Courses of Action - Exfiltration

This playbook handles MITRE ATT&CK Techniques using intelligence-driven Courses of Action (COA) defined by Palo Alto Networks Unit 42 team. It utilizes each of the sub-playbooks for specific techniques that belong to this phase (tactic) according to the MITRE ATT&CK kill chain. The sub-playbook called depends on the technique input. ***Disclaimer: This playbook does not simulate an attack using the specified techniques, but follows the steps to remediation as defined by Palo Alto Networks Unit 42 team’s Actionable Threat Objects and Mitigations (ATOMs). Tactic: - TA0010: Exfiltration MITRE ATT&CK Description: The adversary is trying to steal data. Exfiltration consists of techniques that adversaries may use to steal data from your network. Once they’ve collected data, adversaries often package it to avoid detection while removing it. This can include compression and encryption. Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission. Possible playbook triggers: - The playbook can be used as a part of the “Courses of Action - Collection” playbook to remediate techniques based on kill chain phase. - The playbook can be used as a part of the “MITRE ATT&CK - Courses of Action” playbook, that can be triggered by different sources and accepts the technique MITRE ATT&CK ID as an input.

MITRE ATT&CK - Courses of Action · 14 tasks · 4 inputs · 2 outputs

Details

IDCourses of Action - Exfiltration
From Version6.5.0
Tasks14

README

This playbook handles MITRE ATT&CK Techniques using intelligence-driven Courses of Action (COA) defined by Palo Alto Networks Unit 42 team. It utilizes each of the sub-playbooks for specific techniques that belong to this phase (tactic) according to the MITRE ATT&CK kill chain. The sub-playbook called depends on the technique input.

***Disclaimer: This playbook does not simulate an attack using the specified techniques, but follows the steps to remediation as defined by Palo Alto Networks Unit 42 team’s Actionable Threat Objects and Mitigations (ATOMs).

Tactic:

  • TA0010: Exfiltration

MITRE ATT&CK Description:
The adversary is trying to steal data.

Exfiltration consists of techniques that adversaries may use to steal data from your network. Once they’ve collected data, adversaries often package it to avoid detection while removing it. This can include compression and encryption. Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission.

Possible playbook triggers:

  • The playbook can be used as a part of the “Courses of Action - Collection” playbook to remediate techniques based on kill chain phase.
  • The playbook can be used as a part of the “MITRE ATT&CK - Courses of Action” playbook, that can be triggered by different sources and accepts the technique MITRE ATT&CK ID as an input.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • MITRE ATT&CK CoA - T1041 - Exfiltration Over C2 Channel
  • MITRE ATT&CK CoA - T1048 - Exfiltration Over Alternative Protocol
  • MITRE ATT&CK CoA - T1560.001 - Archive via Utility

Integrations

This playbook does not use any integrations.

Scripts

  • Set
  • SetAndHandleEmpty

Commands

  • setIncident

Playbook Inputs

Name Description Default Value Required
technique Mitre ATT&CK ID of a technique.   Optional
pre_post Rules location. Can be ‘pre-rulebase’ or ‘post-rulebase’. Mandatory for Panorama instances.   Optional
device-group The device group for which to return addresses (Panorama instances).   Optional
tag Tag for which to filter the rules.   Optional

Playbook Outputs

Path Description Type
Handled.Techniques The techniques handled in this playbook unknown
Exfiltration.ProductList Products used for remediation. unknown

Playbook Image

Courses of Action - Exfiltration

Inputs

  • technique — Mitre ATT&CK ID of a technique.
  • pre_post — Rules location. Can be 'pre-rulebase' or 'post-rulebase'. Mandatory for Panorama instances.
  • device-group — The device group for which to return addresses (Panorama instances).
  • tag — Tag for which to filter the rules.

Outputs

  • Handled.Techniques — The techniques handled in this playbook
  • Exfiltration.ProductList — Products used for remediation.

Commands used

setIncident

Flowchart

yes yes yes Start Start Exfiltration Over Alternative Protocol Exfiltration Over Alterna... Done Done Data Encrypted Data Encrypted Exfiltration Over C2 Channel Exfiltration Over C2 Channel MITRE ATT&CK CoA - T1048 - Exfiltration Over Alternative Protocol - MITRE ATT&CK CoA - T1048 - Exfiltration Over Alternative Protocol MITRE ATT&CK CoA - T1048 ... MITRE ATT&CK CoA - T1048 - Ex... MITRE ATT&CK CoA - T1041 - Exfiltration Over C2 Channel - MITRE ATT&CK CoA - T1041 - Exfiltration Over C2 Channel MITRE ATT&CK CoA - T1041 ... MITRE ATT&CK CoA - T1041 - Ex... MITRE ATT&CK CoA - T1560.001 - Archive via Utility - MITRE ATT&CK CoA - T1560.001 - Archive via Utility MITRE ATT&CK CoA - T1560.... MITRE ATT&CK CoA - T1560.001 ... Set remediation products Set remediation products Set remediation products Set remediation products Set remediation products Set remediation products Set Exfiltration Remediation products to the layout - setIncident Set Exfiltration Remediat... setIncident Set techniques information to the layout Set techniques informatio... Set techniques information to the layout Set techniques informatio...

Source

playbook-Courses_of_Action_-_Exfiltration.yml
Download History Raw 
id: Courses of Action - Exfiltration
name: Courses of Action - Exfiltration
description: "This playbook handles MITRE ATT&CK Techniques using intelligence-driven Courses of Action (COA) defined by Palo Alto Networks Unit 42 team. It utilizes each of the sub-playbooks for specific techniques that belong to this phase (tactic) according to the MITRE ATT&CK kill chain. The sub-playbook called depends on the technique input.\n \n***Disclaimer: This playbook does not simulate an attack using the specified techniques, but follows the steps to remediation as defined by Palo Alto Networks Unit 42 team’s Actionable Threat Objects and Mitigations (ATOMs).\n \nTactic:\n- TA0010: Exfiltration\n\nMITRE ATT&CK Description: \nThe adversary is trying to steal data.\n\nExfiltration consists of techniques that adversaries may use to steal data from your network. Once they’ve collected data, adversaries often package it to avoid detection while removing it. This can include compression and encryption. Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission.\n\nPossible playbook triggers:\n- The playbook can be used as a part of the “Courses of Action - Collection” playbook to remediate techniques based on kill chain phase.\n- The playbook can be used as a part of the “MITRE ATT&CK - Courses of Action” playbook, that can be triggered by different sources and accepts the technique MITRE ATT&CK ID as an input.\n"
inputs:
- description: Mitre ATT&CK ID of a technique.
  key: technique
  playbookInputQuery:
  required: false
  value: {}
- description: Rules location. Can be 'pre-rulebase' or 'post-rulebase'. Mandatory for Panorama instances.
  key: pre_post
  playbookInputQuery:
  required: false
  value: {}
- description: The device group for which to return addresses (Panorama instances).
  key: device-group
  playbookInputQuery:
  required: false
  value: {}
- description: Tag for which to filter the rules.
  key: tag
  playbookInputQuery:
  required: false
  value: {}
outputs:
- contextPath: Handled.Techniques
  description: The techniques handled in this playbook
  type: unknown
- contextPath: Exfiltration.ProductList
  description: Products used for remediation.
  type: unknown
starttaskid: "0"
system: true
tasks:
  "0":
    id: "0"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "2"
      - "7"
      - "8"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 5c043a40-9f18-42d9-8bd8-ba9b11db68e5
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: 5c043a40-9f18-42d9-8bd8-ba9b11db68e5
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 480,
          "y": 50
        }
      }
  "2":
    conditions:
    - condition:
      - - left:
            value:
              simple: T1048
          operator: inList
          right:
            iscontext: true
            value:
              complex:
                root: inputs.technique
                transformers:
                - args:
                    delimiter:
                      value:
                        simple: ','
                  operator: split
      label: "yes"
    id: "2"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "10"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 0f47d3aa-d3ff-4ce6-8a52-b866e0f1f954
      iscommand: false
      name: Exfiltration Over Alternative Protocol
      description: ""
      type: condition
      version: -1
    taskid: 0f47d3aa-d3ff-4ce6-8a52-b866e0f1f954
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 730,
          "y": 190
        }
      }
  "3":
    id: "3"
    ignoreworker: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 0d627030-804d-4998-8dca-bbb46077be5e
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 0d627030-804d-4998-8dca-bbb46077be5e
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1190
        }
      }
  "7":
    conditions:
    - condition:
      - - left:
            value:
              simple: T1560.001
          operator: inList
          right:
            iscontext: true
            value:
              complex:
                root: inputs.technique
                transformers:
                - args:
                    delimiter:
                      value:
                        simple: ','
                  operator: split
      label: "yes"
    id: "7"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "12"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 0d63cb9f-096e-4a5d-84ce-acf95f9adebe
      iscommand: false
      name: Data Encrypted
      description: ""
      type: condition
      version: -1
    taskid: 0d63cb9f-096e-4a5d-84ce-acf95f9adebe
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 230,
          "y": 190
        }
      }
  "8":
    conditions:
    - condition:
      - - left:
            value:
              simple: T1041
          operator: inList
          right:
            iscontext: true
            value:
              complex:
                root: inputs.technique
                transformers:
                - args:
                    delimiter:
                      value:
                        simple: ','
                  operator: split
      label: "yes"
    id: "8"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "11"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 69b111c2-9e37-4108-844b-0997422d3d12
      iscommand: false
      name: Exfiltration Over C2 Channel
      description: ""
      type: condition
      version: -1
    taskid: 69b111c2-9e37-4108-844b-0997422d3d12
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": -200,
          "y": 190
        }
      }
  "10":
    id: "10"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - "13"
    note: false
    quietmode: 0
    scriptarguments:
      ApplyToRule:
        complex:
          root: inputs.ApplyToRule
      device-group:
        complex:
          root: inputs.device-group
      pre_post:
        complex:
          root: inputs.pre_post
      rule_name:
        complex:
          root: inputs.rule_name
      tag:
        complex:
          root: inputs.tag
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: 4edb9ec3-2f92-4672-84cb-32f3ba97b930
      iscommand: false
      name: MITRE ATT&CK CoA - T1048 - Exfiltration Over Alternative Protocol
      playbookId: MITRE ATT&CK CoA - T1048 - Exfiltration Over Alternative Protocol
      type: playbook
      version: -1
      description: ''
    taskid: 4edb9ec3-2f92-4672-84cb-32f3ba97b930
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 730,
          "y": 360
        }
      }
  "11":
    id: "11"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 0
      wait: 1
    nexttasks:
      '#none#':
      - "15"
    note: false
    quietmode: 0
    scriptarguments:
      ApplyToRule:
        complex:
          root: inputs.ApplyToRule
      device-group:
        complex:
          root: inputs.device-group
      pre_post:
        complex:
          root: inputs.pre_post
      rule_name:
        complex:
          root: inputs.rule_name
      tag:
        complex:
          root: inputs.tag
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: e94ef6ae-e8e1-4519-8e88-a7c26f753cfc
      iscommand: false
      name: MITRE ATT&CK CoA - T1041 - Exfiltration Over C2 Channel
      playbookId: MITRE ATT&CK CoA - T1041 - Exfiltration Over C2 Channel
      type: playbook
      version: -1
      description: ''
    taskid: e94ef6ae-e8e1-4519-8e88-a7c26f753cfc
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": -200,
          "y": 360
        }
      }
  "12":
    id: "12"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "14"
    note: false
    quietmode: 0
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: ef0b7076-cd82-4fc3-8d76-bba541521ec1
      iscommand: false
      name: MITRE ATT&CK CoA - T1560.001 - Archive via Utility
      playbookId: MITRE ATT&CK CoA - T1560.001 - Archive via Utility
      type: playbook
      version: -1
      description: ''
    taskid: ef0b7076-cd82-4fc3-8d76-bba541521ec1
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 230,
          "y": 360
        }
      }
  "13":
    id: "13"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "16"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Exfiltration.Products
      value:
        simple: PAN-OS
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered.
      id: 670e620c-a7cd-4cb9-8c57-e68a42c81de1
      iscommand: false
      name: Set remediation products
      script: Set
      type: regular
      version: -1
    taskid: 670e620c-a7cd-4cb9-8c57-e68a42c81de1
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 730,
          "y": 530
        }
      }
  "14":
    id: "14"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "16"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Exfiltration.Products
      value:
        simple: Cortex XDR
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered.
      id: 9e19f702-df20-4618-8447-78210e2f9e3b
      iscommand: false
      name: Set remediation products
      script: Set
      type: regular
      version: -1
    taskid: 9e19f702-df20-4618-8447-78210e2f9e3b
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 230,
          "y": 530
        }
      }
  "15":
    id: "15"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "16"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Exfiltration.Products
      value:
        simple: PAN-OS
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered.
      id: b1d0c2c4-e24d-40a9-8033-4931b39d23d1
      iscommand: false
      name: Set remediation products
      script: Set
      type: regular
      version: -1
    taskid: b1d0c2c4-e24d-40a9-8033-4931b39d23d1
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -200,
          "y": 530
        }
      }
  "16":
    id: "16"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "17"
    note: false
    quietmode: 0
    scriptarguments:
      exfiltrationremediationproducts:
        complex:
          root: Exfiltration
          transformers:
          - args:
              title: {}
            operator: JsonToTable
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 3e092570-79df-4526-80ea-556c9d2cea3d
      iscommand: true
      name: Set Exfiltration Remediation products to the layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 3e092570-79df-4526-80ea-556c9d2cea3d
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 120,
          "y": 700
        }
      }
  "17":
    id: "17"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "18"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 11ee4107-138c-445d-8c81-f19d4444f514
      iscommand: false
      name: Set techniques information to the layout
      description: ""
      type: title
      version: -1
    taskid: 11ee4107-138c-445d-8c81-f19d4444f514
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 120,
          "y": 870
        }
      }
  "18":
    fieldMapping:
    - incidentfield: Remediated Techniques
      output:
        complex:
          root: Handled
          transformers:
          - args:
              title: {}
            operator: JsonToTable
    - incidentfield: Techniques to Handle
      output:
        complex:
          root: Unhandled
          transformers:
          - args:
              title: {}
            operator: JsonToTable
    id: "18"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "3"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: Unhandled.Techniques
      stringify: {}
      value:
        complex:
          filters:
          - - left:
                iscontext: true
                value:
                  simple: TechniquesList
              operator: notIn
              right:
                iscontext: true
                value:
                  simple: Handled.Techniques
          root: TechniquesList
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.
      id: 06cab971-ae3a-42f7-8dde-6fea02167b2d
      iscommand: false
      name: Set techniques information to the layout
      script: SetAndHandleEmpty
      type: regular
      version: -1
    taskid: 06cab971-ae3a-42f7-8dde-6fea02167b2d
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 120,
          "y": 1020
        }
      }
version: -1
view: |-
  {
    "linkLabelsPosition": {
      "2_3_#default#": 0.22,
      "7_3_#default#": 0.23,
      "8_3_#default#": 0.29
    },
    "paper": {
      "dimensions": {
        "height": 1205,
        "width": 1310,
        "x": -200,
        "y": 50
      }
    }
  }
tests:
- No tests (auto formatted)
fromversion: 6.5.0
marketplaces:
- xsoar
- marketplacev2
- platform