Courses of Action - Defense Evasion

This playbook handles MITRE ATT&CK Techniques using intelligence-driven Courses of Action (COA) defined by Palo Alto Networks Unit 42 team. It utilizes each of the sub-playbooks for specific techniques that belong to this phase (tactic) according to the MITRE ATT&CK kill chain. The sub-playbook called depends on the technique input. ***Disclaimer: This playbook does not simulate an attack using the specified techniques, but follows the steps to remediation as defined by Palo Alto Networks Unit 42 team’s Actionable Threat Objects and Mitigations (ATOMs). Tactic: - TA0005: Defense Evasion MITRE ATT&CK Description: The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses. Possible playbook triggers: - The playbook can be used as a part of the “Courses of Action - Collection” playbook to remediate techniques based on kill chain phase. - The playbook can be used as a part of the “MITRE ATT&CK - Courses of Action” playbook, that can be triggered by different sources and accepts the technique MITRE ATT&CK ID as an input.

MITRE ATT&CK - Courses of Action · 17 tasks · 5 inputs · 2 outputs

Details

IDCourses of Action - Defense Evasion
From Version6.5.0
Tasks17

README

This playbook handles MITRE ATT&CK Techniques using intelligence-driven Courses of Action (COA) defined by Palo Alto Networks Unit 42 team. It utilizes each of the sub-playbooks for specific techniques that belong to this phase (tactic) according to the MITRE ATT&CK kill chain. The sub-playbook called depends on the technique input.

***Disclaimer: This playbook does not simulate an attack using the specified techniques, but follows the steps to remediation as defined by Palo Alto Networks Unit 42 team’s Actionable Threat Objects and Mitigations (ATOMs).

Tactic:

  • TA0005: Defense Evasion

MITRE ATT&CK Description:
The adversary is trying to avoid being detected.

Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.

Possible playbook triggers:

  • The playbook can be used as a part of the “Courses of Action - Collection” playbook to remediate techniques based on kill chain phase.
  • The playbook can be used as a part of the “MITRE ATT&CK - Courses of Action” playbook, that can be triggered by different sources and accepts the technique MITRE ATT&CK ID as an input.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • MITRE ATT&CK CoA - T1562.001 - Disable or Modify Tools
  • MITRE ATT&CK CoA - T1564.004 - NTFS File Attributes
  • MITRE ATT&CK CoA - T1078 - Valid Accounts
  • MITRE ATT&CK CoA - T1027 - Obfuscated Files or Information

Integrations

This playbook does not use any integrations.

Scripts

  • Set
  • SetAndHandleEmpty

Commands

  • setIncident

Playbook Inputs

Name Description Default Value Required
technique Mitre ATT&CK ID of a technique.   Optional
template Template name to enforce WildFire best practices profile.   Optional
pre_post Rules location. Can be ‘pre-rulebase’ or ‘post-rulebase’. Mandatory for Panorama instances.   Optional
device-group The device group for which to return addresses (Panorama instances).   Optional
tag Tag for which to filter the rules.   Optional

Playbook Outputs

Path Description Type
Handled.Techniques The techniques handled in this playbook unknown
DefenseEvasion.ProductList Products used for remediation. unknown

Playbook Image

Courses of Action - Defense Evasion

Inputs

  • technique — Mitre ATT&CK ID of a technique.
  • template — Template name to enforce WildFire best practices profile.
  • pre_post — Rules location. Can be 'pre-rulebase' or 'post-rulebase'. Mandatory for Panorama instances.
  • device-group — The device group for which to return addresses (Panorama instances).
  • tag — Tag for which to filter the rules.

Outputs

  • Handled.Techniques — The techniques handled in this playbook
  • DefenseEvasion.ProductList — Products used for remediation.

Commands used

setIncident

Flowchart

yes yes yes yes Start Start Done Done Valid Accounts Valid Accounts NTFS File Attributes NTFS File Attributes Disable or Modify Tools Disable or Modify Tools Scripting, Obfuscated Files or Information Scripting, Obfuscated Fil... MITRE ATT&CK CoA - T1562.001 - Disable or Modify Tools - MITRE ATT&CK CoA - T1562.001 - Disable or Modify Tools MITRE ATT&CK CoA - T1562.... MITRE ATT&CK CoA - T1562.001 ... MITRE ATT&CK CoA - T1078 - Valid Accounts - MITRE ATT&CK CoA - T1078 - Valid Accounts MITRE ATT&CK CoA - T1078 ... MITRE ATT&CK CoA - T1078 - Va... MITRE ATT&CK CoA - T1564.004 - NTFS File Attributes - MITRE ATT&CK CoA - T1564.004 - NTFS File Attributes MITRE ATT&CK CoA - T1564.... MITRE ATT&CK CoA - T1564.004 ... MITRE ATT&CK CoA - T1027 - Obfuscated Files or Information - MITRE ATT&CK CoA - T1027 - Obfuscated Files or Information MITRE ATT&CK CoA - T1027 ... MITRE ATT&CK CoA - T1027 - Ob... Set remediation products Set remediation products Set remediation products Set remediation products Set remediation products Set remediation products Set remediation products Set remediation products Set Defense Evasion Remediation products to the layout - setIncident Set Defense Evasion Remed... setIncident Set techniques information to the layout Set techniques informatio... Set techniques information to the layout Set techniques informatio...

Source

playbook-Courses_of_Action_-_Defense_Evasion.yml
Download History Raw 
id: Courses of Action - Defense Evasion
name: Courses of Action - Defense Evasion
description: "This playbook handles MITRE ATT&CK Techniques using intelligence-driven Courses of Action (COA) defined by Palo Alto Networks Unit 42 team. It utilizes each of the sub-playbooks for specific techniques that belong to this phase (tactic) according to the MITRE ATT&CK kill chain. The sub-playbook called depends on the technique input.\n \n***Disclaimer: This playbook does not simulate an attack using the specified techniques, but follows the steps to remediation as defined by Palo Alto Networks Unit 42 team’s Actionable Threat Objects and Mitigations (ATOMs).\n \nTactic:\n- TA0005: Defense Evasion\n\nMITRE ATT&CK Description: \nThe adversary is trying to avoid being detected.\n\nDefense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.\n\nPossible playbook triggers:\n- The playbook can be used as a part of the “Courses of Action - Collection” playbook to remediate techniques based on kill chain phase.\n- The playbook can be used as a part of the “MITRE ATT&CK - Courses of Action” playbook, that can be triggered by different sources and accepts the technique MITRE ATT&CK ID as an input.\n"
inputs:
- description: Mitre ATT&CK ID of a technique.
  key: technique
  playbookInputQuery:
  required: false
  value: {}
- description: Template name to enforce WildFire best practices profile.
  key: template
  playbookInputQuery:
  required: false
  value: {}
- description: Rules location. Can be 'pre-rulebase' or 'post-rulebase'. Mandatory for Panorama instances.
  key: pre_post
  playbookInputQuery:
  required: false
  value: {}
- description: The device group for which to return addresses (Panorama instances).
  key: device-group
  playbookInputQuery:
  required: false
  value: {}
- description: Tag for which to filter the rules.
  key: tag
  playbookInputQuery:
  required: false
  value: {}
outputs:
- contextPath: Handled.Techniques
  description: The techniques handled in this playbook
  type: unknown
- contextPath: DefenseEvasion.ProductList
  description: Products used for remediation.
  type: unknown
starttaskid: "0"
system: true
tasks:
  "0":
    id: "0"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "8"
      - "9"
      - "10"
      - "11"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: d7cd42e2-7129-4cbd-834a-552ceee745fd
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: d7cd42e2-7129-4cbd-834a-552ceee745fd
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
  "3":
    id: "3"
    ignoreworker: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 1f1bd726-81ec-45de-8b85-d03a848e2199
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 1f1bd726-81ec-45de-8b85-d03a848e2199
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 440,
          "y": 1210
        }
      }
  "8":
    conditions:
    - condition:
      - - left:
            value:
              simple: T1078
          operator: inList
          right:
            iscontext: true
            value:
              complex:
                root: inputs.technique
                transformers:
                - args:
                    delimiter:
                      value:
                        simple: ','
                  operator: split
      label: "yes"
    id: "8"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "13"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: c102893d-3b28-4547-8ed8-b639f8de849d
      iscommand: false
      name: Valid Accounts
      description: ""
      type: condition
      version: -1
    taskid: c102893d-3b28-4547-8ed8-b639f8de849d
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1110,
          "y": 190
        }
      }
  "9":
    conditions:
    - condition:
      - - left:
            value:
              simple: T1564.004
          operator: inList
          right:
            iscontext: true
            value:
              complex:
                root: inputs.technique
                transformers:
                - args:
                    delimiter:
                      value:
                        simple: ','
                  operator: split
      label: "yes"
    id: "9"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "14"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: dcf64353-5a74-4479-8509-a4c5a84226c4
      iscommand: false
      name: NTFS File Attributes
      description: ""
      type: condition
      version: -1
    taskid: dcf64353-5a74-4479-8509-a4c5a84226c4
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 690,
          "y": 190
        }
      }
  "10":
    conditions:
    - condition:
      - - left:
            value:
              simple: T1562.001
          operator: inList
          right:
            iscontext: true
            value:
              complex:
                root: inputs.technique
                transformers:
                - args:
                    delimiter:
                      value:
                        simple: ','
                  operator: split
      label: "yes"
    id: "10"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "12"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: cc81d3ee-0b73-42b7-85e1-f5a7a96e65dc
      iscommand: false
      name: Disable or Modify Tools
      description: ""
      type: condition
      version: -1
    taskid: cc81d3ee-0b73-42b7-85e1-f5a7a96e65dc
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 210,
          "y": 190
        }
      }
  "11":
    conditions:
    - condition:
      - - left:
            value:
              simple: T1064
          operator: inList
          right:
            iscontext: true
            value:
              complex:
                root: inputs.technique
                transformers:
                - args:
                    delimiter:
                      value:
                        simple: ','
                  operator: split
        - left:
            value:
              simple: T1027
          operator: inList
          right:
            iscontext: true
            value:
              complex:
                root: inputs.technique
                transformers:
                - args:
                    delimiter:
                      value:
                        simple: ','
                  operator: split
      label: "yes"
    id: "11"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "15"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 4f3c5e72-f69b-4093-84ec-09200a221501
      iscommand: false
      name: Scripting, Obfuscated Files or Information
      description: ""
      type: condition
      version: -1
    taskid: 4f3c5e72-f69b-4093-84ec-09200a221501
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": -220,
          "y": 190
        }
      }
  "12":
    id: "12"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "17"
    note: false
    quietmode: 0
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: 42103420-382c-48f4-895b-ffc1011b038a
      iscommand: false
      name: MITRE ATT&CK CoA - T1562.001 - Disable or Modify Tools
      playbookId: MITRE ATT&CK CoA - T1562.001 - Disable or Modify Tools
      type: playbook
      version: -1
      description: ''
    taskid: 42103420-382c-48f4-895b-ffc1011b038a
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 210,
          "y": 370
        }
      }
  "13":
    id: "13"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - "19"
    note: false
    quietmode: 0
    scriptarguments:
      ApplyToRule:
        complex:
          root: inputs.ApplyToRule
      device-group:
        complex:
          root: inputs.pre_post
      pre_post:
        complex:
          root: inputs.pre_post
      rule_name:
        complex:
          root: inputs.rule_name
      tag:
        complex:
          root: inputs.tag
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: ff597b04-1a70-4ca2-863f-853cf2bc25d5
      iscommand: false
      name: MITRE ATT&CK CoA - T1078 - Valid Accounts
      playbookId: MITRE ATT&CK CoA - T1078 - Valid Accounts
      type: playbook
      version: -1
      description: ''
    taskid: ff597b04-1a70-4ca2-863f-853cf2bc25d5
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 1110,
          "y": 370
        }
      }
  "14":
    id: "14"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 0
      wait: 1
    nexttasks:
      '#none#':
      - "18"
    note: false
    quietmode: 0
    scriptarguments:
      ApplyToRule:
        complex:
          root: inputs.ApplyToRule
      device-group:
        complex:
          root: inputs.device-group
      pre_post:
        complex:
          root: inputs.pre_post
      rule_name:
        complex:
          root: inputs.rule_name
      tag:
        complex:
          root: inputs.tag
      template:
        complex:
          root: inputs.template
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: 2e7b4452-da08-44af-84cd-01c150e796de
      iscommand: false
      name: MITRE ATT&CK CoA - T1564.004 - NTFS File Attributes
      playbookId: MITRE ATT&CK CoA - T1564.004 - NTFS File Attributes
      type: playbook
      version: -1
      description: ''
    taskid: 2e7b4452-da08-44af-84cd-01c150e796de
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 690,
          "y": 370
        }
      }
  "15":
    id: "15"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - "16"
    note: false
    quietmode: 0
    scriptarguments:
      ApplyToRule:
        complex:
          root: inputs.ApplyToRule
      device-group:
        complex:
          root: inputs.device-group
      pre_post:
        complex:
          root: inputs.pre_post
      rule_name:
        complex:
          root: inputs.rule_name
      tag:
        complex:
          root: inputs.tag
      template:
        complex:
          root: inputs.template
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: 4a570a1a-f829-48a2-83d9-ba0606d04a1d
      iscommand: false
      name: MITRE ATT&CK CoA - T1027 - Obfuscated Files or Information
      playbookId: MITRE ATT&CK CoA - T1027 - Obfuscated Files or Information
      type: playbook
      version: -1
      description: ''
    taskid: 4a570a1a-f829-48a2-83d9-ba0606d04a1d
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": -220,
          "y": 370
        }
      }
  "16":
    id: "16"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "21"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: DefenseEvasion.Products
      value:
        simple: '["Cortex XDR","PAN-OS"]'
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered.
      id: e5c39f16-aa18-4342-8d6b-2adcc6ae9ab6
      iscommand: false
      name: Set remediation products
      script: Set
      type: regular
      version: -1
    taskid: e5c39f16-aa18-4342-8d6b-2adcc6ae9ab6
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -220,
          "y": 550
        }
      }
  "17":
    id: "17"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "21"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: DefenseEvasion.Products
      value:
        simple: Cortex XDR
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered.
      id: 06d40709-e0a5-4206-8e0b-4aae49747137
      iscommand: false
      name: Set remediation products
      script: Set
      type: regular
      version: -1
    taskid: 06d40709-e0a5-4206-8e0b-4aae49747137
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 210,
          "y": 550
        }
      }
  "18":
    id: "18"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "21"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: DefenseEvasion.Products
      value:
        simple: '["Cortex XDR","PAN-OS"]'
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered.
      id: c6f37ac2-259a-4ee3-8266-51cb78203619
      iscommand: false
      name: Set remediation products
      script: Set
      type: regular
      version: -1
    taskid: c6f37ac2-259a-4ee3-8266-51cb78203619
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 690,
          "y": 550
        }
      }
  "19":
    id: "19"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "21"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: DefenseEvasion.Products
      value:
        simple: '["Cortex XSOAR","PAN-OS"]'
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered.
      id: 14684929-16bc-482d-86c5-7d8e5c5f1430
      iscommand: false
      name: Set remediation products
      script: Set
      type: regular
      version: -1
    taskid: 14684929-16bc-482d-86c5-7d8e5c5f1430
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1110,
          "y": 550
        }
      }
  "21":
    id: "21"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "22"
    note: false
    quietmode: 0
    scriptarguments:
      defenseevasionremediationproducts:
        complex:
          root: DefenseEvasion
          transformers:
          - args:
              title: {}
            operator: JsonToTable
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 5e2bc58a-83a1-4060-8142-ffbf547cb83a
      iscommand: true
      name: Set Defense Evasion Remediation products to the layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 5e2bc58a-83a1-4060-8142-ffbf547cb83a
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 210,
          "y": 725
        }
      }
  "22":
    id: "22"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "23"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 75a66f4d-d826-4414-85ad-a87ba6431a8e
      iscommand: false
      name: Set techniques information to the layout
      description: ""
      type: title
      version: -1
    taskid: 75a66f4d-d826-4414-85ad-a87ba6431a8e
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 210,
          "y": 900
        }
      }
  "23":
    fieldMapping:
    - incidentfield: Remediated Techniques
      output:
        complex:
          root: Handled
          transformers:
          - args:
              title: {}
            operator: JsonToTable
    - incidentfield: Techniques to Handle
      output:
        complex:
          root: Unhandled
          transformers:
          - args:
              title: {}
            operator: JsonToTable
    id: "23"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "3"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: Unhandled.Techniques
      stringify: {}
      value:
        complex:
          filters:
          - - left:
                iscontext: true
                value:
                  simple: TechniquesList
              operator: notIn
              right:
                iscontext: true
                value:
                  simple: Handled.Techniques
          root: TechniquesList
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.
      id: e6c19409-e796-45f9-8e72-4c19e1776538
      iscommand: false
      name: Set techniques information to the layout
      script: SetAndHandleEmpty
      type: regular
      version: -1
    taskid: e6c19409-e796-45f9-8e72-4c19e1776538
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 210,
          "y": 1040
        }
      }
version: -1
view: |-
  {
    "linkLabelsPosition": {
      "10_3_#default#": 0.24,
      "11_3_#default#": 0.29,
      "8_3_#default#": 0.27,
      "9_3_#default#": 0.21
    },
    "paper": {
      "dimensions": {
        "height": 1225,
        "width": 1710,
        "x": -220,
        "y": 50
      }
    }
  }
tests:
- No tests (auto formatted)
fromversion: 6.5.0
marketplaces:
- xsoar
- marketplacev2
- platform