Courses of Action - Command and Control

This playbook handles MITRE ATT&CK Techniques using intelligence-driven Courses of Action (COA) defined by Palo Alto Networks Unit 42 team. It utilizes each of the sub-playbooks for specific techniques that belong to this phase (tactic) according to the MITRE ATT&CK kill chain. The sub-playbook called depends on the technique input. ***Disclaimer: This playbook does not simulate an attack using the specified techniques, but follows the steps to remediation as defined by Palo Alto Networks Unit 42 team’s Actionable Threat Objects and Mitigations (ATOMs). Tactic: - TA0011: command and control MITRE ATT&CK Description: The adversary is trying to communicate with compromised systems to control them. Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses. Possible playbook triggers: - The playbook can be used as a part of the “Courses of Action - Collection” playbook to remediate techniques based on kill chain phase. - The playbook can be used as a part of the “MITRE ATT&CK - Courses of Action” playbook, that can be triggered by different sources and accepts the technique MITRE ATT&CK ID as an input.

MITRE ATT&CK - Courses of Action · 14 tasks · 5 inputs · 2 outputs

Details

IDCourses of Action - Command and Control
From Version6.5.0
Tasks14

README

This playbook handles MITRE ATT&CK Techniques using intelligence-driven Courses of Action (COA) defined by Palo Alto Networks Unit 42 team. It utilizes each of the sub-playbooks for specific techniques that belong to this phase (tactic) according to the MITRE ATT&CK kill chain. The sub-playbook called depends on the technique input.

***Disclaimer: This playbook does not simulate an attack using the specified techniques, but follows the steps to remediation as defined by Palo Alto Networks Unit 42 team’s Actionable Threat Objects and Mitigations (ATOMs).

Tactic:

  • TA0011: command and control

MITRE ATT&CK Description:
The adversary is trying to communicate with compromised systems to control them.

Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.

Possible playbook triggers:

  • The playbook can be used as a part of the “Courses of Action - Collection” playbook to remediate techniques based on kill chain phase.
  • The playbook can be used as a part of the “MITRE ATT&CK - Courses of Action” playbook, that can be triggered by different sources and accepts the technique MITRE ATT&CK ID as an input.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • MITRE ATT&CK CoA - T1071 - Application Layer Protocol
  • MITRE ATT&CK CoA - T1105 - Ingress tool transfer
  • MITRE ATT&CK CoA - T1573.002 - Asymmetric Cryptography

Integrations

This playbook does not use any integrations.

Scripts

  • SetAndHandleEmpty
  • Set

Commands

  • setIncident

Playbook Inputs

Name Description Default Value Required
technique Mitre ATT&CK ID of a technique.   Optional
template Template name to enforce WildFire best practices profile.   Optional
pre_post Rules location. Can be ‘pre-rulebase’ or ‘post-rulebase’. Mandatory for Panorama instances.   Optional
device-group The device group for which to return addresses (Panorama instances).   Optional
tag Tag for which to filter the rules.   Optional

Playbook Outputs

Path Description Type
Handled.Techniques The techniques handled in this playbook unknown
CC.ProductList Products used for remediation. unknown

Playbook Image

Courses of Action - Command and Control

Inputs

  • technique — Mitre ATT&CK ID of a technique.
  • template — Template name to enforce WildFire best practices profile.
  • pre_post — Rules location. Can be 'pre-rulebase' or 'post-rulebase'. Mandatory for Panorama instances.
  • device-group — The device group for which to return addresses (Panorama instances).
  • tag — Tag for which to filter the rules.

Outputs

  • Handled.Techniques — The techniques handled in this playbook
  • CC.ProductList — Products used for remediation.

Commands used

setIncident

Flowchart

yes yes yes Start Start Application Layer Protocol Application Layer Protocol Done Done Asymmetric Cryptography Asymmetric Cryptography Ingress tool transfer Ingress tool transfer MITRE ATT&CK CoA - T1071 - Application Layer Protocol - MITRE ATT&CK CoA - T1071 - Application Layer Protocol MITRE ATT&CK CoA - T1071 ... MITRE ATT&CK CoA - T1071 - Ap... MITRE ATT&CK CoA - T1573.002 - Asymmetric Cryptography - MITRE ATT&CK CoA - T1573.002 - Asymmetric Cryptography MITRE ATT&CK CoA - T1573.... MITRE ATT&CK CoA - T1573.002 ... MITRE ATT&CK CoA - T1105 - Ingress tool transfer - MITRE ATT&CK CoA - T1105 - Ingress tool transfer MITRE ATT&CK CoA - T1105 ... MITRE ATT&CK CoA - T1105 - In... Set remediation products Set remediation products Set remediation products Set remediation products Set remediation products Set remediation products Set Command and Control Remediation products to the layout - setIncident Set Command and Control R... setIncident Set techniques information to the layout Set techniques informatio... Set techniques information to the layout Set techniques informatio...

Source

playbook-Courses_of_Action_-_Command_and_Control.yml
Download History Raw 
id: Courses of Action - Command and Control
name: Courses of Action - Command and Control
description: "This playbook handles MITRE ATT&CK Techniques using intelligence-driven Courses of Action (COA) defined by Palo Alto Networks Unit 42 team. It utilizes each of the sub-playbooks for specific techniques that belong to this phase (tactic) according to the MITRE ATT&CK kill chain. The sub-playbook called depends on the technique input.\n \n***Disclaimer: This playbook does not simulate an attack using the specified techniques, but follows the steps to remediation as defined by Palo Alto Networks Unit 42 team’s Actionable Threat Objects and Mitigations (ATOMs).\n \nTactic:\n- TA0011: command and control\n\nMITRE ATT&CK Description: \nThe adversary is trying to communicate with compromised systems to control them.\n\nCommand and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.\n\nPossible playbook triggers:\n- The playbook can be used as a part of the “Courses of Action - Collection” playbook to remediate techniques based on kill chain phase.\n- The playbook can be used as a part of the “MITRE ATT&CK - Courses of Action” playbook, that can be triggered by different sources and accepts the technique MITRE ATT&CK ID as an input.\n"
inputs:
- description: Mitre ATT&CK ID of a technique.
  key: technique
  playbookInputQuery:
  required: false
  value: {}
- description: Template name to enforce WildFire best practices profile.
  key: template
  playbookInputQuery:
  required: false
  value: {}
- description: Rules location. Can be 'pre-rulebase' or 'post-rulebase'. Mandatory for Panorama instances.
  key: pre_post
  playbookInputQuery:
  required: false
  value: {}
- description: The device group for which to return addresses (Panorama instances).
  key: device-group
  playbookInputQuery:
  required: false
  value: {}
- description: Tag for which to filter the rules.
  key: tag
  playbookInputQuery:
  required: false
  value: {}
outputs:
- contextPath: Handled.Techniques
  description: The techniques handled in this playbook
  type: unknown
- contextPath: CC.ProductList
  description: Products used for remediation.
  type: unknown
starttaskid: "0"
system: true
tasks:
  "0":
    id: "0"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "2"
      - "7"
      - "8"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 56f85db2-5a8e-4286-8020-e62df079f1d8
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: 56f85db2-5a8e-4286-8020-e62df079f1d8
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 490,
          "y": 50
        }
      }
  "2":
    conditions:
    - condition:
      - - left:
            value:
              simple: T1071
          operator: inList
          right:
            iscontext: true
            value:
              complex:
                root: inputs.technique
                transformers:
                - args:
                    delimiter:
                      value:
                        simple: ','
                  operator: split
      label: "yes"
    id: "2"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "9"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: f657340b-30bc-49fe-8b90-38eb88b03cf3
      iscommand: false
      name: Application Layer Protocol
      description: ""
      type: condition
      version: -1
    taskid: f657340b-30bc-49fe-8b90-38eb88b03cf3
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 700,
          "y": 190
        }
      }
  "3":
    id: "3"
    ignoreworker: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 5fb4c985-4271-43ba-8775-531daf1972e4
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 5fb4c985-4271-43ba-8775-531daf1972e4
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1200
        }
      }
  "7":
    conditions:
    - condition:
      - - left:
            value:
              simple: T1573.002
          operator: inList
          right:
            iscontext: true
            value:
              complex:
                root: inputs.technique
                transformers:
                - args:
                    delimiter:
                      value:
                        simple: ','
                  operator: split
      label: "yes"
    id: "7"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "10"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: eae50a55-5822-4012-833a-d38cd0684bfa
      iscommand: false
      name: Asymmetric Cryptography
      description: ""
      type: condition
      version: -1
    taskid: eae50a55-5822-4012-833a-d38cd0684bfa
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 200,
          "y": 190
        }
      }
  "8":
    conditions:
    - condition:
      - - left:
            value:
              simple: T1105
          operator: inList
          right:
            iscontext: true
            value:
              complex:
                root: inputs.technique
                transformers:
                - args:
                    delimiter:
                      value:
                        simple: ','
                  operator: split
      label: "yes"
    id: "8"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "11"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 8d7796d5-0d02-4d8d-899b-e6ffd9337d97
      iscommand: false
      name: Ingress tool transfer
      description: ""
      type: condition
      version: -1
    taskid: 8d7796d5-0d02-4d8d-899b-e6ffd9337d97
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": -220,
          "y": 190
        }
      }
  "9":
    id: "9"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - "14"
    note: false
    quietmode: 0
    scriptarguments:
      ApplyToRule:
        complex:
          root: inputs.ApplyToRule
      device-group:
        complex:
          root: inputs.device-group
      pre_post:
        complex:
          root: inputs.pre_post
      rule_name:
        complex:
          root: inputs.rule_name
      tag:
        complex:
          root: inputs.tag
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: 96d5e60c-4ec7-4776-8961-a9e90c754672
      iscommand: false
      name: MITRE ATT&CK CoA - T1071 - Application Layer Protocol
      playbookId: MITRE ATT&CK CoA - T1071 - Application Layer Protocol
      type: playbook
      version: -1
      description: ''
    taskid: 96d5e60c-4ec7-4776-8961-a9e90c754672
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 700,
          "y": 360
        }
      }
  "10":
    id: "10"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - "13"
    note: false
    quietmode: 0
    scriptarguments:
      ApplyToRule:
        complex:
          root: inputs.ApplyToRule
      device-group:
        complex:
          root: inputs.device-group
      pre_post:
        complex:
          root: inputs.pre_post
      rule_name:
        complex:
          root: inputs.rule_name
      tag:
        complex:
          root: inputs.tag
      template:
        complex:
          root: inputs.template
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: 22133a68-22ae-4947-8f3e-125172f54ac6
      iscommand: false
      name: MITRE ATT&CK CoA - T1573.002 - Asymmetric Cryptography
      playbookId: MITRE ATT&CK CoA - T1573.002 - Asymmetric Cryptography
      type: playbook
      version: -1
      description: ''
    taskid: 22133a68-22ae-4947-8f3e-125172f54ac6
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 200,
          "y": 360
        }
      }
  "11":
    id: "11"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - "12"
    note: false
    quietmode: 0
    scriptarguments:
      ApplyToRule:
        complex:
          root: inputs.ApplyToRule
      device-group:
        complex:
          root: inputs.device-group
      pre_post:
        complex:
          root: inputs.pre_post
      rule_name:
        complex:
          root: inputs.rule_name
      tag:
        complex:
          root: inputs.tag
      template:
        complex:
          root: inputs.template
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: 44bf0b74-8b04-4dc0-8b5d-fdb0c5cbad80
      iscommand: false
      name: MITRE ATT&CK CoA - T1105 - Ingress tool transfer
      playbookId: MITRE ATT&CK CoA - T1105 - Ingress tool transfer
      type: playbook
      version: -1
      description: ''
    taskid: 44bf0b74-8b04-4dc0-8b5d-fdb0c5cbad80
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": -220,
          "y": 360
        }
      }
  "12":
    id: "12"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "17"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: CC.Products
      value:
        simple: '["Cortex XDR","PAN-OS"]'
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered.
      id: b095b49a-0eda-4d4a-82af-e290dc79563d
      iscommand: false
      name: Set remediation products
      script: Set
      type: regular
      version: -1
    taskid: b095b49a-0eda-4d4a-82af-e290dc79563d
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -220,
          "y": 530
        }
      }
  "13":
    id: "13"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "17"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: CC.Products
      value:
        simple: PAN-OS
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered.
      id: 818bba6c-1826-44bd-80e4-cee6b4c840ea
      iscommand: false
      name: Set remediation products
      script: Set
      type: regular
      version: -1
    taskid: 818bba6c-1826-44bd-80e4-cee6b4c840ea
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 200,
          "y": 530
        }
      }
  "14":
    id: "14"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "17"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: CC.Products
      value:
        simple: '["Cortex XDR","PAN-OS"]'
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered.
      id: 8524c7af-f5de-4fc2-8352-688fb7a89f80
      iscommand: false
      name: Set remediation products
      script: Set
      type: regular
      version: -1
    taskid: 8524c7af-f5de-4fc2-8352-688fb7a89f80
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 700,
          "y": 530
        }
      }
  "17":
    id: "17"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "18"
    note: false
    quietmode: 0
    scriptarguments:
      commandandcontrolremediationproducts:
        complex:
          root: CC
          transformers:
          - args:
              title: {}
            operator: JsonToTable
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 7cca4301-f796-405e-8b41-dca7685ff1aa
      iscommand: true
      name: Set Command and Control Remediation products to the layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 7cca4301-f796-405e-8b41-dca7685ff1aa
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 200,
          "y": 700
        }
      }
  "18":
    id: "18"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "20"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: aa701a1d-6874-47d5-83ed-738fd16b4174
      iscommand: false
      name: Set techniques information to the layout
      description: ""
      type: title
      version: -1
    taskid: aa701a1d-6874-47d5-83ed-738fd16b4174
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 200,
          "y": 880
        }
      }
  "20":
    fieldMapping:
    - incidentfield: Remediated Techniques
      output:
        complex:
          root: Handled
          transformers:
          - args:
              title: {}
            operator: JsonToTable
    - incidentfield: Techniques to Handle
      output:
        complex:
          root: Unhandled
          transformers:
          - args:
              title: {}
            operator: JsonToTable
    id: "20"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "3"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: Unhandled.Techniques
      stringify: {}
      value:
        complex:
          filters:
          - - left:
                iscontext: true
                value:
                  simple: TechniquesList
              operator: notIn
              right:
                iscontext: true
                value:
                  simple: Handled.Techniques
          root: TechniquesList
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.
      id: 42726c68-e29f-4ee3-8926-1a13a95aa62b
      iscommand: false
      name: Set techniques information to the layout
      script: SetAndHandleEmpty
      type: regular
      version: -1
    taskid: 42726c68-e29f-4ee3-8926-1a13a95aa62b
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 200,
          "y": 1030
        }
      }
version: -1
view: |-
  {
    "linkLabelsPosition": {
      "2_3_#default#": 0.21,
      "7_3_#default#": 0.21,
      "8_3_#default#": 0.17
    },
    "paper": {
      "dimensions": {
        "height": 1215,
        "width": 1300,
        "x": -220,
        "y": 50
      }
    }
  }
tests:
- No tests (auto formatted)
fromversion: 6.5.0
marketplaces:
- xsoar
- marketplacev2
- platform