D2

Returns a file sample to the war-room from a path on an endpoint using Demisto Dissolvable Agent (D2)

Input:

• Credentials - credentials to use when trying to deploy Demisto Dissolvable Agent (D2) (default: Admin)
• ${Endpoint.Hostname} - deploy agent on target endpoint
• ${File.Path} - file's path to collect

Uses Demisto's d2 agent to collect data from an endpoint for IR purposes.

Input:

• Hostname (default: ${Endpoint.Hostname})
• OS (default: windows)
• Credentials (default: Admin)
• Path (default: None)

Copy a log file. Works on Windows and Unix (differently - take a peek at the script itself to see how).

Get a file from a system using D2 agent.

Show system services

Use the D2 agent to retrieve the value of the given registry key.

Get a File from using a D2 agent

Common code that will be merged into each D2 agent script when it runs

Get active users from a D2 agent and parsed them into context

Show system information

Drop a file to a target system by providing its path on the server. Use CopyFileD2 instead in most cases.
This is a utility agent script to be used inside server scripts. See CopyFileD2 for an example.

For phishing incidents, iterate on all attachments and run PE dump on each

Use the D2 agent to execute Rekall on a system (usually a forensics workstation) and analyze a memory dump file located on that system.

Check the given registry path against a small block list (score 3), allow list (score 1), and suspicious list (score 2). If the key matches neither, returns an answer of 0.

Execute the command and pack the output back to server

Assign a 'Mailbox Import Export' management role to a user. This script runs through the agent on a Windows machine, pulls and executes a PowerShell script - which talks to the Exchange server.

Used by the server-side script "Autoruns".
Uses d2 agent on endpoint to run SysInternals Autoruns.

Collect Autoruns items from an endpoint and hashes for each item.
Uses a d2 agent to run SysInternals Autoruns.

Execute PE Dump on a file that is under /tmp somewhere. Used internally by StaticAnalyze

Show running processes

Copy a file from an entry to the destination path on the specified system. This uses the dissolvable agent's HTTPS communication channel rather than scp or other out-of-band methods.
Example usage: !CopyFileD2 destpath=/home/sansforensics/collectedbinaries/inv8_suspiciousPE1.exe.evil entryid=21@8 system=Analyst1

Run a D2 built-in command on a D2 agent

Show local accounts

Use the D2 agent to carry the winpmem binary to a system and return the memory dump file to the war room. This usually takes a while, depending on amount of RAM in the target system.

Collect values for the given registry path from all Windows systems in this investigation.

Perform a short probe of the specified system's registry - retrieve and display the values of a list of interesting keys

Removes the Demisto D2 agent from the system using d2_remove command.

Show local accounts

Search mails in office-365

Assign a 'Mailbox Import Export' management role to a user. This script runs through the agent on a Windows machine, pulls and executes a PowerShell script - which talks to the Exchange server.