Scripts vs PUT Files

[jkozlowicz]

I am trying to understand the full difference between scripts and PUT files in order to implement the following flow:

• upload an executable for a specific platform to target hosts,
• execute it,
• upload the results of the executable back to CrowdStrike cloud
• download the results on our server

I've gone through the documentation of falconpy and I have the following questions:

1. What is the different between those two?
   a) creating a script (CreateScript) + running a script (BatchAdminCmd -> runscript <my-script>)
   b) creating a PUT file (RTR_CreatePut_Files) + putting a PUT file to a target host (BatchAdminCmd -> put <my-put-file>) + running a script (BatchAdminCmd -> run <my-put-file>)

The "script" way seems to be more convenient.

Moreover, why isn't put command supported on linux and put-and-run is? At least according to this part of the table here:
https://www.falconpy.io/Service-Collections/Real-Time-Response-Admin.html#available-base-commands

[crowdstrikedcs]

Hi @jkozlowicz Thanks for the question!

I implemented something similar for a recent project I was working on with RTR.

For my use case I have a binary that runs collects some data, and needed to write the response to disk and grab this.

1. Put binary on host RTR_CreatePut_Files + BatchAdminCmd put
2. Script checks binary matches expected hash value and executes the binary on disk with a parsed command. It then writes the response to disk and prints a status as well as the location of the saved response. BatchAdminCmd runscript
3. Used RTR to upload the stored file on disk
4. Grab the stored file and unzip it.

As to your question, runscript allows you to specify a script at runtime through the -Raw flag as a properly fomated string or as a cloudfile.
I find it easier to first create my script in the UI or with CreateScript and then use the runscript -cloudfile=scriptname command.

For the second part, you need to create a put file first, then are you able to reference it by name using BatchAdminCmd. Like put "macosbin"

I think for your use case you may need to do both, create a script and put file similar to my example above.

You're correct on the put-and-run command this isn't supported on Linux as of yet.

Let me know with any additional questions on the above!

[jkozlowicz]

Hey @crowdstrikedcs ,
thank you so much for the quick response!

That was helpful, but I still have more questions.

1. Using scripts.

I had thought that I might be able to do it without PUT files. I was thinking about something along these lines (let's assume I have a similar scenario to yours and I have a binary file called collector):

• CreateScript --name collector --file collector --data collector_file.read()
• run script -cloudfile=collector --output_file XYZ
• BatchAdminCmd put XYZ

This way I wouldn't have to put any files onto the remote host. I guess that by using the run script -cloudfile the script has to be downloaded on the target hosts anyway. I am just not sure if it was OK to create a script with 25MB.. Perhaps it would be better to put the executable file to the target host as a PUT file and use a lightweight script to verify script's checksum, execute it, and report back where the result is. Any thoughts?

2. Command availability on different platforms.

You're correct on the put-and-run command this isn't supported on Linux as of yet.

According to the falconpy documentation it is not the put-and-run command being unavailable on Linux as of yet, but rather the put command. (please see the attached screenshot in my initial post) Could you please confirm that put is unsupported on Linux? That'd be bad, because it might be crucial for implementing the flow that I described. Maybe there's an error in the documentation and it is the other way round, i.e. put is supported on all platform, and put-and-run only on mac and windows?

3. PUT Files.

a) What is the retention policy for PUT files? Do they stay in CrowdStrike cloud forever or do they get deleted after some time?

b) Once uploaded to a target host, the PUT files stay there, right? If I wanted to re-collect some data I could use already existing PUT-file on a target host, if it had been uploaded there before?

4. Samples.

I've read the documentation for falconpy and noticed that an entity called Sample was mentioned there. It seems that this entity would be perfect for storing and uploading results after running an executable on a remote host, e.g. running a collector from the example above and uploading its results as samples. However, that is only available with falconpy, but not with BatchAdminCmd, which will not be pre-installed (or not installable at all) on target remote hosts. I was expecting to see an admin command like upload-sample. Could you please comment on that? The only way (or the recommended and supported one) to upload "samples" from a target host is to use put admin command?

5. Target host discovery and admin commands.

Can it be safely assumed that all discovered hosts via CrowdStrike API have CrowdStrike's agent running, which will make the aforementioned admin commands available, i.e. put, runscript, etc. ?

[crowdstrikedcs]

Hey @jkozlowicz

1. When we talk about scripts these are powershell, bash, or zsh depending on the platform you can either provide these at runtime using the -raw commnad at runtime or stage them as cloud scripts using CreateScript. Here is an example of uploading and executing scripts. For your use case of executing a binary it would be neccesary to have this binary present on the host at script runtime. I'd stage this as a put file using create_put_files and then using the put command.

2. I did confirm that put is supported on all platforms. put-and-run is not compatabile with Linux. This will need to be updated in our docs.

3. I didn't find any detail on the retention of put files or scripts so I would expect them to stay in the cloud through the lifetime of the account. Once uploaded to a host they are present until deleted.

4. For Uploading files from a host to the CrowdStrike cloud you can use the BatchGetCmd or by using the get command with RTR. These will be staged and can be downloaded using teh GetSampleV3 operation.

5. Can you confirm you're talking about hosts where the CrowdStrike Agent is deployed? In this case yes commands are avaliable but depending on the hosts policy there may be addtional settings to enable certain "high risk" commands.

[jkozlowicz]

Hi @crowdstrikedcs,
thank you for you reply!

1. Got it!

2. Perfect. The put command followed by runscript will do the job!

3. Ok, good to know. Is there any additional fee for storing data as CrowdStrikes PUT Files / Samples?

4. Okay, that makes sense! For some reason I had thought that I'd have to use CreatePutFiles on remote hosts to upload a file to the CrowdStrike cloud. But not sure if that is even available on the remote host... So the complete flow will be as follows:
   a) CreatePutFile -> upload the executable to CrowdStrike (to be done only once)
   b) CreateScript -> upload the script to run the executable to CrowdStrike (to be done only once)
   c) QueryHosts -> select hosts on which to execute the script
   d) BatchAdminCmd:put -> place the executable onto remote hosts
   e) BatchAdminCmd:runscript -> run the executable on the remote hosts
   f) RTR_CheckAdminCommandStatus -> get results of running the script (e.g. result file location/name)
   g) BatchGetCmd -> upload the results to CrowdStrike
   h) GetSample -> download the results from CrowdStrike

5. I think so. I can only discover or execute commands on hosts that have the CrowdStrike Agent deployed, right? Otherwise, CrowdStrike wouldn't know how to find them?

[crowdstrikedcs]

3. No additional cost for these

4. Yes that flow looks good to me

5. That's correct, we do have an aditional Discover Service Collection just making sure we weren't confusing them.