Uses Demisto's d2 agent to collect data from an endpoint for IR purposes.

Input:

• Hostname (default: ${Endpoint.Hostname})
• OS (default: windows)
• Credentials (default: Admin)
• Path (default: None)

Returns a file sample to the war-room from a path on an endpoint using Demisto Dissolvable Agent (D2)

Input:

• Credentials - credentials to use when trying to deploy Demisto Dissolvable Agent (D2) (default: Admin)
• ${Endpoint.Hostname} - deploy agent on target endpoint
• ${File.Path} - file's path to collect

Get active users from a D2 agent and parsed them into context

Collect Autoruns items from an endpoint and hashes for each item.
Uses a d2 agent to run SysInternals Autoruns.

Common code that will be merged into each D2 agent script when it runs

Copy a file from an entry to the destination path on the specified system. This uses the dissolvable agent's HTTPS communication channel rather than scp or other out-of-band methods.
Example usage: !CopyFileD2 destpath=/home/sansforensics/collectedbinaries/inv8_suspiciousPE1.exe.evil entryid=21@8 system=Analyst1

Show local accounts

Used by the server-side script "Autoruns".
Uses d2 agent on endpoint to run SysInternals Autoruns.

Drop a file to a target system by providing its path on the server. Use CopyFileD2 instead in most cases.
This is a utility agent script to be used inside server scripts. See CopyFileD2 for an example.

Execute the command and pack the output back to server

Get a file from a system using D2 agent.

Copy a log file. Works on Windows and Unix (differently - take a peek at the script itself to see how).

Show system information

Assign a 'Mailbox Import Export' management role to a user. This script runs through the agent on a Windows machine, pulls and executes a PowerShell script - which talks to the Exchange server.

Assign a 'Mailbox Import Export' management role to a user. This script runs through the agent on a Windows machine, pulls and executes a PowerShell script - which talks to the Exchange server.

Execute PE Dump on a file that is under /tmp somewhere. Used internally by StaticAnalyze

Show running processes

Use the D2 agent to retrieve the value of the given registry key.

Use the D2 agent to execute Rekall on a system (usually a forensics workstation) and analyze a memory dump file located on that system.

Show system services

Show local accounts

Use the D2 agent to carry the winpmem binary to a system and return the memory dump file to the war room. This usually takes a while, depending on amount of RAM in the target system.

Run a D2 built-in command on a D2 agent

Get a File from using a D2 agent

Search mails in office-365

Collect values for the given registry path from all Windows systems in this investigation.

Check the given registry path against a small blacklist (score 3), whitelist (score 1), and suspicious list (score 2). If the key matches neither, returns an answer of 0.

Perform a short probe of the specified system's registry - retrieve and display the values of a list of interesting keys

For phishing incidents, iterate on all attachments and run PE dump on each

Removes the Demisto D2 agent from the system using d2_remove command.