Command-Line Analysis

id: Command-Line Analysis
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Command-Line Analysis
description: "This playbook takes a command line from the alert and performs the following actions:\n- Checks for base64 string and decodes if exists\n- Extracts and enriches indicators from the command line\n- Checks specific arguments for malicious usage \n\nAt the end of the playbook, it sets a possible verdict for the command line, based on the finding:\n1. Indicators found in the command line\n2. Found AMSI techniques\n3. Found suspicious parameters\n4. Usage of malicious tools\n5. Indication of network activity\n6. Indication of suspicious LOLBIN execution\n7. Suspicious path and arguments in the command line\n\nNote: To run this playbook with a list of command lines, set this playbook to run in a loop. To do so, navigate to 'Loop'  and check \"For Each Input\"."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: a2848830-3438-4bea-87eb-793c8026f1ef
    type: start
    task:
      id: a2848830-3438-4bea-87eb-793c8026f1ef
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2530,
          "y": -1620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: d0ba6b98-7de7-4621-8d6b-85a067f4f314
    type: title
    task:
      id: d0ba6b98-7de7-4621-8d6b-85a067f4f314
      version: -1
      name: Command-Line Indicator Extraction
      description: Extracts indicators from the command line.
      type: title
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "23"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2240,
          "y": 0
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 95c7a960-8b66-48f0-8510-ed22481ae4f2
    type: condition
    task:
      id: 95c7a960-8b66-48f0-8510-ed22481ae4f2
      version: -1
      name: Is there a base64 string in the command-line?
      description: Checks for a base64 string in the command line.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: MatchRegex
                accessor: results
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2010,
          "y": -830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 7c5def9c-5b0b-4c84-867e-43de7bfe984c
    type: regular
    task:
      id: 7c5def9c-5b0b-4c84-867e-43de7bfe984c
      version: -1
      name: Decode base64 string
      description: Decodes an input in Base64 format.
      scriptName: Base64Decode
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      value:
        complex:
          root: MatchRegex
          accessor: results
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1820,
          "y": -660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 81a7238c-3db0-43d4-89e3-5f4e7da0f2f7
    type: title
    task:
      id: 81a7238c-3db0-43d4-89e3-5f4e7da0f2f7
      version: -1
      name: Done
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2530,
          "y": 1780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 8a4fdd44-5f23-4285-8e9f-3219392329a5
    type: regular
    task:
      id: 8a4fdd44-5f23-4285-8e9f-3219392329a5
      version: -1
      name: Check if base64 string exists in command-line
      description: Extracts regex data from the provided text. The script support groups and looping.
      scriptName: MatchRegexV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      data:
        complex:
          root: commandline.original
      group:
        simple: "1"
      regex:
        simple: (?:^|[ \"'])((?:[A-Za-z0-9+/]{4}){4,}(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))(?:$|[ \"'])
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2010,
          "y": -980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 5610ad88-bc53-45a1-865c-6a6b607e1a98
    type: title
    task:
      id: 5610ad88-bc53-45a1-865c-6a6b607e1a98
      version: -1
      name: Command-Line Parameters
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
      - "19"
      - "21"
      - "22"
      - "31"
      - "39"
      - "45"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2240,
          "y": 1260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: b027e4bc-d481-4f58-842d-395bd7ef348f
    type: regular
    task:
      id: b027e4bc-d481-4f58-842d-395bd7ef348f
      version: -1
      name: Set command line verdict of networkActivity
      description: Sets a value in context from the key entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      key:
        simple: CommandlineVerdict.networkActivity
      value:
        simple: "True"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 961ec942-dacf-4f4a-8b34-7e2847919a5e
    type: condition
    task:
      id: 961ec942-dacf-4f4a-8b34-7e2847919a5e
      version: -1
      name: Check for suspicious parameters usage
      description: Checks for suspicious parameters usage.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "27"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: -w hidden
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: -WindowStyle Hidden
          ignorecase: true
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
            iscontext: true
          right:
            value:
              simple: -window hidden
          ignorecase: true
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: -noni
          ignorecase: true
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: -NonInteractive
          ignorecase: true
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: -nop
          ignorecase: true
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: -noprofile
          ignorecase: true
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: -ExecutionPolicy Bypass
          ignorecase: true
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: Bypass
          ignorecase: true
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
            iscontext: true
          right:
            value:
              simple: Invoke-Expression
          ignorecase: true
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: -iex
          ignorecase: true
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: ClipboardContents
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: Screenshot
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: Get-LSASecret
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: Get-GPPPassword
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 1410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 4191d8a3-0ed7-4abd-8b4d-a2fe3af03fa4
    type: condition
    task:
      id: 4191d8a3-0ed7-4abd-8b4d-a2fe3af03fa4
      version: -1
      name: Check for encoded command parameters
      description: Checks for encoded command parameters.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsString
          left:
            value:
              complex:
                root: commandline.original
            iscontext: true
          right:
            value:
              simple: -EncodedCommand
          ignorecase: true
        - operator: containsString
          left:
            value:
              complex:
                root: commandline.original
            iscontext: true
          right:
            value:
              simple: -enc
          ignorecase: true
        - operator: containsString
          left:
            value:
              complex:
                root: commandline.original
            iscontext: true
          right:
            value:
              simple: –^e^C^
          ignorecase: true
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
            iscontext: true
          right:
            value:
              simple: '-e '
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2240,
          "y": -1150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 6f484473-7f55-4d72-8ce3-07361395169c
    type: condition
    task:
      id: 6f484473-7f55-4d72-8ce3-07361395169c
      version: -1
      name: Check for network activity parameters
      description: Checks for network activity parameters.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: (New-object System.net.webclient).DownlodFile()
          ignorecase: true
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: (New-object System.net.Webclient).DownloadString()
          ignorecase: true
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: Net.webclient
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: e3b1b82d-4b1c-4cd4-8273-f4b2b3f9477f
    type: condition
    task:
      id: e3b1b82d-4b1c-4cd4-8273-f4b2b3f9477f
      version: -1
      name: Check for malicious tools usage
      description: Checks for malicious tools usage.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "26"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: mimikatz
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: NinjaCopy
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: NetRipper
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: ThunderStruck
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: PsExec
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: Mimikittenz
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: MailRaider
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: VoiceTroll
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: Get-RickAstley
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 920,
          "y": 1410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: b355c8cd-9438-4d16-88cf-367aad8dc5a2
    type: condition
    task:
      id: b355c8cd-9438-4d16-88cf-367aad8dc5a2
      version: -1
      name: Check for AMSI evasion techniques
      description: Checks for AMSI evasion techniques.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "28"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: System.Management.Automation.AmsiUtils
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: amsiInitFailed
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: QQBtAHMAaQBVAHQAaQBsAHMA
          ignorecase: true
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA==
          ignorecase: true
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: LoadLibrary("amsi.dll")
        - operator: containsString
          left:
            value:
              complex:
                root: commandline
                accessor: original
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: commandline.decoded
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: AmsiScanBuffer()
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1810,
          "y": 1410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: c56fef87-e77c-452f-850d-8a76d44d6e30
    type: regular
    task:
      id: c56fef87-e77c-452f-850d-8a76d44d6e30
      version: -1
      name: Extract indicators from command-line
      description: Extracts indicators from the command line.
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "37"
    scriptarguments:
      text:
        complex:
          root: commandline
          transformers:
          - operator: RemoveEmpty
            args:
              empty_values: {}
              remove_keys:
                value:
                  simple: "true"
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2240,
          "y": 130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 4eb71ce1-0bd1-47e9-8679-293960d28e78
    type: regular
    task:
      id: 4eb71ce1-0bd1-47e9-8679-293960d28e78
      version: -1
      name: Set decoded commandline
      description: Sets a value in context from the key entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "36"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: commandline.decoded
      value:
        complex:
          root: inputs.Commandline
          filters:
          - - operator: containsString
              left:
                value:
                  simple: inputs.Commandline
                iscontext: true
              right:
                value:
                  simple: Base64.originalValue
                iscontext: true
          transformers:
          - operator: replace
            args:
              limit: {}
              replaceWith:
                value:
                  simple: Base64.decoded
                iscontext: true
              toReplace:
                value:
                  simple: MatchRegex.results
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1820,
          "y": -500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: c89fbf52-da5f-4bab-836e-07a697e0fb71
    type: regular
    task:
      id: c89fbf52-da5f-4bab-836e-07a697e0fb71
      version: -1
      name: Set command line verdict of maliciousTools
      description: Sets a value in context from the key entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      key:
        simple: CommandlineVerdict.maliciousTools
      value:
        simple: "True"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 920,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: b9b89f0b-8885-4908-8d0f-c785c90feddd
    type: regular
    task:
      id: b9b89f0b-8885-4908-8d0f-c785c90feddd
      version: -1
      name: Set command line verdict of suspiciousParameters
      description: Sets a value in context from the key entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      key:
        simple: CommandlineVerdict.suspiciousParameters
      value:
        simple: "True"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: 0fbff6eb-dc6e-4a75-876a-7dcb37dffa6b
    type: regular
    task:
      id: 0fbff6eb-dc6e-4a75-876a-7dcb37dffa6b
      version: -1
      name: Set command line verdict of AMSI
      description: Sets a value in context from the key entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      key:
        simple: CommandlineVerdict.AMSI
      value:
        simple: "True"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1810,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: cb6662a9-4a56-48b9-8b2d-e375410b246d
    type: regular
    task:
      id: cb6662a9-4a56-48b9-8b2d-e375410b246d
      version: -1
      name: 'Set command line verdict '
      description: Sets a value in context from the key entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      key:
        simple: CommandlineVerdict.base64
      value:
        simple: "True"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1820,
          "y": -170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 7d374634-8e9f-42f4-821e-aae890e35f05
    type: condition
    task:
      id: 7d374634-8e9f-42f4-821e-aae890e35f05
      version: -1
      name: Found indicators in the command-line?
      description: Checks if indicators exist in the command line.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "32"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: ExtractedIndicators
                filters:
                - - operator: isNotExists
                    left:
                      value:
                        simple: ExtractedIndicators.Attack_Pattern
                      iscontext: true
            iscontext: true
          right:
            value: {}
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2240,
          "y": 1410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 118d06f7-1309-4b4b-8b2d-6f56454411d9
    type: regular
    task:
      id: 118d06f7-1309-4b4b-8b2d-6f56454411d9
      version: -1
      name: Set command line verdict of foundIndicators
      description: Sets a value in context from the key entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      key:
        simple: CommandlineVerdict.foundIndicators
      value:
        simple: "True"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2240,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 1bde910b-a975-4fc5-8a0d-e05230b3ecf6
    type: regular
    task:
      id: 1bde910b-a975-4fc5-8a0d-e05230b3ecf6
      version: -1
      name: Set original commandline
      description: Sets a value in context from the key entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: commandline.original
      value:
        complex:
          root: inputs.Commandline
          transformers:
          - operator: RemoveEmpty
            args:
              empty_values: {}
              remove_keys:
                value:
                  simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2240,
          "y": -1315
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: d02185ac-3059-4ac1-84df-388155f7bfee
    type: condition
    task:
      id: d02185ac-3059-4ac1-84df-388155f7bfee
      version: -1
      name: Is there a command line input?
      description: Is there a command line input?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "33"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Commandline
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2530,
          "y": -1490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 0db44584-e9dc-435f-84d7-36315a8b5020
    type: regular
    task:
      id: 0db44584-e9dc-435f-84d7-36315a8b5020
      version: -1
      name: Delete "Decode" Context
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      key:
        simple: Base64
      subplaybook:
        simple: "yes"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1820,
          "y": -330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 940e7968-93d7-4fcb-86cb-46b9e276e19e
    type: title
    task:
      id: 940e7968-93d7-4fcb-86cb-46b9e276e19e
      version: -1
      name: Suspicious LOLBIN Execution
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "38"
      - "41"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2240,
          "y": 300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: 38a7a83c-9784-45a3-84b8-105caba13f26
    type: playbook
    task:
      id: 38a7a83c-9784-45a3-84b8-105caba13f26
      version: -1
      name: Compare Process Execution Arguments To LOLBAS Patterns
      description: 'This playbook takes a process name and a command line from the alert and performs the following actions:'
      playbookName: Compare Process Execution Arguments To LOLBAS Patterns
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "41"
    scriptarguments:
      Commandline:
        complex:
          root: commandline
          accessor: original
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: commandline.decoded
                iscontext: true
          - operator: uniq
      ProcessName:
        complex:
          root: commandline
          accessor: original
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: commandline.decoded
                iscontext: true
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case:
                value:
                  simple: "true"
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: \\([^\\"]+\.(?:exe))
              unpack_matches: {}
          - operator: RemoveEmpty
            args:
              empty_values: {}
              remove_keys: {}
          - operator: uniq
      StringSimilarityThreashold:
        complex:
          root: inputs.StringSimilarityThreshold
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1850,
          "y": 440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 3212780f-1634-43cd-8a59-39af8883e672
    type: condition
    task:
      id: 3212780f-1634-43cd-8a59-39af8883e672
      version: -1
      name: Found suspicious LOLBIN execution?
      description: "Found suspicious LOLBIN execution?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "40"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: SuspiciousLolbinArguments
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 70,
          "y": 1410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: 0de2c957-6cf3-4552-8776-c49fe89e5d60
    type: regular
    task:
      id: 0de2c957-6cf3-4552-8776-c49fe89e5d60
      version: -1
      name: Set command line verdict of SuspiciousLolbinExecution
      description: Sets a value in context from the key entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      key:
        simple: CommandlineVerdict.SuspiciousLolbinExecution
      value:
        simple: "True"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 70,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 5e4bfe08-b080-43f9-8930-25c8fef9b738
    type: title
    task:
      id: 5e4bfe08-b080-43f9-8930-25c8fef9b738
      version: -1
      name: Suspicious Command-line path and arguments
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "42"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2240,
          "y": 610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: 15a423f3-58a4-4bcb-8e17-45907b22ba0c
    type: regular
    task:
      id: 15a423f3-58a4-4bcb-8e17-45907b22ba0c
      version: -1
      name: Search for suspicious path in the Command-line
      description: Extracts regex data from the provided text. The script supports groups and looping.
      scriptName: MatchRegexV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    scriptarguments:
      contextKey:
        simple: SuspiciousCmdPath
      data:
        complex:
          root: commandline
          accessor: original
          transformers:
          - operator: AppendIfNotEmpty
            args:
              item:
                value:
                  simple: commandline.decoded
                iscontext: true
              raw: {}
      regex:
        simple: (?i)(\\temp\\)
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2240,
          "y": 740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: 38648326-762d-4be2-8cbc-081a0f8a04bc
    type: condition
    task:
      id: 38648326-762d-4be2-8cbc-081a0f8a04bc
      version: -1
      name: Found any suspicious path in the Command-line
      description: |-
        Determines the appropriate verdict based on:
        - IP Reputation.
        - Whether the task was created from an external IP address.
        - Suspicious Command-line parameters.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "12"
      "Yes":
      - "44"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: SuspiciousCmdPath
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2240,
          "y": 905
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: ec1a8793-7715-444e-812f-746b33637555
    type: regular
    task:
      id: ec1a8793-7715-444e-812f-746b33637555
      version: -1
      name: Search for suspicious arguments with a suspicious path
      description: Extracts regex data from the provided text. The script supports groups and looping.
      scriptName: MatchRegexV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      contextKey:
        simple: SuspiciousCmdPathAndArguments
      data:
        complex:
          root: commandline
          accessor: original
          transformers:
          - operator: AppendIfNotEmpty
            args:
              item:
                value:
                  simple: commandline.decoded
                iscontext: true
              raw: {}
      regex:
        simple: (?i)(rundll32|tasklist|lsass|shadow|wmic)
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2240,
          "y": 1100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: a86c5c18-8d9c-4034-8d0d-1da4b0aae564
    type: condition
    task:
      id: a86c5c18-8d9c-4034-8d0d-1da4b0aae564
      version: -1
      name: Found suspicious Command-line path and arguments?
      description: Found suspicious LOLBIN execution?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "46"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: SuspiciousCmdPathAndArguments
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -360,
          "y": 1410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: 3e622f6a-54fa-4ad8-8633-60f3943c489a
    type: regular
    task:
      id: 3e622f6a-54fa-4ad8-8633-60f3943c489a
      version: -1
      name: Set command line verdict of SuspiciousCmdPathAndArguments
      description: Sets a value in context from the key entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      key:
        simple: CommandlineVerdict.SuspiciousCmdPathAndArguments
      value:
        simple: "True"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -360,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "15_9_#default#": 0.71,
      "17_11_yes": 0.44,
      "17_4_#default#": 0.1,
      "19_13_yes": 0.5,
      "19_9_#default#": 0.9,
      "21_9_#default#": 0.71,
      "22_9_#default#": 0.85,
      "31_9_#default#": 0.9,
      "43_44_Yes": 0.38,
      "7_4_#default#": 0.27,
      "7_8_yes": 0.58
    },
    "paper": {
      "dimensions": {
        "height": 3465,
        "width": 3270,
        "x": -360,
        "y": -1620
      }
    }
  }
inputs:
- key: Commandline
  value: {}
  required: false
  description: The command line.
  playbookInputQuery:
- key: StringSimilarityThreshold
  value:
    simple: "0.5"
  required: false
  description: StringSimilarity automation threshold. Used by the Compare "Process Execution Arguments To LOLBAS Patterns" sub-playbook. This input controls the StringSimilarity automation threshold.
  playbookInputQuery:
outputs:
- contextPath: MatchRegex
  description: The regex found in the command line.
  type: unknown
- contextPath: Indicators
  description: Indicators extracted from the command line.
  type: unknown
- contextPath: commandline.original
  description: The original command line.
  type: unknown
- contextPath: commandline.decoded
  description: The decoded command line.
  type: unknown
- contextPath: IP
  description: The IP object.
  type: unknown
- contextPath: URL
  description: The URL object.
  type: uknown
- contextPath: File
  description: The file object.
  type: unknown
- contextPath: Domain
  description: The domain object.
  type: unknown
- contextPath: CommandlineVerdict.base64
  description: Command line verdict base64 was found. True/False
  type: unknown
- contextPath: CommandlineVerdict.suspiciousParameters
  description: Command line verdict suspicious parameters found. True/False
  type: unknown
- contextPath: CommandlineVerdict.AMSI
  description: Command line verdict AMSI found. True/False
  type: unknown
- contextPath: CommandlineVerdict.foundIndicators
  description: Command line verdict foundIndicators found. True/False
  type: unknown
- contextPath: CommandlineVerdict.maliciousTools
  description: Command line verdict maliciousTools found. True/False
  type: unknown
- contextPath: CommandlineVerdict.networkActivity
  description: Command line verdict networkActivity found. True/False
  type: unknown
- contextPath: CommandlineVerdict.SuspiciousLolbinExecution
  description: Command line verdict SuspiciousLolbinExecution found. True/False
  type: unknown
- contextPath: CommandlineVerdict.SuspiciousCmdPathAndArguments
  description: Command line verdict SuspiciousCmdPathAndArguments found. True/False
  type: unknown
tests:
- no tests
fromversion: 6.0.0