Examining Executed .EXE on Endpoint

[OlexTratisky]

Hello,

I am curious to know if its possible to auto copy a given app.exe executed on a windows endpoint, automatically to SO for further analysis with Streika and YARA files?

Idea is whenever a user executes some .exe on his pc, to have them copied to SO and run some analysis on them.

Thank you

[weslambert]

You should be able to use strelka-fileshot (assuming the firewall allows the connection, via so-allow).

[OlexTratisky]

Thank you for your reply.

I tried strelka-fileshot but it seems it cannot be triggered upon file execution. The different options are scheduled file analsys and on demand.

The ideal workflow that i waas thinking of is as follow:
User tries to executes file.exe
file.exe is autocopied to strelka and used to match generic yara rules
analysis (.json result) is returned to the user to allow/deny the file.exe from executing