FireEye Red Team Tools Investigation and Response

This playbook does the following: Collect indicators to aid in your threat hunting process. - Retrieve IOCs of FireEye red team tools. - Discover IOCs of associated activity related to the infection. - Generate an indicator list to block indicators with SUNBURST tags. Hunt for the indicators - Search endpoints with the FireEye red team tools CVEs. - Search endpoint logs for FireEye red team tools hashes. - Search and link previous incidents with the FireEye hashes. If compromised hosts are found, fire off sub-playbooks to isolate/quarantine infected hosts/endpoints and await further actions from the security team.

Rapid Breach Response · 27 tasks · 3 inputs · 0 outputs

Inputs

  • FireEyeToolsCVE — CVE-2019-0708 ,CVE-2017-11774
  • FireEyeRedTeamToolsCVEsURL — The URL of FireEye red team tools CVEs
  • IsolateEndpointAutomatically — Whether to automatically isolate endpoints, or opt for manual user approval. True means isolation will be done automatically.

Commands used

appendIndicatorField closeInvestigation createNewIndicator cve enrichIndicators extractIndicators linkIncidents

Flowchart

yes yes yes yes Start Start Are there CVEs? Are there CVEs? CVE Enrichments CVE Enrichments Hunt IOC's Hunt IOC's Create indicators - createNewIndicator Create indicators createNewIndicator Enrich indicators - enrichIndicators Enrich indicators enrichIndicators Search CVE's Search CVE's Search Endpoint by CVE - Generic - Search Endpoint by CVE - Generic Search Endpoint by CVE - ... Search Endpoint by CVE - Generic Red team tools hashes Red team tools hashes Collect Hashes from FireEye for red team tools - http Collect Hashes from FireE... http Create red team tools hash indicators - extractIndicators Create red team tools has... extractIndicators Add red team tools tag - appendIndicatorField Add red team tools tag appendIndicatorField Search red team tools hashes Search red team tools hashes Search Endpoints By Hash - Generic V2 - Search Endpoints By Hash - Generic V2 Search Endpoints By Hash ... Search Endpoints By Hash - Ge... Remediation Remediation Any compromised hosts found? Any compromised hosts found? Should isolate automatically compromised hosts? Should isolate automatica... Isolate Endpoint - Generic V2 - Isolate Endpoint - Generic V2 Isolate Endpoint - Generi... Isolate Endpoint - Generic V2 Investigate Investigate Manually isolate endpoints Manually isolate endpoints Investigate further Investigate further Close investigation - closeInvestigation Close investigation closeInvestigation Done Done Find incidents with indicators - findIncidentsWithIndicator Find incidents with indic... findIncidentsWithIndicator Found incident with indicators? Found incident with indic... Link incidents - linkIncidents Link incidents linkIncidents Enrich FireEye red team tools CVEs - cve Enrich FireEye red team t... cve