Cortex XDR - Possible External RDP Brute-Force

This playbook investigates a “Possible External RDP Brute Force” XDR Alert by gathering user, IP, and hostname information, and investigating if the following suspicious elements exists: - "IP Reputation" - Dbot Score is 2-3 - "Source geolocation" - RDP Connection made from rare geo-location - Related to campaign - IP address is related to campaign, based on TIM module - Hunting results - the hunt for indicators related to the source IP and the related campaign returned results - XDR Alert search - XDR Alerts that related to the same username and endpoint, and to the MITRE tactics that comes after "Credential Access", were found. - Risky User - The user that was identified in the attack was given a medium or high score by XDR's ITDR module. - Risky Host - The destination host that was identified in the attack was given a medium or high score by XDR's ITDR module. Set verdict method: * Critical Element - The "Critical Element" input allows you to select a specific element that, if identified as suspicious, the investigation's final verdict will be deemed a "True Positive". * Final Verdict - Each suspicious element is being added to an array called "Suspicious Elements", which is used to count potential security threats. The array size will be compared to a final threshold. If the size is greater than or equal to the threshold, the investigation's final verdict will be deemed a "True Positive". * User Engagement - The "UserEngagementThreshold" input allows you to set the number of suspicious elements that trigger user engagement. When this threshold is met, an email will be sent to the user and their manager asking for authorization of RDP activity. If the RDP activity is not authorized by the user, the investigation's final verdict will be deemed a "True Positive".

Cortex XDR by Palo Alto Networks · 59 tasks · 14 inputs · 0 outputs

Inputs

  • Username — RDP connection username.
  • ExternalIP — Source external IP address.
  • AutoRemediation — Set this value to "true" to enable auto remediation (IP Block and User Block).
  • FinalThreshold — The threshold number of suspicious elements required to determine a 'True Positive' verdict.
  • CriticalElement — You can select a specific element that, if identified as suspicious, will automatically set the final verdict as true positive. The following options are available: IP Reputation Related Campaign Hunting Results Related Alerts Unusual Country Risky User Risky Host NOTE: You can read about the meaning of every element in the playbook description.
  • UserEngagementThreshold — The threshold number of suspicious elements that will trigger a user engagement. Set 0 to disable user engagement. NOTICE: If this threshold is equal to or higher than "FinalThreshold", the final verdict will be deemed by the user response and not by the FinalThreshold calculation.
  • Hostname — RDP connection destination hostname.
  • EndpointID — RDP connection destination endpoint ID.
  • Alert_Name — Alert name.
  • AlertDescription — Alert description.
  • Country — Source external IP country.
  • IsolateEndpoint — Set this value to "true" to enable endpoint isolation in case of a true positive.
  • SOCEmailAddress — The SOC email address to use for the user engagement section.
  • EarlyContainment — Set this value to "true" to allow early containment when the IP is known malicious

Commands used

ad-expire-password ip setIncident

Flowchart

no yes yes yes yes yes yes yes Yes yes yes yes yes yes yes 0 or 1 2 or 3 yes yes Do Not Isolate Isolate Start Start Analysis Analysis Account Enrichment - Generic v2.1 - Account Enrichment - Generic v2.1 Account Enrichment - Gene... Account Enrichment - Generic ... Set Verdict Set Verdict Communicate With User? Communicate With User? User Communication User Communication Malicious Activity? Malicious Activity? Malicious Malicious Benign Benign Expire User Password - ad-expire-password Expire User Password ad-expire-password Done Done IP Enrichment - ip IP Enrichment ip Authorized Activity? Authorized Activity? Has related Indicators to hunt? Has related Indicators to... Threat Hunting - Generic - Threat Hunting - Generic Threat Hunting - Generic Threat Hunting - Generic Critical Element exist? Critical Element exist? Investigation - Related Indicators Hunt Investigation - Related I... Investigation Investigation Is the IP malicious? Is the IP malicious? Containment Execution Containment Execution IP and Account block playbooks executed? IP and Account block play... Containment Complete Containment Complete Isolate Endpoint Isolate Endpoint Isolate Endpoint? Isolate Endpoint? Cortex XDR - Get entity alerts by MITRE tactics - Cortex XDR - Get entity alerts by MITRE tactics Cortex XDR - Get entity a... Cortex XDR - Get entity alert... Cortex XDR - Get entity alerts by MITRE tactics - Cortex XDR - Get entity alerts by MITRE tactics Cortex XDR - Get entity a... Cortex XDR - Get entity alert... Set final verdict - setIncident Set final verdict setIncident Set final verdict - setIncident Set final verdict setIncident Cortex XDR - Isolate Endpoint - Cortex XDR - Isolate Endpoint Cortex XDR - Isolate Endp... Cortex XDR - Isolate Endpoint Remediation Complete Remediation Complete Set Account Details - setIncident Set Account Details setIncident TIM - Indicator Relationships Analysis - TIM - Indicator Relationships Analysis TIM - Indicator Relations... TIM - Indicator Relationships... Cortex XDR - Possible External RDP Brute-Force - Set Verdict - Cortex XDR - Possible External RDP Brute-Force - Set Verdict Cortex XDR - Possible Ext... Cortex XDR - Possible Externa... Has hunt results? Has hunt results? Set hunt results true - Set Set hunt results true Set User Investigation - Generic - User Investigation - Generic User Investigation - Generic User Investigation - Generic Block Indicators Block Indicators Account Password Expire Account Password Expire Is Active Directory Enabled? - IsIntegrationAvailable Is Active Directory Enabled? IsIntegrationAvailable Set endpoint isolation status - setIncident Set endpoint isolation st... setIncident Set user response - setIncident Set user response setIncident Block Indicators - Generic v3 - Block Indicators - Generic v3 Block Indicators - Generi... Block Indicators - Generic v3 Block Indicators - Generic v3 - Block Indicators - Generic v3 Block Indicators - Generi... Block Indicators - Generic v3 IP block executed? IP block executed? User containment executed? User containment executed? Set User Containment Executed - setIncident Set User Containment Exec... setIncident Set IP Block Executed - setIncident Set IP Block Executed setIncident IP block executed? IP block executed? User containment executed? User containment executed? Set IP Block Executed - setIncident Set IP Block Executed setIncident Set User Containment Executed - setIncident Set User Containment Exec... setIncident Check IP Reputation Check IP Reputation Set Reputation - Unknown or Benign - setIncident Set Reputation - Unknown ... setIncident Set Reputation - Suspicious or Malicious - setIncident Set Reputation - Suspicio... setIncident Early containment enabled? Early containment enabled? Early Containment Early Containment Endpoint Enrichment - Generic v2.1 - Endpoint Enrichment - Generic v2.1 Endpoint Enrichment - Gen... Endpoint Enrichment - Generic... Is the endpoint at high risk? Is the endpoint at high r... Recommend isolation anyway Recommend isolation anyway