BulkStrike

BulkStrike enables the usage of CrowdStrike Real Time Response (RTR) to bulk collect artifacts from multiple machines.

Dependencies

None if using release executable. Else, refer to requirements.txt

Usage

• From CrowdStrike Falcon web console, click on Support | API Clients and Keys
• Add new API client and ensure at least the following API Scopes
  • Hosts - Read
  • Real time response - Read and Write
• It is recommended to also have Write scope for Real time response (admin) otherwise some RTR commands (e.g. put) will not execute
• Input your Client ID and Secret via bulk_strike configure
• Request for an Authentication Token via bulk_strike req_token
• Start using BulkStrike!
• More help available via bulk_stike -h

usage: bulk_strike.py [-h] [-c CLOUDREQID] [-d DESCRIPTION] [-f FILE] [-i ID]
                      [-p PERMISSION] [-q QSESSIONID] [-s HOST] [--log]
                      [--queue]
                      action

BulkStrike enables the usage of CrowdStrike Real Time Response (RTR) to bulk execute commands on multiple machines.

positional arguments:
  action                                Req Arguments              Description
                        configure       NIL                        provide CrowdStrike Client ID, Secret and API server.
                        req_token       NIL                        request for CrowdStrike authentication token.
                        get_info        -s or -f [--log]           get system info of provided host id or hostname.
                        get_logins      -s or -f [--log] [--clean] get recent logins of provided host ids.
                        list_files      NIL                        list basic info of all RTR response files on CrowdStrike Cloud.
                        get_file        -i                         get detailed info of a RTR response file on CrowdStrike Cloud.
                        upload_file     -f and -d                  upload a RTR response file to CrowdStrike Cloud.
                        delete_file     -i                         delete a RTR response file from CrowdStrike Cloud.
                        list_scripts    NIL                        list basic info of all RTR response files on CrowdStrike Cloud.
                        get_script      -i                         get detailed info of a RTR response file on CrowdStrike Cloud.
                        upload_script   -f and -p [-d]             upload a RTR response file to CrowdStrike Cloud.
                        delete_script   -i                         delete a RTR response file from CrowdStrike Cloud.
                        start_rtr       -s or -f [--log] [--queue] initialise rtr session on specified hosts.
                        get_qsessions   NIL                        get session ids of RTR sessions that had commands queued.
                        get_qsess_data  NIL [--log]                get metadata of RTR sessions that had commands queued.
                        del_qsession    -q                         delete a currently queued RTR session.
                        del_qsess_cmd   -q and -c                  delete a currently queued RTR session command.

optional arguments:
  -h, --help            show this help message and exit
  -c CLOUDREQID, --cloudreqid CLOUDREQID
                        cloud request id of currently queued RTR session command
  -d DESCRIPTION, --description DESCRIPTION
                        description of RTR response file or script
  -f FILE, --file FILE  path of file containing host ids or hostnames
  -i ID, --id ID        id of RTR response file or script
  -p PERMISSION, --permission PERMISSION
                        permission of RTR response script (private, group, public)
  -q QSESSIONID, --qsessionid QSESSIONID
                        session id of currently queued RTR session
  -s HOST, --host HOST  host id or hostname
  --log                 write raw server response to tsv file in current working directory
  --queue               queue commands to offline hosts
  --clean               exclude less important details from output

Demo

Future Work

1. Create parallel thread to keep RTR session alive
2. Download retrieved file (via get file) to local disk
3. ~~Retry the initiating/starting of RTR session to offline host until it comes online~~

Credits

Demisto's CrowdStrikeFalcon Integrations code