Cortex XDR - Possible External RDP Brute-Force - Set Verdict

This playbook creating an array called "Suspicious Elements", which is used to count potential security threats. The following elements can be added to the array: - "IP Reputation" - DBot Score is 2-3 - "Source geolocation" - RDP Connection made from rare geo-location - Related to campaign - IP address is related to campaign, based on TIM module - Hunting results - the hunt for indicators related to the source IP and the related campaign returned results - XDR Alert search - XDR Alerts that related to the same username and endpoint, and to the MITRE tactics that comes after "Credential Access", were found. - Risky User - one or more risky users are involved in the incident, as identified by the Cortex XDR - IR integration's ITDR module. - Risky Host - one or more risky hosts are involved in the incident, as identified by the Cortex XDR - IR integration's ITDR module. The array will then be outputted and its size will be compared to a final threshold. If the size is greater than or equal to the threshold, the investigation's final verdict will be deemed a "True Positive."

Cortex XDR by Palo Alto Networks · 16 tasks · 7 inputs · 1 output

Details

ID	`Cortex XDR - Possible External RDP Brute-Force - Set Verdict`
From Version	6.8.0
Tasks	16

README

This playbook creating an array called “Suspicious Elements”, which is used to count potential security threats. The following elements can be added to the array:

“IP Reputation” - Dbot Score is 2-3
“Source geolocation” - RDP Connection made from rare geo-location
Related to campaign - IP address is related to campaign, based on TIM module
Hunting results - the hunt for indicators related to the source IP and the related campaign returned results
XDR Alert search - XDR Alerts that related to the same username and endpoint, and to the MITRE tactics that comes after “Credential Access”, were found.

The array will then be outputted and its size will be compared to a final threshold. If the size is greater than or equal to the threshold, the investigation’s final verdict will be deemed a “True Positive.”

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
RelatedAlerts	Number of XDR alerts that are related to the same user or endpoint.		Optional
RelatedCampaign	Campaign related to the external IP.		Optional
HuntResults	Determine whether hunting results exist. The input value should be true or false.		Optional
UnusualGeoLocation	determine whether the RDP connection has made RDP Connection made from rare geo-location. the input value should be true or false.		Optional
IpReputation	The external IP reputation.		Optional
XDRRiskyUser	Usernames of users that were found as risky by Cortex XDR.	PaloAltoNetworksXDR.RiskyUser.id	Optional
XDRRiskyHost	Hostnames that were found as risky by Cortex XDR.	PaloAltoNetworksXDR.RiskyHost.id	Optional

Playbook Outputs

Path	Description	Type
Suspicious_Elements	Array that contains all the suspicious elements.	unknown

Playbook Image

Cortex XDR - Possible External RDP Brute-Force - Set Verdict

Inputs

RelatedAlerts — Number of XDR alerts that are related to the same user or endpoint.
RelatedCampaign — Campaign related to the external IP.
HuntResults — Determine whether hunting results exist. The input value should be true or false.
UnusualGeoLocation — determine whether the RDP connection has made RDP Connection made from rare geo-location. the input value should be true or false.
IpReputation — The external IP reputation.
XDRRiskyUser — Usernames of users that were found as risky by Cortex XDR.
XDRRiskyHost — Hostnames that were found as risky by Cortex XDR.

Outputs

Suspicious_Elements — Array that contains all the suspicious elements.

Flowchart

Source

playbook-Cortex_XDR_-_Possible_External_RDP_Brute-Force_-_Set_Verdict.yml

Download History Raw

id: Cortex XDR - Possible External RDP Brute-Force - Set Verdict
version: -1
name: Cortex XDR - Possible External RDP Brute-Force - Set Verdict
description: "This playbook creating an array called \"Suspicious Elements\", which is used to count potential security threats. The following elements can be added to the array:\n\n- \"IP Reputation\" - DBot Score is 2-3 \n- \"Source geolocation\" - RDP Connection made from rare geo-location \n-  Related to campaign - IP address is related to campaign, based on TIM module\n-  Hunting results - the hunt for indicators related to the source IP and the related campaign returned results\n-  XDR Alert search - XDR Alerts that related to the same username and endpoint, and to the MITRE tactics that comes after \"Credential Access\", were found.\n- Risky User - one or more risky users are involved in the incident, as identified by the Cortex XDR - IR integration's ITDR module.\n- Risky Host - one or more risky hosts are involved in the incident, as identified by the Cortex XDR - IR integration's ITDR module.\n\n\nThe array will then be outputted and its size will be compared to a final threshold. If the size is greater than or equal to the threshold, the investigation's final verdict will be deemed a \"True Positive.\""
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f858fb51-cdf1-4ebc-82ef-52ce56de6555
    type: start
    task:
      id: f858fb51-cdf1-4ebc-82ef-52ce56de6555
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
      - "4"
      - "1"
      - "2"
      - "10"
      - "15"
      - "16"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: ad4c70ac-fa2f-4d57-84f7-9cbe13790fd1
    type: condition
    task:
      id: ad4c70ac-fa2f-4d57-84f7-9cbe13790fd1
      version: -1
      name: Related to specific campaign?
      description: Check if a related campaign exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.RelatedCampaign
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 30,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 598f8193-b48c-4682-8ec6-2d3c2240b87f
    type: condition
    task:
      id: 598f8193-b48c-4682-8ec6-2d3c2240b87f
      version: -1
      name: Has Hunting Results?
      description: Check if hunting results exist.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.HuntResults
                transformers:
                - operator: count
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: faddab4a-86fb-4ba6-8587-f9e75832c152
    type: condition
    task:
      id: faddab4a-86fb-4ba6-8587-f9e75832c152
      version: -1
      name: Has related alerts?
      description: Check if XDR related alerts exist.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.RelatedAlerts
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 880,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: ebf825df-cbb0-44bb-8c6c-217ff1d984be
    type: condition
    task:
      id: ebf825df-cbb0-44bb-8c6c-217ff1d984be
      version: -1
      name: Connection from unusual country?
      description: Check if the connection was made from an unusual country.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.UnusualGeoLocation
            iscontext: true
          right:
            value:
              simple: "false"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1300,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 301a9fe4-8dbd-4216-81c8-c41bdf9e98e8
    type: regular
    task:
      id: 301a9fe4-8dbd-4216-81c8-c41bdf9e98e8
      version: -1
      name: Set unusual country
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: Unusual Country
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1300,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Source Geolocation
      output:
        simple: Connection from unusual country
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: c5abd0de-b0a2-4646-8bf7-65f83996c7ac
    type: regular
    task:
      id: c5abd0de-b0a2-4646-8bf7-65f83996c7ac
      version: -1
      name: Set related alerts
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: Related Alerts
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 880,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: XDR Alert Search Results
      output:
        complex:
          root: inputs.RelatedAlerts
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 9eceb85c-37b8-4f99-8b8e-fa4afb28099b
    type: regular
    task:
      id: 9eceb85c-37b8-4f99-8b8e-fa4afb28099b
      version: -1
      name: Set hunting results
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: Hunting Results
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Hunt Results Count
      output:
        simple: Has campaign hunt results
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 0b05c05d-1cd9-4f4c-8e5e-479a54d6a7c8
    type: regular
    task:
      id: 0b05c05d-1cd9-4f4c-8e5e-479a54d6a7c8
      version: -1
      name: Set campaign
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: Related Campaign
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 30,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Part of Campaign
      output:
        complex:
          root: inputs.RelatedCampaign
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 61423854-c073-470c-8555-1cd6a1713304
    type: title
    task:
      id: 61423854-c073-470c-8555-1cd6a1713304
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: ab591416-07d8-4ed8-8433-e9d6e2e45424
    type: condition
    task:
      id: ab591416-07d8-4ed8-8433-e9d6e2e45424
      version: -1
      name: IP Reputation is suspicious?
      description: Check if the IP reputation is suspicious or higher.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: inputs.IpReputation
            iscontext: true
          right:
            value:
              simple: "2"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -390,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: ea8c7cf4-29d3-408d-862a-4335f62283f2
    type: regular
    task:
      id: ea8c7cf4-29d3-408d-862a-4335f62283f2
      version: -1
      name: Set IP Reputation
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: IP Reputation
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -390,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 6d003e29-d346-458d-8456-f929b1a66eab
    type: regular
    task:
      id: 6d003e29-d346-458d-8456-f929b1a66eab
      version: -1
      name: Add risky user to suspicious elements
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: Risky User
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -830,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 0a724d34-9e60-4f38-85e3-99228741f075
    type: condition
    task:
      id: 0a724d34-9e60-4f38-85e3-99228741f075
      version: -1
      name: Risky user involved?
      description: Checks if a risky user is involved in the incident.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.XDRRiskyUser
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -830,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: d45554b1-95ca-49af-8540-addc1a53c928
    type: condition
    task:
      id: d45554b1-95ca-49af-8540-addc1a53c928
      version: -1
      name: Risky host involved?
      description: Checks if a risky host is involved in the incident.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "17"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.XDRRiskyHost
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1260,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 39626191-a5ed-4a4a-8406-2582fd4a7d42
    type: regular
    task:
      id: 39626191-a5ed-4a4a-8406-2582fd4a7d42
      version: -1
      name: Add risky host to suspicious elements
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: Risky Host
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1260,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "10_9_#default#": 0.28,
      "15_9_#default#": 0.12,
      "16_9_#default#": 0.1,
      "1_9_#default#": 0.23,
      "2_9_#default#": 0.29,
      "3_9_#default#": 0.19,
      "4_9_#default#": 0.2
    },
    "paper": {
      "dimensions": {
        "height": 565,
        "width": 2940,
        "x": -1260,
        "y": 50
      }
    }
  }
inputs:
- key: RelatedAlerts
  value: {}
  required: false
  description: Number of XDR alerts that are related to the same user or endpoint.
  playbookInputQuery:
- key: RelatedCampaign
  value: {}
  required: false
  description: Campaign related to the external IP.
  playbookInputQuery:
- key: HuntResults
  value: {}
  required: false
  description: Determine whether hunting results exist. The input value should be true or false.
  playbookInputQuery:
- key: UnusualGeoLocation
  value: {}
  required: false
  description: ' determine whether the RDP connection has made RDP Connection made from rare geo-location. the input value should be true or false.'
  playbookInputQuery:
- key: IpReputation
  value: {}
  required: false
  description: The external IP reputation.
  playbookInputQuery:
- key: XDRRiskyUser
  value:
    complex:
      root: PaloAltoNetworksXDR.RiskyUser
      filters:
      - - operator: isEqualString
          left:
            value:
              simple: PaloAltoNetworksXDR.RiskyUser.risk_level
            iscontext: true
          right:
            value:
              simple: MED
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              simple: PaloAltoNetworksXDR.RiskyUser.risk_level
            iscontext: true
          right:
            value:
              simple: HIGH
          ignorecase: true
      accessor: id
      transformers:
      - operator: uniq
  required: false
  description: Usernames of users that were found as risky by Cortex XDR.
  playbookInputQuery:
- key: XDRRiskyHost
  value:
    complex:
      root: PaloAltoNetworksXDR.RiskyHost
      filters:
      - - operator: isEqualString
          left:
            value:
              simple: PaloAltoNetworksXDR.RiskyHost.risk_level
            iscontext: true
          right:
            value:
              simple: MED
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              simple: PaloAltoNetworksXDR.RiskyHost.risk_level
            iscontext: true
          right:
            value:
              simple: HIGH
          ignorecase: true
      accessor: id
      transformers:
      - operator: uniq
  required: false
  description: Hostnames that were found as risky by Cortex XDR.
  playbookInputQuery:
outputs:
- contextPath: Suspicious_Elements
  description: Array that contains all the suspicious elements.
  type: unknown
tests:
- no tests
fromversion: 6.8.0
contentitemexportablefields:
  contentitemfields: {}
system: true