mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Lou Stella
26 lines
1014 B
YAML
26 lines
1014 B
YAML
name: Delete Detected Files
|
|
id: fc0edc96-ff2b-48b0-9a6f-63da6783fd63
|
|
version: 1
|
|
date: '2021-03-29'
|
|
author: Philip Royer, Splunk
|
|
type: Response
|
|
description: This playbook acts upon events where a file has been determined to be malicious (ie webshells being dropped on an end host). Before deleting the file, we run a "more" command on the file in question to extract its contents. We then run a delete on the file in question.
|
|
playbook: delete_detected_files
|
|
how_to_implement: This playbook reads and then deletes files stored with artifact:*.cef.filePath from hosts stored in artifact:*.cef.destinationAddress. Windows Remote Management must be enabled on the remote computer.
|
|
references: []
|
|
app_list:
|
|
- "Windows Remote Management"
|
|
tags:
|
|
analytic_story:
|
|
- Active Directory Lateral Movement
|
|
detections:
|
|
- Executable File Written in Administrative SMB Share
|
|
platform_tags: []
|
|
playbook_type: Automation
|
|
vpe_type: Classic
|
|
playbook_fields:
|
|
- filePath
|
|
- destinationAddress
|
|
product:
|
|
- Splunk SOAR
|