What are you doing with PSFalcon?

[bk-cs]

I'd love to hear your feedback on how you're using PSFalcon and what sort of additional commands or features you'd like to see. The module itself seems to be at a point where I can spend more time adding in additional functionality.

Two things I'm currently considering:

1. An Uninstall-FalconSensor command that's designed to remove the Falcon sensor (including getting the maintenance token) to specified host identifiers.
2. Incorporating support for the Microsoft Secret Management module for credential handling.

What are you using PSFalcon for today? What else would you like to see?

[z0her0]

Nice, both of those sound great.

Sorry if I'm in the wrong forum, so feel free to relocate this if need:

I have a question on the demo you did with RiskIQ. I installed PSRiskIQ, and I have the RiskIQ icon in CS, but is not integrated with Illuminate... I'm getting errors when GetArtifacts.ps1 tries importing the custom IOC's into Falcon:

RiskIQ Article d8fef278 artifacts:

  9 domain result(s)
  40 hash_sha256 result(s)

Importing into CrowdStrike Falcon...

The first/original error (does not generate a csv):

.\GetArtifacts.ps1 -CSV .\passivetotal_article_d8fef278.csv

RiskIQ Article d8fef278 artifacts:

  9 domain result(s)
  40 hash_sha256 result(s)

Importing into CrowdStrike Falcon...New-FalconIoc : Cannot validate argument on parameter 'Array'. '2021-09-05T04:37:34.000Z' is not a valid 'expiration' value. 
{"action":"detect","description":"RiskIQ Article d8fef278","expiration":"2021-09-05T04:37:34.000Z","value":"53a48d3314d4c4660931653821496
415ba9687e4f14b458d9cf61cc96632c131","type":"sha256","applied_globally":true,"platforms":["windows","mac","linux"]}
At C:\Users\<redacted>\<redacted>\Documents\PSFalcon\GetArtifacts.ps1:146 char:38
+ ...               New-FalconIOC -Array $Array[$i..($i + ($MaxCount - 1))]
+                                        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidData: (:) [New-FalconIoc], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,New-FalconIoc

I removed the expiration field (this generated a csv, but still no upload to CS):

.\GetArtifacts.ps1 -CSV .\passivetotal_article_d8fef278.csv -Verbose

RiskIQ Article d8fef278 artifacts:

  9 domain result(s)
  40 hash_sha256 result(s)

Importing into CrowdStrike Falcon...VERBOSE: [ApiClient.Invoke] POST https://api.crowdstrike.com/oauth2/token
VERBOSE: [ApiClient.Invoke] ContentType: application/x-www-form-urlencoded, Accept: application/json
VERBOSE: [ApiClient.Invoke] 201: Created
VERBOSE: [ApiClient.Invoke] POST https://api.crowdstrike.com/iocs/entities/indicators/v1
VERBOSE: [ApiClient.Invoke] ContentType: application/json, Accept: application/json
VERBOSE: [ApiClient.Invoke] 400: BadRequest
Write-Result : 400: Provided data does not match expected format
At C:\Users\<redacted>\<redacted>\Documents\WindowsPowerShell\Modules\PSFalcon\2.1.2\Private\Private.ps1:582 char:35
+                         $Result = Write-Result $Request
+                                   ~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (System.Threadin...esponseMessage]:Task`1) [Write-Result], Exception
    + FullyQualifiedErrorId : be0a315e-e480-487d-9e8b-894a3c4c700a,Write-Result

I get the access token using my CS client ID/secret before running the script. Do I need an API key from RiskIQ? Or an enterprise account (not community)? I recorded the second error with start/stop-transcript if you want that.

Any help is appreciated! Thank you!

[z0her0]

holy cow it worked @bk-cs

[z0her0]

Checked the IOC management UI and they all uploaded successfully. Woot woot. @bk-cs

RiskIQ Article d8fef278 artifacts:

  9 domain result(s)
  40 hash_sha256 result(s)

Importing into CrowdStrike Falcon...complete.

[bk-cs]

-Severity isn't required as far as I know, but something about creating those IOCs is still slightly off--though acceptable enough to create them if you ignore the warnings.

I'm glad it worked for you! If you figure out the exact field that was the problem, I'd be happy to fix it. I haven't been able to figure it out from glancing at the example CSVs.

[z0her0]

@bk-cs I emailed you

[z0her0]

Not sure if the email will get blocked because I attached the CSV of the riskIQ indicators... If you don't get it i'll resend with just the getartifacts.txt file @bk-cs

[z0her0]

Is there a way to download strict IOC's from a Falcon sandbox report > upload the IOC's into a threat indicator graph > then export the list of all hosts in contact with those IOC's? I'm trying to figure out a smoother process of getting hostnames and host id's to use in PSFalcon without going into Host Management.

Ideal workflow: View Falcon sandbox report > click the 'Search Indicator Graph' button to see what hosts may be communicating with that malware sample > Refine indicator graph by removing noisey IOC's > Before exiting the "refine graph" interface, 'Export hosts to CSV'.

Is this doable with PSFalcon?

[bk-cs]

You can't export a list from the Indicator Graph, or access the Indicator Graph using the API, but you can create the IOCs and set them to generate retroactive detections (which is effectively how they're displayed on the Indicator Graph).

You can get hostnames/host IDs using Get-FalconHost, and presumably do what you're trying to do using a combination of Get-FalconReport, and New-FalconIoc (with retroactive detections), then export the affected hosts based on the generated detections (Get-FalconDetection) or see which host IDs encountered the IOCs using Get-FalconIocHost.

[z0her0]

Oh awesome. Good thinking. I will give that a shot.