Threat Hunting - Generic

This playbook enables threat hunting for IOCs in your enterprise. It currently supports the following integrations: - Splunk - Qradar - Pan-os - Cortex Data Lake - Autofocus - Microsoft 365 Defender

Pack

CommonPlaybooks

Tasks

6

Inputs

• MD5 — The MD5 hash file or an array of hashes to search.
• SHA256 — The SHA256 hash file or an array of hashes to search.
• SHA1 — The SHA1 hash file or an array of hashes to search.
• IPAddress — The source or destination IP address to search. Can be a single address or an array of list of addresses.
• URLDomain — Domain or URL to search. Can be a single domain or URL or an array of domains or URLs to search. By default, the LIKE clause is used.
• InternalRange — A comma-separated list of internal IP ranges to check IP addresses against. The list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).
• InternalDomainName — The organization's internal domain name. This is provided for the script IsInternalHostName that checks if the detected hostnames are internal or external, if the hosts contain the internal domains suffix. For example, paloaltonetworks.com. If there is more than one domain, use the | character to separate values such as (paloaltonetworks.com|test.com).
• InternalHostRegex — Provided for the script IsInternalHostName that checks if the detected host names are internal or external, if the hosts match the organization's naming convention. For example, the host testpc1 will have the following regex \w{6}\d{1}
• QRadarTimeFrame — The time frame to search in QRadar.
• SplunkEarliestTime — The earliest time to search in Splunk.
• SplunkLatestTime — The latest time to search in Splunk.
• MessageID — This input will be used in the "Microsoft 365 Defender - Get Email URL clicks" playbook. MessageID of the email from which the URL was clicked. Please note that this can be either of the following 2 values: - The value of the header "Message-ID". - The internal ID of the message within Microsoft's products (e.g. NetworkMessageId). Can be a single MessageID or an array of MessageIDs to search.

Outputs

• Splunk.DetectedUsers — Users detected based on the username field in your search.
• Splunk.DetectedInternalIPs — Internal IP addresses detected by your search.
• Splunk.DetectedExternalIPs — External IP addresses detected by your search.
• Splunk.DetectedInternalHosts — Internal hostnames detected based on the fields in your search.
• Splunk.DetectedExternalHosts — External hostnames detected based on the fields in your search.
• PANWHunting.DetectedUsers — User or array of users that were detected during hunting.
• PANWHunting.DetectedInternalIPs — Internal IP addresses detected based on fields and inputs in your search.
• PANWHunting.DetectedExternalIPs — External IP addresses detected based on fields and inputs in your search.
• PANWHunting.DetectedInternalHosts — Internal hostnames detected based on fields and inputs in your search.
• PANWHunting.DetectedExternalHosts — External hostnames detected based on fields and inputs in your search.
• QRadar.DetectedUsers — Users detected based on the username field in your search.
• QRadar.DetectedInternalIPs — Internal IP addresses detected based on fields and inputs in your search.
• QRadar.DetectedExternalIPs — External IP addresses detected based on fields and inputs in your search.
• QRadar.DetectedInternalHosts — Internal host names detected based on hosts in your assets table. Note that the data accuracy depends on how the asset mapping is configured in QRadar.
• QRadar.DetectedExternalHosts — External host names detected based on hosts in your assets table. Note that the data accuracy depends on how the asset mapping is configured in QRadar.
• Microsoft365Defender.RetrievedEmails — Email objects containing relevant fields.
• Microsoft365Defender.RetrievedEmails.InternetMessageId — Internet Message ID of the email.
• Microsoft365Defender.RetrievedEmails.SenderFromDomain — Sender domain.
• Microsoft365Defender.RetrievedEmails.EmailDirection — Email direction (inbound/outbound).
• Microsoft365Defender.RetrievedEmails.DeliveryLocation — Delivery location.
• Microsoft365Defender.RetrievedEmails.AuthenticationDetails — Authentication details (SPF, DKIM, DMARC, CompAuth).
• Microsoft365Defender.RetrievedEmails.DeliveryAction — Email subject.
• Microsoft365Defender.RetrievedEmails.AttachmentCount — Number of attachments.
• Microsoft365Defender.RetrievedEmails.ThreatNames — Threat names.
• Microsoft365Defender.RetrievedEmails.RecipientEmailAddress — Recipient email address.
• Microsoft365Defender.RetrievedEmails.EmailAction — Email action.
• Microsoft365Defender.RetrievedEmails.EmailLanguage — Email language.
• Microsoft365Defender.RetrievedEmails.SenderFromAddress — Sender address.
• Microsoft365Defender.RetrievedEmails.Timestamp — Timestamp.
• Microsoft365Defender.RetrievedEmails.SenderDisplayName — Sender display name.
• Microsoft365Defender.RetrievedEmails.SenderIPv4 — Sender IPv4.
• Microsoft365Defender.RetrievedEmails.ConfidenceLevel — Threat types.
• Microsoft365Defender.RetrievedEmails.SHA256 — SHA256 of the attachments (if exist in the email).
• Microsoft365Defender.RetrievedEmails.Url — URLs found in the email's body.
• Microsoft365Defender.RetrievedEmails.UrlCount — Number of URLs found in the email's body.
• Microsoft365Defender.RetrievedEmails.SenderIPv6 — Sender IPv6.
• Microsoft365Defender.RetrievedEmails.AccountUpn — User principal name (UPN) of the account.
• Microsoft365Defender.RetrievedEmails.IsClickedThrough — Indicates whether the user was able to click through to the original URL or not.
• Microsoft365Defender.RetrievedEmails.BulkComplaintLevel — Threshold assigned to email from bulk mailers, a high bulk complain level (BCL) means the email is more likely to generate complaints, and thus more likely to be spam.
• Microsoft365Defender.RetrievedEmails.IPAddress — IP address assigned to the device during communication.
• Microsoft365Defender.RetrievedEmails.DetectionMethods — Methods used to detect whether the URL contains or leads to malware, phishing, or other threats.
• Microsoft365Defender.RetrievedEmails.ActionType — Type of activity that triggered the event.
• Microsoft365Defender.RetrievedEmails.UrlChain — List of URLs in the redirection chain.
• Microsoft365Defender.RetrievedEmails.NetworkMessageId — Unique identifier for the email, generated by Office 365.
• Microsoft365Defender.RetrievedEmails.DisplayName — Name of the sender displayed in the address book, typically a combination of a given or first name, a middle initial, and a last name or surname.
• Microsoft365Defender.RetrievedEmails.SenderMailFromDomain — Sender domain in the MAIL FROM header, also known as the envelope sender or the Return-Path address.
• Microsoft365Defender.RetrievedEmails.SenderMailFromAddress — Sender email address in the MAIL FROM header, also known as the envelope sender or the Return-Path address.
• Microsoft365Defender.RetrievedEmails.Subject — Subject of the email.
• Microsoft365Defender.RetrievedEmails.ThreatTypes — Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats.