TARGET: Process

---

info

Requirements	Limitations	Considerations
SMB+WMI (RPC) or WinRM enabled/accessbile on the target host		Targeting cmd.exe or powershell.exe with names instead of PIDs will kill the job itself
The hostname or IP of the target host
Either the target process Process Id or Process Name

---

TACTIC: Terminate Process (262 - [🔥Volatile Info] Terminate Processes)

1 - Create the Job

1. From the Metasponse web UI, navigate to Job -> +New Job from the top pane

2. Name: Set a unique but descriptive name for the job

2 - Configure the Job

1. 🚊 Transports - Select the following transport plugin(s):

   • WMI Transport
   • SMB Transport

2. 🔧 Remediators - Select the following remediator plugin(s):

   • 262 - [🔥Volatile Info] Terminate Processes

3. 🔍 Analyzers - Select the following analyzer plugin(s):

   • Elasticsearch Analyzer

4. ⛭ Authentication - Configure the following settings:

   Setting	Value
   Domain	Target authentication domain or workgroup
   Elasticsearch: Password	metasponse
   Elasticsearch: Username	Password to authenticate with Elasticsearch
   Elasticsearch: Verify SSL Certificate	UNCHECKED (False)
   Password	Target user password
   Username	Target user

   NOTE: DIP Kits configured IAW 262COS-DIP-SOP-001 already have the Elastic user metasponse pre-configured with the Kit password - otherwise you will need to manually create this user in Kibana with superuser privileges

5. ⛭ Deployment - Target the host(s):

   Setting	Value
   Network Root	\%WinDir%\Temp\262
   Physical Root	%WinDir%\Temp\262
   Target Addresses	The target hostname(s)/address(es)

   NOTE: Changing the Network Root and Physical Root folders to a path with a known unique string will aid in whitelisting alerts that spawn from Metasponse activity

6. ⛭ Remediate - Target the process(es):

   Setting	Value
   262 - Terminate Processes: Process Names/IDs	A list of Process names and/or IDs to terminate.

3 - Execute the Job

1. Click the ⭮ Check button on the left-hand to verify the job settings

2. Click the ⯈ Schedule button on the left-hand column to execute the job

4 - Verify the response results

1. Monitor the Job status until the 🗏 Analysis button appears, then click it to be taken to the Data Collections screen

2. Within the 262 Volatile Info section, click on the 262_processes data collection

NOTE: If the 262_processes data collection is not present, then this indicates that no processes were terminated

3. Verify that the list of processes matches your intended targets

---

TACTIC: Terminate Process (Basic Remediator)

1 - Create the Job

1. From the Metasponse web UI, navigate to Job -> +New Job from the top pane

2. Name: Set a unique but descriptive name for the job

2 - Configure the Job

1. 🚊 Transports - Select the following transport plugin(s):

   • WMI Transport
   • SMB Transport

2. 🔧 Remediators - Select the following remediator plugin(s):

   • 262 - [🔥Volatile Info] Terminate Processes

3. 🔍 Analyzers - Select the following analyzer plugin(s):

   • Elasticsearch Analyzer

4. ⛭ Authentication - Configure the following settings:

   Setting	Value
   Domain	Target authentication domain or workgroup
   Elasticsearch: Password	metasponse
   Elasticsearch: Username	Password to authenticate with Elasticsearch
   Elasticsearch: Verify SSL Certificate	UNCHECKED (False)
   Password	Target user password
   Username	Target user

   NOTE: DIP Kits configured IAW 262COS-DIP-SOP-001 already have the Elastic user metasponse pre-configured with the Kit password - otherwise you will need to manually create this user in Kibana with superuser privileges

5. ⛭ Deployment - Target the host(s):

   Setting	Value
   Network Root	\%WinDir%\Temp\262
   Physical Root	%WinDir%\Temp\262
   Target Addresses	The target hostname(s)/address(es)

   NOTE: Changing the Network Root and Physical Root folders to a path with a known unique string will aid in whitelisting alerts that spawn from Metasponse activity

6. ⛭ Remediate - Target the process(es):

   Setting	Value
   Remediate: Kill Processes	Process image names or PIDs to kill

3 - Execute the Job

1. Click the ⭮ Check button on the left-hand to verify the job settings

2. Click the ⯈ Schedule button on the left-hand column to execute the job

4 - Verify the response results

1. Monitor the Job status until the 🗏 Analysis button appears, then click it to be taken to the Data Collections screen

2. Within the Remediation section, click on the remediate data collection

3. Verify that the WasSuccessful field is true for the actions against your intended target processes

---