SpyCloud - Malware Incident Enrichment

SpyCloud Malware Playbook executes the spycloud-compass-device-data command when any incident of the SpyCloud Malware Data type is created, and sets the corresponding incident field.

Pack

SpyCloudEnterpriseProtection

Tasks

7

Inputs

• Infected Machine Id

Outputs

• SpyCloud.CompassDeviceData.username — Username.
• SpyCloud.CompassDeviceData.password — Account password.
• SpyCloud.CompassDeviceData.password_plaintext — The cracked, plaintext version of the password (where the password is crackable).
• SpyCloud.CompassDeviceData.password_type — Password type for original password as found in the data breach. This will either be plaintext or one of the many password hash/encryption types (SHA1, MD5, 3DES, etc).
• SpyCloud.CompassDeviceData.target_url — URL extracted from Botnet data. This is the URL that is captured from a key logger installed on an infected user's system.
• SpyCloud.CompassDeviceData.user_browser — Browser name.
• SpyCloud.CompassDeviceData.ip_addresses — List of one or more IP addresses in alphanumeric format. Both IPV4 and IPv6 addresses are supported.
• SpyCloud.CompassDeviceData.infected_machine_id — A unique identifier either extracted from an infostealer log, when present, or an RFC 4122-compliant universally unique identifier (UUID) generated by SpyCloud, when no identifier is present in an infected record. The method of generation of these identifiers varies by malware family and may or may not conform to a UUID format. For the ID's in the aforementioned UUID format, there is not currently any way to determine whether an infected_machine_id was extracted from a malware log or generated by SpyCloud.
• SpyCloud.CompassDeviceData.infected_path — The local path to the malicious software installed on the infected user's system.
• SpyCloud.CompassDeviceData.infected_time — The time at which the user's system was infected with malicious software.
• SpyCloud.CompassDeviceData.user_sys_domain — System domain. This usually comes from Botnet data.
• SpyCloud.CompassDeviceData.user_hostname — System hostname. This usually comes from Botnet data.
• SpyCloud.CompassDeviceData.user_os — System OS name. This usually comes from Botnet data.
• SpyCloud.CompassDeviceData.user_sys_registered_owner — System registered owner name. This usually comes from Botnet data.
• SpyCloud.CompassDeviceData.source_id — Numerical breach ID. This correlates directly with the id field in Breach Catalog objects.
• SpyCloud.CompassDeviceData.spycloud_publish_date — The date on which we ingested the breached data into our systems. This is the same date on which the data becomes publicly available to our customers.
• SpyCloud.CompassDeviceData.target_domain — SLD extracted from 'target_url' field.
• SpyCloud.CompassDeviceData.target_subdomain — Subdomain and SLD extracted from 'target_url' field.
• SpyCloud.CompassDeviceData.severity — Severity is a numeric code representing severity of a breach record. This can be used in API requests to ensure only Breach Records with plaintext password are returned. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 -> High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address.
• SpyCloud.CompassDeviceData.document_id — UUID v4 string which uniquely identifies this breach record in our data set.
• SpyCloud.CompassDeviceData.email — Email address.
• SpyCloud.CompassDeviceData.email_domain — Domain extracted from 'email_address' field. This is not a SLD, but everything after the '@' symbol.
• SpyCloud.CompassDeviceData.email_username — Username extracted from 'email' field. This is everything before the '@' symbol.
• SpyCloud.CompassDeviceData.domain — Domain name.

Commands used

• setIncident