Detonate File - Trend Micro Deep Discovery Analyzer Beta

Detonates a File using the TrendAI™ Deep Discovery™ Analyzer sandbox. Deep Discovery Analyzer(version 6.0.0) supports the following File Types: bat, cell, chm, class, cmd, dll, doc, docx, exe, gul, hta, htm, html, hwp, hwpx, jar, js, jse, jtd, lnk, mov, pdf, ppt, pptx, ps1, pub, rtf, slk, svg, swf, vbe, vbs, wsf, xls, xlsx, xml

TrendAI™ Deep Discovery™ Analyzer · 10 tasks · 3 inputs · 17 outputs

Details

ID	`Detonate File - Trend Micro Deep Discovery Analyzer Beta`
From Version	5.0.0
Tasks	10

README

Detonates a File using the TrendAI™ Deep Discovery™ Analyzer sandbox.
Deep Discovery Analyzer(version 6.0.0) supports the following File Types:
bat, cell, chm, class, cmd, dll, doc, docx, exe, gul, hta, htm, html, hwp, hwpx, jar, js, jse, jtd, lnk, mov, pdf, ppt, pptx, ps1, pub, rtf, slk, svg, swf, vbe, vbs,
wsf, xls, xlsx, xml

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

Trend Micro Deep Discovery Analyzer

Scripts

Commands

trendmicro-dda-check-status
trendmicro-dda-get-report
trendmicro-dda-upload-file

Playbook Inputs

Name	Description	Default Value	Required
File	The file to detonate. File is taken from the context.	File	Required
interval	Polling frequency - how often the polling command should run (minutes)	1	Optional
timeout	How much time to wait before a timeout occurs (minutes)	15	Optional

Playbook Outputs

Path	Description	Type
DBotScore.Type	The type of the indicator	string
DBotScore.Vendor	Vendor used to calculate the score	string
TrendMicroDDA.Submissions.SHA1	SHA1 of the submission	string
TrendMicroDDA.Submissions.RiskLevel	The Risk Level of the sample	number
DBotScore.Score	The actual score	number
TrendMicroDDA.Submissions.isCompleted	Stating if the detonation was complete or not	string
DBotScore.Indicator	The indicator we tested	string
TrendMicroDDA.Submissions.status	The status of the sample	string
InfoFile.MD5	MD5 hash of the report file	string
InfoFile.SHA1	SHA1 hash of the report file	string
InfoFile.SHA256	SHA256 hash of the report file	string
InfoFile.Name	Report file name	string
InfoFile.Type	Report file type e.g. “PE”	string
InfoFile.Size	Report file size	number
File.Malicious.Vendor	For malicious files, the vendor that made the decision	string
File.Malicious.Description	For malicious files, the reason for the vendor to make the decision	string
IP.Address	IPs relevant to the submission	string

Playbook Image

Detonate File - Trend Micro Deep Discovery Analyzer Beta

Inputs

File — The file to detonate. File is taken from the context.
interval — Polling frequency - how often the polling command should run (minutes)
timeout — How much time to wait before a timeout occurs (minutes)

Outputs

DBotScore.Type — The type of the indicator
DBotScore.Vendor — Vendor used to calculate the score
TrendMicroDDA.Submissions.SHA1 — SHA1 of the submission
TrendMicroDDA.Submissions.RiskLevel — The Risk Level of the sample
DBotScore.Score — The actual score
TrendMicroDDA.Submissions.isCompleted — Stating if the detonation was complete or not
DBotScore.Indicator — The indicator we tested
TrendMicroDDA.Submissions.status — The status of the sample
InfoFile.MD5 — MD5 hash of the report file
InfoFile.SHA1 — SHA1 hash of the report file
InfoFile.SHA256 — SHA256 hash of the report file
InfoFile.Name — Report file name
InfoFile.Type — Report file type e.g. "PE"
InfoFile.Size — Report file size
File.Malicious.Vendor — For malicious files, the vendor that made the decision
File.Malicious.Description — For malicious files, the reason for the vendor to make the decision
IP.Address — IPs relevant to the submission

Commands used

trendmicro-dda-check-status trendmicro-dda-get-report trendmicro-dda-upload-file

Flowchart

Source

playbook-TrendMicro_DDA_DetonateFile.yml

Download History Raw

id: Detonate File - Trend Micro Deep Discovery Analyzer Beta
version: -1
name: Detonate File - Trend Micro Deep Discovery Analyzer Beta
fromversion: 5.0.0
description: "Detonates a File using the TrendAI™ Deep Discovery™ Analyzer sandbox.\nDeep Discovery Analyzer(version 6.0.0) supports the following File Types:\nbat, cell, chm, class, cmd, dll, doc, docx, exe, gul, hta, htm, html, hwp, hwpx, jar, js, jse, jtd, lnk, mov, pdf, ppt, pptx, ps1, pub, rtf, slk, svg, swf, vbe, vbs, \nwsf, xls, xlsx, xml"
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: fbcc0577-3904-48a9-82c9-5bb0e70b19bd
    type: start
    task:
      id: fbcc0577-3904-48a9-82c9-5bb0e70b19bd
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
  "1":
    id: "1"
    taskid: c3878144-0a86-4654-8b08-63f655876242
    type: title
    task:
      id: c3878144-0a86-4654-8b08-63f655876242
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1595
        }
      }
    note: false
  "2":
    id: "2"
    taskid: 054e1385-da5e-4d14-8126-359343f57190
    type: condition
    task:
      id: 054e1385-da5e-4d14-8126-359343f57190
      version: -1
      name: Is TrendAI™ DDA sandbox enabled?
      description: |
        Verify that there is a valid instance of TrendAI™ DDA enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "1"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Trend Micro Deep Discovery Analyzer Beta
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
  "3":
    id: "3"
    taskid: c0f86d20-a8e6-4ac8-8827-aa258d0b47b9
    type: condition
    task:
      id: c0f86d20-a8e6-4ac8-8827-aa258d0b47b9
      version: -1
      name: Is there a File to Detonate?
      description: Checks that there is a file in the playbook’s input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "1"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.File
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
  "4":
    id: "4"
    taskid: 438549fb-1463-4997-8f3e-e12ed18bd247
    type: regular
    task:
      id: 438549fb-1463-4997-8f3e-e12ed18bd247
      version: -1
      name: Set File to context
      description: Set the file object into context.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      append: {}
      key:
        simple: File
      value:
        complex:
          root: inputs.File
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
  "5":
    id: "5"
    taskid: fafcbca2-d501-45d7-8eb5-91d067517bc0
    type: condition
    task:
      id: fafcbca2-d501-45d7-8eb5-91d067517bc0
      version: -1
      name: Is File type supported?
      description: Check if file type is supported.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "1"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                filters:
                - - operator: match
                    left:
                      value:
                        simple: File.Type
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:BAT|CELL|CHM|CLASS|CMD|DLL|DOC|DOCX|EXE|GUL|HTA|HTM|HTML|HWP|HWPX|JAR|JS|JSE|JTD|LNK|MOV|PDF|PPT|PPTX|PS1|PUB|RTF|SLK|SVG|SWF|VBE|VBS|WSF|XLS|XLSX|XML)\b
                    ignorecase: true
                  - operator: match
                    left:
                      value:
                        simple: File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:BAT|CELL|CHM|CLASS|CMD|DLL|DOC|DOCX|EXE|GUL|HTA|HTM|HTML|HWP|HWPX|JAR|JS|JSE|JTD|LNK|MOV|PDF|PPT|PPTX|PS1|PUB|RTF|SLK|SVG|SWF|VBE|VBS|WSF|XLS|XLSX|XML)\b
                    ignorecase: true
                  - operator: match
                    left:
                      value:
                        simple: File.Info
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:BAT|CELL|CHM|CLASS|CMD|DLL|DOC|DOCX|EXE|GUL|HTA|HTM|HTML|HWP|HWPX|JAR|JS|JSE|JTD|LNK|MOV|PDF|PPT|PPTX|PS1|PUB|RTF|SLK|SVG|SWF|VBE|VBS|WSF|XLS|XLSX|XML)\b
                    ignorecase: true
                accessor: EntryID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
  "6":
    id: "6"
    taskid: 759f9829-2d6e-4679-8a61-8aa294224f87
    type: regular
    task:
      id: 759f9829-2d6e-4679-8a61-8aa294224f87
      version: -1
      name: TrendAI™ DDA Upload File
      description: Uploads the submission to TrendAI™ DDA.
      script: '|||trendmicro-dda-upload-file'
      type: regular
      iscommand: true
      brand: Trend Micro Deep Discovery Analyzer
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      EntryID:
        simple: ${inputs.File.EntryID}
      entryID:
        simple: ${inputs.File.EntryID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 895
        }
      }
    note: false
  "7":
    id: "7"
    taskid: 5c162061-9a4f-4ae4-8232-87d4a06566a5
    type: playbook
    task:
      id: 5c162061-9a4f-4ae4-8232-87d4a06566a5
      version: -1
      name: GenericPolling
      description: Generic Polling Playbook
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Ids:
        simple: ${TrendMicroDDA.Submission.SHA1}
      Interval:
        simple: "1"
      PollingCommandArgName:
        simple: sha1
      PollingCommandName:
        simple: trendmicro-dda-check-status
      Timeout:
        simple: "10"
      dt:
        simple: TrendMicroDDA.Submission(val.Status != 'Completed').SHA1
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1070
        }
      }
    note: false
  "8":
    id: "8"
    taskid: cc912d0d-6f66-4217-810e-6acbd1b813f5
    type: regular
    task:
      id: cc912d0d-6f66-4217-810e-6acbd1b813f5
      version: -1
      name: trendmicro-dda-check-status
      description: Updates the status of the submissions in the context.
      script: '|||trendmicro-dda-check-status'
      type: regular
      iscommand: true
      brand: Trend Micro Deep Discovery Analyzer
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      sha1:
        simple: ${TrendMicroDDA.Submission.SHA1}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1245
        }
      }
    note: false
  "9":
    id: "9"
    taskid: 1528760c-006b-405e-8c87-a3eebf451a84
    type: regular
    task:
      id: 1528760c-006b-405e-8c87-a3eebf451a84
      version: -1
      name: TrendAI™ DDA Get Report
      description: Retrieve the reports from TrendAI™ DDA.
      script: '|||trendmicro-dda-get-report'
      type: regular
      iscommand: true
      brand: Trend Micro Deep Discovery Analyzer
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      sha1:
        simple: ${TrendMicroDDA.Submission(val.Status == 'Completed').SHA1}
      threshold: {}
      verbose: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1420
        }
      }
    note: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1610,
        "width": 717.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: true
  description: The file to detonate. File is taken from the context.
- key: interval
  value:
    simple: "1"
  required: false
  description: Polling frequency - how often the polling command should run (minutes)
- key: timeout
  value:
    simple: "15"
  required: false
  description: How much time to wait before a timeout occurs (minutes)
outputs:
- contextPath: DBotScore.Type
  description: The type of the indicator
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score
  type: string
- contextPath: TrendMicroDDA.Submissions.SHA1
  description: SHA1 of the submission
  type: string
- contextPath: TrendMicroDDA.Submissions.RiskLevel
  description: The Risk Level of the sample
  type: number
- contextPath: DBotScore.Score
  description: The actual score
  type: number
- contextPath: TrendMicroDDA.Submissions.isCompleted
  description: Stating if the detonation was complete or not
  type: string
- contextPath: DBotScore.Indicator
  description: The indicator we tested
  type: string
- contextPath: TrendMicroDDA.Submissions.status
  description: The status of the sample
  type: string
- contextPath: InfoFile.MD5
  description: MD5 hash of the report file
  type: string
- contextPath: InfoFile.SHA1
  description: SHA1 hash of the report file
  type: string
- contextPath: InfoFile.SHA256
  description: SHA256 hash of the report  file
  type: string
- contextPath: InfoFile.Name
  description: Report file name
  type: string
- contextPath: InfoFile.Type
  description: Report file type e.g. "PE"
  type: string
- contextPath: InfoFile.Size
  description: 'Report file size '
  type: number
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision
  type: string
- contextPath: File.Malicious.Description
  description: For malicious files, the reason for the vendor to make the decision
  type: string
- contextPath: IP.Address
  description: IPs relevant to the submission
  type: string
beta: true
tests:
- No Test - run "Test Playbook TrendMicroDDA" manually