Cloud Token Theft - Set Verdict

--- ## Cloud Token Theft - Set Verdict Playbook The playbook is built from a decision tree whose ultimate goal is to decide whether the observed activity is malicious. ### Event Search The playbook searches for events based on the attacker's IP address within the last two hours. ### Tests Performed The following tests are performed on the observed activity: 1. **Malicious IP Check**: Determines if the IP address is malicious. 2. **CSP ASN Check**: Checks if the activity was performed from an Autonomous System Number (ASN) belonging to one of the Cloud Service Providers (CSPs). 3. **IP and ASN History Check**: Verifies if the IP address and ASN have been previously observed. 4. **Region Check**: Determines if the API call was made from outside the recognized region. 5. **Anomalous State Check**: Checks if the API call was made from an anomalous state. 6. **Alert Check**: Looks for any related alerts around the event, including: - Possible cloud instance metadata service (IMDS) abuse. - Impossible Traveler by cloud identity. ---

Cloud Incident Response · 12 tasks · 2 inputs · 2 outputs

Details

ID	`Cloud Token Theft - Set Verdict`
From Version	6.8.0
Tasks	12

README

Cloud Token Theft - Set Verdict Playbook

The playbook is built from a decision tree whose ultimate goal is to decide whether the observed activity is malicious.

Event Search

The playbook searches for events based on the attacker’s IP address within the last two hours.

Tests Performed

The following tests are performed on the observed activity:

Malicious IP Check: Determines if the IP address is malicious.
CSP ASN Check: Checks if the activity was performed from an Autonomous System Number (ASN) belonging to one of the Cloud Service Providers (CSPs).
IP and ASN History Check: Verifies if the IP address and ASN have been previously observed.
Region Check: Determines if the API call was made from outside the recognized region.
Anomalous State Check: Checks if the API call was made from an anomalous state.
Alert Check: Looks for any related alerts around the event, including:
- Possible cloud instance metadata service (IMDS) abuse.
- Impossible Traveler by cloud identity.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

Commands

getAlerts

Playbook Inputs

Name	Description	Default Value	Required
sourceIP	The source IP to search by additional alerts.		Optional
fromDate	The start date for the search additional alerts task. Filter by from date (e.g., “3 days ago” or 2006-01-02T15:04:05+07:00 or 2006-01-02T15:04:05Z)		Optional

Playbook Outputs

Path	Description	Type
alertVerdict	The alert verdict.	unknown
foundIncidents	The additional alerts found.	unknown

Playbook Image

Cloud Token Theft - Set Verdict

Inputs

sourceIP — The source IP to search by additional alerts.
fromDate — The start date for the search additional alerts task. Filter by from date (e.g., "3 days ago" or 2006-01-02T15:04:05+07:00 or 2006-01-02T15:04:05Z)

Outputs

alertVerdict — The alert verdict.
foundIncidents — The additional alerts found.

Commands used

getAlerts

Flowchart

Source

playbook-Cloud_Token_Theft_-_Set_Verdict.yml

Download History Raw

id: Cloud Token Theft - Set Verdict
version: -1
name: Cloud Token Theft - Set Verdict
description: |-
  ---

  ## Cloud Token Theft  - Set Verdict Playbook

  The playbook is built from a decision tree whose ultimate goal is to decide whether the observed activity is malicious.

  ### Event Search

  The playbook searches for events based on the attacker's IP address within the last two hours.

  ### Tests Performed

  The following tests are performed on the observed activity:

  1. **Malicious IP Check**: Determines if the IP address is malicious.
  2. **CSP ASN Check**: Checks if the activity was performed from an Autonomous System Number (ASN) belonging to one of the Cloud Service Providers (CSPs).
  3. **IP and ASN History Check**: Verifies if the IP address and ASN have been previously observed.
  4. **Region Check**: Determines if the API call was made from outside the recognized region.
  5. **Anomalous State Check**: Checks if the API call was made from an anomalous state.
  6. **Alert Check**: Looks for any related alerts around the event, including:
     - Possible cloud instance metadata service (IMDS) abuse.
     - Impossible Traveler by cloud identity.

  ---
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 8edcb308-c0b8-46f2-8858-38f2fb3a5e58
    type: start
    task:
      id: 8edcb308-c0b8-46f2-8858-38f2fb3a5e58
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 100,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 9e581115-9afa-473a-81e8-23b0a8268515
    type: condition
    task:
      id: 9e581115-9afa-473a-81e8-23b0a8268515
      version: -1
      name: Check caller IP reputation
      description: Checks the verdict logic. Refer to the playbook description for detailed information.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      Malicious:
      - "4"
    separatecontext: false
    conditions:
    - label: Malicious
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: DBotScore
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: DBotScore.Indicator
                      iscontext: true
                    right:
                      value:
                        simple: inputs.sourceIP
                      iscontext: true
                accessor: Score
            iscontext: true
          right:
            value:
              simple: "2"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 100,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 759d168e-6a6f-470b-83da-af9a108070a0
    type: regular
    task:
      id: 759d168e-6a6f-470b-83da-af9a108070a0
      version: -1
      name: Get additional alerts
      description: commands.local.cmd.get.incs
      script: Builtin|||getAlerts
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      fromdate:
        complex:
          root: inputs.fromDate
      query:
        simple: hostip:${inputs.sourceIP}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 100,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 81f407f2-b2e4-4a82-8a59-171e1d156546
    type: regular
    task:
      id: 81f407f2-b2e4-4a82-8a59-171e1d156546
      version: -1
      name: Set verdict - Malicious
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      key:
        simple: alertVerdict
      value:
        simple: Malicious
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 100,
          "y": 2110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: d3428dc0-7a40-4d18-8f60-91fc15d5856c
    type: regular
    task:
      id: d3428dc0-7a40-4d18-8f60-91fc15d5856c
      version: -1
      name: Set verdict - User verification
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      key:
        simple: alertVerdict
      value:
        simple: userVerification
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -780,
          "y": 2110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 992685e9-199f-4467-8e95-7aa0bec6d1aa
    type: condition
    task:
      id: 992685e9-199f-4467-8e95-7aa0bec6d1aa
      version: -1
      name: Check source ASN
      description: Detailed explanation available in the playbook description.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      Cloud ASN:
      - "5"
    separatecontext: false
    conditions:
    - label: Cloud ASN
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: Core.OriginalAlert.event.caller_ip_asn_org
            iscontext: true
          right:
            value:
              simple: GOOGLE
          ignorecase: true
        - operator: containsGeneral
          left:
            value:
              simple: Core.OriginalAlert.event.caller_ip_asn_org
            iscontext: true
          right:
            value:
              simple: MICROSOFT
        - operator: containsGeneral
          left:
            value:
              simple: Core.OriginalAlert.event.caller_ip_asn_org
            iscontext: true
          right:
            value:
              simple: AMAZON
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -780,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: b14d1b34-a5d1-40c5-8055-27b3eb16a0e5
    type: condition
    task:
      id: b14d1b34-a5d1-40c5-8055-27b3eb16a0e5
      version: -1
      name: Check ASN & Agent IP popularity
      description: Checks the verdict logic. Refer to the playbook description for detailed information.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "12"
      Malicious:
      - "4"
    separatecontext: false
    conditions:
    - label: Malicious
      condition:
      - - operator: isEqualNumber
          left:
            value:
              simple: Core.OriginalAlert.event.cloud_agent_external_ip_days_seen_count
            iscontext: true
          right:
            value:
              simple: "0"
      - - operator: isEqualNumber
          left:
            value:
              simple: Core.OriginalAlert.event.cloud_caller_ip_asn_count_distinct_cloud_best_identity
            iscontext: true
          right:
            value:
              simple: "0"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -390,
          "y": 1200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: eae9a464-1de4-4c8d-8cc5-b7689233d15d
    type: condition
    task:
      id: eae9a464-1de4-4c8d-8cc5-b7689233d15d
      version: -1
      name: Check for API call executed outside the instance region
      description: Detailed explanation available in the playbook description.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "13"
      Malicious:
      - "4"
    separatecontext: false
    conditions:
    - label: Malicious
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: foundIncidents.name
            iscontext: true
          right:
            value:
              simple: A compute-attached identity executed API calls outside the instance's region
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -390,
          "y": 1380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 5983c9cf-dc47-4e55-889d-3c5fb3a5ef38
    type: condition
    task:
      id: 5983c9cf-dc47-4e55-889d-3c5fb3a5ef38
      version: -1
      name: Check for API call from unusual country
      description: Detailed explanation available in the playbook description.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "14"
      Malicious:
      - "4"
    separatecontext: false
    conditions:
    - label: Malicious
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: foundIncidents.name
            iscontext: true
          right:
            value:
              simple: A cloud identity executed an API call from an unusual country
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -390,
          "y": 1560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 8cccf35c-4e55-4b0f-8a41-1e467d990fad
    type: condition
    task:
      id: 8cccf35c-4e55-4b0f-8a41-1e467d990fad
      version: -1
      name: Check for IMDS Access alert
      description: Detailed explanation available in the playbook description.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "15"
      Malicious:
      - "4"
    separatecontext: false
    conditions:
    - label: Malicious
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: foundIncidents.name
            iscontext: true
          right:
            value:
              simple: Possible Cloud Instance Metadata Service (IMDS) Abuse
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -390,
          "y": 1740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 4ee22698-d941-42a5-8add-87640f6d13e5
    type: condition
    task:
      id: 4ee22698-d941-42a5-8add-87640f6d13e5
      version: -1
      name: Check for Impossible Traveler alert
      description: Detailed explanation available in the playbook description.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      Malicious:
      - "4"
    separatecontext: false
    conditions:
    - label: Malicious
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: foundIncidents.name
            iscontext: true
          right:
            value:
              simple: Impossible travel by cloud identity
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -390,
          "y": 1925
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 78982aba-a0ea-4afa-848b-23338d4f91ad
    type: title
    task:
      id: 78982aba-a0ea-4afa-848b-23338d4f91ad
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -780,
          "y": 2290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "11_12_#default#": 0.39,
      "11_4_Malicious": 0.22,
      "12_13_#default#": 0.4,
      "12_4_Malicious": 0.26,
      "13_14_#default#": 0.42,
      "13_4_Malicious": 0.31,
      "14_15_#default#": 0.41,
      "14_4_Malicious": 0.41,
      "15_4_Malicious": 0.51,
      "15_5_#default#": 0.13,
      "2_4_Malicious": 0.1,
      "2_6_#default#": 0.1,
      "6_5_Cloud ASN": 0.11
    },
    "paper": {
      "dimensions": {
        "height": 1785,
        "width": 1260,
        "x": -780,
        "y": 570
      }
    }
  }
inputs:
- key: sourceIP
  value: {}
  required: false
  description: The source IP to search by additional alerts.
  playbookInputQuery:
- key: fromDate
  value: {}
  required: false
  description: |-
    The start date for the search additional alerts task.

    Filter by from date (e.g., "3 days ago" or 2006-01-02T15:04:05+07:00 or 2006-01-02T15:04:05Z)
  playbookInputQuery:
outputs:
- contextPath: alertVerdict
  description: The alert verdict.
  type: unknown
- contextPath: foundIncidents
  description: The additional alerts found.
  type: unknown
quiet: false
tests:
- No tests (auto formatted)
marketplaces: 
- marketplacev2
- platform
fromversion: 6.8.0