CrowdStrike Falcon - T1059 - Command and Scripting Interpreter

This playbook handles command and scripting interpreter alerts based on the MITRE T1059 technique. An attacker might abuse command and script interpreters to execute commands, scripts, or binaries. The playbook executes the following stages: **Analysis** - Initiates the CommandLineAnalysiss script which will determine if the command lines have any suspicious artifacts that might indicate malicious behavior. - Enriches any indicators found during the command lines analysis phase. **Investigative Actions:** - In case malicious indicators were found, the playbook will initiate a check against CrowdStrike Falcon to identify if any other endpoint has been associated with the same indicators. - If there are any, the playbook will update the layout and create a new incident for further investigation. **Remediation:** - Terminate the process if the CrowdStike Falcon agent doesn't block it. - If the process failed or the parent process command line was suspicious as well, a manual action will be provided to the analyst to choose how to proceed further: - Terminate the parent process - Isolate the endpoint **Closure Steps:** - Handle malicious alerts by closing the alert as True Positive. - Handle non-malicious alerts by closing the alert as False Positive.

CrowdStrike Falcon · 33 tasks · 2 inputs · 0 outputs

Inputs

  • CommandLines — The command line analysis that was found in the alert. By default, we will analyze the command line and its parent command line.
  • CreateNewIncidentForIndicators — If the playbook identifies malicious indicators associated with other hosts, a new incident will be generated with relevant information for the analysts.

Commands used

closeInvestigation createNewIncident cs-falcon-rtr-kill-process endpoint enrichIndicators linkIncidents setIncident

Flowchart

yes yes Automated Remediation Manual Remediation #error# Isolate Endpoint Terminate Parent Process Close alert as False Positive Remediation - Process termination yes yes yes yes yes Start Start Analysis Analysis Close Alert - True Positive - closeInvestigation Close Alert - True Positive closeInvestigation Done Done Found any malicious behavior? Found any malicious behav... Remediation Remediation Is the CMD defined? Is the CMD defined? No CMD Parameters found No CMD Parameters found Is the process blocked? Is the process blocked? Terminate Process - cs-falcon-rtr-kill-process Terminate Process cs-falcon-rtr-kill-process Manual Response Manual Response Get Endpoint Status Endpoint - endpoint Get Endpoint Status Endpoint endpoint Crowdstrike Falcon - Isolate Endpoint - Crowdstrike Falcon - Isolate Endpoint Crowdstrike Falcon - Isol... Crowdstrike Falcon - Isolate ... Close Alert - False Positive - closeInvestigation Close Alert - False Positive closeInvestigation Investigation Investigation No suspicious artifacts were found No suspicious artifacts w... False Positive False Positive Are there any additional affected endpoints? Are there any additional ... CrowdStrike Falcon - Search Endpoints By Indicators - CrowdStrike Falcon - Search Endpoints By Indicators CrowdStrike Falcon - Sear... CrowdStrike Falcon - Search E... Update the affected hosts by IOC field - setIncident Update the affected hosts... setIncident Set the Grand Parent Details into context - SetAndHandleEmpty Set the Grand Parent Deta... SetAndHandleEmpty Set the parent Process Details - SetAndHandleEmpty Set the parent Process De... SetAndHandleEmpty Set the Policy Actions - SetAndHandleEmpty Set the Policy Actions SetAndHandleEmpty CommandLine Analysis - CommandLineAnalysis CommandLine Analysis CommandLineAnalysis Enrich Indicators Extracted From CommandLine - enrichIndicators Enrich Indicators Extract... enrichIndicators Create new incident for investigating the indicators - createNewIncident Create new incident for i... createNewIncident Terminate Parent Process - cs-falcon-rtr-kill-process Terminate Parent Process cs-falcon-rtr-kill-process Get Endpoint Status Endpoint - endpoint Get Endpoint Status Endpoint endpoint Is there a process to terminate? Is there a process to ter... Link current incident to the new one - linkIncidents Link current incident to ... linkIncidents Are there any malicious indicators? Are there any malicious i... Whether to open another incident to track findings? Whether to open another i... Are there any Indicators to enrich? Are there any Indicators ...