Remote execution of scan in powershell based on incident details

[hermanmaleiane]

Hi team,

Hope you are doing well.

I'm starting to use crowdstrike and i have some questions.

I'm able to connect to CrowdStrike through API and get incidents.
falcon.get_incidents(ids='')

My task is to submit the the details (Host) to scan.
Crowdstrike handle the kill of the process. My organization want to be able to start a scan for example on windows defender and remove that malware.

There is a command in powershel to execute it.

Start-MpScan -ScanType QuickScan

I want to crowdstrike to open a remote connection and call this script and pass the host to be scanned in python using falconpy.
Is this possible?

Thanks in advance

[jshcodes]

Hi @hermanmaleiane!

Yes this can be done a couple of different ways. Let's start with getting you connected to the host using Real Time Response.

Check out these samples, and then let us know where you run into questions?

[jshcodes]

I just updated the Quick Scan and Sample Uploads examples as well. They can be found here: Quick Scan and Sample Uploads.

[hermanmaleiane]

Hi @jshcodes

Thanks for replying!

I have some points here.

I understood how to be connected to the host, in this sample (https://github.com/CrowdStrike/falconpy/blob/main/samples/rtr/pony/my_little_rtr.py), in the init_session() function. And then i think i need to pass the correct scripts (script to scan and script to remove de infected files based on scan results) to execute_command() function.

In the other hand it seems that quick_scan does the job (Scan and get the analysis result and remove from host and sandbox)
but i can't see how to connect to a specific host there, in the documentation https://falconpy.io/Service-Collections/Quick-Scan.html and the samples https://github.com/CrowdStrike/falconpy/tree/main/samples/sample_uploads
I'm little bit confused on which approach to use.

Sorry I'm beginner with this API.

Thanks in advance.

[jshcodes]

I understood how to be connected to the host, in this sample (https://github.com/CrowdStrike/falconpy/blob/main/samples/rtr/pony/my_little_rtr.py), in the init_session() function. And then i think i need to pass the correct scripts (script to scan and script to remove de infected files based on scan results) to execute_command() function.

That is correct. Depending on the command, you may want to use the methods in the RealTimeResponseAdmin Service Class.

In the other hand it seems that quick_scan does the job (Scan and get the analysis result and remove from host and sandbox)
but i can't see how to connect to a specific host there, in the documentation https://falconpy.io/Service-Collections/Quick-Scan.html and the samples https://github.com/CrowdStrike/falconpy/tree/main/samples/sample_uploads
I'm little bit confused on which approach to use.

That's my fault for not detailing this better. 😄 The Quick Scan / Sample Uploads examples I sent you are not host-specific, they upload any target file (or directory) and then perform a Quick Scan of the contents. For your scenario, you would use these examples the same way you are using PowerShell to call MpScan. (e.g. The QuickScan example would be a script you upload to execute later using the -CloudFile and -CommandLine flags with runscript.)