CVE-2023-36884 - Microsoft Office and Windows HTML RCE

## CVE-2023-36884 - Microsoft Office and Windows HTML RCE **Summary:** Microsoft recently detected a sophisticated phishing campaign orchestrated by a threat actor called Storm-0978. The targets of this campaign were defense and government organizations in Europe and North America. The attackers exploited the previously undisclosed CVE-2023-36884, introduced in July's recent Patch Tuesday release. CVE-2023-36884 is affecting both Office and Windows. This zero-day vulnerability enables remote code execution through specially crafted Microsoft Office documents. **This playbook should be triggered manually or can be configured as a job.** Please create a new incident and choose the CVE-2023-36884 - Office and Windows HTML RCE playbook and Rapid Breach Response incident type. **The playbook includes the following tasks:** **IoCs Collection** - Unit42 IoCs download **Hunting:** - PANW Hunting: - Cortex XDR XQL exploitation patterns hunting - Panorama Threat IDs hunting - Advanced SIEM exploitation patterns hunting - Indicators hunting - Endpoints by CVE hunting The hunting queries are searching for the following activities: - Detects a Microsoft Office file drops a file called 'file001.url'. - Suspicious New Instance Of An Office COM Object - Change PowerShell Policies to an Insecure Level `Please note that the threat hunting queries are related to the behavior identified as part of the exploitation patterns and may result in false positive detections.` **Mitigations:** - Microsoft mitigation measures **References:** [CVE-2023-36884 - Microsoft Office and Windows HTML Remote Code Execution: Threat Brief](https://unit42.paloaltonetworks.com/cve-2023-36884-rce/) [Storm-0978 attacks reveal financial and espionage motives ](https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/)

CVE-2023-36884 - Microsoft Office and Windows HTML RCE · 51 tasks · 8 inputs · 0 outputs

Details

IDCVE-2023-36884 - Microsoft Office and Windows HTML RCE
From Version6.9.0
Tasks51

README

CVE-2023-36884 - Microsoft Office and Windows HTML RCE

Summary:

Microsoft recently detected a sophisticated phishing campaign orchestrated by a threat actor called Storm-0978. The targets of this campaign were defense and government organizations in Europe and North America. The attackers exploited the previously undisclosed CVE-2023-36884, introduced in July’s recent Patch Tuesday release.

CVE-2023-36884 is affecting both Office and Windows. This zero-day vulnerability enables remote code execution through specially crafted Microsoft Office documents.

This playbook should be triggered manually or can be configured as a job.

Please create a new incident and choose the CVE-2023-36884 - Office and Windows HTML RCE playbook and Rapid Breach Response incident type.

The playbook includes the following tasks:

IoCs Collection

  • Unit42 IoCs download

Hunting:

  • PANW Hunting:
    • Cortex XDR XQL exploitation patterns hunting
    • Panorama Threat IDs hunting
  • Advanced SIEM exploitation patterns hunting
  • Indicators hunting
  • Endpoints by CVE hunting

The hunting queries are searching for the following activities:

  • Detects a Microsoft Office file drops a file called ‘file001.url’.
  • Suspicious New Instance Of An Office COM Object
  • Change PowerShell Policies to an Insecure Level

Please note that the threat hunting queries are related to the behavior identified as part of the exploitation patterns and may result in false positive detections.

Mitigations:

  • Microsoft mitigation measures

References:

CVE-2023-36884 - Microsoft Office and Windows HTML Remote Code Execution: Threat Brief
Storm-0978 attacks reveal financial and espionage motives

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Rapid Breach Response - Set Incident Info
  • QRadarFullSearch
  • Search Endpoint by CVE - Generic
  • Block Indicators - Generic v3
  • Threat Hunting - Generic
  • Panorama Query Logs

Integrations

This playbook does not use any integrations.

Scripts

  • CreateNewIndicatorsOnly
  • ParseHTMLIndicators

Commands

  • xdr-xql-generic-query
  • splunk-search
  • closeInvestigation
  • azure-log-analytics-execute-query
  • es-eql-search

Playbook Inputs

Name Description Default Value Required
PlaybookDescription The playbook description to be used in the Rapid Breach Response - Set Incident Info sub-playbook. ## CVE-2023-36884 - Microsoft Office and Windows HTML RCE

Summary:

Microsoft recently detected a sophisticated phishing campaign orchestrated by a threat actor called Storm-0978. The targets of this campaign were defense and government organizations in Europe and North America. The attackers exploited the previously undisclosed CVE-2023-36884, introduced in July’s recent Patch Tuesday release.

CVE-2023-36884 is affecting both Office and Windows. This zero-day vulnerability enables remote code execution through specially crafted Microsoft Office documents.

This playbook should be triggered manually or can be configured as a job.

Please create a new incident and choose the CVE-2023-36884 - Office and Windows HTML RCE playbook and Rapid Breach Response incident type.

The playbook includes the following tasks:

IoCs Collection
- Unit42 IoCs download

Hunting:
- PANW Hunting:
- Cortex XDR XQL exploitation patterns hunting
- Panorama Threat IDs hunting
- Advanced SIEM exploitation patterns hunting
- Indicators hunting
- Endpoints by CVE hunting

The hunting queries are searching for the following activities:
- Detects a Microsoft Office file drops a file called ‘file001.url’.
- Suspicious New Instance Of An Office COM Object
- Change PowerShell Policies to an Insecure Level

Please note that the threat hunting queries are related to the behavior identified as part of the exploitation patterns and may result in false positive detections.

Mitigations:
- Microsoft mitigation measures

References:

CVE-2023-36884 - Microsoft Office and Windows HTML Remote Code Execution: Threat Brief
Storm-0978 attacks reveal financial and espionage motives
 Optional
autoBlockIndicators Wether to block the indicators automatically. True Optional
QRadarTimeRange The time range for the QRadar queries. Last 14 Days Optional
SplunkEarliestTime The time range for the Splunk queries. -14d@d Optional
ElasticEarliestTime The time range for the Elastic queries. now-14d/d Optional
LogAnalyticsTimespan The time range for the Azure Log Analytics queries. 14d Optional
XQLTimeRange The time range for the XQL queries. 14 days ago Optional
ElasticIndex The elastic index to search in.   Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

CVE-2023-36884 - Microsoft Office and Windows HTML RCE

Inputs

  • PlaybookDescription — The playbook description to be used in the Rapid Breach Response - Set Incident Info sub-playbook.
  • XQLTimeRange — The time range for the XQL queries.
  • SplunkEarliestTime — The time range for the Splunk queries.
  • ElasticEarliestTime — The time range for the Elastic queries.
  • ElasticIndex — The elastic index to search in.
  • LogAnalyticsTimespan — The time range for the Azure Log Analytics queries.
  • QRadarTimeRange — The time range for the QRadar queries.
  • autoBlockIndicators — Wether to block the indicators automatically.

Commands used

azure-log-analytics-execute-query closeInvestigation es-eql-search splunk-search xdr-xql-generic-query

Flowchart

Yes Yes Yes yes Yes Yes yes Start Start Collect Indicators Collect Indicators Collect IoCs from Unit42 - ParseHTMLIndicators Collect IoCs from Unit42 ParseHTMLIndicators Tag Indicators Tag Indicators Set Rapid Breach Response Layout Set Rapid Breach Response... Rapid Breach Response - Set Incident Info - Rapid Breach Response - Set Incident Info Rapid Breach Response - S... Rapid Breach Response - Set I... Tag Domain Indicators - CreateNewIndicatorsOnly Tag Domain Indicators CreateNewIndicatorsOnly Threat Hunting Threat Hunting SIEM Advanced Hunting SIEM Advanced Hunting Indicators Hunting Indicators Hunting PANW Hunting PANW Hunting Threat Hunting - Generic - Threat Hunting - Generic Threat Hunting - Generic Threat Hunting - Generic Is Splunk Enabled? Is Splunk Enabled? Is QRadar Enabled? Is QRadar Enabled? Is Elasticsearch Enabled? Is Elasticsearch Enabled? Is Azure Log Analytics Enabled? Is Azure Log Analytics En... Microsoft Word drops file named 'file001.url' - azure-log-analytics-execute-query Microsoft Word drops file... azure-log-analytics-execute-q... Microsoft Word drops file named 'file001.url' - splunk-search Microsoft Word drops file... splunk-search Microsoft Word drops file named 'file001.url' - es-eql-search Microsoft Word drops file... es-eql-search QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch Cortex XDR - XQL Hunting Queries Cortex XDR - XQL Hunting ... Is Cortex XDR - XQL Enabled? Is Cortex XDR - XQL Enabled? Microsoft Word drops file named 'file001.url' - xdr-xql-generic-query Microsoft Word drops file... xdr-xql-generic-query Change PowerShell Policies to an Insecure Level - xdr-xql-generic-query Change PowerShell Policie... xdr-xql-generic-query Should continue with the investigation? Should continue with the ... Should block indicators automatically? Should block indicators a... Block Indicators - Generic v3 - Block Indicators - Generic v3 Block Indicators - Generi... Block Indicators - Generic v3 Handle indicators manually Handle indicators manually Investigate further Investigate further Done Done Remediation Remediation Mitigation Mitigation Microsoft mitigation measures Microsoft mitigation meas... Resolution Resolution Tag File Indicators - CreateNewIndicatorsOnly Tag File Indicators CreateNewIndicatorsOnly Close Investigation - closeInvestigation Close Investigation closeInvestigation Change PowerShell Policies to an Insecure Level - azure-log-analytics-execute-query Change PowerShell Policie... azure-log-analytics-execute-q... Change PowerShell Policies to an Insecure Level - splunk-search Change PowerShell Policie... splunk-search Change PowerShell Policies to an Insecure Level - es-eql-search Change PowerShell Policie... es-eql-search QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch Tag CVE Indicators - CreateNewIndicatorsOnly Tag CVE Indicators CreateNewIndicatorsOnly Tag IP Indicators - CreateNewIndicatorsOnly Tag IP Indicators CreateNewIndicatorsOnly Suspicious New Instance Of An Office COM Object - azure-log-analytics-execute-query Suspicious New Instance O... azure-log-analytics-execute-q... Suspicious New Instance Of An Office COM Object - splunk-search Suspicious New Instance O... splunk-search Suspicious New Instance Of An Office COM Object - es-eql-search Suspicious New Instance O... es-eql-search QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch Suspicious New Instance Of An Office COM Object - xdr-xql-generic-query Suspicious New Instance O... xdr-xql-generic-query Panorama Threat Prevention Panorama Threat Prevention Panorama Query Logs - Panorama Query Logs Panorama Query Logs Panorama Query Logs CVE Hunting CVE Hunting Search Endpoint by CVE - Generic - Search Endpoint by CVE - Generic Search Endpoint by CVE - ... Search Endpoint by CVE - Generic

Source

playbook-CVE-2023-36884_-_Microsoft_Office_and_Windows_HTML_RCE.yml
Download History Raw 
id: CVE-2023-36884 - Microsoft Office and Windows HTML RCE
version: -1
name: CVE-2023-36884 - Microsoft Office and Windows HTML RCE
description: "## CVE-2023-36884 - Microsoft Office and Windows HTML RCE\n\n**Summary:**\n\nMicrosoft recently detected a sophisticated phishing campaign orchestrated by a threat actor called Storm-0978. The targets of this campaign were defense and government organizations in Europe and North America. The attackers exploited the previously undisclosed CVE-2023-36884, introduced in July's recent Patch Tuesday release.\n\nCVE-2023-36884 is affecting both Office and Windows. This zero-day vulnerability enables remote code execution through specially crafted Microsoft Office documents.\n\n**This playbook should be triggered manually or can be configured as a job.** \n\nPlease create a new incident and choose the CVE-2023-36884 - Office and Windows HTML RCE playbook and Rapid Breach Response incident type.\n\n**The playbook includes the following tasks:**\n\n**IoCs Collection**\n- Unit42 IoCs download\n\n**Hunting:**\n- PANW Hunting:\n  - Cortex XDR XQL exploitation patterns hunting\n  - Panorama Threat IDs hunting\n- Advanced SIEM exploitation patterns hunting\n- Indicators hunting\n- Endpoints by CVE hunting\n\nThe hunting queries are searching for the following activities:\n  - Detects a Microsoft Office file drops a file called 'file001.url'.\n  - Suspicious New Instance Of An Office COM Object\n  - Change PowerShell Policies to an Insecure Level\n\n`Please note that the threat hunting queries are related to the behavior identified as part of the exploitation patterns and may result in false positive detections.`\n\n**Mitigations:**\n- Microsoft mitigation measures\n\n**References:**\n\n[CVE-2023-36884 - Microsoft Office and Windows HTML Remote Code Execution: Threat Brief](https://unit42.paloaltonetworks.com/cve-2023-36884-rce/)\n[Storm-0978 attacks reveal financial and espionage motives\n](https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/)"
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: bdfccc2e-ee28-4622-8eb3-9e32bebdd5a7
    type: start
    task:
      id: bdfccc2e-ee28-4622-8eb3-9e32bebdd5a7
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 2ff00b7c-2104-40fe-8e95-5a67cfc744b3
    type: title
    task:
      id: 2ff00b7c-2104-40fe-8e95-5a67cfc744b3
      version: -1
      name: Collect Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 9247f400-fb62-47f5-8099-f459eb4ede74
    type: regular
    task:
      id: 9247f400-fb62-47f5-8099-f459eb4ede74
      version: -1
      name: Collect IoCs from Unit42
      description: This script will extract indicators from given HTML and will handle bad top-level domains to avoid false positives caused by file extensions.
      scriptName: ParseHTMLIndicators
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      exclude_indicators:
        simple: '"hxxps://"'
      url:
        simple: https://unit42.paloaltonetworks.com/cve-2023-36884-rce/
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 9202ab44-fc31-4fe9-8638-58d50b6727ab
    type: title
    task:
      id: 9202ab44-fc31-4fe9-8638-58d50b6727ab
      version: -1
      name: Tag Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
      - "49"
      - "55"
      - "56"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: a23eb650-3dbb-408e-885a-9a9162539c10
    type: title
    task:
      id: a23eb650-3dbb-408e-885a-9a9162539c10
      version: -1
      name: Set Rapid Breach Response Layout
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 7708df1e-a81d-4cdb-80f2-ca509db5fea0
    type: playbook
    task:
      id: 7708df1e-a81d-4cdb-80f2-ca509db5fea0
      version: -1
      name: Rapid Breach Response - Set Incident Info
      description: This playbook is responsible for setting up the Rapid Breach Response Incident Info tab in the layout.
      playbookName: Rapid Breach Response - Set Incident Info
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      SourceOfIndicators:
        complex:
          root: http.parsedBlog
          accessor: sourceLink
      countTotalIndicators:
        complex:
          root: CVE
          accessor: ID
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: File.SHA256
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: Domain.Name
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: IP.Address
                iscontext: true
          - operator: uniq
          - operator: count
      playbookDescription:
        complex:
          root: inputs.PlaybookDescription
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: efef6706-f4e5-4088-8264-c52abe4911be
    type: regular
    task:
      id: efef6706-f4e5-4088-8264-c52abe4911be
      version: -1
      name: Tag Domain Indicators
      description: Create indicators to the Threat Intel database only if they are not registered. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.
      scriptName: CreateNewIndicatorsOnly
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      indicator_values:
        complex:
          root: Domain
          accessor: Name
      source:
        complex:
          root: http.parsedBlog
          accessor: sourceLink
      tags:
        simple: CVE-2023-36884, Microsoft, RCE, HTML, Microsoft Office, Storm-0978, RomCom
      type:
        simple: Domain
      verdict:
        simple: Malicious
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1070,
          "y": 740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: ef632a65-b77d-4134-894b-a96e6cfa0af0
    type: title
    task:
      id: ef632a65-b77d-4134-894b-a96e6cfa0af0
      version: -1
      name: Threat Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
      - "16"
      - "17"
      - "64"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 77e2a9be-cf00-4ed7-8c71-bf4b8c125bfa
    type: title
    task:
      id: 77e2a9be-cf00-4ed7-8c71-bf4b8c125bfa
      version: -1
      name: SIEM Advanced Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "24"
      - "22"
      - "21"
      - "23"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: b60b10f6-ea88-4482-8750-7e0d52169874
    type: title
    task:
      id: b60b10f6-ea88-4482-8750-7e0d52169874
      version: -1
      name: Indicators Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -900,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 5567ac53-c216-4e0e-8a1e-a40cd84577f6
    type: title
    task:
      id: 5567ac53-c216-4e0e-8a1e-a40cd84577f6
      version: -1
      name: PANW Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "33"
      - "62"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1810,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: dbdafc41-904a-4cb4-80ae-75d9a932c77b
    type: playbook
    task:
      id: dbdafc41-904a-4cb4-80ae-75d9a932c77b
      version: -1
      name: Threat Hunting - Generic
      description: "This playbook enables threat hunting for IOCs in your enterprise. It currently supports the following integrations: \n- Splunk\n- Qradar\n- Pan-os \n- Cortex data lake \n- Autofocus\n- Microsoft 365 Defender"
      playbookName: Threat Hunting - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    scriptarguments:
      IPAddress:
        complex:
          root: IP
          accessor: Address
          transformers:
          - operator: uniq
      QRadarTimeFrame:
        complex:
          root: inputs.QRadarTimeRange
      SHA256:
        complex:
          root: File
          accessor: SHA256
          transformers:
          - operator: uniq
      SplunkEarliestTime:
        complex:
          root: inputs.SplunkEarliestTime
      SplunkLatestTime:
        simple: now
      URLDomain:
        complex:
          root: Domain
          accessor: Name
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -900,
          "y": 1650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: c23232ea-f476-4567-8916-c16f7a1bee63
    type: condition
    task:
      id: c23232ea-f476-4567-8916-c16f7a1bee63
      version: -1
      name: Is Splunk Enabled?
      description: Check if Splunk instance is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "43"
      "Yes":
      - "30"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: SplunkPy
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 670,
          "y": 1640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 52d9ab48-3726-46d3-8767-4dcd57c2b7f9
    type: condition
    task:
      id: 52d9ab48-3726-46d3-8767-4dcd57c2b7f9
      version: -1
      name: Is QRadar Enabled?
      description: Check if Splunk instance is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "43"
      "Yes":
      - "32"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: QRadar v3
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 38276dec-e1d0-456e-8582-6040b84de65f
    type: condition
    task:
      id: 38276dec-e1d0-456e-8582-6040b84de65f
      version: -1
      name: Is Elasticsearch Enabled?
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "43"
      "Yes":
      - "31"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Elasticsearch
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1110,
          "y": 1640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: cfec6212-a7bf-4c5e-84ba-21bc7a978a14
    type: condition
    task:
      id: cfec6212-a7bf-4c5e-84ba-21bc7a978a14
      version: -1
      name: Is Azure Log Analytics Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "43"
      "yes":
      - "29"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Azure Log Analytics
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -210,
          "y": 1640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 5ed00bc4-f5de-4bd5-865d-00dbe1ad5463
    type: regular
    task:
      id: 5ed00bc4-f5de-4bd5-865d-00dbe1ad5463
      version: -1
      name: Microsoft Word drops file named 'file001.url'
      description: Detects a part of the exploitation flow where the Microsoft Office file drops a file called 'file001.url'.
      tags:
      - SIEMResults
      script: '|||azure-log-analytics-execute-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "57"
    scriptarguments:
      query:
        simple: SysmonEvent | where EventID == 11 | where (Image endswith @'\winword.exe' and TargetFilename =~ @'file001.url')
      timespan:
        complex:
          root: inputs.LogAnalyticsTimespan
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -210,
          "y": 1810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: ee18c7d9-817b-4b1a-89db-149af952dad1
    type: regular
    task:
      id: ee18c7d9-817b-4b1a-89db-149af952dad1
      version: -1
      name: Microsoft Word drops file named 'file001.url'
      description: Detects a part of the exploitation flow where the Microsoft Office file drops a file called 'file001.url'.
      tags:
      - SIEMResults
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "58"
    scriptarguments:
      earliest_time:
        complex:
          root: inputs.SplunkEarliestTime
      query:
        simple: index=* source="WinEventLog:*" AND ((Image="*\\winword.exe") AND (TargetFilename="file001.url"))
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 670,
          "y": 1810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 637f8742-16ab-49ed-840f-796493875ff2
    type: regular
    task:
      id: 637f8742-16ab-49ed-840f-796493875ff2
      version: -1
      name: Microsoft Word drops file named 'file001.url'
      description: Detects a part of the exploitation flow where the Microsoft Office file drops a file called 'file001.url'.
      tags:
      - SIEMResults
      script: '|||es-eql-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "59"
    scriptarguments:
      index:
        complex:
          root: inputs.ElasticIndex
      query:
        simple: (process.executable.text:"*\\winword.exe" AND file.path.text:"file001.url")
      timestamp_range_start:
        complex:
          root: inputs.ElasticEarliestTime
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1110,
          "y": 1810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 93ca4a8e-d68f-4db9-8fda-6b155fb053e0
    type: playbook
    task:
      id: 93ca4a8e-d68f-4db9-8fda-6b155fb053e0
      version: -1
      name: QRadarFullSearch
      description: This playbook runs a QRadar query and return its results to the context.
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "60"
    scriptarguments:
      interval:
        simple: "1"
      query_expression:
        simple: SELECT UTF8(payload) FROM events WHERE LOGSOURCETYPENAME(devicetype)='Microsoft Windows Security Event Log' AND CATEGORYNAME(category)='Process Creation Success' AND "Image" ILIKE '%\winword.exe' AND ("Filename" = 'file001.url')
      range:
        complex:
          root: inputs.QRadarTimeRange
      timeout:
        simple: "600"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: c3248ac2-aa18-4eb9-8454-4bddc09374fa
    type: title
    task:
      id: c3248ac2-aa18-4eb9-8454-4bddc09374fa
      version: -1
      name: Cortex XDR - XQL Hunting Queries
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1810,
          "y": 1495
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: d290b457-1630-43d1-86a4-9f508054cbb1
    type: condition
    task:
      id: d290b457-1630-43d1-86a4-9f508054cbb1
      version: -1
      name: Is Cortex XDR - XQL Enabled?
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "43"
      "Yes":
      - "35"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Cortex XDR - XQL Query Engine
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1810,
          "y": 1640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 0d33ad61-935f-45d5-8e02-1fc60a759d29
    type: regular
    task:
      id: 0d33ad61-935f-45d5-8e02-1fc60a759d29
      version: -1
      name: Microsoft Word drops file named 'file001.url'
      description: |-
        Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised.
        When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file,
        unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "61"
    scriptarguments:
      query:
        simple: dataset = xdr_data | filter event_type =3 and event_sub_type = 1 and action_file_name ~= "file001.url" and (causality_actor_process_image_name = "winword.exe" or actor_process_image_name = "winword.exe")
      query_name:
        simple: Microsoft Word drops file named 'file001.url'
      time_frame:
        complex:
          root: inputs.XQLTimeRange
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1990,
          "y": 1810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 0fafbe3e-954d-456e-8cd4-a5de8a49caa2
    type: regular
    task:
      id: 0fafbe3e-954d-456e-8cd4-a5de8a49caa2
      version: -1
      name: Change PowerShell Policies to an Insecure Level
      description: |-
        Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised.
        When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file,
        unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    scriptarguments:
      query:
        simple: |-
          dataset = xdr_data | filter (causality_actor_process_command_line ~= "-executionpolicy" OR
           causality_actor_process_command_line ~= "-ep" OR
           causality_actor_process_command_line ~= "-exec") AND
          (causality_actor_process_command_line ~= "Unrestricted" OR
           causality_actor_process_command_line ~= "bypass" OR
           causality_actor_process_command_line ~= "RemoteSigned") AND
          NOT (causality_actor_process_command_line ~= "C:\\Program Files" OR
           causality_actor_process_command_line ~= "C:\\ProgramData" OR
           causality_actor_process_command_line ~= "\\AppData\\Roaming\\Code")
      query_name:
        simple: Change PowerShell Policies to an Insecure Level
      time_frame:
        complex:
          root: inputs.XQLTimeRange
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1990,
          "y": 2150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 7897a924-b8ad-4cdd-8369-76429ed2e436
    type: condition
    task:
      id: 7897a924-b8ad-4cdd-8369-76429ed2e436
      version: -1
      name: Should continue with the investigation?
      description: Whether to continue with the investigation or close it.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "50"
      "Yes":
      - "41"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: 063e6a9c-5dec-4101-8019-a60bef6b6433
    type: condition
    task:
      id: 063e6a9c-5dec-4101-8019-a60bef6b6433
      version: -1
      name: Should block indicators automatically?
      description: Checks whether to block the indicators automatically.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "40"
      "yes":
      - "39"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.autoBlockIndicators
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 3ba1e60f-9b15-439f-8bdf-3b22fdd8e17b
    type: playbook
    task:
      id: 3ba1e60f-9b15-439f-8bdf-3b22fdd8e17b
      version: -1
      name: Block Indicators - Generic v3
      description: |+
        This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks:

        - Block URL - Generic v2
        - Block Account - Generic v2
        - Block IP - Generic v3
        - Block File - Generic v2
        - Block Email - Generic v2
        - Block Domain - Generic v2

      playbookName: Block Indicators - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "44"
    scriptarguments:
      AutoBlockIndicators:
        simple: "True"
      AutoCommit:
        simple: "No"
      CustomBlockRule:
        simple: "True"
      CustomURLCategory:
        simple: XSOAR Remediation - Malicious URLs
      DomainToBlock:
        complex:
          root: Domain
          accessor: Name
          transformers:
          - operator: uniq
      EmailToBlock:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: email
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      FilesToBlock:
        complex:
          root: File
          accessor: SHA256
          transformers:
          - operator: uniq
      IP:
        complex:
          root: IP
          accessor: Address
          transformers:
          - operator: uniq
      InputEnrichment:
        simple: "False"
      MD5:
        complex:
          root: DBotScore
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: DBotScore.Indicator
                iscontext: true
              right:
                value:
                  simple: "32"
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: file
            - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: hash
          accessor: Indicator
          transformers:
          - operator: uniq
      RuleDirection:
        simple: outbound
      RuleName:
        simple: XSOAR - Block Indicators playbook - ${incident.id}
      SHA256:
        complex:
          root: File
          accessor: SHA256
          transformers:
          - operator: uniq
      URL:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: url
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      UserVerification:
        simple: "False"
      Username:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: username
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 670,
          "y": 2630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: 81716d60-ffcd-4c48-888e-57637379e4f3
    type: regular
    task:
      id: 81716d60-ffcd-4c48-888e-57637379e4f3
      version: -1
      name: Handle indicators manually
      description: Manual task for indicators handling.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "44"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": 2630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 62be319d-a3c8-418a-82c6-63aab4218ddb
    type: regular
    task:
      id: 62be319d-a3c8-418a-82c6-63aab4218ddb
      version: -1
      name: Investigate further
      description: Continue with the investigation manually.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "50"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 3430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: ede2a696-f7e5-45a4-8c5d-8e8e1931f441
    type: title
    task:
      id: ede2a696-f7e5-45a4-8c5d-8e8e1931f441
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: 5b885f9c-46bd-4b7f-8926-3fdbe8bdcc9d
    type: title
    task:
      id: 5b885f9c-46bd-4b7f-8926-3fdbe8bdcc9d
      version: -1
      name: Remediation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "38"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: e1b661f1-258f-4407-8357-05a8e443631e
    type: title
    task:
      id: e1b661f1-258f-4407-8357-05a8e443631e
      version: -1
      name: Mitigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "45"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: 229cd39c-aa93-4b2a-8af6-9cc8b87a2725
    type: regular
    task:
      id: 229cd39c-aa93-4b2a-8af6-9cc8b87a2725
      version: -1
      name: Microsoft mitigation measures
      description: "## Recommendations\n\nIn current attack chains, the use of the [Block all Office applications from creating child processes](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-all-office-applications-from-creating-child-processes) attack surface reduction rule prevents the vulnerability from being exploited.\n\nOrganizations who cannot take advantage of these protections can set the `FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION` registry key to avoid exploitation. \n\nNo OS restart is required, but restarting the applications that have had the registry key added for them is recommended in case the value was already queried and is cached.\n\nPlease note that while these registry settings would mitigate exploitation of this issue, it could affect regular functionality for certain use cases related to these applications. For this reason, we suggest testing. To disable the mitigation, delete the registry key or set it to `0`.\n\nAdd the following application names to this registry key as values of type REG_DWORD with data 1.:\n`Computer\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION`\n\n- Excel.exe\n- Graph.exe\n- MSAccess.exe\n- MSPub.exe\n- Powerpnt.exe\n- Visio.exe\n- WinProj.exe\n- WinWord.exe\n- Wordpad.exe\n\nReference: [Storm-0978 attacks reveal financial and espionage motives](https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/)\n"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: 108bec27-7ad3-4ffa-8158-bec493792f8e
    type: title
    task:
      id: 108bec27-7ad3-4ffa-8158-bec493792f8e
      version: -1
      name: Resolution
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "37"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "49":
    id: "49"
    taskid: 8fdc666c-3b43-49c2-8acf-fc56da3cef49
    type: regular
    task:
      id: 8fdc666c-3b43-49c2-8acf-fc56da3cef49
      version: -1
      name: Tag File Indicators
      description: Create indicators to the Threat Intel database only if they are not registered. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.
      scriptName: CreateNewIndicatorsOnly
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      indicator_values:
        complex:
          root: File
          accessor: SHA256
      source:
        complex:
          root: http.parsedBlog
          accessor: sourceLink
      tags:
        simple: CVE-2023-36884, Microsoft, RCE, HTML, Microsoft Office, Storm-0978, RomCom
      type:
        simple: File
      verdict:
        simple: Malicious
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 240,
          "y": 740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: 1f0a8941-2aaf-4997-87cf-6fc060069222
    type: regular
    task:
      id: 1f0a8941-2aaf-4997-87cf-6fc060069222
      version: -1
      name: Close Investigation
      description: Close the current incident
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "42"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "51":
    id: "51"
    taskid: f3eb9beb-c815-4181-8690-2651cc0dcfa8
    type: regular
    task:
      id: f3eb9beb-c815-4181-8690-2651cc0dcfa8
      version: -1
      name: Change PowerShell Policies to an Insecure Level
      description: |-
        Detects use of executionpolicy option to set insecure policies.
        May cause high rate of False Positives.
      tags:
      - SIEMResults
      script: '|||azure-log-analytics-execute-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    scriptarguments:
      query:
        simple: SecurityEvent | where EventID == 4688 | where (((CommandLine contains @' -executionpolicy ' or CommandLine contains @' -ep ' or CommandLine contains @' -exec ') and (CommandLine contains @'Unrestricted' or CommandLine contains @'bypass' or CommandLine contains @'RemoteSigned')) and not (CommandLine contains @'C:\Program Files' or CommandLine contains @'C:\ProgramData' or CommandLine contains @'\AppData\Roaming\Code\'))
      timespan:
        complex:
          root: inputs.LogAnalyticsTimespan
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -210,
          "y": 2150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "52":
    id: "52"
    taskid: 8be6df43-22a5-418b-8e01-b556b5e90453
    type: regular
    task:
      id: 8be6df43-22a5-418b-8e01-b556b5e90453
      version: -1
      name: Change PowerShell Policies to an Insecure Level
      description: |-
        Detects use of executionpolicy option to set insecure policies.
        May cause high rate of False Positives.
      tags:
      - SIEMResults
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    scriptarguments:
      earliest_time:
        complex:
          root: inputs.SplunkEarliestTime
      query:
        simple: index=* source="WinEventLog:*" AND (((CommandLine="* -executionpolicy *" OR CommandLine="* -ep *" OR CommandLine="* -exec *") AND (CommandLine="*Unrestricted*" OR CommandLine="*bypass*" OR CommandLine="*RemoteSigned*")) AND NOT (CommandLine="*C:\\Program Files*" OR CommandLine="*C:\\ProgramData*" OR CommandLine="*\\AppData\\Roaming\\Code\\*"))
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 670,
          "y": 2150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "53":
    id: "53"
    taskid: 018ca18e-759c-4a6b-842c-3cc2e47b9a7c
    type: regular
    task:
      id: 018ca18e-759c-4a6b-842c-3cc2e47b9a7c
      version: -1
      name: Change PowerShell Policies to an Insecure Level
      description: |-
        Detects use of executionpolicy option to set insecure policies.
        May cause high rate of False Positives.
      tags:
      - SIEMResults
      script: '|||es-eql-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    scriptarguments:
      index:
        complex:
          root: inputs.ElasticIndex
      query:
        simple: ((process.command_line.text:("*\ \-executionpolicy\ *" OR "*\ \-ep\ *" OR "*\ \-exec\ *") AND process.command_line.text:("*Unrestricted*" OR "*bypass*" OR "*RemoteSigned*")) AND (NOT process.command_line.text:("*C\:\\Program\ Files*" OR "*C\:\\ProgramData*" OR "*\\AppData\\Roaming\\Code\\*")))
      timestamp_range_start:
        complex:
          root: inputs.ElasticEarliestTime
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1110,
          "y": 2150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "54":
    id: "54"
    taskid: 551808aa-3405-4a6e-808b-3731f6202e02
    type: playbook
    task:
      id: 551808aa-3405-4a6e-808b-3731f6202e02
      version: -1
      name: QRadarFullSearch
      description: This playbook runs a QRadar query and return its results to the context.
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    scriptarguments:
      interval:
        simple: "1"
      query_expression:
        simple: SELECT UTF8(payload) FROM events WHERE LOGSOURCETYPENAME(devicetype)='Microsoft Windows Security Event Log' AND CATEGORYNAME(category)='Process Creation Success' AND (("Process CommandLine" ILIKE '% -executionpolicy %' OR "Process CommandLine" ILIKE '% -ep %' OR "Process CommandLine" ILIKE '% -exec %') AND ("Process CommandLine" ILIKE '%Unrestricted%' OR "Process CommandLine" ILIKE '%bypass%' OR "Process CommandLine" ILIKE '%RemoteSigned%')) AND NOT (("Process CommandLine" ILIKE '%C:\Program Files%' OR "Process CommandLine" ILIKE '%C:\ProgramData%' OR "Process CommandLine" ILIKE '%\AppData\Roaming\Code\%'))
      range:
        complex:
          root: inputs.QRadarTimeRange
      timeout:
        simple: "600"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 230,
          "y": 2150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "55":
    id: "55"
    taskid: b884a2d5-f1b1-4614-89d2-1e3477b16b16
    type: regular
    task:
      id: b884a2d5-f1b1-4614-89d2-1e3477b16b16
      version: -1
      name: Tag CVE Indicators
      description: Create indicators to the Threat Intel database only if they are not registered. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.
      scriptName: CreateNewIndicatorsOnly
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      indicator_values:
        complex:
          root: CVE
          accessor: ID
      source:
        complex:
          root: http.parsedBlog
          accessor: sourceLink
      tags:
        simple: CVE-2023-36884, Microsoft, RCE, HTML, Microsoft Office, Storm-0978, RomCom
      type:
        simple: CVE
      verdict:
        simple: Malicious
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -170,
          "y": 740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "56":
    id: "56"
    taskid: 4a89f79c-e339-4ced-8c5a-9f538f1e5e66
    type: regular
    task:
      id: 4a89f79c-e339-4ced-8c5a-9f538f1e5e66
      version: -1
      name: Tag IP Indicators
      description: Create indicators to the Threat Intel database only if they are not registered. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.
      scriptName: CreateNewIndicatorsOnly
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      indicator_values:
        complex:
          root: IP
          accessor: Address
      source:
        complex:
          root: http.parsedBlog
          accessor: sourceLink
      tags:
        simple: CVE-2023-36884, Microsoft, RCE, HTML, Microsoft Office, Storm-0978, RomCom
      type:
        simple: IP
      verdict:
        simple: Malicious
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 660,
          "y": 740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "57":
    id: "57"
    taskid: b7485513-86b9-410e-8e29-313706c79f38
    type: regular
    task:
      id: b7485513-86b9-410e-8e29-313706c79f38
      version: -1
      name: Suspicious New Instance Of An Office COM Object
      description: |-
        Detects an svchost process spawning an instance of an office application.
        May cause high rate of False Positives.
      tags:
      - SIEMResults
      script: '|||azure-log-analytics-execute-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "51"
    scriptarguments:
      query:
        simple: SecurityEvent | where EventID == 4688 | where (ParentProcessName endswith @'\svchost.exe' and (NewProcessName endswith @'\winword.exe' or NewProcessName endswith @'\excel.exe' or NewProcessName endswith @'\powerpnt.exe' or NewProcessName endswith @'\msaccess.exe' or NewProcessName endswith @'\mspub.exe' or NewProcessName endswith @'\eqnedt32.exe' or NewProcessName endswith @'\visio.exe'))
      timespan:
        complex:
          root: inputs.LogAnalyticsTimespan
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -210,
          "y": 1980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "58":
    id: "58"
    taskid: fb3f8b49-440f-442f-830d-2bb8a1456deb
    type: regular
    task:
      id: fb3f8b49-440f-442f-830d-2bb8a1456deb
      version: -1
      name: Suspicious New Instance Of An Office COM Object
      description: |-
        Detects an svchost process spawning an instance of an office application.
        May cause high rate of False Positives.
      tags:
      - SIEMResults
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "52"
    scriptarguments:
      earliest_time:
        complex:
          root: inputs.SplunkEarliestTime
      query:
        simple: index=* source="WinEventLog:*" AND (ParentImage="*\\svchost.exe" AND (Image="*\\winword.exe" OR Image="*\\excel.exe" OR Image="*\\powerpnt.exe" OR Image="*\\msaccess.exe" OR Image="*\\mspub.exe" OR Image="*\\eqnedt32.exe" OR Image="*\\visio.exe"))
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 670,
          "y": 1980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "59":
    id: "59"
    taskid: 16b0dd98-f968-41a9-802f-4385999fe252
    type: regular
    task:
      id: 16b0dd98-f968-41a9-802f-4385999fe252
      version: -1
      name: Suspicious New Instance Of An Office COM Object
      description: |-
        Detects an svchost process spawning an instance of an office application.
        May cause high rate of False Positives.
      tags:
      - SIEMResults
      script: '|||es-eql-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "53"
    scriptarguments:
      index:
        complex:
          root: inputs.ElasticIndex
      query:
        simple: (process.parent.executable.text:"*\\svchost.exe" AND process.executable.text:("*\\winword.exe" OR "*\\excel.exe" OR "*\\powerpnt.exe" OR "*\\msaccess.exe" OR "*\\mspub.exe" OR "*\\eqnedt32.exe" OR "*\\visio.exe"))
      timestamp_range_start:
        complex:
          root: inputs.ElasticEarliestTime
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1110,
          "y": 1980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "60":
    id: "60"
    taskid: f036b229-4a86-4588-8fad-a8e2d24e4671
    type: playbook
    task:
      id: f036b229-4a86-4588-8fad-a8e2d24e4671
      version: -1
      name: QRadarFullSearch
      description: This playbook runs a QRadar query and return its results to the context.
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "54"
    scriptarguments:
      interval:
        simple: "1"
      query_expression:
        simple: SELECT UTF8(payload) FROM events WHERE LOGSOURCETYPENAME(devicetype)='Microsoft Windows Security Event Log' AND CATEGORYNAME(category)='Process Creation Success' AND "ParentImage" ILIKE '%\svchost.exe' AND ("Image" ILIKE '%\winword.exe' OR "Image" ILIKE '%\excel.exe' OR "Image" ILIKE '%\powerpnt.exe' OR "Image" ILIKE '%\msaccess.exe' OR "Image" ILIKE '%\mspub.exe' OR "Image" ILIKE '%\eqnedt32.exe' OR "Image" ILIKE '%\visio.exe')
      range:
        complex:
          root: inputs.QRadarTimeRange
      timeout:
        simple: "600"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "61":
    id: "61"
    taskid: 8b820b26-df56-425d-855c-4d9714f377ba
    type: regular
    task:
      id: 8b820b26-df56-425d-855c-4d9714f377ba
      version: -1
      name: Suspicious New Instance Of An Office COM Object
      description: |-
        Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised.
        When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file,
        unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "36"
    scriptarguments:
      query:
        simple: dataset = xdr_data | filter causality_actor_process_image_name ~= "svchost.exe" and (action_process_image_name ~= "winword.exe" or action_process_image_name ~= "excel.exe" or action_process_image_name ~= "powerpnt.exe" or action_process_image_name ~= "msaccess.exe" or action_process_image_name ~= "mspub.exe" or action_process_image_name ~= "eqnedt32.exe" or action_process_image_name ~= "visio.exe" )
      query_name:
        simple: Suspicious New Instance Of An Office COM Object
      time_frame:
        complex:
          root: inputs.XQLTimeRange
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1990,
          "y": 1980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "62":
    id: "62"
    taskid: 585b92cf-4169-472e-8bc0-4c847159bd9a
    type: title
    task:
      id: 585b92cf-4169-472e-8bc0-4c847159bd9a
      version: -1
      name: Panorama Threat Prevention
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "63"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2530,
          "y": 1495
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "63":
    id: "63"
    taskid: 5f15af29-acd4-4c9e-8c3f-c8815f5509d6
    type: playbook
    task:
      id: 5f15af29-acd4-4c9e-8c3f-c8815f5509d6
      version: -1
      name: Panorama Query Logs
      description: 'Query Panorama Logs of types: traffic, threat, url, data-filtering and wildfire.'
      playbookName: Panorama Query Logs
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    scriptarguments:
      log_type:
        simple: threat
      query:
        simple: (threatid eq 86775) or (threatid eq 86776) or (threatid eq 86777)
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 2530,
          "y": 1810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "64":
    id: "64"
    taskid: 88d46991-cc9a-4298-8f85-52df74cad4dc
    type: title
    task:
      id: 88d46991-cc9a-4298-8f85-52df74cad4dc
      version: -1
      name: CVE Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "65"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1460,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "65":
    id: "65"
    taskid: 2143eecb-6a54-47b7-8062-36fe11c1361b
    type: playbook
    task:
      id: 2143eecb-6a54-47b7-8062-36fe11c1361b
      version: -1
      name: Search Endpoint by CVE - Generic
      description: Hunt for assets with a given CVE using available tools
      playbookName: Search Endpoint by CVE - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    scriptarguments:
      CVE_ID:
        complex:
          root: CVE
          accessor: ID
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -1460,
          "y": 1650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "21_30_Yes": 0.41,
      "21_43_#default#": 0.24,
      "22_32_Yes": 0.41,
      "22_43_#default#": 0.24,
      "23_31_Yes": 0.41,
      "23_43_#default#": 0.16,
      "24_29_yes": 0.41,
      "24_43_#default#": 0.17,
      "34_43_#default#": 0.1
    },
    "paper": {
      "dimensions": {
        "height": 3655,
        "width": 4370,
        "x": -1460,
        "y": 170
      }
    }
  }
inputs:
- key: PlaybookDescription
  value:
    simple: "## CVE-2023-36884 - Microsoft Office and Windows HTML RCE\n\n**Summary:**\n\nMicrosoft recently detected a sophisticated phishing campaign orchestrated by a threat actor called Storm-0978. The targets of this campaign were defense and government organizations in Europe and North America. The attackers exploited the previously undisclosed CVE-2023-36884, introduced in July's recent Patch Tuesday release.\n\nCVE-2023-36884 is affecting both Office and Windows. This zero-day vulnerability enables remote code execution through specially crafted Microsoft Office documents.\n\n**This playbook should be triggered manually or can be configured as a job.** \n\nPlease create a new incident and choose the CVE-2023-36884 - Office and Windows HTML RCE playbook and Rapid Breach Response incident type.\n\n**The playbook includes the following tasks:**\n\n**IoCs Collection**\n- Unit42 IoCs download\n\n**Hunting:**\n- PANW Hunting:\n  - Cortex XDR XQL exploitation patterns hunting\n  - Panorama Threat IDs hunting\n- Advanced SIEM exploitation patterns hunting\n- Indicators hunting\n- Endpoints by CVE hunting\n\nThe hunting queries are searching for the following activities:\n  - Detects a Microsoft Office file drops a file called 'file001.url'.\n  - Suspicious New Instance Of An Office COM Object\n  - Change PowerShell Policies to an Insecure Level\n\n`Please note that the threat hunting queries are related to the behavior identified as part of the exploitation patterns and may result in false positive detections.`\n\n**Mitigations:**\n- Microsoft mitigation measures\n\n**References:**\n\n[CVE-2023-36884 - Microsoft Office and Windows HTML Remote Code Execution: Threat Brief](https://unit42.paloaltonetworks.com/cve-2023-36884-rce/)\n[Storm-0978 attacks reveal financial and espionage motives\n](https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/)"
  required: false
  description: The playbook description to be used in the Rapid Breach Response - Set Incident Info sub-playbook.
  playbookInputQuery:
- key: XQLTimeRange
  value:
    simple: 14 days ago
  required: false
  description: The time range for the XQL queries.
  playbookInputQuery:
- key: SplunkEarliestTime
  value:
    simple: -14d@d
  required: false
  description: The time range for the Splunk queries.
  playbookInputQuery:
- key: ElasticEarliestTime
  value:
    simple: now-14d/d
  required: false
  description: The time range for the Elastic queries.
  playbookInputQuery:
- key: ElasticIndex
  value: {}
  required: false
  description: The elastic index to search in.
  playbookInputQuery:
- key: LogAnalyticsTimespan
  value:
    simple: 14d
  required: false
  description: The time range for the Azure Log Analytics queries.
  playbookInputQuery:
- key: QRadarTimeRange
  value:
    simple: Last 14 Days
  required: false
  description: The time range for the QRadar queries.
  playbookInputQuery:
- key: autoBlockIndicators
  value:
    simple: "True"
  required: false
  description: Wether to block the indicators automatically.
  playbookInputQuery:
inputSections:
- inputs:
  - PlaybookDescription
  name: Incident Management
  description: Incident management settings and data, including escalation processes, and user engagements.
- inputs:
  - XQLTimeRange
  - SplunkEarliestTime
  - ElasticEarliestTime
  - ElasticIndex
  - LogAnalyticsTimespan
  - QRadarTimeRange
  name: Investigation
  description: Incident management settings and data, including escalation processes, and user engagements.
- inputs:
  - autoBlockIndicators
  name: Remediation
  description: Remediation settings and data, including containment, eradication, and recovery.
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.9.0