Command-Line Analysis

This playbook takes a command line from the alert and performs the following actions: - Checks for base64 string and decodes if exists - Extracts and enriches indicators from the command line - Checks specific arguments for malicious usage At the end of the playbook, it sets a possible verdict for the command line, based on the finding: 1. Indicators found in the command line 2. Found AMSI techniques 3. Found suspicious parameters 4. Usage of malicious tools 5. Indication of network activity 6. Indication of suspicious LOLBIN execution 7. Suspicious path and arguments in the command line Note: To run this playbook with a list of command lines, set this playbook to run in a loop. To do so, navigate to 'Loop' and check "For Each Input".

Common Playbooks · 34 tasks · 2 inputs · 16 outputs

Inputs

  • Commandline — The command line.
  • StringSimilarityThreshold — StringSimilarity automation threshold. Used by the Compare "Process Execution Arguments To LOLBAS Patterns" sub-playbook. This input controls the StringSimilarity automation threshold.

Outputs

  • MatchRegex — The regex found in the command line.
  • Indicators — Indicators extracted from the command line.
  • commandline.original — The original command line.
  • commandline.decoded — The decoded command line.
  • IP — The IP object.
  • URL — The URL object.
  • File — The file object.
  • Domain — The domain object.
  • CommandlineVerdict.base64 — Command line verdict base64 was found. True/False
  • CommandlineVerdict.suspiciousParameters — Command line verdict suspicious parameters found. True/False
  • CommandlineVerdict.AMSI — Command line verdict AMSI found. True/False
  • CommandlineVerdict.foundIndicators — Command line verdict foundIndicators found. True/False
  • CommandlineVerdict.maliciousTools — Command line verdict maliciousTools found. True/False
  • CommandlineVerdict.networkActivity — Command line verdict networkActivity found. True/False
  • CommandlineVerdict.SuspiciousLolbinExecution — Command line verdict SuspiciousLolbinExecution found. True/False
  • CommandlineVerdict.SuspiciousCmdPathAndArguments — Command line verdict SuspiciousCmdPathAndArguments found. True/False

Commands used

extractIndicators

Flowchart

yes yes yes yes yes yes yes yes yes Yes yes Start Start Command-Line Indicator Extraction Command-Line Indicator Ex... Is there a base64 string in the command-line? Is there a base64 string ... Decode base64 string - Base64Decode Decode base64 string Base64Decode Done Done Check if base64 string exists in command-line - MatchRegexV2 Check if base64 string ex... MatchRegexV2 Command-Line Parameters Command-Line Parameters Set command line verdict of networkActivity - Set Set command line verdict ... Set Check for suspicious parameters usage Check for suspicious para... Check for encoded command parameters Check for encoded command... Check for network activity parameters Check for network activit... Check for malicious tools usage Check for malicious tools... Check for AMSI evasion techniques Check for AMSI evasion te... Extract indicators from command-line - extractIndicators Extract indicators from c... extractIndicators Set decoded commandline - Set Set decoded commandline Set Set command line verdict of maliciousTools - Set Set command line verdict ... Set Set command line verdict of suspiciousParameters - Set Set command line verdict ... Set Set command line verdict of AMSI - Set Set command line verdict ... Set Set command line verdict - Set Set command line verdict Set Found indicators in the command-line? Found indicators in the c... Set command line verdict of foundIndicators - Set Set command line verdict ... Set Set original commandline - Set Set original commandline Set Is there a command line input? Is there a command line i... Delete "Decode" Context - DeleteContext Delete "Decode" Context DeleteContext Suspicious LOLBIN Execution Suspicious LOLBIN Execution Compare Process Execution Arguments To LOLBAS Patterns - Compare Process Execution Arguments To LOLBAS Patterns Compare Process Execution... Compare Process Execution Arg... Found suspicious LOLBIN execution? Found suspicious LOLBIN e... Set command line verdict of SuspiciousLolbinExecution - Set Set command line verdict ... Set Suspicious Command-line path and arguments Suspicious Command-line p... Search for suspicious path in the Command-line - MatchRegexV2 Search for suspicious pat... MatchRegexV2 Found any suspicious path in the Command-line Found any suspicious path... Search for suspicious arguments with a suspicious path - MatchRegexV2 Search for suspicious arg... MatchRegexV2 Found suspicious Command-line path and arguments? Found suspicious Command-... Set command line verdict of SuspiciousCmdPathAndArguments - Set Set command line verdict ... Set