{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44757,"path":"security-management/security-incident-response/playbook-setup-defense-evasion-mimikatz-dcshadow.md","title":"Set up the T1003 - Defense Evasion - Mimikatz DCShadow playbook","bundle":null,"doc_type":null,"release":"australia","body":"\n# Set up the T1003 - Defense Evasion - Mimikatz DCShadow playbook\n\nUse the following steps to set up the T1003 - Defense Evasion - Mimikatz DCShadow playbook.\n\n## Before you begin\n\nRole required:\n\n-   sn\\_si.admin\n-   flow\\_designer\n\nMake sure you have installed Security Operations Spoke \\(`sn_sec_spoke`\\).\n\n## Procedure\n\n1.  Login as a user with sn\\_si.user and flow\\_designer roles.\n\n2.  Navigate to **All** > **Flow Designer** and select the **T1003 - Defense Evasion - Mimikatz DCShadow** playbook.\n\n3.  Create a copy of the T1003 - Defense Evasion - Mimikatz DCShadow playbook flow and make the necessary modifications.\n\n    To create a copy of the playbook's flow, select the \\[Omitted image \"more-action-menu.png\"\\] Alt text: More actions menu icon and select **Copy flow**. Perform this step only if you plan to customize or make specific changes to the flow.\n\n4.  Activate the playbooks.\n\n    1.  Activate the main flow to use the playbook available in the base system.\n\n    2.  Activate the copied flows after making the required changes.\n\n5.  Set a **Trigger Condition** for the playbook.\n\n    This playbook is triggered and associated with the security incident when the **Category** is **Malicious code activity**.\n\n\n**Parent Topic:**[Playbook for T1003 - Defense Evasion - Mimikatz DCShadow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/playbook-defense-evasion-mimikatz-dcshadow.md)\n\n"}}