CVE-2023-34362 - MOVEit Transfer SQL Injection

id: CVE-2023-34362 - MOVEit Transfer SQL Injection
version: -1
name: CVE-2023-34362 - MOVEit Transfer SQL Injection
description: "### CVE-2023-34362 - Critical SQL Injection vulnerability in MOVEit Transfer.\n\n#### Summary \n\nA critical vulnerability has been identified in MOVEit Transfer, a managed file transfer solution. The vulnerability affects versions prior to the latest release and involves improper input validation. Exploiting this vulnerability can lead to remote execution of arbitrary code, potentially resulting in unauthorized access and compromise of sensitive data.\n\nTo mitigate the risk associated with this vulnerability, it is crucial for users to update to the latest version of MOVEit Transfer that includes necessary security patches.\n\n#### Affected Products \n\n\n| Affected Version               | Fixed Version             | Documentation                       |\n|-------------------------------|---------------------------|-------------------------------------|\n| MOVEit Transfer 2023.0.0 (15.0) | MOVEit Transfer 2023.0.1 | [MOVEit 2023 Upgrade Documentation](https://docs.ipswitch.com/MOVEit/2023/Upgrade/) |\n| MOVEit Transfer 2022.1.x (14.1) | MOVEit Transfer 2022.1.5 | [MOVEit 2022 Upgrade Documentation](https://docs.ipswitch.com/MOVEit/2022/Upgrade/) |\n| MOVEit Transfer 2022.0.x (14.0) | MOVEit Transfer 2022.0.4 | [MOVEit 2022 Upgrade Documentation](https://docs.ipswitch.com/MOVEit/2022/Upgrade/) |\n| MOVEit Transfer 2021.1.x (13.1) | MOVEit Transfer 2021.1.4 | [MOVEit 2021 Upgrade Documentation](https://docs.ipswitch.com/MOVEit/2021/Upgrade/) |\n| MOVEit Transfer 2021.0.x (13.0) | MOVEit Transfer 2021.0.6 | [MOVEit 2021 Upgrade Documentation](https://docs.ipswitch.com/MOVEit/2021/Upgrade/) |\n| MOVEit Transfer 2020.1.x (12.1) | Special Patch Available   | See [KB 000234559](https://docs.ipswitch.com/MOVEit/2020/234559.htm) |\n| MOVEit Transfer 2020.0.x (12.0) or older | MUST upgrade to a supported version | See [MOVEit Transfer Upgrade and Migration Guide](https://docs.ipswitch.com/MOVEit/Transfer2021/UpgradeGuide/) |\n\n\n**This playbook should be triggered manually or can be configured as a job.** \n\nPlease create a new incident and choose the CVE-2023-34362 - MOVEit SQL Injection playbook and Rapid Breach Response incident type.\n\n**The playbook includes the following tasks:**\n\n**IoCs Collection**\n- Blog IoCs download\n- Yara Rules download\n- Sigma rules download\n\n**Hunting:**\n- Cortex XDR XQL exploitation patterns hunting\n- Cortex Xpanse external facing instances hunting\n- Advanced SIEM exploitation patterns hunting\n- Indicators hunting\n\nThe hunting queries are searching for the following activities:\n  - ASPX file creation by w3wp.exe\n  - IIS compiling binaries via the csc.exe on behalf of the MOVEit\n  - Detects get requests to specific exploitation related files\n\n**Mitigations:**\n- Progress official CVE-2023-34362 patch\n- Progress mitigation measures\n- Detection Rules\n    - Yara\n    - Sigma\n\n\n**References:**\n\n[CVE-2023-34362: MOVEit Transfer SQL Injection Vulnerability Threat Brief](https://unit42.paloaltonetworks.com/threat-brief-moveit-cve-2023-34362/)\n\n[MOVEit Transfer Critical Vulnerability (May 2023)](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023)\n\nNote: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: bf12d27c-1ac2-4fe1-896a-41199b347044
    type: start
    task:
      id: bf12d27c-1ac2-4fe1-896a-41199b347044
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
      - "54"
      - "50"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -330,
          "y": 130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: fa42cf99-3a7c-4eaa-8d7d-f45912174f93
    type: title
    task:
      id: fa42cf99-3a7c-4eaa-8d7d-f45912174f93
      version: -1
      name: Collect Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "20"
      - "55"
      - "90"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 750,
          "y": 290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 2363610e-9e02-46e1-80d6-9cde602f68eb
    type: title
    task:
      id: 2363610e-9e02-46e1-80d6-9cde602f68eb
      version: -1
      name: Tag Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
      - "22"
      - "56"
      - "57"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -330,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 6be9c21a-6f77-48fd-87a5-3da4a748ece0
    type: regular
    task:
      id: 6be9c21a-6f77-48fd-87a5-3da4a748ece0
      version: -1
      name: Tag CVE Indicators
      description: Create indicators to the Threat Intel database only if they are not registered. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.
      scriptName: CreateNewIndicatorsOnly
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      indicator_values:
        complex:
          root: CVE
          accessor: ID
      tags:
        simple: MOVEit, SQL injection, CVE-2023-34362
      type:
        simple: CVE
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -560,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 9acb4dad-e9a7-41b3-8c39-e0624c5c67a4
    type: title
    task:
      id: 9acb4dad-e9a7-41b3-8c39-e0624c5c67a4
      version: -1
      name: Threat Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
      - "48"
      - "80"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -330,
          "y": 1210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 597cbcec-ab40-4557-8c3a-20c27804b0cd
    type: title
    task:
      id: 597cbcec-ab40-4557-8c3a-20c27804b0cd
      version: -1
      name: SIEM Advanced Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
      - "9"
      - "14"
      - "13"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -330,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 43ee6cdf-703e-4952-8f57-4f6fdd2c321f
    type: condition
    task:
      id: 43ee6cdf-703e-4952-8f57-4f6fdd2c321f
      version: -1
      name: Is Splunk Enabled?
      description: Check if Splunk instance is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "40"
      "Yes":
      - "17"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: SplunkPy
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -110,
          "y": 1550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 0ccf2492-c288-4a31-8307-e689064bd2c1
    type: condition
    task:
      id: 0ccf2492-c288-4a31-8307-e689064bd2c1
      version: -1
      name: Is QRadar Enabled?
      description: Check if Splunk instance is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "40"
      "Yes":
      - "23"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: QRadar_v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -550,
          "y": 1550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: db12e671-7c53-449e-8731-441eace92937
    type: title
    task:
      id: db12e671-7c53-449e-8731-441eace92937
      version: -1
      name: Set Rapid Breach Response Layout
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -330,
          "y": 920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: be39dc74-8a11-48ae-8713-1f225e75269e
    type: playbook
    task:
      id: be39dc74-8a11-48ae-8713-1f225e75269e
      version: -1
      name: Rapid Breach Response - Set Incident Info
      description: This playbook is responsible for setting up the Rapid Breach Response Incident Info tab in the layout.
      playbookName: Rapid Breach Response - Set Incident Info
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      SourceOfIndicators:
        complex:
          root: http.parsedBlog
          accessor: sourceLink
      countTotalIndicators:
        complex:
          root: CVE
          accessor: ID
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: File.SHA256
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: Domain.Name
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: IP.Address
                iscontext: true
          - operator: uniq
          - operator: count
      playbookDescription:
        complex:
          root: inputs.PlaybookDescription
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -330,
          "y": 1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: fb680adc-7457-4c78-83f2-f0d65c58257b
    type: condition
    task:
      id: fb680adc-7457-4c78-83f2-f0d65c58257b
      version: -1
      name: Is Elasticsearch Enabled?
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "40"
      "Yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Elasticsearch
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 330,
          "y": 1550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 3552fc8b-26e9-4524-82ba-47bb2a709a2a
    type: condition
    task:
      id: 3552fc8b-26e9-4524-82ba-47bb2a709a2a
      version: -1
      name: Is Azure Log Analytics Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "40"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Azure Log Analytics
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -990,
          "y": 1550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: f771f522-4e22-4783-8717-9437c05364fb
    type: regular
    task:
      id: f771f522-4e22-4783-8717-9437c05364fb
      version: -1
      name: ASPX file creation by w3wp.exe
      description: Detects ASPX file creation by the w3wp.exe process.
      tags:
      - SIEMResults
      script: '|||azure-log-analytics-execute-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "62"
    scriptarguments:
      query:
        simple: Sysmon | where (Image endswith @'\w3wp.exe' and TargetFilename contains @'.aspx')
      timespan:
        complex:
          root: inputs.LogAnalyticsTimespan
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -990,
          "y": 1730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 4a466f49-4947-4b71-8a0b-12f52a597d06
    type: regular
    task:
      id: 4a466f49-4947-4b71-8a0b-12f52a597d06
      version: -1
      name: ASPX file creation by w3wp.exe
      description: Detects ASPX file creation by the w3wp.exe process.
      tags:
      - SIEMResults
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "63"
    scriptarguments:
      earliest_time:
        complex:
          root: inputs.SplunkEarliestTime
      query:
        simple: index=* ((Image="*\\w3wp.exe") AND (TargetFilename="*.aspx*"))
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -110,
          "y": 1730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 17a8638a-6d96-4627-8411-311bac5285e2
    type: regular
    task:
      id: 17a8638a-6d96-4627-8411-311bac5285e2
      version: -1
      name: ASPX file creation by w3wp.exe
      description: Detects ASPX file creation by the w3wp.exe process.
      tags:
      - SIEMResults
      script: '|||es-eql-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "64"
    scriptarguments:
      index:
        complex:
          root: inputs.ElasticIndex
      query:
        simple: (process.executable.text:"*\\w3wp.exe" AND file.path.text:"*.aspx*")
      timestamp_field:
        complex:
          root: inputs.ElasticEarliestTime
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 330,
          "y": 1730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 06b72db6-e3b8-4cd2-8eb2-0febbed6971e
    type: regular
    task:
      id: 06b72db6-e3b8-4cd2-8eb2-0febbed6971e
      version: -1
      name: Collect IoCs from Huntress
      description: This script will extract indicators from given HTML and will handle bad top-level domains to avoid false positives caused by file extensions.
      scriptName: ParseHTMLIndicators
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      url:
        simple: https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 330,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 521f06be-e2d7-41bc-8f07-276fa1464308
    type: regular
    task:
      id: 521f06be-e2d7-41bc-8f07-276fa1464308
      version: -1
      name: Tag IP Indicators
      description: Create indicators to the Threat Intel database only if they are not registered. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.
      scriptName: CreateNewIndicatorsOnly
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      indicator_values:
        complex:
          root: IP
          accessor: Address
      tags:
        simple: Outlook, 0-day, Microsoft
      type:
        simple: IP
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -990,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 9d3492f4-1d99-444a-8ed1-d8eac62cb083
    type: playbook
    task:
      id: 9d3492f4-1d99-444a-8ed1-d8eac62cb083
      version: -1
      name: ASPX file creation by w3wp.exe
      description: This playbook runs a QRadar query and return its results to the context.
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "65"
    scriptarguments:
      interval:
        simple: "1"
      query_expression:
        simple: SELECT UTF8(payload) FROM events WHERE LOGSOURCENAME(logsourceid) ILIKE '%sysmon%' AND "Image" ILIKE '%\w3wp.exe' AND "Filename" ILIKE '%.aspx%'
      range:
        complex:
          root: inputs.QRadarTimeRange
      timeout:
        simple: "600"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": -550,
          "y": 1730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: a42e7e2e-00e5-4eef-8105-bfdab412d4e2
    type: condition
    task:
      id: a42e7e2e-00e5-4eef-8105-bfdab412d4e2
      version: -1
      name: Should continue with the investigation?
      description: Whether to continue with the investigation or close it.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "39"
      "Yes":
      - "38"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -330,
          "y": 3440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 61a214b6-9c1b-4834-8f27-87cb8c193829
    type: condition
    task:
      id: 61a214b6-9c1b-4834-8f27-87cb8c193829
      version: -1
      name: Should block indicators automatically?
      description: Checks whether to block the indicators automatically.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "37"
      "yes":
      - "36"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.autoBlockIndicators
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -330,
          "y": 2640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: bcabdbb3-48b4-43bd-82b0-73c15b457d9e
    type: playbook
    task:
      id: bcabdbb3-48b4-43bd-82b0-73c15b457d9e
      version: -1
      name: Block Indicators - Generic v3
      description: |+
        This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks:

        - Block URL - Generic v2
        - Block Account - Generic v2
        - Block IP - Generic v3
        - Block File - Generic v2
        - Block Email - Generic
        - Block Domain - Generic

      playbookName: Block Indicators - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "42"
    scriptarguments:
      AutoBlockIndicators:
        simple: "True"
      AutoCommit:
        simple: "No"
      CustomBlockRule:
        simple: "True"
      CustomURLCategory:
        simple: XSOAR Remediation - Malicious URLs
      DomainToBlock:
        complex:
          root: Domain
          accessor: Name
          transformers:
          - operator: uniq
      FilesToBlock:
        complex:
          root: File
          accessor: SHA256
          transformers:
          - operator: uniq
      IP:
        complex:
          root: IP
          accessor: Address
          transformers:
          - operator: uniq
      InputEnrichment:
        simple: "False"
      MD5:
        complex:
          root: DBotScore
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: DBotScore.Indicator
                iscontext: true
              right:
                value:
                  simple: "32"
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: file
            - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: hash
          accessor: Indicator
          transformers:
          - operator: uniq
      RuleDirection:
        simple: outbound
      RuleName:
        simple: XSOAR - Block Indicators playbook - ${incident.id}
      SHA256:
        complex:
          root: File
          accessor: SHA256
          transformers:
          - operator: uniq
      URL:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: url
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      UserVerification:
        simple: "True"
      Username:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: username
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -110,
          "y": 2810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 0345f447-729c-47a3-8e08-5a341df18e89
    type: regular
    task:
      id: 0345f447-729c-47a3-8e08-5a341df18e89
      version: -1
      name: Handle indicators manually
      description: Manual task for indicators handling.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "42"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -550,
          "y": 2810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: 8ac741ea-62b7-4a00-883d-67cfc88c2ab1
    type: regular
    task:
      id: 8ac741ea-62b7-4a00-883d-67cfc88c2ab1
      version: -1
      name: Investigate further
      description: Continue with the investigation manually.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "39"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 110,
          "y": 3610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 9a7ff786-dd6a-4a84-82c8-f2de1652322c
    type: title
    task:
      id: 9a7ff786-dd6a-4a84-82c8-f2de1652322c
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -330,
          "y": 3780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: 84d23e2d-faf3-4672-816c-9f02d2697f4d
    type: title
    task:
      id: 84d23e2d-faf3-4672-816c-9f02d2697f4d
      version: -1
      name: Remediation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -330,
          "y": 2510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: 0a54ed67-5618-4e6f-8fa3-5d0086aac136
    type: title
    task:
      id: 0a54ed67-5618-4e6f-8fa3-5d0086aac136
      version: -1
      name: Mitigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "47"
      - "43"
      - "44"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -330,
          "y": 2990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: 88957532-3350-4dc1-8361-eca8f35b5b72
    type: regular
    task:
      id: 88957532-3350-4dc1-8361-eca8f35b5b72
      version: -1
      name: Progress mitigation measures
      description: |
        Recommended Remediation

        To help prevent successful exploitation of the mentioned SQLi vulnerability to your MOVEit Transfer environment, we strongly recommend that you immediately apply the following mitigation measures per the steps below.

        1. Disable all HTTP and HTTPs traffic to your MOVEit Transfer environment
           - More specifically, modify firewall rules to deny HTTP and HTTPs traffic to MOVEit Transfer on ports 80 and 443 until the patch can be applied.

           It is important to note, that until HTTP and HTTPS traffic is enabled again:
           - Users will not be able to log on to the MOVEit Transfer web UI
           - MOVEit Automation tasks that use the native MOVEit Transfer host will not work
           - REST, Java, and .NET APIs will not work
           - MOVEit Transfer add-in for Outlook will not work

           Please note: SFTP and FTP/s protocols will continue to work as normal

           Administrators will still be able to access MOVEit Transfer by using a remote desktop to access the Windows machine and then accessing https://localhost/. For more information on localhost connections, please refer to MOVEit Transfer Help.

        2. Review, Delete and Reset
           - Delete Unauthorized Files and User Accounts
             - Delete any instances of the human2.aspx and .cmdline script files.
             - On the MOVEit Transfer server, look for any new files created in the C:\MOVEitTransfer\wwwroot\ directory.
             - On the MOVEit Transfer server, look for new files created in the C:\Windows\TEMP\[random]\ directory with a file extension of [.]cmdline
             - Remove any unauthorized user accounts. See Progress MOVEit Users Documentation article.
             - Review logs for unexpected downloads of files from unknown IPs or large numbers of files downloaded. For more information on reviewing logs, please refer to MOVEit Transfer Logs guide.
             - Review IIS logs for any events including GET /human2.aspx. Large numbers of log entries or entries with large data sizes may indicate unexpected file downloads
             - If applicable, review Azure logs for unauthorized access to Azure Blob Storage Keys and consider rotating any potentially affected keys.

           - Reset Credentials
             - Reset service account credentials for affected systems and MOVEit Service Account. See KB 000115941.

        4. Enable all HTTP and HTTPs traffic to your MOVEit Transfer environment

        5. Verification
           - To confirm the files have been successfully deleted and no unauthorized accounts remain, follow steps 2A again. If you do find indicators of compromise, you should reset the service account credentials again.

        6. Continuous Monitoring
           - Monitor network, endpoints, and logs for IoCs (Indicators of Compromise) as listed in the table below.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "49"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -330,
          "y": 3140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: 20ffb6c2-720c-488f-8513-6482cfc216b3
    type: regular
    task:
      id: 20ffb6c2-720c-488f-8513-6482cfc216b3
      version: -1
      name: Patch vulnerable servers
      description: |
        | Affected Version               | Fixed Version             | Documentation                       |
        |-------------------------------|---------------------------|-------------------------------------|
        | MOVEit Transfer 2023.0.0 (15.0) | MOVEit Transfer 2023.0.1 | [MOVEit 2023 Upgrade Documentation](https://docs.ipswitch.com/MOVEit/2023/Upgrade/) |
        | MOVEit Transfer 2022.1.x (14.1) | MOVEit Transfer 2022.1.5 | [MOVEit 2022 Upgrade Documentation](https://docs.ipswitch.com/MOVEit/2022/Upgrade/) |
        | MOVEit Transfer 2022.0.x (14.0) | MOVEit Transfer 2022.0.4 |                                     |
        | MOVEit Transfer 2021.1.x (13.1) | MOVEit Transfer 2021.1.4 | [MOVEit 2021 Upgrade Documentation](https://docs.ipswitch.com/MOVEit/2021/Upgrade/) |
        | MOVEit Transfer 2021.0.x (13.0) | MOVEit Transfer 2021.0.6 |                                     |
        | MOVEit Transfer 2020.1.x (12.1) | Special Patch Available   | See [KB 000234559](https://docs.ipswitch.com/MOVEit/2020/234559.htm) |
        | MOVEit Transfer 2020.0.x (12.0) or older | MUST upgrade to a supported version | See [MOVEit Transfer Upgrade and Migration Guide](https://docs.ipswitch.com/MOVEit/Transfer2021/UpgradeGuide/) |
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "49"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 110,
          "y": 3140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "47":
    id: "47"
    taskid: 31e9d355-3dc6-42e7-8ff7-1ae06614ca26
    type: regular
    task:
      id: 31e9d355-3dc6-42e7-8ff7-1ae06614ca26
      version: -1
      name: Deploy Yara and Sigma rules
      description: |
        The Yara rules file is ready to be used in the incident War Room, you can also find it by filtering for '**Yara**' tag.

        File name: expl_outlook_cve_2023_23397.yar
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "49"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -770,
          "y": 3140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: bc7b492b-80ec-4cf3-860a-e62ef35c9272
    type: title
    task:
      id: bc7b492b-80ec-4cf3-860a-e62ef35c9272
      version: -1
      name: Indicators Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "79"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1710,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "49":
    id: "49"
    taskid: 96a79660-ea58-47be-8fe3-b2faf1cffcf6
    type: title
    task:
      id: 96a79660-ea58-47be-8fe3-b2faf1cffcf6
      version: -1
      name: Resolution
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -330,
          "y": 3310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: 278bb014-3667-4c5b-8379-ab5b0b93e8c9
    type: title
    task:
      id: 278bb014-3667-4c5b-8379-ab5b0b93e8c9
      version: -1
      name: Download Sigma Rules
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "52"
      - "76"
      - "77"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1390,
          "y": 290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "51":
    id: "51"
    taskid: 0c2eb88a-cbbf-4aa7-827f-3f4f6f9567e9
    type: regular
    task:
      id: 0c2eb88a-cbbf-4aa7-827f-3f4f6f9567e9
      version: -1
      name: Download Huntress Yara rules
      description: |-
        This file contains a Yara rule provided by Huntress.

        Reference: [MOVEit Transfer Critical Vulnerability CVE-2023-34362 Rapid Response](https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response)
      tags:
      - Yara
      scriptName: HttpV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      filename:
        simple: human2_MOVEit.yar
      method:
        simple: GET
      save_as_file:
        simple: "yes"
      unsecure:
        simple: "True"
      url:
        simple: https://raw.githubusercontent.com/huntresslabs/threat-intel/main/2023/2023-06/1-MOVEit/yara/human2_MOVEit.yar
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -120,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "52":
    id: "52"
    taskid: 835f353f-d4cd-448f-83b3-e9b0dd975259
    type: regular
    task:
      id: 835f353f-d4cd-448f-83b3-e9b0dd975259
      version: -1
      name: MOVEit exploitation
      description: |-
        This file contains a Sigma rule provided by [Kostas](https://twitter.com/Kostastsale/status/1664410827804524544).

        Reference: [MOVEit_exploitation.yml](https://github.com/tsale/Sigma_rules/blob/main/Threat%20Hunting%20Queries/MOVEit_exploitation.yml)
      tags:
      - Sigma
      scriptName: HttpV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      filename:
        simple: MOVEit_exploitation.yml
      method:
        simple: GET
      save_as_file:
        simple: "yes"
      unsecure:
        simple: "True"
      url:
        simple: https://raw.githubusercontent.com/tsale/Sigma_rules/main/Threat%20Hunting%20Queries/MOVEit_exploitation.yml
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -970,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "54":
    id: "54"
    taskid: d4d907a8-97f2-42ad-8631-97e4d0dd9e0c
    type: title
    task:
      id: d4d907a8-97f2-42ad-8631-97e4d0dd9e0c
      version: -1
      name: Download Yara Rules
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "51"
      - "78"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -330,
          "y": 290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "55":
    id: "55"
    taskid: 1fb4964e-edb8-4b52-8a0e-5e47e245f2dd
    type: regular
    task:
      id: 1fb4964e-edb8-4b52-8a0e-5e47e245f2dd
      version: -1
      name: Collect IoCs from Progress
      description: commands.local.cmd.extract.indicators
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      text:
        simple: |-
          5.252.23.116    IPv4    01-Jun-2023
          5.252.25.88 IPv4    01-Jun-2023
          84.234.96.104   IPv4    01-Jun-2023
          89.39.105.108   IPv4    01-Jun-2023
          138.197.152.201 IPv4    01-Jun-2023
          148.113.152.144 IPv4    01-Jun-2023
          198.12.76.214   IPv4    01-Jun-2023
          198.27.75.110   IPv4    03-Jun-2023
          209.97.137.33   IPv4    01-Jun-2023
          209.222.103.170 IPv4    01-Jun-2023
          Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/105.0.5195.102+Safari/537.36    User Agent  02-Jun-2023
          dojustit[.]mooo[.]com   Domain  02-Jun-2023
          0b3220b11698b1436d1d866ac07cc90018e59884e91a8cb71ef8924309f1e0e9    SHA256 Hash 01-Jun-2023
          110e301d3b5019177728010202c8096824829c0b11bb0dc0bff55547ead18286    SHA256 Hash 01-Jun-2023
          1826268249e1ea58275328102a5a8d158d36b4fd312009e4a2526f0bfbc30de2    SHA256 Hash 01-Jun-2023
          2ccf7e42afd3f6bf845865c74b2e01e2046e541bb633d037b05bd1cdb296fa59    SHA256 Hash 01-Jun-2023
          58ccfb603cdc4d305fddd52b84ad3f58ff554f1af4d7ef164007cb8438976166    SHA256 Hash 01-Jun-2023
          98a30c7251cf622bd4abce92ab527c3f233b817a57519c2dd2bf8e3d3ccb7db8    SHA256 Hash 01-Jun-2023
          a8f6c1ccba662a908ef7b0cb3cc59c2d1c9e2cbbe1866937da81c4c616e68986    SHA256 Hash 01-Jun-2023
          b5ef11d04604c9145e4fe1bedaeb52f2c2345703d52115a5bf11ea56d7fb6b03    SHA256 Hash 01-Jun-2023
          cec425b3383890b63f5022054c396f6d510fae436041add935cd6ce42033f621    SHA256 Hash 01-Jun-2023
          ed0c3e75b7ac2587a5892ca951707b4e0dd9c8b18aaf8590c24720d73aa6b90c    SHA256 Hash 01-Jun-2023
          0b3220b11698b1436d1d866ac07cc90018e59884e91a8cb71ef8924309f1e0e9    SHA256 Hash 01-Jun-2023
          110e301d3b5019177728010202c8096824829c0b11bb0dc0bff55547ead18286    SHA256 Hash 01-Jun-2023
          1826268249e1ea58275328102a5a8d158d36b4fd312009e4a2526f0bfbc30de2    SHA256 Hash 01-Jun-2023
          2ccf7e42afd3f6bf845865c74b2e01e2046e541bb633d037b05bd1cdb296fa59    SHA256 Hash 01-Jun-2023
          58ccfb603cdc4d305fddd52b84ad3f58ff554f1af4d7ef164007cb8438976166    SHA256 Hash 01-Jun-2023
          98a30c7251cf622bd4abce92ab527c3f233b817a57519c2dd2bf8e3d3ccb7db8    SHA256 Hash 01-Jun-2023
          a8f6c1ccba662a908ef7b0cb3cc59c2d1c9e2cbbe1866937da81c4c616e68986    SHA256 Hash 01-Jun-2023
          b5ef11d04604c9145e4fe1bedaeb52f2c2345703d52115a5bf11ea56d7fb6b03    SHA256 Hash 01-Jun-2023
          cec425b3383890b63f5022054c396f6d510fae436041add935cd6ce42033f621    SHA256 Hash 01-Jun-2023
          ed0c3e75b7ac2587a5892ca951707b4e0dd9c8b18aaf8590c24720d73aa6b90c    SHA256 Hash 01-Jun-2023
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1170,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "56":
    id: "56"
    taskid: 69893722-9e32-43fe-8aec-8c2fca977aff
    type: regular
    task:
      id: 69893722-9e32-43fe-8aec-8c2fca977aff
      version: -1
      name: Tag Domain Indicators
      description: Create indicators to the Threat Intel database only if they are not registered. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.
      scriptName: CreateNewIndicatorsOnly
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      indicator_values:
        complex:
          root: Domain
          accessor: Name
      tags:
        simple: MOVEit, SQL injection, CVE-2023-34362
      type:
        simple: Domain
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -100,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "57":
    id: "57"
    taskid: 23352a71-0c5d-4df1-8912-4bff93bd3a44
    type: regular
    task:
      id: 23352a71-0c5d-4df1-8912-4bff93bd3a44
      version: -1
      name: Tag File Indicators
      description: Create indicators to the Threat Intel database only if they are not registered. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.
      scriptName: CreateNewIndicatorsOnly
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      indicator_values:
        complex:
          root: File
          accessor: SHA256
      tags:
        simple: MOVEit, SQL injection, CVE-2023-34362
      type:
        simple: File
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 330,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "59":
    id: "59"
    taskid: 19d4e670-46a1-4906-8064-7b4a76286905
    type: title
    task:
      id: 19d4e670-46a1-4906-8064-7b4a76286905
      version: -1
      name: Cortex XDR - XQL Hunting Queries
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "60"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 940,
          "y": 1510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "60":
    id: "60"
    taskid: 03e43224-79a9-4112-8273-b1f6a580c0f9
    type: condition
    task:
      id: 03e43224-79a9-4112-8273-b1f6a580c0f9
      version: -1
      name: Is Cortex XDR - XQL Enabled?
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "40"
      "Yes":
      - "61"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Cortex XDR - XQL Query Engine
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 940,
          "y": 1650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "61":
    id: "61"
    taskid: c20d408e-3d6e-47ba-898a-f64487e2d8bd
    type: regular
    task:
      id: c20d408e-3d6e-47ba-898a-f64487e2d8bd
      version: -1
      name: ASPX file creation by w3wp moveitdmz pool
      description: |-
        Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised.
        When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file,
        unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "74"
    scriptarguments:
      query:
        simple: "dataset = xdr_data | filter event_type = 3 \nand event_sub_type in (1,3,6)\nand lowercase(action_file_extension) in (\"aspx\")\nand (causality_actor_process_image_name = \"w3wp.exe\" or actor_process_image_name =\"w3wp.exe\")\nand (lowercase(actor_process_command_line) contains \"%moveitdmz%\" OR lowercase(causality_actor_process_command_line) contains \"%moveitdmz%\")\nand lowercase(action_file_path) contains \"%.aspx%\""
      query_name:
        simple: aspx file creation by w3wp moveitdmz
      time_frame:
        complex:
          root: inputs.XQLTimeRange
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1120,
          "y": 1820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "62":
    id: "62"
    taskid: bfb17fd1-b1a7-4012-8078-548852e1540e
    type: regular
    task:
      id: bfb17fd1-b1a7-4012-8078-548852e1540e
      version: -1
      name: IIS compiling binaries via the csc.exe on behalf of the MOVEit
      description: |-
        Detects events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, based on the following Sigma rule:

        [MOVEit exploitation](https://github.com/tsale/Sigma_rules/blob/main/Threat%20Hunting%20Queries/MOVEit_exploitation.yml)
      tags:
      - SIEMResults
      script: '|||azure-log-analytics-execute-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "66"
    scriptarguments:
      query:
        simple: SecurityEvent | where EventID == 1 | where (NewProcessName endswith @'\csc.exe' and ParentProcessName endswith @'\w3wp.exe' and ParentCommandLine contains @'moveitdmz pool')
      timespan:
        complex:
          root: inputs.LogAnalyticsTimespan
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -990,
          "y": 1900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "63":
    id: "63"
    taskid: 53d66f2e-ca70-4d02-8faa-b7cd7714a979
    type: regular
    task:
      id: 53d66f2e-ca70-4d02-8faa-b7cd7714a979
      version: -1
      name: IIS compiling binaries via the csc.exe on behalf of the MOVEit
      description: |-
        Detects events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, based on the following Sigma rule:

        [MOVEit exploitation](https://github.com/tsale/Sigma_rules/blob/main/Threat%20Hunting%20Queries/MOVEit_exploitation.yml)
      tags:
      - SIEMResults
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "67"
    scriptarguments:
      earliest_time:
        complex:
          root: inputs.SplunkEarliestTime
      query:
        simple: index=* source="WinEventLog:*" AND ((Image="*\\csc.exe") AND (ParentImage="*\\w3wp.exe") AND (ParentCommandLine="*moveitdmz pool*"))
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -110,
          "y": 1900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "64":
    id: "64"
    taskid: edb89eae-0866-4d22-85bd-6da433a7e76a
    type: regular
    task:
      id: edb89eae-0866-4d22-85bd-6da433a7e76a
      version: -1
      name: IIS compiling binaries via the csc.exe on behalf of the MOVEit
      description: |-
        Detects events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, based on the following Sigma rule:

        [MOVEit exploitation](https://github.com/tsale/Sigma_rules/blob/main/Threat%20Hunting%20Queries/MOVEit_exploitation.yml)
      tags:
      - SIEMResults
      script: '|||es-eql-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "68"
    scriptarguments:
      index:
        complex:
          root: inputs.ElasticIndex
      query:
        simple: (process.executable.text:"*\\csc.exe" AND process.parent.executable.text:"*\\w3wp.exe" AND process.parent.command_line.text:"*moveitdmz\ pool*")
      timestamp_range_start:
        complex:
          root: inputs.ElasticEarliestTime
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 330,
          "y": 1900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "65":
    id: "65"
    taskid: 066878ba-eeb6-4c0a-8ada-8dde93b1447b
    type: playbook
    task:
      id: 066878ba-eeb6-4c0a-8ada-8dde93b1447b
      version: -1
      name: IIS compiling binaries via the csc.exe on behalf of the MOVEit
      description: This playbook runs a QRadar query and return its results to the context.
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "69"
    scriptarguments:
      interval:
        simple: "1"
      query_expression:
        simple: SELECT UTF8(payload) FROM events WHERE LOGSOURCETYPENAME(devicetype)='Microsoft Windows Security Event Log' AND CATEGORYNAME(category)='Process Creation Success' AND "Image" ILIKE '%\csc.exe' AND "ParentImage" ILIKE '%\w3wp.exe' AND "ParentCommandLine" ILIKE '%moveitdmz pool%'
      range:
        complex:
          root: inputs.QRadarTimeRange
      timeout:
        simple: "600"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": -550,
          "y": 1900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "66":
    id: "66"
    taskid: 1f85bb36-2c8a-4abd-86ba-3c458d56b960
    type: regular
    task:
      id: 1f85bb36-2c8a-4abd-86ba-3c458d56b960
      version: -1
      name: 'Detects get requests to specific exploitation related files '
      description: |-
        Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362, based on the following Sigma rule:

        [MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request](https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/web_cve_2023_34362_known_payload_request.yml.yml)
      tags:
      - SIEMResults
      script: '|||azure-log-analytics-execute-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      query:
        simple: ApacheHTTPServer | where (HttpRequestMethod =~ @'GET' and cs_uri_stem in~ (@'/human2.aspx', @'/_human2.aspx'))
      timespan:
        complex:
          root: inputs.LogAnalyticsTimespan
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -990,
          "y": 2070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "67":
    id: "67"
    taskid: dc6a2a15-9776-4622-8099-a6fedf4f7dc5
    type: regular
    task:
      id: dc6a2a15-9776-4622-8099-a6fedf4f7dc5
      version: -1
      name: 'Detects get requests to specific exploitation related files '
      description: |-
        Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362, based on the following Sigma rule:

        [MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request](https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/web_cve_2023_34362_known_payload_request.yml.yml)
      tags:
      - SIEMResults
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      earliest_time:
        complex:
          root: inputs.SplunkEarliestTime
      query:
        simple: index=* (cs-method="GET" AND (cs-uri-stem="/human2.aspx" OR cs-uri-stem="/_human2.aspx"))
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -110,
          "y": 2070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "68":
    id: "68"
    taskid: 0a019e3b-4e00-4eea-85b2-7cc13ed7160a
    type: regular
    task:
      id: 0a019e3b-4e00-4eea-85b2-7cc13ed7160a
      version: -1
      name: 'Detects get requests to specific exploitation related files'
      description: |-
        Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362, based on the following Sigma rule:

        [MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request](https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/web_cve_2023_34362_known_payload_request.yml.yml)
      tags:
      - SIEMResults
      script: '|||es-eql-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      index:
        complex:
          root: inputs.ElasticIndex
      query:
        simple: (http.request.method:"GET" AND cs-uri-stem:("/human2.aspx" OR "/_human2.aspx")
      timestamp_range_start:
        complex:
          root: inputs.ElasticEarliestTime
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 330,
          "y": 2070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "69":
    id: "69"
    taskid: d12ea2bb-6755-40fb-8588-74cce0355749
    type: playbook
    task:
      id: d12ea2bb-6755-40fb-8588-74cce0355749
      version: -1
      name: 'Detects get requests to specific exploitation related files'
      description: This playbook runs a QRadar query and return its results to the context.
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      interval:
        simple: "1"
      query_expression:
        simple: SELECT UTF8(payload) FROM events WHERE UTF8(payload) ILIKE '%GET%' AND (UTF8(payload) ILIKE '%/human2.aspx%' OR UTF8(payload) ILIKE '%/_human2.aspx%')
      range:
        complex:
          root: inputs.QRadarTimeRange
      timeout:
        simple: "600"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": -550,
          "y": 2070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "74":
    id: "74"
    taskid: ab5d1ee4-2b50-423a-8a50-4c671a296290
    type: regular
    task:
      id: ab5d1ee4-2b50-423a-8a50-4c671a296290
      version: -1
      name: IIS compiling binaries via the csc.exe on behalf of the MOVEit
      description: |-
        Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised.
        When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file,
        unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "75"
    scriptarguments:
      query:
        simple: "dataset = xdr_data\n|filter (causality_actor_process_image_name = \"w3wp.exe\" AND causality_actor_process_command_line contains \"moveit\")\n|filter action_process_image_name = \"csc.exe\"\n|fields _time, agent_hostname, agent_version, actor_effective_username,actor_process_image_name , actor_process_image_sha256, actor_process_command_line,action_process_image_name, action_process_image_sha256 ,action_process_image_command_line, action_process_signature_product "
      query_name:
        simple: aspx file creation by w3wp moveitdmz
      time_frame:
        complex:
          root: inputs.XQLTimeRange
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1120,
          "y": 1995
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "75":
    id: "75"
    taskid: 2636a31e-82e4-4138-8a53-e8e7356816b6
    type: regular
    task:
      id: 2636a31e-82e4-4138-8a53-e8e7356816b6
      version: -1
      name: 'Detects get requests to specific exploitation related files '
      description: |-
        Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised.
        When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file,
        unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "91"
    scriptarguments:
      query:
        simple: dataset in (*)|filter ((`http_method` = "GET") AND (((`uri` = "/human2.aspx") OR (`uri` contains "/_human2.aspx"))))
      query_name:
        simple: aspx file creation by w3wp moveitdmz
      time_frame:
        complex:
          root: inputs.XQLTimeRange
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1120,
          "y": 2165
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "76":
    id: "76"
    taskid: 2dbced88-fb70-46c9-8e60-9c085d30804a
    type: regular
    task:
      id: 2dbced88-fb70-46c9-8e60-9c085d30804a
      version: -1
      name: Detects file indicators of potential exploitation
      description: |-
        This file contains a Sigma rule provided by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems).

        Reference: [Potential MOVEit Transfer CVE-2023-34362 Exploitation](https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/file_event_win_exploit_cve_2023_34362_moveit_transfer.yml)
      tags:
      - Sigma
      scriptName: HttpV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      filename:
        simple: file_event_win_exploit_cve_2023_34362_moveit_transfer.yml
      method:
        simple: GET
      save_as_file:
        simple: "yes"
      unsecure:
        simple: "True"
      url:
        simple: https://raw.githubusercontent.com/SigmaHQ/sigma/master/rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/file_event_win_exploit_cve_2023_34362_moveit_transfer.yml
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1390,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "77":
    id: "77"
    taskid: dd87be0f-b4b5-40d1-80ec-d3258ff3b3c4
    type: regular
    task:
      id: dd87be0f-b4b5-40d1-80ec-d3258ff3b3c4
      version: -1
      name: 'Detects get requests to specific exploitation related files '
      description: |-
        This file contains a Sigma rule provided by Nasreddine Bencherchali (Nextron Systems)

        Reference: [MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request](https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/web_cve_2023_34362_known_payload_request.yml.yml)
      tags:
      - Sigma
      scriptName: HttpV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      filename:
        simple: web_cve_2023_34362_known_payload_request.yml.yml
      method:
        simple: GET
      save_as_file:
        simple: "yes"
      unsecure:
        simple: "True"
      url:
        simple: https://raw.githubusercontent.com/SigmaHQ/sigma/master/rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/web_cve_2023_34362_known_payload_request.yml.yml
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1810,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "78":
    id: "78"
    taskid: 5ecc8e8f-fc89-4af9-81a5-4d46514329c5
    type: regular
    task:
      id: 5ecc8e8f-fc89-4af9-81a5-4d46514329c5
      version: -1
      name: Download Folrian Roth Yara rules
      description: |-
        This file contains a Yara rule provided by Florian Roth.

        Reference: [MOVEit 0day vulnerability](https://github.com/Neo23x0/signature-base/blob/master/yara/vuln_moveit_0day_jun23.yar)
      tags:
      - Yara
      scriptName: HttpV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      filename:
        simple: vuln_moveit_0day_jun23.yar
      method:
        simple: GET
      save_as_file:
        simple: "yes"
      unsecure:
        simple: "True"
      url:
        simple: https://raw.githubusercontent.com/Neo23x0/signature-base/master/yara/vuln_moveit_0day_jun23.yar
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -540,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "79":
    id: "79"
    taskid: 7e34eb12-a850-4307-809c-bf5449b6e656
    type: playbook
    task:
      id: 7e34eb12-a850-4307-809c-bf5449b6e656
      version: -1
      name: Threat Hunting - Generic
      playbookName: Threat Hunting - Generic
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      IPAddress:
        complex:
          root: IP
          accessor: Address
          transformers:
          - operator: uniq
      QRadarTimeFrame:
        complex:
          root: inputs.QRadarTimeRange
      SHA256:
        complex:
          root: File
          accessor: SHA256
          transformers:
          - operator: uniq
      SplunkEarliestTime:
        complex:
          root: inputs.SplunkEarliestTime
      SplunkLatestTime:
        simple: now
      URLDomain:
        complex:
          root: Domain
          accessor: Name
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -1710,
          "y": 1550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "80":
    id: "80"
    taskid: 5d2edd82-1a49-466a-8656-c52a2dc835dc
    type: title
    task:
      id: 5d2edd82-1a49-466a-8656-c52a2dc835dc
      version: -1
      name: Cortex Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "85"
      - "59"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 940,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "85":
    id: "85"
    taskid: 3a93be4f-7893-4e2a-81a1-b5c8c68f56e1
    type: title
    task:
      id: 3a93be4f-7893-4e2a-81a1-b5c8c68f56e1
      version: -1
      name: Cortex Xpanse
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "86"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1990,
          "y": 1520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "86":
    id: "86"
    taskid: 2b7d29d8-2f90-4b06-8d16-bfaccdfb6376
    type: condition
    task:
      id: 2b7d29d8-2f90-4b06-8d16-bfaccdfb6376
      version: -1
      name: Is Cortex Xpanse Enabled?
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "40"
      "Yes":
      - "87"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Cortex Xpanse
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1990,
          "y": 1655
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "87":
    id: "87"
    taskid: 397fd9b1-b2ed-4930-8e51-371b4bd51275
    type: regular
    task:
      id: 397fd9b1-b2ed-4930-8e51-371b4bd51275
      version: -1
      name: Search external facing MOVEit Transfer instances
      description: Retrieve issues
      script: '|||expanse-get-issues'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "89"
    scriptarguments:
      issue_type:
        simple: MOVEit Transfer
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2190,
          "y": 1825
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "88":
    id: "88"
    taskid: 085276ba-5622-4d02-8ba2-47926c884a36
    type: regular
    task:
      id: 085276ba-5622-4d02-8ba2-47926c884a36
      version: -1
      name: 'Review possible vulnerable servers '
      description: Manual investigation of the exposed servers.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2410,
          "y": 2160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "89":
    id: "89"
    taskid: 7707ef20-4ec7-456c-8dad-a745a8218adb
    type: condition
    task:
      id: 7707ef20-4ec7-456c-8dad-a745a8218adb
      version: -1
      name: Found servers using Prisma Cloud?
      description: Checks if external facing MOVEit Transfer instances have been found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "40"
      "yes":
      - "88"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: Redlock.RQL.Response.Data.NetworkInterfaces
                accessor: PrivateIpAddress
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2190,
          "y": 1990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "90":
    id: "90"
    taskid: 3fca8336-61b2-471a-8f30-2da74d3d2fd0
    type: regular
    task:
      id: 3fca8336-61b2-471a-8f30-2da74d3d2fd0
      version: -1
      name: Collect IoCs from Unit42
      description: This script will extract indicators from given HTML and will handle bad top-level domains to avoid false positives caused by file extensions.
      scriptName: ParseHTMLIndicators
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      url:
        simple: https://unit42.paloaltonetworks.com/threat-brief-moveit-cve-2023-34362/
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 750,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "91":
    id: "91"
    taskid: 71ad225e-2589-4d94-8887-7483a8b329ba
    type: regular
    task:
      id: 71ad225e-2589-4d94-8887-7483a8b329ba
      version: -1
      name: Identify agents with MOVEit Transfer installed
      description: |-
        Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised.
        When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file,
        unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      query:
        simple: 'dataset = xdr_data | filter action_process_image_path contains "MOVEit\XferStatusServer.exe" OR actor_process_image_path contains "MOVEit\XferStatusServer.exe" OR causality_actor_process_image_path contains "MOVEit\XferStatusServer.exe" '
      query_name:
        simple: Presence of MOVEit Transfer app on endpoint
      time_frame:
        complex:
          root: inputs.XQLTimeRange
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1120,
          "y": 2335
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "13_19_Yes": 0.4,
      "13_40_#default#": 0.24,
      "14_15_yes": 0.4,
      "14_40_#default#": 0.24,
      "35_36_yes": 0.41,
      "60_40_#default#": 0.25,
      "60_61_Yes": 0.36,
      "86_40_#default#": 0.1,
      "89_40_#default#": 0.1,
      "8_17_Yes": 0.42,
      "8_40_#default#": 0.2,
      "9_23_Yes": 0.4,
      "9_40_#default#": 0.2
    },
    "paper": {
      "dimensions": {
        "height": 3715,
        "width": 4600,
        "x": -1810,
        "y": 130
      }
    }
  }
inputs:
- key: PlaybookDescription
  value:
    simple: "### CVE-2023-34362 - Critical SQL Injection vulnerability in MOVEit Transfer.\n\n#### Summary \n\nA critical vulnerability has been identified in MOVEit Transfer, a managed file transfer solution. The vulnerability affects versions prior to the latest release and involves improper input validation. Exploiting this vulnerability can lead to remote execution of arbitrary code, potentially resulting in unauthorized access and compromise of sensitive data.\n\nTo mitigate the risk associated with this vulnerability, it is crucial for users to update to the latest version of MOVEit Transfer that includes necessary security patches.\n\n#### Affected Products \n\n\n| Affected Version               | Fixed Version             | Documentation                       |\n|-------------------------------|---------------------------|-------------------------------------|\n| MOVEit Transfer 2023.0.0 (15.0) | MOVEit Transfer 2023.0.1 | [MOVEit 2023 Upgrade Documentation](https://docs.ipswitch.com/MOVEit/2023/Upgrade/) |\n| MOVEit Transfer 2022.1.x (14.1) | MOVEit Transfer 2022.1.5 | [MOVEit 2022 Upgrade Documentation](https://docs.ipswitch.com/MOVEit/2022/Upgrade/) |\n| MOVEit Transfer 2022.0.x (14.0) | MOVEit Transfer 2022.0.4 | [MOVEit 2022 Upgrade Documentation](https://docs.ipswitch.com/MOVEit/2022/Upgrade/) |\n| MOVEit Transfer 2021.1.x (13.1) | MOVEit Transfer 2021.1.4 | [MOVEit 2021 Upgrade Documentation](https://docs.ipswitch.com/MOVEit/2021/Upgrade/) |\n| MOVEit Transfer 2021.0.x (13.0) | MOVEit Transfer 2021.0.6 | [MOVEit 2021 Upgrade Documentation](https://docs.ipswitch.com/MOVEit/2021/Upgrade/) |\n| MOVEit Transfer 2020.1.x (12.1) | Special Patch Available   | See [KB 000234559](https://docs.ipswitch.com/MOVEit/2020/234559.htm) |\n| MOVEit Transfer 2020.0.x (12.0) or older | MUST upgrade to a supported version | See [MOVEit Transfer Upgrade and Migration Guide](https://docs.ipswitch.com/MOVEit/Transfer2021/UpgradeGuide/) |\n\n\n**This playbook should be triggered manually or can be configured as a job.** \n\nPlease create a new incident and choose the CVE-2023-34362 - MOVEit SQL Injection playbook and Rapid Breach Response incident type.\n\n**The playbook includes the following tasks:**\n\n**IoCs Collection**\n- Blog IoCs download\n- Yara Rules download\n- Sigma rules download\n\n**Hunting:**\n- Cortex XDR XQL exploitation patterns hunting\n- Cortex Xpanse external facing instances hunting\n- Advanced SIEM exploitation patterns hunting\n- Indicators hunting\n\nThe hunting queries are searching for the following activities:\n  - ASPX file creation by w3wp.exe\n  - IIS compiling binaries via the csc.exe on behalf of the MOVEit\n  - Detects get requests to specific exploitation related files\n\n**Mitigations:**\n- Progress official CVE-2023-34362 patch\n- Progress mitigation measures\n- Detection Rules\n    - Yara\n    - Sigma\n\n\n**References:**\n\n[CVE-2023-34362: MOVEit Transfer SQL Injection Vulnerability Threat Brief](https://unit42.paloaltonetworks.com/threat-brief-moveit-cve-2023-34362/)\n\n[MOVEit Transfer Critical Vulnerability (May 2023)](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023)\n\nNote: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve."
  required: false
  description: The playbook description to be used in the Rapid Breach Response - Set Incident Info sub-playbook.
  playbookInputQuery:
- key: autoBlockIndicators
  value:
    simple: "False"
  required: false
  description: Wether to block the indicators automatically.
  playbookInputQuery:
- key: QRadarTimeRange
  value:
    simple: Last 10 Days
  required: false
  description: The time range for the QRadar queries.
  playbookInputQuery:
- key: SplunkEarliestTime
  value:
    simple: -10d@d
  required: false
  description: The time range for the Splunk queries.
  playbookInputQuery:
- key: ElasticEarliestTime
  value:
    simple: now-7d/d
  required: false
  description: The time range for the Elastic queries.
  playbookInputQuery:
- key: LogAnalyticsTimespan
  value:
    simple: 10d
  required: false
  description: The time range for the Azure Log Analytics queries.
  playbookInputQuery:
- key: XQLTimeRange
  value:
    simple: 2 hours ago
  required: false
  description: The time range for the XQL queries.
  playbookInputQuery:
- key: ElasticIndex
  value: {}
  required: false
  description: The elastic index to search in.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.8.0