CounterCraft Deception Director

CounterCraft Deception Solution detects advanced adversaries. Automate counterintelligence campaigns to discover targeted attacks with real-time active response.

Deception & Breach Simulation · CounterCraft Deception Director

Details

IDCounterCraft Deception Director
ProviderCounterCraft
CategoryDeception & Breach Simulation
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Overview

CounterCraft Deception Solution detects advanced adversaries. Automate counterintelligence campaigns to discover targeted attacks with real-time active response.
This integration was integrated and tested with version 2.5.13 of CounterCraft Deception Director

CounterCraft Deception Director Playbook

Use Cases

  • Query IOCs (objects) in your Deception Director
  • Retrieve events from your deception campaigns
  • Retrieve configuration from your Deception Director
  • Retrieve alerts (notifications) from your Deception Director
  • Create new deception campaigns
  • Create new deception hosts
  • Operate your campaigns, hosts, services and breadcrumbs

Prerequisites

You need to obtain the following Deception Director information.

  • Server URL
  • API Key
  • Secret Key

In order to obtain the API Key and the Secret Key you need to go to the user settings in the Deception Director
and copy both or generate a new pair if they are not already generated.

Configure CounterCraft Deception Director on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for CounterCraft Deception Director.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • Deception Director Domain or IP Address: for example, https://192.168.1.1
    • Fetch incidents: if you select this option, your notifications in the Deception Director will be created as Cortex XSOAR incidents.
    • Incident type
    • API Key for Deception Director connection: paste your API Key.
    • Secret Key for Deception Director connection: paste your Secret Key.
    • Ignore SSL Warnings: in case the SSL certificate is self-signed.
    • Use system proxy settings: in case you need to connect through a proxy.
  4. Click Test to validate the URLs, token, and connection.

Fetched Incidents Data

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. countercraft-list-campaigns
  2. countercraft-list-hosts
  3. countercraft-list-services
  4. countercraft-list-breadcrumbs
  5. countercraft-get-object
  6. countercraft-get-events
  7. countercraft-create-campaign
  8. countercraft-list-dsns
  9. countercraft-list-providers
  10. countercraft-create-host-machine
  11. countercraft-list-incidents
  12. countercraft-manage-campaign
  13. countercraft-manage-host
  14. countercraft-manage-service
  15. countercraft-manage-breadcrumb

1. countercraft-list-campaigns

List all deception campaigns

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to list only the campaigns you have access to.

Base Command

countercraft-list-campaigns

Input
Argument Name Description Required
name Campaign Name Optional
Context Output
Path Type Description
CounterCraft.Campaign.ID number Campaign ID
CounterCraft.Campaign.Name string Campaign Name
CounterCraft.Campaign.Description string Campaign Description
CounterCraft.Campaign.StatusCode string Campaign Status
Command Example

!countercraft-list-campaigns

Human Readable Output
ID Name Description StatusCode
1 AntiPhishing Gather intelligence from phishers ACTIVE
2 External recoinassance Collect pre-attack evidence ACTIVE
3 Internal lateral movement Detect lateral movement ACTIVE
4 DMZ DMZ activity ACTIVE
5 VIP VIP mobile protection ACTIVE

2. countercraft-list-hosts

Lists all deception hosts

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to list only the hosts you have access to.

Base Command

countercraft-list-hosts

Input
Argument Name Description Required
campaign_id Campaign ID Optional
Context Output
Path Type Description
CounterCraft.Host.ID number Host Id
CounterCraft.Host.Name string Host Name
CounterCraft.Host.Description string Host Description
CounterCraft.Host.StatusCode string Host Status
CounterCraft.Host.TypeCode string Host Type
Command Example

!countercraft-list-hosts campaign_id=2

Human Readable Output
ID Name Description StatusCode TypeCode
1 Ubuntu Web Wordpress ACTIVE MACHINE
2 Azure Windows 2019 RDP with breadcrumbs ACTIVE MACHINE
3 Office365 tenant Office365 with domain name ACTIVE CLOUD_ENTITY
4 Apache Struts Vulnerable Apache Struts ACTIVE MACHINE
5 CFO CFO persona ACTIVE IDENTITY

3. countercraft-list-services

List services currently deployed on deception hosts

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to list only the services you have access to.

Base Command

countercraft-list-services

Input
Argument Name Description Required
host_id Host Id Optional
Context Output
Path Type Description
CounterCraft.Service.ID number Service ID
CounterCraft.Service.Name string Service Name
CounterCraft.Service.Description string Service.Description
CounterCraft.Service.StatusCode string Service Status
CounterCraft.Service.TypeCode string Service Type
Command Example

!countercraft-list-services host_id=1

Human Readable Output
ID Name Description StatusCode TypeCode
1 Operating system User events ACTIVE SYSTEM
2 WebApp Web application ACTIVE WEB_SERVER
8 Tailored Service Anonymous FTP ACTIVE FTP_SERVER
9 Phishing Sinkhole Sinkhole ACTIVE SMTP_SERVER

4. countercraft-list-breadcrumbs

List breadcrumbs in a campaign

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to list only the breadcrumbs you have access to.

Base Command

countercraft-list-breadcrumbs

Input
Argument Name Description Required
campaign_id Campaign ID Optional
Context Output
Path Type Description
CounterCraft.Breadcrumb.ID number Breadcrumb ID
CounterCraft.Breadcrumb.Name string Breadcrumb Name
CounterCraft.Breadcrumb.Description string Breadcrumb Description
CounterCraft.Breadcrumb.StatusCode string Breadcrumb Status
CounterCraft.Breadcrumb.TypeCode string Breadcrumb Type
Command Example

!countercraft-list-breadcrumbs campaign_id=1

Human Readable Output
ID Name Description StatusCode TypeCode
1 Fake document   ACTIVE DOCUMENT
2 Mobile App   ACTIVE MOBILE_APP
3 SSL Certificate   ACTIVE SSL_CERTIFICATE
4 LinkedIn_persona   ACTIVE HONEYTOKEN

5. countercraft-get-object

Get information about an object (IoC)

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to list only the objects you have access to.

Base Command

countercraft-get-object

Input
Argument Name Description Required
value Object value Required
Context Output
Path Type Description
CounterCraft.Object.ID number Object ID
CounterCraft.Object.Value string Object value
CounterCraft.Object.Hits number Object hits
CounterCraft.Object.Score number Object score
CounterCraft.Object.TypeCode string Object type
CounterCraft.Object.FirstSeen date Object first seen
CounterCraft.Object.LastSeen date Object last seen
CounterCraft.Object.EventsCount number Object events count
CounterCraft.Object.Tags string Object tags
Command Example

!countercraft-get-object value=root

Human Readable Output
   
Id 852
Value root
EventsCount 7
TypeCode CC_USERNAME
Score 0
FirstSeen Wed Jan 29 12:33:34 2020
LastSeen Wed Jan 29 12:53:19 2020
Tags  

6. countercraft-get-events

Get full list of Events

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to list only the objects you have access to.

Base Command

countercraft-get-events

Input
Argument Name Description Required
criteria Search criteria Required
max_results Maximum number of results Required
Context Output
Path Type Description
CounterCraft.Event.ID number Event id
CounterCraft.Event.CampaignName string Campaign name
CounterCraft.Event.CategoryCode string Category Code
CounterCraft.Event.EventDate date Event date
CounterCraft.Event.HostName string Host name
CounterCraft.Event.ServiceName string Service name
CounterCraft.Event.TypeCode string Type
CounterCraft.Event.Score number Score
CounterCraft.Event.Tags string Tags
CounterCraft.Events.Data unknown Data
Command Example

!countercraft-get-events criteria="type_code:ValidAuth" max_results="1"

Human Readable Output
     
Id 45  
Campaignname External recoinassance  
Hostname Azure Windows
Servicename OS Logs (Azure Windows)
Eventdate Thu Jan 30 08:11:01 2020  
Score 100  
Typecode ValidAuth  
Data event: ValidAuth subject: A session was reconnected to a Window Station event_id: 4778 …  
Tags attack.T1078  

7. countercraft-create-campaign

Create a new deception campaign

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You can only create campaigns if you have the role ARCHITECT.

Base Command

countercraft-create-campaign

Input
Argument Name Description Required
name Campaign name Required
description Campaign description Required
Context Output
Path Type Description
CounterCraft.Campaign.ID number Campaign ID
CounterCraft.Campaign.Name string Name
CounterCraft.Campaign.Description string Description
CounterCraft.Campaign.StatusCode string Status Code
Command Example

!countercraft-create-campaign name="TestCampaign" description="Test Description"

Human Readable Output
   
Id 5
Name TestCampaign
Description Test Description
StatusCode DESIGN

8. countercraft-list-dsns

List Deception Support Nodes (DSNs)

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You can only create campaigns if you have the role ARCHITECT.

Base Command

countercraft-list-dsns

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output
Path Type Description
CounterCraft.DSN.ID number ID
CounterCraft.DSN.Name string Name
CounterCraft.DSN.Description string Description
CounterCraft.DSN.Hostname string Hostname
CounterCraft.DSN.Port number Port
Command Example

!countercraft-list-dsns

Human Readable Output
   
Id 1
Name Local DSN
Description Local DSN in the intranet
Hostname 192.168.1.2
Port  4567

9. countercraft-list-providers

List providers (providers for hosts or services i.e. AWS or Office365)

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to list only the providers you have access to.

Base Command

countercraft-list-providers

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output
Path Type Description
ID number ID
CounterCraft.Provider.Name string Name
CounterCraft.Provider.Description string Description
CounterCraft.Provider.TypeCode string Type
CounterCraft.Provider.StatusCode string Status
Command Example

!countercraft-list-providers

Human Readable Output
ID Name Description StatusCode TypeCode
1 Splunk Internal Splunk HEALTHY SPLUNK_PROVIDER
3 Signal Signal notifications HEALTHY SIGNAL_PROVIDER
4 Office365 Office365 Tenant HEALTHY OFFICE365_PROVIDER
5 AWS AWS EC2 HEALTHY AWS_PROVIDER

10. countercraft-create-host-machine

Deploy a new deception host

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to create a host if you are MANAGER in a campaign.

Base Command

countercraft-create-host-machine

Input
Argument Name Description Required
name Name Required
description Description Optional
provider_id Provider Required
deception_support_node_id Deception Support Node ID Required
campaign_id Campaign Required
os_family Operating System Required
ip_address IP Address Required
port Port Required
username Username Required
password Password Required
Context Output
Path Type Description
CounterCraft.Host.Id number Host ID
Command Example

!countercraft-create-host-machine campaign_id=2 deception_support_node_id=1 os_family=linux ip_address=192.168.1.2 port=22 name="Test host" description="Test Description" username="ubuntu" password="ubuntu provider_id=1"

Human Readable Output
   
Id 8
Name Test Host
Description Test Description
StatusCode DESIGN
TypeCode MACHINE

11. countercraft-list-incidents

List all incidents currently active

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to list only the incidents you have access to.

Base Command

countercraft-list-incidents

Input
Argument Name Description Required
campaign_id Campaign ID Required
Context Output
Path Type Description
CounterCraft.Incident.ID number Incident ID
CounterCraft.Incident.Name string Name
CounterCraft.Incident.Description string Description
CounterCraft.Incident.StatusCode string Status
CounterCraft.Incident.TLPCode string TLP code
Command Example

!countercraft-list-incidents campaign_id=1

Human Readable Output
ID Name Description StatusCode TLPCode Tags
1 APT incident State-sponsored OPEN AMBER  
2 Internal Fraud SWIFT apps CLOSED AMBER  

12. countercraft-manage-campaign

Manage Campaign parameters

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to manage only the campaigns you have access to.

Base Command

countercraft-manage-campaign

Input
Argument Name Description Required
campaign_id Campaign ID Required
operation Operation Required
Context Output
Path Type Description
CounterCraft.Campaign.Message string Result message
CounterCraft.Campaign.ID number Campaign ID
Command Example

!countercraft-manage-campaign campaign_id=5 operation=activate

Human Readable Output
   
Id 5
Message Campaign is currently in state: PAUSED. Action activate discarded

13. countercraft-manage-host

Manage a deception host

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to manage only the hosts you have access to.

Base Command

countercraft-manage-host

Input
Argument Name Description Required
host_id Host ID Required
operation Operation Required
Context Output
Path Type Description
CounterCraft.Host.Message string Result message
CounterCraft.Host.ID number Host ID
Command Example

!countercraft-manage-campaign host_id=5 operation=activate

Human Readable Output
   
Id 5
Message Host is currently in state: PAUSED. Action activate discarded

14. countercraft-manage-service

Manage a deception service

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to manage only the services you have access to.

Base Command

countercraft-manage-service

Input
Argument Name Description Required
service_id Service ID Required
operation Operation Required
Context Output
Path Type Description
CounterCraft.Service.Message string Result message
CounterCraft.Service.ID number Service ID
Command Example

!countercraft-manage-campaign service_id=5 operation=activate

Human Readable Output
   
Id 5
Message Service is currently in state: PAUSED. Action activate discarded

15. countercraft-manage-breadcrumb

Manage breadcrumb

Required Permissions

Any interaction will be based on your permissions on the Deception Director. Please consult
your Deception Director administrator in you have any questions.

You will be able to manage only the breadcrumbs you have access to.

Base Command

countercraft-manage-breadcrumb

Input
Argument Name Description Required
breadcrumb_id Breadcrumb ID Required
operation Operation Required
Context Output
Path Type Description
CounterCraft.Breadcrumb.Message string Result message
CounterCraft.Breadcrumb.ID number Breadcrumb ID
Command Example

!countercraft-manage-campaign breadcrumb_id=5 operation=activate

Human Readable Output
   
Id 5
Message Breadcrumb is currently in state: PAUSED. Action activate discarded

Additional Information

Please check the Deception Director user manual for more guidance on how to use and deploy campaigns.

Configuration parameters

  • server — Deception Director Domain or IP Address (required)
  • api_key — API Key for Deception Director connection (required)
  • secret_key — Secret Key for Deception Director connection (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval

Commands (15)

  • countercraft-create-campaign

    Create a new deception campaign.

  • countercraft-create-host-machine

    Deploy a new deception host.

  • countercraft-get-events

    Get full list of Events.

  • countercraft-get-object

    Get information about an object (IoC).

  • countercraft-list-breadcrumbs

    List breadcrumbs in a campaign.

  • countercraft-list-campaigns

    List all deception campaigns.

  • countercraft-list-dsns

    List Deception Support Nodes (DSNs).

  • countercraft-list-hosts

    Lists all deception hosts.

  • countercraft-list-incidents

    List all incidents currently active.

  • countercraft-list-providers

    List providers (providers for hosts or services i.e. AWS or Office365).

  • countercraft-list-services

    List services currently deployed on deception hosts.

  • countercraft-manage-breadcrumb

    Manage breadcrumb.

  • countercraft-manage-campaign

    Manage Campaign parameters.

  • countercraft-manage-host

    Manage a deception host.

  • countercraft-manage-service

    Manage a deception service.

Source

CounterCraft.py CounterCraft_test.py CounterCraft.yml CounterCraft_description.md
Download History Raw 
## Prerequisites
---

To configure an instance of Deception Director, you need to obtain the following information.

* Server URL
* API Key
* Secret Key

## Get your API Key and Secret Key
1. In Deception Director, go to user settings.
2. Either copy or generate a new API Key and Secret Key.
3. Make note of both keys so you can enter them as parameter values when configuring the integration instance.