Skip to content

task: document the new sensor taskings, and fix two broken examples #351

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
maximelb wants to merge 1 commit into
base: master
Choose a base branch
from
Open

task: document the new sensor taskings, and fix two broken examples #351

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion doc/cli/sensor-management.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ limacharlie endpoint-policy unseal --sid SENSOR_ID
## task

```bash
limacharlie task send --sid SENSOR_ID --command os_processes
limacharlie task send --sid SENSOR_ID --task os_processes
limacharlie task request --sid SENSOR_ID --command os_processes # Wait for response
limacharlie task reliable-send --sid SENSOR_ID --command os_processes
limacharlie task reliable-list --sid SENSOR_ID
Expand Down
15 changes: 14 additions & 1 deletion limacharlie/commands/task.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,8 @@ def group() -> None:

File system:
dir_list <path> - List a directory
dir_find <path> - Find files by size, mtime or hash (bounded)
file_grep <path> -p <str> - Search file contents for a literal (bounded)
file_get <path> - Retrieve a file as artifact
file_del <path> - Delete a file
file_hash <path> - Get hash of a file
Expand All @@ -98,14 +100,25 @@ def group() -> None:

Scanning:
yara_scan <rule> <path> - YARA scan a file or directory
artifact_get <path> - Collect an artifact (file/log)
artifact_get --file <path> - Collect one file as an artifact
artifact_get --root-dir <p> - Collect many files as artifacts (bounded)

System info:
os_version - Get OS version info
os_packages - List installed packages
os_autoruns - List autorun entries
os_users - List local user accounts (Win)
history_dump - Dump recent telemetry
container_list - List containers and images (Linux only)

The commands marked (bounded) stop at whichever budget is reached first
and report that in the reply via SCAN_IS_TRUNCATED and
SCAN_STOPPED_REASON, so an empty result is not necessarily a clean host.
Widen with --depth, --limit, --max-seconds and --max-files-scanned.

This list is not exhaustive. The task string is parsed by the backend,
not by this CLI, so the full and current set of commands and flags is
documented at https://docs.limacharlie.io/8-reference/endpoint-commands.

This command does not wait for a response. To see results, use
'limacharlie task request' (synchronous) or 'limacharlie stream events'.
Expand Down
5 changes: 3 additions & 2 deletions limacharlie/help_topics.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -715,8 +715,9 @@
# Send investigative tasks
limacharlie task send --sid <sid> --task os_processes
limacharlie task send --sid <sid> --task os_services
limacharlie task send --sid <sid> --task dir_list --args '{"rootDir":"C:\\\\Users"}'
limacharlie task send --sid <sid> --task file_hash --args '{"filePath":"C:\\\\suspect.exe"}'
limacharlie task send --sid <sid> --task 'dir_list "C:\\\\Users" "*.exe"'
limacharlie task send --sid <sid> --task 'file_hash "C:\\\\suspect.exe"'
limacharlie task send --sid <sid> --task 'file_grep "C:\\\\Users" -p "<literal>" --no-content'

# Search for IOCs
limacharlie ioc search --type file_hash --value <sha256>
Expand Down