Endpoint Malware Investigation - Generic Deprecated

Deprecated. Use 'Malware Investigation & Response Incident handler' instead. (From the 'Malware Investigation And Response Pack') This playbook is triggered by a malware incident from an 'Endpoint' type integration. The playbook performs enrichment, detonation, and hunting within the organization, and remediation on the malware. Used sub-playbooks: - Endpoint Enrichment - Generic v2.1 - Retrieve File from Endpoint - Generic - Detonate File - Generic - File Enrichment - Generic v2 - Calculate Severity - Generic v2 - Isolate Endpoint - Generic - Block Indicators - Generic v2

Malware Core · 34 tasks · 8 inputs · 0 outputs

Details

IDEndpoint Malware Investigation - Generic
From Version5.0.0
Tasks34

README

Deprecated. Please use the ‘Malware Investigation & Response Incident handler (From the ‘Malware Investigation And Response’ Pack).

Performs enrichment, detonation, and hunting within the organization, and remediation on the malware. This playbook is triggered by a malware incident from an Endpoint type integration.

Used sub-playbooks:

  • Endpoint Enrichment - Generic v2.1
  • Retrieve File from Endpoint - Generic
  • Detonate File - Generic
  • File Enrichment - Generic v2
  • Calculate Severity - Generic v2
  • Isolate Endpoint - Generic
  • Block Indicators - Generic v2

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Endpoint Enrichment - Generic v2.1
  • Detonate File - Generic
  • Retrieve File from Endpoint - Generic
  • Calculate Severity - Generic v2
  • Isolate Endpoint - Generic
  • Block Indicators - Generic v2
  • File Enrichment - Generic v2

Integrations

  • Builtin

Scripts

  • GenerateInvestigationSummaryReport

Commands

  • send-mail
  • setIncident
  • closeInvestigation

Playbook Inputs

Name Description Default Value Source Required
AutoIsolation This input determines the threshold severity from which to perform auto-isolation for the infected endpoint. Specify the severity number (default is High): Specify the severity number:”0” means Unknown, “0.5” means Informational, “1” means Low, “2” means Medium, “3” means High, “4” means Critical. 3 - Optional
Email The email address to notify if there is a possibility of the malware spreading and infecting other endpoints. - - Optional
MD5 The MD5 hash of the file. md5string incident Optional
SHA256 The SHA256 hash of the file. sha256 incident Optional
Hostname The hostname of the machine on which the file is located. Hostname Endpoint Optional
FilePath The file path. Path File Optional
UseD2 Whether to use the D2 agent to retrieve the file. no - Optional
SHA1 The SHA1 hash of the file. sha1 incident Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Endpoint_Malware_Investigation_Generic

Inputs

  • AutoIsolation — This input determines the threshold severity from which to perform auto-isolation for the infected endpoint. Specify the severity number (default is High): Specify the severity number: 0 - Unknown 0.5 - Informational 1 - Low 2 - Medium 3 - High 4 - Critical
  • Email — The Email address to notify if there is a possibility of the malware spreading and infecting other endpoints.
  • MD5 — File MD5.
  • SHA256 — File SHA256.
  • Hostname — Hostname of the machine on which the file is located.
  • FilePath — File path.
  • UseD2 — Specifies whether to use D2 agent to retrieve the file.
  • SHA1 — File SHA1.

Commands used

closeInvestigation send-mail setIncident

Flowchart

No Yes yes No Yes No Yes yes Close as False positive Continue yes Start Start Detonation Detonation File enrichment File enrichment Hunting Hunting Remediation Remediation Manual - Get analyst approval for auto-remediation Manual - Get analyst appr... Analyst review of the investigation Analyst review of the inv... Manual - Unisolate endpoints Manual - Unisolate endpoints Endpoint Enrichment - Generic v2.1 - Endpoint Enrichment - Generic v2.1 Endpoint Enrichment - Gen... Endpoint Enrichment - Generic... File Enrichment - Generic v2 - File Enrichment - Generic v2 File Enrichment - Generic v2 File Enrichment - Generic v2 Detonate File - Generic - Detonate File - Generic Detonate File - Generic Detonate File - Generic Generate Investigation Summary Report - GenerateInvestigationSummaryReport Generate Investigation Su... GenerateInvestigationSummaryR... Was a file retrieved? Was a file retrieved? Retrieve file manually Retrieve file manually Manual - Hunt for other infected endpoints Manual - Hunt for other i... Were there any more infected endpoints found? Were there any more infec... Analyst manual remediation Analyst manual remediation Perform manual malware analysis and forensics Perform manual malware an... False Positive False Positive Get analyst approval for local containment Get analyst approval for ... Auto-Isolation? Auto-Isolation? Continue with the investigation or close as false positive? Continue with the investi... Calculate Severity - Generic v2 - Calculate Severity - Generic v2 Calculate Severity - Gene... Calculate Severity - Generic v2 Notify that more infected endpoints were found - send-mail Notify that more infected... send-mail Notify? Notify? Done Done Close Demisto Investigation - closeInvestigation Close Demisto Investigation closeInvestigation Manual - Close incident in the source product Manual - Close incident i... Set incident - Isolated field - setIncident Set incident - Isolated f... setIncident Retrieve File from Endpoint - Generic - Retrieve File from Endpoint - Generic Retrieve File from Endpoi... Retrieve File from Endpoint -... Isolate Endpoint - Generic - Isolate Endpoint - Generic Isolate Endpoint - Generic Isolate Endpoint - Generic Isolate Endpoint - Generic - Isolate Endpoint - Generic Isolate Endpoint - Generic Isolate Endpoint - Generic Block Indicators - Generic v2 - Block Indicators - Generic v2 Block Indicators - Generi... Block Indicators - Generic v2 Isolate infected endpoints Isolate infected endpoints

Source

playbook-Endpoint_Malware_Investigation_-_Generic.yml playbook-Endpoint_Malware_Investigation_-_Generic_V2.yml playbook-Endpoint_Malware_Investigation_-_Generic_V2_README.md
Download History Raw 
Deprecated. Please use the 'Malware Investigation & Response Incident handler (From the 'Malware Investigation And Response' Pack).

---
This playbook provides a framework for handling malware investigation through all essential steps. The playbook consists of 7 stages. Each stage contains the relevant playbook or tasks. 
This playbook will auto extract indicators from incidents by indicator extraction rules of the malware incident type.
To use Illusive integration in the `Forensics - Generic` playbook, note that you will be able to set th eforensic timeline by editing the `Forensics - Generic` playbook inputs.  
    

## Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks
* Unisolate Endpoint - Generic
* File Enrichment - Generic v2
* Block Indicators - Generic v2
* Get host forensics - Generic 
* Calculate Severity - Generic v2
* Threat Hunting - Generic 
* Detonate File - Generic
* Isolate Endpoint - Generic V2
* Retrieve File from Endpoint - Generic V2
* Get endpoint details - Generic

### Integrations
This playbook does not use any integrations.

### Scripts
* SetAndHandleEmpty
* AssignAnalystToIncident
* commentsToContext
* SetGridField
* Set
* DBotFindSimilarIncidents
* GenerateInvestigationSummaryReport

### Commands
* closeInvestigation
* setIncident
* send-mail
* linkIncidents

## Playbook Inputs
---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| AutoIsolation | This input determines the threshold severity from which to perform auto-isolation for the infected endpoint.<br/>Specify the severity number. \(Default is High\):<br/>Specify the severity number:<br/>0 - Unknown<br/>0.5 - Informational<br/>1 - Low<br/>2 - Medium<br/>3 - High<br/>4 - Critical | 3 | Optional |
| Email | The email address to send a notification to if there is a possibility of the malware spreading and infecting other endpoints. |  | Optional |
| MD5 | The MD5 hash value for the suspicious file. | incident.md5 | Optional |
| SHA256 | The SHA256 hash value for the suspicious file. | incident.sha256 | Optional |
| Hostname | Hostname of the machine on which the file is located. | incident.hostname | Optional |
| FilePath | The path of the file to retrieve.<br/>For example:<br/>C:\\users\\folder\\file.txt | File.Path | Optional |
| UseD2 | Specifies whether to use a D2 agent to retrieve the file. | no | Optional |
| SHA1 | The SHA1 hash value for the suspicious file. | incident.sha1 | Optional |
| ActivateAutomaticHunting | Activate Threat Hunting - Generic playbook for automatic hunting.<br/>Yes- to activate.<br/> | no | Optional |
| ManualThreatHunting | Perform manual threat hunting.<br/>Yes- to activate.<br/> | No | Optional |
| NeedMoreForensics | Providing the value \`Yes\` will activate the \`Forensics - Generic\` playbook that retrieves additional forensics on the investigating host. <br/>Yes- to activate. | no | Optional |
| IPAddress | This input is relevant if the Threat Hunting - Generic playbook is activated. <br/>If you activated the Threat Hunting - Generic playbook and you are hunting IP addresses, provide the IP addresses here.<br/> |  | Optional |
| URLDomain | This input is relevant if the Threat Hunting - Generic playbook is activated. <br/>If you activated the Threat Hunting - Generic playbook and you are hunting for URLs or domains, provide them here.  |  | Optional |
| InternalRange | This input is relevant if the Threat Hunting - Generic playbook is activated. <br/>The input is a list of internal IP ranges to check IP addresses against. The list should be provided in CIDR notation, separated by commas. An example of a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" \(without quotes\). If a list is not provided, it will use the default list provided in the IsIPInRanges script \(the known IPv4 private address ranges\). |  | Optional |
| InternalDomainName | This input is relevant if the Threat Hunting - Generic playbook is activated. <br/>The input is the organization's internal domain name. This is provided for the IsInternalHostName  script that checks if the detected host names are internal or external if the hosts contain the internal domains suffix. For example, demisto.com. If there is more than one domain, use the \| character to separate values such as \(demisto.com\|test.com\) |  | Optional |
| InternalHostRegex | This input is relevant if the Threat Hunting - Generic playbook is activated.<br/>This is provided for the IsInternalHostName script that checks if the detected host names are internal or external if the hosts match the organizations naming convention. For example, the host testpc1 will have the following regex \\w\{6\}\\d\{1\} |  | Optional |
| Agent_ID | This input is relevant if retrieving the file by EDR. If so, provide the relevant Agent_ID\\Endpoint ID.   | Agents ID | Optional |
| CriticalUsers | This input will be used by the \`Calculate Severity - Generic v2\` playbook.<br/>Provide your critical users \(CSV is optional\). | admin | Optional |
| CriticalEndpoints | This input will be used by the \`Calculate Severity - Generic v2\` playbook.<br/>Provide your critical endpoint hostnames \(CSV is optional\). |  | Optional |
| CriticalGroups | This input be used by the \`Calculate Severity - Generic v2\` playbook.<br/>Provide the DN names of your critical AD groups \(CSV is optional\). |  | Optional |
| AutoUnIsolation | Providing "Yes" in this playbook input will activate the "Unisolate Endpoint - Generic" playbook. | no | Optional |
| Endpoint_ip | The IP of the endpoint which is involved in the investigation. |  | Optional |
| LinkSimilarIncidents | Providing "Yes" in this playbook input will link the incidents that were found similar by DBotFindSimilarIncidents.  | no | Optional |
| DetonateFile | Providing "Yes" to this input will activate the "Detonate File - Generic".  | no | Optional |
| IsolationAfterHunting | Providing "Yes" to this input will activate "Isolate Endpoint Generic V2" after the execution of the threat hunting procedures.  | no | Optional |

## Playbook Outputs
---
There are no outputs for this playbook.

## Playbook Image
---
![Endpoint Malware Investigation - Generic V2](https://github.com/demisto/content/raw/ee07059dc8769d6f5652a4a07b668d63266cafaf/Packs/Malware/doc_files/Endpoint_Malware_Investigation_-_Generic_V2.png)