Skip to main content

TARGET: File

info
RequirementsLimitationsConsiderations
Endgame installed on the target hostOnly one host can be targeted at a time
The hostname of the target hostCannot target folders
The target File Path

TACTIC: Delete File​

1 - Target the host​

  1. From the Endgame web UI, navigate to the Endpoints tab on the left-hand pane

  2. Find the hostname of interest and click on the respective ENDPOINT NAME to get to the Endpoint Details page

2 - Target and delete the file​

  1. Click on Take Action -> Respond

  2. Click on the Delete File radio button and fill the File Name with the full file path

  3. Click on Create Response

  4. Verify that the Responses successfully launched message appears and click Close

3 - Verify the response results​

  1. Wait for the Activity Timeline under the Endpoint Details on the left-hand pane to update with a REFRESH LIST notification

  2. Click on the REFRESH LIST notification

  3. Verify that the newest Delete File response entry under the Activity Timeline says Delete File (Success)

NOTE: If the entry says Delete File (Failed), click on the entry to expand the log message to investigate why the response failed

TACTIC: Download File​

1 - Target the host​

  1. From the Endgame web UI, navigate to the Endpoints tab on the left-hand pane

  2. Find the hostname of interest and click on the respective ENDPOINT NAME to get to the Endpoint Details page

2 - Target and download the file​

  1. Click on Take Action -> Respond

  2. Click on the Get File radio button and fill the File Name with the full file path

  3. Click on Create Response

  4. Verify that the Responses successfully launched message appears and click Close

3 - Verify the response results​

  1. Wait for the Activity Timeline under the Endpoint Details on the left-hand pane to update with a REFRESH LIST notification

  2. Click on the REFRESH LIST notification

  3. Verify that the newest Get File response entry under the Activity Timeline says Get File (Success)

NOTE: If the entry says Get File (Failed), click on the entry to expand the log message to investigate why the response failed

  1. Select the entry and click Download Raw Data -> Download File to download the file