Cortex XDR - PrintNightmare Detection and Response

The playbook targets specific PrintNightmare rules written by Cortex XDR for both vulnerabilities: [CVE-2021-1675 LPE](https://nvd.nist.gov/vuln/detail/CVE-2021-1675) [CVE-2021-34527 RCE](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) This playbook includes the following tasks: - Containment of files, endpoints, users and IP Addresses - Enrichment of indicators - Data acquisition of system info and files using Cortex XDR - Eradicating compromised user credentials ** Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.

Cortex XDR by Palo Alto Networks · 36 tasks · 5 inputs · 0 outputs

Inputs

  • IsolateEndpointAutomatically — Whether to isolate the endpoint automatically
  • DisableAccountAutomatically — Whether to disable the account automatically
  • BlockIPAutomatically — Whether to block the IP Address automatically
  • EnrichAutomatically — Whether to run indicators auto enrichment automatically
  • UserVerification — Possible values: True/False. Whether to provide user verification for blocking IPs. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.

Commands used

ad-disable-account enrichIndicators xdr-get-incident-extra-data

Flowchart

yes yes yes yes yes yes yes yes yes yes yes yes Start Start Execute endpoint Isolation automatically? Execute endpoint Isolatio... Cortex XDR - Isolate Endpoint - Cortex XDR - Isolate Endpoint Cortex XDR - Isolate Endp... Cortex XDR - Isolate Endpoint Disable account automatically? Disable account automatic... Isolate affected endpoint manually Isolate affected endpoint... Disable affected account manually Disable affected account ... Done Done Containment Containment Block suspicious files manually Block suspicious files ma... Block suspicious IP Address automatically? Block suspicious IP Addre... Block attacker IP Address manually Block attacker IP Address... Acquire Data for Further Investigation Acquire Data for Further ... Eradication Eradication Revoke user credentials Revoke user credentials Enrichment Enrichment Auto Enrichment? Auto Enrichment? Account Enrichment - Generic v2.1 - Account Enrichment - Generic v2.1 Account Enrichment - Gene... Account Enrichment - Generic ... Indicators Enrichment - enrichIndicators Indicators Enrichment enrichIndicators Enrich Indicators manually Enrich Indicators manually Collect Exploitation Indicators Related Activity Collect Exploitation Ind... Threat Hunting - Generic - Threat Hunting - Generic Threat Hunting - Generic Threat Hunting - Generic Cortex XDR - Collect Files and System Info Cortex XDR - Collect Fil... Collect system info Collect system info Disable affected account - ad-disable-account Disable affected account ad-disable-account Endpoint Enrichment - Generic v2.1 - Endpoint Enrichment - Generic v2.1 Endpoint Enrichment - Gen... Endpoint Enrichment - Generic... Is there an account to disable? Is there an account to di... Is Active Directory Query v2 enabled? Is Active Directory Query... Is there an endpoint to isolate? Is there an endpoint to i... Is there an IP Address to block? Is there an IP Address to... Cortex XDR - get incident extra data - xdr-get-incident-extra-data Cortex XDR - get incident... xdr-get-incident-extra-data Search XDR incidents for suspicious network behavior - SearchIncidentsV2 Search XDR incidents for ... SearchIncidentsV2 Is Cortex XDR enabled? Is Cortex XDR enabled? Found PrintNightmare Incidents? Found PrintNightmare Inci... Retrieve suspicious files involved in the attack Retrieve suspicious files... Cortex XDR XQL queries Cortex XDR XQL queries Block IP - Generic v3 - Block IP - Generic v3 Block IP - Generic v3 Block IP - Generic v3