registry path from all Windows systems in this investigation.

Use the D2 agent to execute Rekall on a system (usually a forensics workstation) and analyze a memory dump file located on that system.

Check the given registry path against a small blacklist (score 3), whitelist (score 1), and suspicious list (score 2). If the key matches neither, returns an answer of 0.

Removes the Demisto D2 agent from the system using d2_remove command.

Used by the server-side script "Autoruns".
Uses d2 agent on endpoint to run SysInternals Autoruns.

Show local accounts

Execute PE Dump on a file that is under /tmp somewhere. Used internally by StaticAnalyze

Get active users from a D2 agent and parsed them into context

Show local accounts

Get a file from a system using D2 agent.

Collect Autoruns items from an endpoint and hashes for each item.
Uses a d2 agent to run SysInternals Autoruns.

Search mails in office-365

Assign a 'Mailbox Import Export' management role to a user. This script runs through the agent on a Windows machine, pulls and executes a PowerShell script - which talks to the Exchange server.

Copy a file from an entry to the destination path on the specified system. This uses the dissolvable agent's HTTPS communication channel rather than scp or other out-of-band methods.
Example usage: !CopyFileD2 destpath=/home/sansforensics/collectedbinaries/inv8_suspiciousPE1.exe.evil entryid=21@8 system=Analyst1

Show system services

Assign a 'Mailbox Import Export' management role to a user. This script runs through the agent on a Windows machine, pulls and executes a PowerShell script - which talks to the Exchange server.

Common code that will be merged into each D2 agent script when it runs

Use the D2 agent to carry the winpmem binary to a system and return the memory dump file to the war room. This usually takes a while, depending on amount of RAM in the target system.

Use the D2 agent to retrieve the value of the given registry key.

For phishing incidents, iterate on all attachments and run PE dump on each

Show system information

Execute the command and pack the output back to server

Run a D2 built-in command on a D2 agent

Copy a log file. Works on Windows and Unix (differently - take a peek at the script itself to see how).

Show running processes

Get a File from using a D2 agent