Courses of Action - Credential Access

id: Courses of Action - Credential Access
name: Courses of Action - Credential Access
description: "This playbook handles MITRE ATT&CK Techniques using intelligence-driven Courses of Action (COA) defined by Palo Alto Networks Unit 42 team. It utilizes each of the sub-playbooks for specific techniques that belong to this phase (tactic) according to the MITRE ATT&CK kill chain. The sub-playbook called depends on the technique input.\n \n***Disclaimer: This playbook does not simulate an attack using the specified techniques, but follows the steps to remediation as defined by Palo Alto Networks Unit 42 team’s Actionable Threat Objects and Mitigations (ATOMs).\n \nTactic:\n- TA0006: Credential Access\n\nMITRE ATT&CK Description: \nThe adversary is trying to steal account names and passwords.\n\nCredential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.\n\nPossible playbook triggers:\n- The playbook can be used as a part of the “Courses of Action - Collection” playbook to remediate techniques based on kill chain phase.\n- The playbook can be used as a part of the “MITRE ATT&CK - Courses of Action” playbook, that can be triggered by different sources and accepts the technique MITRE ATT&CK ID as an input.\n"
inputs:
- description: Mitre ATT&CK ID of a technique.
  key: technique
  playbookInputQuery:
  required: false
  value: {}
- description: Rules location. Can be 'pre-rulebase' or 'post-rulebase'. Mandatory for Panorama instances.
  key: pre_post
  playbookInputQuery:
  required: false
  value: {}
- description: The device group for which to return addresses (Panorama instances).
  key: device-group
  playbookInputQuery:
  required: false
  value: {}
- description: Tag for which to filter the rules.
  key: tag
  playbookInputQuery:
  required: false
  value: {}
outputs:
- contextPath: Handled.Techniques
  description: The techniques handled in this playbook
  type: unknown
- contextPath: CredentialAccess.ProductList
  description: Products used for remediation.
  type: unknown
starttaskid: "0"
system: true
tasks:
  "0":
    id: "0"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "2"
      - "6"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 5bcbd2de-38da-45b7-86b8-ffaf59ad5b84
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: 5bcbd2de-38da-45b7-86b8-ffaf59ad5b84
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 440,
          "y": 50
        }
      }
  "2":
    conditions:
    - condition:
      - - left:
            value:
              simple: T1110
          operator: inList
          right:
            iscontext: true
            value:
              complex:
                root: inputs.technique
                transformers:
                - args:
                    delimiter:
                      value:
                        simple: ','
                  operator: split
      label: "yes"
    id: "2"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "7"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 730bbb3d-664c-4794-8d6c-bb2d3116ca52
      iscommand: false
      name: Brute Force
      description: ""
      type: condition
      version: -1
    taskid: 730bbb3d-664c-4794-8d6c-bb2d3116ca52
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 710,
          "y": 190
        }
      }
  "3":
    id: "3"
    ignoreworker: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 55336429-a80c-4bfc-88d4-7a32eecb6a9c
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 55336429-a80c-4bfc-88d4-7a32eecb6a9c
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 440,
          "y": 1190
        }
      }
  "5":
    id: "5"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - "9"
    note: false
    quietmode: 0
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      description: "This playbook Remediates the OS Credential Dumping technique using intelligence-driven Courses of Action (COA) defined by Palo Alto Networks Unit 42 team.\n \n***Disclaimer: This playbook does not simulate an attack using the specified technique, but follows the steps to remediation as defined by Palo Alto Networks Unit 42 team’s Actionable Threat Objects and Mitigations (ATOMs).\nTechniques Handled:\n- T1003: OS Credential Dumping\n\nKill Chain phases:\n- Defense Evasion\n\nMITRE ATT&CK Description:\nAdversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and to access restricted information.\n\nPossible playbook uses:\n- The playbook can be used independently to handle and remediate the specific technique.\n- The playbook can be used as a part of the “Courses of Action - Defense Evasion” playbook to remediate techniques based on the kill chain phase.\n- The playbook can be used as a part of the “MITRE ATT&CK - Courses of Action” playbook, which can be triggered by different sources and accepts the technique MITRE ATT&CK ID as an input.\n"
      id: 7fb7db69-991f-466c-84f5-ceb1f4a28124
      iscommand: false
      name: MITRE ATT&CK CoA - T1003 - OS Credential Dumping
      playbookId: MITRE ATT&CK CoA - T1003 - OS Credential Dumping
      type: playbook
      version: -1
    taskid: 7fb7db69-991f-466c-84f5-ceb1f4a28124
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 190,
          "y": 370
        }
      }
  "6":
    conditions:
    - condition:
      - - left:
            value:
              simple: T1003
          operator: inList
          right:
            iscontext: true
            value:
              complex:
                root: inputs.technique
                transformers:
                - args:
                    delimiter:
                      value:
                        simple: ','
                  operator: split
      label: "yes"
    id: "6"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "5"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 1def1043-a137-4702-8d2a-d233637c0be7
      iscommand: false
      name: OS Credential Dumping
      description: ""
      type: condition
      version: -1
    taskid: 1def1043-a137-4702-8d2a-d233637c0be7
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 190,
          "y": 190
        }
      }
  "7":
    id: "7"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - "8"
    note: false
    quietmode: 0
    scriptarguments:
      ApplyToRule:
        complex:
          root: inputs.ApplyToRule
      device-group:
        complex:
          root: inputs.device-group
      pre_post:
        complex:
          root: inputs.pre_post
      rule_name:
        complex:
          root: inputs.rule_name
      tag:
        complex:
          root: inputs.tag
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: c5ce4791-1c1d-461a-829d-4069dc63294d
      iscommand: false
      name: MITRE ATT&CK CoA - T1110 - Brute Force
      playbookId: MITRE ATT&CK CoA - T1110 - Brute Force
      type: playbook
      version: -1
      description: ''
    taskid: c5ce4791-1c1d-461a-829d-4069dc63294d
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 710,
          "y": 370
        }
      }
  "8":
    id: "8"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "12"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: CredentialAccess.Products
      value:
        simple: PAN-OS
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered.
      id: 78abbfa5-682e-49d4-8556-6e299b3d8bc8
      iscommand: false
      name: Set remediation products
      script: Set
      type: regular
      version: -1
    taskid: 78abbfa5-682e-49d4-8556-6e299b3d8bc8
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 710,
          "y": 540
        }
      }
  "9":
    id: "9"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "12"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: CredentialAccess.Products
      value:
        simple: Cortex XDR
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered.
      id: e87bac17-6b97-468f-819b-e2f0960a2080
      iscommand: false
      name: Set remediation products
      script: Set
      type: regular
      version: -1
    taskid: e87bac17-6b97-468f-819b-e2f0960a2080
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 190,
          "y": 550
        }
      }
  "12":
    id: "12"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "13"
    note: false
    quietmode: 0
    scriptarguments:
      credentialaccessremediationproducts:
        complex:
          root: CredentialAccess
          transformers:
          - args:
              title: {}
            operator: JsonToTable
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 24004340-7d16-420a-825e-bbc9afae0ab7
      iscommand: true
      name: Set Credential Access Remediation products to the layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 24004340-7d16-420a-825e-bbc9afae0ab7
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 190,
          "y": 710
        }
      }
  "13":
    id: "13"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "14"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 0e1b140d-c604-457b-896e-26a1df1b70b0
      iscommand: false
      name: Set techniques information to the layout
      description: ""
      type: title
      version: -1
    taskid: 0e1b140d-c604-457b-896e-26a1df1b70b0
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 190,
          "y": 880
        }
      }
  "14":
    fieldMapping:
    - incidentfield: Remediated Techniques
      output:
        complex:
          root: Handled
          transformers:
          - args:
              title: {}
            operator: JsonToTable
    - incidentfield: Techniques to Handle
      output:
        complex:
          root: Unhandled
          transformers:
          - args:
              title: {}
            operator: JsonToTable
    id: "14"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "3"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: Unhandled.Techniques
      stringify: {}
      value:
        complex:
          filters:
          - - left:
                iscontext: true
                value:
                  simple: TechniquesList
              operator: notIn
              right:
                iscontext: true
                value:
                  simple: Handled.Techniques
          root: TechniquesList
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.
      id: 65c83f44-8b89-4cb4-8fcf-42c7e1d6b6e1
      iscommand: false
      name: Set techniques information to the layout
      script: SetAndHandleEmpty
      type: regular
      version: -1
    taskid: 65c83f44-8b89-4cb4-8fcf-42c7e1d6b6e1
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 190,
          "y": 1020
        }
      }
version: -1
view: |-
  {
    "linkLabelsPosition": {
      "2_3_#default#": 0.22,
      "6_3_#default#": 0.24
    },
    "paper": {
      "dimensions": {
        "height": 1205,
        "width": 900,
        "x": 190,
        "y": 50
      }
    }
  }
tests:
- No tests (auto formatted)
fromversion: 6.5.0
marketplaces:
- xsoar
- marketplacev2
- platform