CVE-2022-3786 & CVE-2022-3602 - OpenSSL X.509 Buffer Overflows

On November 1, OpenSSL released a [security advisory](https://www.openssl.org/news/secadv/20221101.txt) describing two high severity vulnerabilities within the OpenSSL library, CVE-2022-3786 and CVE-2022-3602. OpenSSL versions from 3.0.0 - 3.0.6 are vulnerable, with 3.0.7 containing the patch for both vulnerabilities. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue. The vulnerability described in CVE-2022-3602 allows an attacker to obtain a 4-byte overflow on the stack by crafting a malicious email address within the attacker-controlled certificate. The overflow will result in a crash (most likely scenario) or potentially remote code execution (much less likely). In CVE-2022-3786, an attacker can achieve a stack overflow of arbitrary length by crafting a malicious email address within the attacker-controlled certificate. Both vulnerabilities are “triggered through X.509 certificate verification, specifically, name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer.” **The playbook includes the following tasks:** * Hunting for active processes running OpenSSL vulnerable versions using: * Cortex XDR * Splunk * Azure Sentinel * Cortex Xpanse * Prisma * PANOS **Mitigations:** * OpenSSL official patch More information: [Unit42 Threat Brief: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows](https://unit42.paloaltonetworks.com/openssl-vulnerabilities/) [NCSC-NL - OpenSSL overview Scanning software](https://github.com/NCSC-NL/OpenSSL-2022/tree/main/scanning) Note: This is a beta playbook that lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.

CVE-2022-3786 & CVE-2022-3602 - OpenSSL X.509 Buffer Overflows · 49 tasks · 8 inputs · 0 outputs

Details

ID	`CVE-2022-3786 & CVE-2022-3602 - OpenSSL X.509 Buffer Overflows`
From Version	6.5.0
Tasks	49

README

On November 1, OpenSSL released a security advisory describing two high severity vulnerabilities within the OpenSSL library, CVE-2022-3786 and CVE-2022-3602. OpenSSL versions from 3.0.0 - 3.0.6 are vulnerable, with 3.0.7 containing the patch for both vulnerabilities. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.

The vulnerability described in CVE-2022-3602 allows an attacker to obtain a 4-byte overflow on the stack by crafting a malicious email address within the attacker-controlled certificate. The overflow will result in a crash (most likely scenario) or potentially remote code execution (much less likely). In CVE-2022-3786, an attacker can achieve a stack overflow of arbitrary length by crafting a malicious email address within the attacker-controlled certificate.

Both vulnerabilities are “triggered through X.509 certificate verification, specifically, name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer.”

The playbook includes the following tasks:

Hunting for active processes running OpenSSL vulnerable versions using:
- Cortex XDR
- Splunk
- Azure Sentinel
Cortex Xpanse
Prisma
PANOS

Mitigations:

OpenSSL official patch

More information:
Unit42 Threat Brief: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows
NCSC-NL - OpenSSL overview Scanning software

Note: This is a beta playbook that lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Rapid Breach Response - Set Incident Info
Panorama Query Logs

Integrations

This playbook does not use any integrations.

Scripts

HttpV2
IsIntegrationAvailable

Commands

xdr-get-endpoints
closeInvestigation
associateIndicatorsToIncident
xdr-script-commands-execute
splunk-search
redlock-get-rql-response
createNewIndicator
azure-log-analytics-execute-query
expanse-get-issues
prisma-cloud-config-search

Playbook Inputs

Name	Description	Default Value	Required
HuntLinuxOS	Whether to search for relevant OpenSSL 3.x processes on Linux endpoints.	False	Optional
HuntWindowsOS	Whether to search for relevant OpenSSL 3.x processes on Windows endpoints.	False	Optional
HuntMacOS	Whether to search for relevant OpenSSL 3.x processes on Mac endpoints.	False	Optional
SplunkIndex	Splunk index to search. Note that the input value should include the field name as well. e.g. “index=*”	index=* OR index=_*	Optional
SplunkEarliestTime	Splunk earliest time to search.	-1d@d	Optional
SplunkLatestTime	Splunk latest time to search.	now	Optional
PlaybookDescription	The playbook’s description.	On November 1, OpenSSL released a security advisory describing two high severity vulnerabilities within the OpenSSL library, CVE-2022-3786 and CVE-2022-3602. OpenSSL versions from 3.0.0 - 3.0.6 are vulnerable, with 3.0.7 containing the patch for both vulnerabilities. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue. The vulnerability described in CVE-2022-3602 allows an attacker to obtain a 4-byte overflow on the stack by crafting a malicious email address within the attacker-controlled certificate. The overflow will result in a crash (most likely scenario) or potentially remote code execution (much less likely). In CVE-2022-3786, an attacker can achieve a stack overflow of arbitrary length by crafting a malicious email address within the attacker-controlled certificate. Both vulnerabilities are “triggered through X.509 certificate verification, specifically, name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer.” The playbook includes the following tasks: * Hunting for active processes running OpenSSL vulnerable versions using: * Cortex XDR * Splunk * Azure Sentinel * Cortex Xpanse * Prisma * PANOS Mitigations: * OpenSSL official patch More information: Unit42 Threat Brief: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows NCSC-NL - OpenSSL overview Scanning software Note: This is a beta playbook that lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.	Optional
RelatedCVEs	CVE indicators.	CVE-2022-3786,CVE-2022-3602	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

CVE-2022-3786 & CVE-2022-3602 - OpenSSL X.509 Buffer Overflows

Inputs

HuntLinuxOS — Whether to search for relevant OpenSSL 3.x processes on Linux endpoints.
HuntWindowsOS — Whether to search for relevant OpenSSL 3.x processes on Windows endpoints.
HuntMacOS — Whether to search for relevant OpenSSL 3.x processes on Mac endpoints.
SplunkIndex — Splunk index to search. Note that the input value should include the field name as well. e.g. "index=*"
SplunkEarliestTime — Splunk earliest time to search.
SplunkLatestTime — Splunk latest time to search.
PlaybookDescription — The playbook's description.
RelatedCVEs — CVE indicators.

Commands used

associateIndicatorsToIncident azure-log-analytics-execute-query closeInvestigation createNewIndicator expanse-get-issues prisma-cloud-config-search redlock-get-rql-response splunk-search xdr-get-endpoints xdr-script-commands-execute

Flowchart

Source

playbook-CVE-2022-3786_&_CVE-2022-3602_-_OpenSSL_X.509_Buffer_Overflows.yml

Download History Raw

id: CVE-2022-3786 & CVE-2022-3602 - OpenSSL X.509 Buffer Overflows
version: -1
name: CVE-2022-3786 & CVE-2022-3602 - OpenSSL X.509 Buffer Overflows
description: "On November 1, OpenSSL released a [security advisory](https://www.openssl.org/news/secadv/20221101.txt) describing two high severity vulnerabilities within the OpenSSL library, CVE-2022-3786 and CVE-2022-3602. OpenSSL versions from 3.0.0 - 3.0.6 are vulnerable, with 3.0.7 containing the patch for both vulnerabilities. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.\n\nThe vulnerability described in CVE-2022-3602 allows an attacker to obtain a 4-byte overflow on the stack by crafting a malicious email address within the attacker-controlled certificate. The overflow will result in a crash (most likely scenario) or potentially remote code execution (much less likely). In CVE-2022-3786, an attacker can achieve a stack overflow of arbitrary length by crafting a malicious email address within the attacker-controlled certificate.\n\nBoth vulnerabilities are “triggered through X.509 certificate verification, specifically, name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer.” \n\n**The playbook includes the following tasks:**\n* Hunting for active processes running OpenSSL vulnerable versions using:\n    * Cortex XDR\n    * Splunk\n    * Azure Sentinel\n* Cortex Xpanse\n * Prisma\n * PANOS\n\n**Mitigations:**\n* OpenSSL official patch\n\nMore information:\n[Unit42 Threat Brief: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows](https://unit42.paloaltonetworks.com/openssl-vulnerabilities/)\n[NCSC-NL - OpenSSL overview Scanning software](https://github.com/NCSC-NL/OpenSSL-2022/tree/main/scanning)\n\nNote: This is a beta playbook that lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: e3f78c2d-6116-4d7e-8173-eba4c6006b02
    type: start
    task:
      id: e3f78c2d-6116-4d7e-8173-eba4c6006b02
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -1020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 2ac17b29-b556-484d-8388-89f3fb024211
    type: title
    task:
      id: 2ac17b29-b556-484d-8388-89f3fb024211
      version: -1
      name: Tag and Link Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 472a82a2-fd54-496d-8405-813a06d9805a
    type: regular
    task:
      id: 472a82a2-fd54-496d-8405-813a06d9805a
      version: -1
      name: Tag CVE indicators
      description: commands.local.cmd.new.indicator
      script: Builtin|||createNewIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      retry-count:
        simple: "3"
      retry-interval:
        simple: "2"
      tags:
        simple: OpenSSL
      type:
        simple: CVE
      value:
        complex:
          root: inputs.RelatedCVEs
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: a453e538-b130-407a-8904-dc602f272d1a
    type: condition
    task:
      id: a453e538-b130-407a-8904-dc602f272d1a
      version: -1
      name: Check if Cortex XDR - IR is Enabled
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "25"
      "yes":
      - "21"
      - "22"
      - "23"
    scriptarguments:
      brandname:
        simple: Cortex XDR - IR
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: f1c3f5ca-b1ea-47ce-81ef-680d6e0afcdb
    type: title
    task:
      id: f1c3f5ca-b1ea-47ce-81ef-680d6e0afcdb
      version: -1
      name: Cortex XDR Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 74d1e6a9-991a-4d34-805a-6781d7636e52
    type: regular
    task:
      id: 74d1e6a9-991a-4d34-805a-6781d7636e52
      version: -1
      name: Retrieve All Windows OS Endpoint IDs
      description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set (start by counting from 0).
      script: '|||xdr-get-endpoints'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "57"
    scriptarguments:
      platform:
        simple: windows
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -30,
          "y": 665
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: e9c242b5-3f27-47e4-808b-330f5562cd0d
    type: title
    task:
      id: e9c242b5-3f27-47e4-808b-330f5562cd0d
      version: -1
      name: Linux OS
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "61"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 9a42e597-9782-4a59-8738-53b2e9bd3482
    type: title
    task:
      id: 9a42e597-9782-4a59-8738-53b2e9bd3482
      version: -1
      name: Windows OS
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -30,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: afb31071-9259-4e63-808a-337642081bd4
    type: regular
    task:
      id: afb31071-9259-4e63-808a-337642081bd4
      version: -1
      name: Retrieve All Mac OS Endpoint IDs
      description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set (start by counting from 0).
      script: '|||xdr-get-endpoints'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "59"
    scriptarguments:
      platform:
        simple: macos
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 665
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: ef894089-d9ec-4c31-858c-26ee7e5162fa
    type: title
    task:
      id: ef894089-d9ec-4c31-858c-26ee7e5162fa
      version: -1
      name: MacOS
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: e124b740-fdd8-4db3-8dbb-c0e7db9f9e74
    type: condition
    task:
      id: e124b740-fdd8-4db3-8dbb-c0e7db9f9e74
      version: -1
      name: Should hunt for Windows endpoints?
      description: Whether to search for relevant OpenSSL 3.x processes on Windows endpoints.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "17"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.HuntWindowsOS
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -30,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: a6987fce-307c-489e-8222-5ed2a3222f41
    type: condition
    task:
      id: a6987fce-307c-489e-8222-5ed2a3222f41
      version: -1
      name: Should hunt for Linux endpoints?
      description: Whether to search for relevant OpenSSL 3.x processes on Linux endpoints.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "16"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.HuntLinuxOS
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: cf410c15-5593-4596-8a2f-f4b040df21c3
    type: condition
    task:
      id: cf410c15-5593-4596-8a2f-f4b040df21c3
      version: -1
      name: Should hunt for Mac endpoints?
      description: Whether to search for relevant OpenSSL 3.x processes on MacOS endpoints.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "20"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.HuntMacOS
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 3e50fb4d-e5dd-476a-888d-3aea4a078c2a
    type: regular
    task:
      id: 3e50fb4d-e5dd-476a-888d-3aea4a078c2a
      version: -1
      name: Link Indicators To Incident
      description: commands.local.cmd.associate.indicators
      script: Builtin|||associateIndicatorsToIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "41"
    scriptarguments:
      incidentId:
        complex:
          root: incident
          accessor: id
      indicatorsValues:
        complex:
          root: inputs.RelatedCVEs
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: acf06403-8ff1-4189-89cb-a7eb53cdcfed
    type: title
    task:
      id: acf06403-8ff1-4189-89cb-a7eb53cdcfed
      version: -1
      name: SIEM Advanced Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "30"
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 460,
          "y": 1140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 64d3aad5-3150-41cd-86d2-832eeceeaad4
    type: condition
    task:
      id: 64d3aad5-3150-41cd-86d2-832eeceeaad4
      version: -1
      name: Is Azure Log Analytics Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "32"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Azure Log Analytics
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 210,
          "y": 1400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: a61362d1-1119-4e9d-8032-d60b65693c99
    type: regular
    task:
      id: a61362d1-1119-4e9d-8032-d60b65693c99
      version: -1
      name: Hunt for active processes running OpenSSL 3.x
      description: |-
        Detects patterns in process executions caused by China Chopper-like tiny (ASPX) webshells.

        **Author:** Florian Roth (rule), MSTI (query)

        **Status:** experimental

        **References:**
            - https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/
      tags:
      - SIEMResults
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      earliest_time:
        complex:
          root: inputs.SplunkEarliestTime
      latest_time:
        complex:
          root: inputs.SplunkLatestTime
      query:
        simple: |-
          ${inputs.SplunkIndex} TERM(openssl) OR TERM(libcrypto-3) OR TERM(libssl-3) OR term(libssl) NOT TERM(tls1.2) NOT sourcetype IN (splunkd_ui_access, audittrail, splunkd_remote_searches)
          | rex field=_raw "(OpenSSL\/|libssl\.so\.|openssl\.so\.|openssl-|openssl-libs-)(?<SSLversion>[0-6]{1}\.[0-9]{1}\.[0-9]{1}[a-z]{1}|[0-6]{1})"
          | where isnotnull(SSLversion)
          | stats values(SSLversion) AS SSLVersions by host, sourcetype
          | sort -SSLVersions
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 700,
          "y": 1620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 5dc63bd8-98f0-4680-84aa-764e8145056c
    type: condition
    task:
      id: 5dc63bd8-98f0-4680-84aa-764e8145056c
      version: -1
      name: Is Splunk Enabled?
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "34"
      "Yes":
      - "28"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Splunkpy
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 700,
          "y": 1400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: acfa296e-0878-475b-8174-c9e1c4858d52
    type: title
    task:
      id: acfa296e-0878-475b-8174-c9e1c4858d52
      version: -1
      name: Azure Sentinel
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "26"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 210,
          "y": 1280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 8851049d-fa0c-45a7-8ccf-9b3e0494287d
    type: title
    task:
      id: 8851049d-fa0c-45a7-8ccf-9b3e0494287d
      version: -1
      name: Splunk
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "29"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 700,
          "y": 1280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 46675c82-014c-4480-81e9-9891b86bcf9e
    type: regular
    task:
      id: 46675c82-014c-4480-81e9-9891b86bcf9e
      version: -1
      name: Hunt for active processes running OpenSSL 3.x
      description: |-
        Detects suspicious file types dropped by an Exchange component in IIS into a suspicious folder.

        **Author:** Florian Roth (rule), MSTI (query, idea)

        **Status:** experimental

        **References:**
           - https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/
           - https://www.gteltsc.vn/blog/canh-bao-chien-dich-tan-cong-su-dung-lo-hong-zero-day-tren-microsoft-exchange-server-12714.html
           - https://en.gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html
      tags:
      - SIEMResults
      script: '|||azure-log-analytics-execute-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      query:
        simple: |-
          DeviceTvmSoftwareInventory
          | where SoftwareName contains "openssl"
          | where SoftwareName contains "3.0" or SoftwareVersion contains "3.0"
          | project DeviceName, SoftwareName, SoftwareVersion
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 210,
          "y": 1620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 53f89d1c-3f30-446f-884d-585fe00484d3
    type: regular
    task:
      id: 53f89d1c-3f30-446f-884d-585fe00484d3
      version: -1
      name: Install OpenSSL 3.0.7
      description: |-
        For **CVE-2022-3602** and **CVE-2022-3786**, please patch with the following versions:

        [openssl-3.0.7.tar.gz](https://github.com/openssl/openssl/archive/refs/tags/openssl-3.0.7.tar.gz)
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "39"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: 93a024d4-83f3-4e24-8f10-208db5ad203c
    type: title
    task:
      id: 93a024d4-83f3-4e24-8f10-208db5ad203c
      version: -1
      name: Mitigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "40"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 9054397d-eaba-4aa8-8415-e239334571a2
    type: condition
    task:
      id: 9054397d-eaba-4aa8-8415-e239334571a2
      version: -1
      name: Analysis resolution - Should continue with the investigation?
      description: Check with the analyst whether to continue with the investigation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "38"
      "Yes":
      - "37"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Do you need to continue with the investigation?
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: false
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 5714d06c-4708-44c6-8758-d4a9269f8011
    type: title
    task:
      id: 5714d06c-4708-44c6-8758-d4a9269f8011
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: fe32ecf5-59cd-47cd-803b-9b665b9c6927
    type: regular
    task:
      id: fe32ecf5-59cd-47cd-803b-9b665b9c6927
      version: -1
      name: Investigate Further
      description: Update to OpenSSL 3.0.7 as soon as possible. OpenSSL also recommends that organizations operating TLS servers may consider disabling TLS client Authentication, if it is being used, until patches are applied.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "36"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 0,
          "y": 2580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: c1b87637-ddd0-4b36-83b0-811ea4e68537
    type: regular
    task:
      id: c1b87637-ddd0-4b36-83b0-811ea4e68537
      version: -1
      name: Close Investigation
      description: Close the current incident
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "36"
    scriptarguments:
      closeReason:
        simple: No further actions are required.
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: b232418e-ed5e-449c-8b37-168dd186bfb2
    type: title
    task:
      id: b232418e-ed5e-449c-8b37-168dd186bfb2
      version: -1
      name: Resolution
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: 647e0734-b1e6-441f-825b-9c2f31207272
    type: regular
    task:
      id: 647e0734-b1e6-441f-825b-9c2f31207272
      version: -1
      name: Download OpenSSL 3.0.7
      description: Sends a HTTP request with advanced capabilities
      scriptName: HttpV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "33"
    scriptarguments:
      method:
        simple: GET
      url:
        simple: https://github.com/openssl/openssl/archive/refs/tags/openssl-3.0.7.tar.gz
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 9976660f-17ab-46da-8f74-de894a5ed737
    type: title
    task:
      id: 9976660f-17ab-46da-8f74-de894a5ed737
      version: -1
      name: Handle Rapid Breach Response Layout
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "42"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: 95f29e44-a37c-4130-8db6-d6523446e4ed
    type: playbook
    task:
      id: 95f29e44-a37c-4130-8db6-d6523446e4ed
      version: -1
      name: Rapid Breach Response - Set Incident Info
      description: This playbook is responsible for setting up the Rapid Breach Response Incident Info tab in the layout.
      playbookName: Rapid Breach Response - Set Incident Info
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "53"
    scriptarguments:
      playbookDescription:
        complex:
          root: inputs.PlaybookDescription
    separatecontext: true
    continueonerrortype: ""
    loop:
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 450,
          "y": -300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: 4aa7f7c2-287d-45ed-8f64-9f97db64f25a
    type: title
    task:
      id: 4aa7f7c2-287d-45ed-8f64-9f97db64f25a
      version: -1
      name: Cortex Xpanse
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "44"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -850,
          "y": 30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: 4fa44409-a2d6-4f63-8b04-77b54df43034
    type: condition
    task:
      id: 4fa44409-a2d6-4f63-8b04-77b54df43034
      version: -1
      name: Is Xpanse enabled?
      description: Checks if Xpanse instance is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "45"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Xpanse
                    ignorecase: true
                accessor: state
            iscontext: true
          right:
            value:
              simple: active
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -850,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: e4440f6f-160d-4313-8115-2ac414859182
    type: regular
    task:
      id: e4440f6f-160d-4313-8115-2ac414859182
      version: -1
      name: Search for possible vulnerable servers using Xpanse
      description: Retrieve issues
      script: '|||expanse-get-issues'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "51"
    scriptarguments:
      issue_type:
        simple: Insecure OpenSSL
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1060,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: 3f6d5e94-843c-4971-8a17-25f22a8e86a7
    type: regular
    task:
      id: 3f6d5e94-843c-4971-8a17-25f22a8e86a7
      version: -1
      name: 'Review possible vulnerable servers '
      description: "Expander shows systems that are exposed to the public internet, without the need to install agents or sensors of any kind. Some of the systems below do not advertise version information, or are otherwise restricted from doing so depending on the configuration of our customers’ networks. Expander attempts to retrieve or derive version information, but this is not possible in all cases. \n\nXpanse issue IDs:\n${Expanse.Issue.id}"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1260,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "47":
    id: "47"
    taskid: 9bb37d08-979a-4fde-8071-3d9abffd7f6f
    type: title
    task:
      id: 9bb37d08-979a-4fde-8071-3d9abffd7f6f
      version: -1
      name: Prisma Cloud
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "48"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2270,
          "y": 30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: d96ae9f5-6593-4b0c-8158-2c92bf918e98
    type: condition
    task:
      id: d96ae9f5-6593-4b0c-8158-2c92bf918e98
      version: -1
      name: Is Prisma Cloud enabled?
      description: Checks if Prisma Cloud instance is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "49"
      - "62"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: RedLock
                    ignorecase: true
                accessor: state
            iscontext: true
          right:
            value:
              simple: active
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: PrismaCloud v2
                accessor: state
            iscontext: true
          right:
            value:
              simple: active
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2270,
          "y": 180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "49":
    id: "49"
    taskid: f4b97f3a-a5d5-42c7-84d5-d854b2cd71c1
    type: regular
    task:
      id: f4b97f3a-a5d5-42c7-84d5-d854b2cd71c1
      version: -1
      name: Search for possible vulnerable servers using Prisma Cloud
      description: Runs an RQL query on the Prisma Cloud.
      script: '|||redlock-get-rql-response'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "52"
    scriptarguments:
      limit:
        simple: "10"
      rql:
        simple: config from cloud.resource where finding.type = 'Host Vulnerability' AND protection.finding.name = 'CVE-2022-3602, CVE-2022-3786'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2480,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: 6e288b9b-e87a-44f6-895c-6fd398038c59
    type: regular
    task:
      id: 6e288b9b-e87a-44f6-895c-6fd398038c59
      version: -1
      name: 'Review possible vulnerable servers '
      description: "In this case users can utilize the Prisma platform's capabilities to isolate assets with vulnerabilities and also prioritize it further by looking for internet exposed assets receiving traffic. \n\nKnow the hosts in your cloud that has the specific vulnerability CVE-2021-44228:\n${Redlock.RQL.Response.Data.NetworkInterfaces.PrivateIpAddress}"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2670,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "51":
    id: "51"
    taskid: ccaa4cf2-0c5e-4b3d-8afd-b0f91270024b
    type: condition
    task:
      id: ccaa4cf2-0c5e-4b3d-8afd-b0f91270024b
      version: -1
      name: Found servers using Xpanse?
      description: Checks if Xpanse found possible vulnerable server
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "46"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: Expanse.Issue
                accessor: id
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1060,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "52":
    id: "52"
    taskid: aeb2129b-544b-4660-8b63-a551b3f9e5b5
    type: condition
    task:
      id: aeb2129b-544b-4660-8b63-a551b3f9e5b5
      version: -1
      name: Found servers using Prisma Cloud?
      description: Checks if Prisma Clooud found vulnerable server
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "50"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: Redlock.RQL.Response.Data.NetworkInterfaces
                accessor: PrivateIpAddress
            iscontext: true
          right:
            value: {}
        - operator: isExists
          left:
            value:
              complex:
                root: PrismaCloud.Config.data.networkInterfaces.privateIpAddress
            iscontext: true
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2480,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "53":
    id: "53"
    taskid: cd3e4a69-285b-49b8-8186-0b940f7b0cda
    type: title
    task:
      id: cd3e4a69-285b-49b8-8186-0b940f7b0cda
      version: -1
      name: Identify Potentially Vulnerable Hosts
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "13"
      - "43"
      - "47"
      - "55"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "55":
    id: "55"
    taskid: 4bab9e81-a472-48f9-8955-8f10868e401f
    type: title
    task:
      id: 4bab9e81-a472-48f9-8955-8f10868e401f
      version: -1
      name: PANOS
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "56"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1730,
          "y": 30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "56":
    id: "56"
    taskid: b8c49003-0e3b-4f30-87b7-6839eeb0cad9
    type: playbook
    task:
      id: b8c49003-0e3b-4f30-87b7-6839eeb0cad9
      version: -1
      name: Panorama Query Logs
      description: 'Query Panorama Logs of types: traffic, threat, url, data-filtering and wildfire.'
      playbookName: Panorama Query Logs
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      log_type:
        simple: threat
      query:
        simple: (threatid eq 93212)
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1730,
          "y": 180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "57":
    id: "57"
    taskid: 2035c065-e89a-41e6-88eb-6c2e452e2544
    type: regular
    task:
      id: 2035c065-e89a-41e6-88eb-6c2e452e2544
      version: -1
      name: XDR Execute Command
      description: Initiates a new endpoint script execution of shell commands.
      script: '|||xdr-script-commands-execute'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      commands:
        simple: Get-ChildItem -Recurse -File -ErrorAction SilentlyContinue -Path "C:\" -Filter "libssl*"
      endpoint_ids:
        complex:
          root: PaloAltoNetworksXDR.Endpoint
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Endpoint.endpoint_status
                iscontext: true
              right:
                value:
                  simple: CONNECTED
              ignorecase: true
          - - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Endpoint.os_type
                iscontext: true
              right:
                value:
                  simple: AGENT_OS_WINDOWS
              ignorecase: true
          accessor: endpoint_id
      timeout_in_seconds:
        simple: "300"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -30,
          "y": 830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "59":
    id: "59"
    taskid: cf97fa10-1e30-4790-8d45-686248f7b99b
    type: regular
    task:
      id: cf97fa10-1e30-4790-8d45-686248f7b99b
      version: -1
      name: XDR Execute Command
      description: Initiates a new endpoint script execution of shell commands.
      script: '|||xdr-script-commands-execute'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      commands:
        simple: 'sudo lsof -n | grep libssl.so.3 '
      endpoint_ids:
        complex:
          root: PaloAltoNetworksXDR.Endpoint
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Endpoint.endpoint_status
                iscontext: true
              right:
                value:
                  simple: CONNECTED
              ignorecase: true
          - - operator: containsGeneral
              left:
                value:
                  simple: PaloAltoNetworksXDR.Endpoint.os_type
                iscontext: true
              right:
                value:
                  simple: Mac
              ignorecase: true
          accessor: endpoint_id
      timeout_in_seconds:
        simple: "300"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "60":
    id: "60"
    taskid: 61020c4e-ad28-4912-8d70-80e2e91c110d
    type: regular
    task:
      id: 61020c4e-ad28-4912-8d70-80e2e91c110d
      version: -1
      name: XDR Execute Command
      description: Initiates a new endpoint script execution of shell commands.
      script: '|||xdr-script-commands-execute'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      commands:
        simple: 'sudo lsof -n | grep libssl.so.3 '
      endpoint_ids:
        complex:
          root: PaloAltoNetworksXDR.Endpoint
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Endpoint.endpoint_status
                iscontext: true
              right:
                value:
                  simple: CONNECTED
              ignorecase: true
          - - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Endpoint.os_type
                iscontext: true
              right:
                value:
                  simple: AGNET_OS_LINUX
              ignorecase: true
          accessor: endpoint_id
      timeout_in_seconds:
        simple: "300"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "61":
    id: "61"
    taskid: 87d90f28-586c-44bf-81fa-3ae4187ee0d2
    type: regular
    task:
      id: 87d90f28-586c-44bf-81fa-3ae4187ee0d2
      version: -1
      name: Retrieve All Linux OS Endpoint IDs
      description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set (start by counting from 0).
      script: '|||xdr-get-endpoints'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "60"
    scriptarguments:
      platform:
        simple: linux
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 665
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "62":
    id: "62"
    taskid: 195850eb-6cc9-488d-8f8c-c42313b04c6a
    type: regular
    task:
      id: 195850eb-6cc9-488d-8f8c-c42313b04c6a
      version: -1
      name: Search for Prisma Cloud Vulnerable Servers
      description: Search configuration inventory on the Prisma Cloud platform using RQL language. Use this command for all queries that start with "config". When no absolute time nor relative time arguments are provided, the default time range is all times.
      script: '|||prisma-cloud-config-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "52"
    scriptarguments:
      query:
        simple: config from cloud.resource where finding.type = 'Host Vulnerability' AND protection.finding.name = 'CVE-2021-44228'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2910,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "21_17_yes": 0.41,
      "21_25_#default#": 0.21,
      "22_16_yes": 0.46,
      "22_25_#default#": 0.22,
      "23_20_yes": 0.41,
      "23_25_#default#": 0.21,
      "26_32_yes": 0.4,
      "26_34_#default#": 0.56,
      "29_28_Yes": 0.4,
      "29_34_#default#": 0.55,
      "35_37_Yes": 0.62,
      "35_38_No": 0.39,
      "44_25_#default#": 0.15,
      "48_25_#default#": 0.11,
      "48_49_yes": 0.57,
      "52_25_#default#": 0.1,
      "8_21_yes": 0.65,
      "8_22_yes": 0.46,
      "8_23_yes": 0.64,
      "8_25_no": 0.29
    },
    "paper": {
      "dimensions": {
        "height": 3835,
        "width": 4550,
        "x": -1260,
        "y": -1020
      }
    }
  }
inputs:
- key: HuntLinuxOS
  value:
    simple: "False"
  required: false
  description: Whether to search for relevant OpenSSL 3.x processes on Linux endpoints.
  playbookInputQuery:
- key: HuntWindowsOS
  value:
    simple: "False"
  required: false
  description: Whether to search for relevant OpenSSL 3.x processes on Windows endpoints.
  playbookInputQuery:
- key: HuntMacOS
  value:
    simple: "False"
  required: false
  description: Whether to search for relevant OpenSSL 3.x processes on Mac endpoints.
  playbookInputQuery:
- key: SplunkIndex
  value:
    simple: index=* OR index=_*
  required: false
  description: |-
    Splunk index to search.
    Note that the input value should include the field name as well. e.g. "index=*"
  playbookInputQuery:
- key: SplunkEarliestTime
  value:
    simple: -1d@d
  required: false
  description: Splunk earliest time to search.
  playbookInputQuery:
- key: SplunkLatestTime
  value:
    simple: now
  required: false
  description: Splunk latest time to search.
  playbookInputQuery:
- key: PlaybookDescription
  value:
    simple: "On November 1, OpenSSL released a [security advisory](https://www.openssl.org/news/secadv/20221101.txt) describing two high severity vulnerabilities within the OpenSSL library, CVE-2022-3786 and CVE-2022-3602. OpenSSL versions from 3.0.0 - 3.0.6 are vulnerable, with 3.0.7 containing the patch for both vulnerabilities. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.\n\nThe vulnerability described in CVE-2022-3602 allows an attacker to obtain a 4-byte overflow on the stack by crafting a malicious email address within the attacker-controlled certificate. The overflow will result in a crash (most likely scenario) or potentially remote code execution (much less likely). In CVE-2022-3786, an attacker can achieve a stack overflow of arbitrary length by crafting a malicious email address within the attacker-controlled certificate.\n\nBoth vulnerabilities are “triggered through X.509 certificate verification, specifically, name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer.” \n\n**The playbook includes the following tasks:**\n* Hunting for active processes running OpenSSL vulnerable versions using:\n    * Cortex XDR\n    * Splunk\n    * Azure Sentinel\n * Cortex Xpanse\n * Prisma\n * PANOS\n\n**Mitigations:**\n* OpenSSL official patch\n\nMore information:\n[Unit42 Threat Brief: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows](https://unit42.paloaltonetworks.com/openssl-vulnerabilities/)\n[NCSC-NL - OpenSSL overview Scanning software](https://github.com/NCSC-NL/OpenSSL-2022/tree/main/scanning)\n\nNote: This is a beta playbook that lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve."
  required: false
  description: The playbook's description.
  playbookInputQuery:
- key: RelatedCVEs
  value:
    simple: CVE-2022-3786,CVE-2022-3602
  required: false
  description: CVE indicators.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0