Brute Force Investigation - Generic - SANS

This playbook investigates a "Brute Force" incident by gathering user and IP information, and calculating the incident severity based on the gathered information and information received from the user. It then performs remediation. This is done based on the phases for handling an incident as they are described in the SANS Institute ‘Incident Handler’s Handbook’ by Patrick Kral. https://www.sans.org/reading-room/whitepapers/incident/incident-handlers-handbook-33901 The playbook handles the following use-cases: * Brute Force IP Detected - A detection of source IPs that are exceeding a high threshold of rejected and/or invalid logins. * Brute Force Increase Percentage - A detection of large increase percentages in various brute force statistics over different periods of time. * Brute Force Potentially Compromised Accounts - A detection of accounts that have shown high amount of failed logins with one successful login. Used Sub-playbooks: - IP Enrichment - Generic v2 - Account Enrichment - Generic v2.1 - Calculate Severity - Critical Assets v2 - Isolate Endpoint - Generic v2 - Block Indicators - Generic v3 - SANS - Lessons Learned ***Disclaimer: This playbook does not ensure compliance to SANS regulations.

SANS · 54 tasks · 21 inputs · 0 outputs

Inputs

  • username — Username of the user who is suspected of the activity.
  • traps_endpoint_id — Traps endpoint ID, used for endpoint isolation.
  • logins_count_threshold — The threshold for number of logins, from which the investigation and remediation will start automatically without waiting for the user's reply. Default is 10.
  • severity_threshold — The threshold for the severity value from which an automatic remediation takes place. Specify the severity number (default is Critical): 0 - Unknown 0.5 - Informational 1 - Low 2 - Medium 3 - High 4 - Critical
  • internal_range — A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).
  • critical_users — Critical users, separated by comma.
  • critical_endpoints — Critical endpoints, separated by comma.
  • critical_groups — Critical groups, separated by comma.
  • CustomBlockRule — This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used. Specify True to use Custom Block Rules.
  • AutoCommit — This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. Specify the Static Address Group name for IP handling.
  • DAG — This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Specify the Dynamic Address Group tag name for IP handling.
  • StaticAddressGroup — This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. Specify the Static Address Group name for IP handling.
  • CustomURLCategory — Custom URL Category name.
  • type — Custom URL category type. Insert "URL List"/ "Category Match".
  • device-group — Device group for the Custom URL Category (Panorama instances).
  • categories — The list of categories. Relevant from PAN-OS v9.x.
  • EDLServerIP — This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used: * The IP address of the web server on which the files are stored. * The web server IP address is configured in the integration instance.
  • UserVerification — Possible values: True/False. Whether to provide user verification for blocking IPs. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.
  • AutoBlockIndicators — Possible values: True/False. Default: True. Should the given indicators be automatically blocked, or should the user be given the option to choose? If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block.
  • Email — Email address to which to send the questions.
  • DataCollection — Use a data collection task to answer lessons learned questions based on SANS. Specify 'True' to automatically send the communication task, and 'False' to prevent it.

Commands used

ad-disable-account ad-enable-account ad-expire-password closeInvestigation send-mail setIncident

Flowchart

yes yes yes No Yes yes no yes yes yes no yes yes no yes yes yes start_task start_task Ask user to confirm login attempts Ask user to confirm login... Should the password be reset? Should the password be re... Active Directory - Expire Password - ad-expire-password Active Directory - Expire... ad-expire-password Notify User about password reset - send-mail Notify User about passwor... send-mail Close Investigation - closeInvestigation Close Investigation closeInvestigation Set incident severity to low - setIncident Set incident severity to low setIncident Account Enrichment - Generic v2.1 - Account Enrichment - Generic v2.1 Account Enrichment - Gene... Account Enrichment - Generic ... Enrich Indicators Enrich Indicators IP Enrichment - Generic v2 - IP Enrichment - Generic v2 IP Enrichment - Generic v2 IP Enrichment - Generic v2 Manual - Asses the scope of the impact Manual - Asses the scope ... User confirmed the account activity? User confirmed the accoun... Lessons Learned Lessons Learned Containment Containment Active Directory - expire password - ad-expire-password Active Directory - expire... ad-expire-password Active Directory - disable account - ad-disable-account Active Directory - disabl... ad-disable-account Isolate Endpoint - Generic V2 - Isolate Endpoint - Generic V2 Isolate Endpoint - Generi... Isolate Endpoint - Generic V2 Perform manual investigation for malicious artifacts Perform manual investigat... Eradication Eradication Were IOCs found in the investigation? Were IOCs found in the in... Recovery Recovery Would you like to perform auto-recovery? Would you like to perform... Active Directory - enable account - ad-enable-account Active Directory - enable... ad-enable-account Manual - unisolate affected systems Manual - unisolate affect... Done Done Remediation Remediation Investigation Investigation Auto remediation? Auto remediation? Manual remediation Manual remediation Was there a successful login? Was there a successful lo... Set incident severity - setIncident Set incident severity setIncident Manual - close investigation in the source product Manual - close investigat... Calculate Severity - Critical Assets v2 - Calculate Severity - Critical Assets v2 Calculate Severity - Crit... Calculate Severity - Critical... Communicate with user? Communicate with user? False Positive False Positive Raise incident severity - setIncident Raise incident severity setIncident Was there a successful login? Was there a successful lo... Manual - was there a successful login? Manual - was there a succ... Set Incident - setIncident Set Incident setIncident Can incident severity be raised? Can incident severity be ... Identification Identification Set SANS stage to Identification - setIncident Set SANS stage to Identif... setIncident Set SANS stage to Containment - setIncident Set SANS stage to Contain... setIncident Generate investigation summary report - GenerateInvestigationSummaryReport Generate investigation su... GenerateInvestigationSummaryR... Manual - system backup Manual - system backup Set SANS stage to Eradication - setIncident Set SANS stage to Eradica... setIncident Set SANS stage to Recovery - setIncident Set SANS stage to Recovery setIncident Generate investigation summary report - GenerateInvestigationSummaryReport Generate investigation su... GenerateInvestigationSummaryR... Set SANS stage to Lessons Learned - setIncident Set SANS stage to Lessons... setIncident SANS - Lessons Learned - SANS - Lessons Learned SANS - Lessons Learned SANS - Lessons Learned Block IOCs? Block IOCs? Is Active Directory enabled? Is Active Directory enabled? Is Active Directory enabled? Is Active Directory enabled? Block Indicators - Generic v3 - Block Indicators - Generic v3 Block Indicators - Generi... Block Indicators - Generic v3