ExtraHop - CVE-2019-0708 (BlueKeep)

id: ExtraHop - CVE-2019-0708 (BlueKeep)
version: -1
fromversion: 5.0.0
name: ExtraHop - CVE-2019-0708 (BlueKeep)
description: |-
  This server received a Remote Desktop Protocol (RDP) connection request that is consistent with a known vulnerability, also known as BlueKeep, in older versions of Microsoft Windows. This vulnerability allows an unauthenticated attacker to remotely run arbitrary code on an RDP server. The attacker can then tamper with data or install malware that could propagate to other Windows devices across the network. Investigate to determine if this server is hosting a version affected by CVE-2019-0708: Windows 7, Windows XP, Windows Vista, Windows Server 2003, and Windows Server 2008.

  MITIGATION OPTIONS
  - Disable Remote Desktop Services if they are not required
  - Implement Network Level Authentication (NLA) on systems running supported versions of Windows 7, Windows Server 2008, and Windows Server 2008 R2
  - Configure firewalls to block traffic on TCP port 3389
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: c900f024-5ddc-454e-8ab6-0c13880092cc
    type: start
    task:
      id: c900f024-5ddc-454e-8ab6-0c13880092cc
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -10,
          "y": -460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 1cb52ba5-300d-4784-824a-aedf40f72df5
    type: title
    task:
      id: 1cb52ba5-300d-4784-824a-aedf40f72df5
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -10,
          "y": 790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 36a7d3d4-f7c8-459c-84e5-ce689a87a7fd
    type: condition
    task:
      id: 36a7d3d4-f7c8-459c-84e5-ce689a87a7fd
      version: -1
      name: Is ExtraHop Reveal(x) enabled?
      description: Checks if there is an active instance of the ExtraHop Reveal(x)
        integration enabled.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "16"
    scriptarguments:
      value:
        complex:
          root: modules
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: brand
                iscontext: true
              right:
                value:
                  simple: ExtraHop v2
          - - operator: isEqualString
              left:
                value:
                  simple: state
                iscontext: true
              right:
                value:
                  simple: active
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -10,
          "y": -320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: fee1c906-3557-4939-8778-727e02d09dfa
    type: regular
    task:
      id: fee1c906-3557-4939-8778-727e02d09dfa
      version: -1
      name: Run CVE search for BlueKeep vulnerability
      description: Returns CVE information by CVE ID.
      script: '|||cve'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "17"
      - "24"
    scriptarguments:
      cve_id:
        simple: CVE-2019-0708
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": -120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: df037c03-1011-427e-8ad0-4362b45e48e2
    type: playbook
    task:
      id: df037c03-1011-427e-8ad0-4362b45e48e2
      version: -1
      name: ExtraHop - Get Peers by Host
      description: Given a host, the playbook will retrieve the peer network devices
        that communicated with that host in a given time range.  In addition to a
        list of peers and protocols (sorted by bytes) the playbook returns a link
        to the ExtraHop Live Activity Map to visualize the peer relationships.
      playbookName: ExtraHop - Get Peers by Host
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      from_time:
        complex:
          root: incident
          accessor: occurred
          transformers:
          - operator: toUnix
          - operator: subtraction
            args:
              by:
                value:
                  simple: "1800"
      ip:
        complex:
          root: incident
          accessor: extrahoprevealxdetectionparticipants
          transformers:
          - operator: WhereFieldEquals
            args:
              equalTo:
                value:
                  simple: victim
              field:
                value:
                  simple: role
              getField:
                value:
                  simple: ipaddress
      mac:
        complex:
          root: incident
          accessor: extrahoprevealxdetectionparticipants
          transformers:
          - operator: WhereFieldEquals
            args:
              equalTo:
                value:
                  simple: victim
              field:
                value:
                  simple: role
              getField:
                value:
                  simple: macaddress
      name:
        complex:
          root: incident
          accessor: extrahoprevealxdetectionparticipants
          transformers:
          - operator: WhereFieldEquals
            args:
              equalTo:
                value:
                  simple: victim
              field:
                value:
                  simple: role
              getField:
                value:
                  simple: dnsname
      until_time:
        complex:
          root: incident
          accessor: occurred
          transformers:
          - operator: toUnix
          - operator: addition
            args:
              by:
                value:
                  simple: "1800"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 210,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: a518131c-b989-4844-8467-c255dd769f11
    type: condition
    task:
      id: a518131c-b989-4844-8467-c255dd769f11
      version: -1
      name: Email team to block offender IP address
      description: Ask ExtraHop analysts whether or not to automatically block the
        offender IP address.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "20"
      "Yes":
      - "23"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 620,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: ExtraHop
      subject:
        simple: CVE-2019-0708 RDP Exploit Attempt - Block Offender IP?
      body:
        complex:
          root: incident
          accessor: extrahoprevealxdetectionparticipants
          transformers:
          - operator: WhereFieldEquals
            args:
              equalTo:
                value:
                  simple: offender
              field:
                value:
                  simple: role
              getField:
                value:
                  simple: ipaddress
      methods:
      - email
      format: ""
      bcc: null
      cc: null
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 30b3c908-99e9-4ec3-8ddd-85799ce064f3
    type: regular
    task:
      id: 30b3c908-99e9-4ec3-8ddd-85799ce064f3
      version: -1
      name: Guided investigation steps and mitigation options
      description: |-
        Investigate to determine if the victim server is hosting a version affected by CVE-2019-0708: Windows 7, Windows XP, Windows Vista, Windows Server 2003, and Windows Server 2008.

        Mitigation Options
        - Disable Remote Desktop Services if they are not required
        - Implement Network Level Authentication (NLA) on systems running supported versions of Windows 7, Windows Server 2008, and Windows Server 2008 R2
        - Configure firewalls to block traffic on TCP port 3389
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 9ff72dfc-c9c1-42bc-8ffa-59a27ac4d1ea
    type: regular
    task:
      id: 9ff72dfc-c9c1-42bc-8ffa-59a27ac4d1ea
      version: -1
      name: Get associated PCAP file from ExtraHop Reveal(x)
      description: Search for specific packets in Reveal(x).
      script: ExtraHop v2|||extrahop-packets-search
      type: regular
      iscommand: true
      brand: ExtraHop v2
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      ip1:
        complex:
          root: incident
          accessor: extrahoprevealxdetectionparticipants
          transformers:
          - operator: WhereFieldEquals
            args:
              equalTo:
                value:
                  simple: offender
              field:
                value:
                  simple: role
              getField:
                value:
                  simple: ipaddress
      ip2:
        complex:
          root: incident
          accessor: extrahoprevealxdetectionparticipants
          transformers:
          - operator: WhereFieldEquals
            args:
              equalTo:
                value:
                  simple: victim
              field:
                value:
                  simple: role
              getField:
                value:
                  simple: ipaddress
      port2:
        simple: "3389"
      query_from:
        complex:
          root: incident
          accessor: occurred
          transformers:
          - operator: toUnix
          - operator: multiply
            args:
              by:
                value:
                  simple: "1000"
      query_until:
        complex:
          root: incident
          accessor: occurred
          transformers:
          - operator: toUnix
          - operator: addition
            args:
              by:
                value:
                  simple: "2"
          - operator: multiply
            args:
              by:
                value:
                  simple: "1000"
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 942730fc-21ad-480b-8300-acfd7d1e60ef
    type: playbook
    task:
      id: 942730fc-21ad-480b-8300-acfd7d1e60ef
      version: -1
      name: Block IP - Generic v2
      description: |-
        This playbook blocks malicious IPs using all integrations that you have enabled.

        Supported integrations for this playbook:
        * Check Point Firewall
        * Palo Alto Networks Minemeld
        * Palo Alto Networks PAN-OS
        * Zscaler
      playbookName: Block IP - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      IP:
        complex:
          root: incident
          accessor: extrahoprevealxdetectionparticipants
          transformers:
          - operator: WhereFieldEquals
            args:
              equalTo:
                value:
                  simple: offender
              field:
                value:
                  simple: role
              getField:
                value:
                  simple: ipaddress
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 840,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: eff52fa9-8108-4afd-8cb2-3d1be040b749
    type: condition
    task:
      id: eff52fa9-8108-4afd-8cb2-3d1be040b749
      version: -1
      name: Automatically block the offender IP address?
      description: Check the playbook inputs to see if automatically blocking the
        offender IP address is desired.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "19"
      "yes":
      - "23"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.AutoBlockIp
            iscontext: true
          right:
            value:
              simple: "True"
    view: |-
      {
        "position": {
          "x": 620,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "15_2_#default#": 0.12,
      "19_20_#default#": 0.33,
      "19_23_Yes": 0.57,
      "24_19_#default#": 0.55
    },
    "paper": {
      "dimensions": {
        "height": 1315,
        "width": 1230,
        "x": -10,
        "y": -460
      }
    }
  }
inputs:
- key: AutoBlockIp
  value:
    simple: "False"
  required: false
  description: |-
    Enable the "Block IP" capability automatically (can be either "True" or "False").
    The "Block IP" sub-playbook will block the offender IP address in the relevant integrations.
  playbookInputQuery: null
outputs:
- contextPath: CVE
  description: Details on the CVE.
  type: unknown
- contextPath: ExtraHop.Device
  description: 'Details on the host and any peer devices found. '
  type: unknown
- contextPath: ExtraHop.ActivityMap
  description: The link to a visual activity map in ExtraHop.
  type: string
- contextPath: ExtraHop.Record.Source
  description: Associated transaction records from ExtraHop.
  type: unknown
tests:
- ExtraHop_v2-Test