Running Scripts on Host Groups with more than 30 Seconds Timeout?

[HughMannRezident]

Description of your question

I'm trying to deploy a potentially long running script against a group of hosts using PSFalcon

To Reproduce

$HostIDs = @(
        "4693d6c3e0a645c484ffb939aa281423", 
        "886b93c6424f410da1d0cdcda848a2e9"
 )
$CloudScript = "CVE-2022-42889-Apache2Commons"


Import-Module -Name PSFalcon

$Batch = Start-FalconSession -Id $HostIDs
Write-Output ('Obtained Batch ID: ' + $Batch.batch_id)

$runScriptParams = @{
    Command     = 'runscript'
    Arguments   = '-CloudFile="' + $CloudScript + '" -CommandLine="" -Timeout="600"' 
    BatchID     = $Batch.batch_id
}

Write-Output ('(' + $Batch.batch_id + ') runscript -CloudFile="' + $CloudScript + '"')
$payloadCmd = Invoke-FalconAdminCommand @runScriptParams
Write-Output($payloadCmd | ConvertTo-Json)

The cloudfile reffered to is just this powershell command,

Get-ChildItem -Path C:\ -Include "commons-text*.jar" -Recurse -Force -ErrorAction SilentlyContinue 

Expected behavior

I expected that the script would only cutoff after 600 seconds, but a majority of responses indicate 30s.

    {
        "session_id":  "814beca7-42ed-4734-8a72-05dc9b668531",
        "task_id":  "f4501452-dd76-4045-ad97-617b7dbe29cf",
        "complete":  false,
        "stdout":  "",
        "stderr":  "",
        "aid":  "4693d6c3e0a645c484ffb939aa281423",
        "errors":  [
                       "@{code=50401; message=Exceeded maximum read timeout: 29.49s}"
                   ],
        "query_time":  29.495240324,
        "offline_queued":  false,
        "batch_id":  "baf76152-caa0-45b6-addd-a8a8ffeaae2b"
    },

Environment (please complete the following information):

• OS: Windows 10
• PowerShell: 5.1.19041.1682
• PSFalcon: 2.2.1

The Question is:

Am i doing this correctly? How can i make it work?

[bk-cs]

There are two timeout values--one for the command, and one for the script. Try this:

$runScriptParams = @{
    Command = 'runscript'
    Arguments = '-CloudFile="' + $CloudScript + '" -CommandLine="" -Timeout="550"' 
    Timeout = 600
    BatchID = $Batch.batch_id
}

You'll notice that I put 600 for the command timeout, and 550 for the script timeout to allow for some API processing so they don't both end at the same time.

If you have a script that could potentially run for as long as five minutes, I recommend re-writing it so that it's fully self-contained and can be launched as a secondary process. That way Real-time Response can be used to start the script, return that the script was started, and you can collect results after the fact (or send them to a third-party destination for review, like a log collector).

You could also use my find_file script instead, which seems to be serving the same purpose. It will send results to Humio if you configure it to do so, or create a Json file in \Windows\system32\CrowdStrike\Rtr.