FireEye Red Team Tools Investigation and Response

This playbook does the following: Collect indicators to aid in your threat hunting process. - Retrieve IOCs of FireEye red team tools. - Discover IOCs of associated activity related to the infection. - Generate an indicator list to block indicators with SUNBURST tags. Hunt for the indicators - Search endpoints with the FireEye red team tools CVEs. - Search endpoint logs for FireEye red team tools hashes. - Search and link previous incidents with the FireEye hashes. If compromised hosts are found, fire off sub-playbooks to isolate/quarantine infected hosts/endpoints and await further actions from the security team.

Rapid Breach Response · 27 tasks · 3 inputs · 0 outputs

Details

ID	`FireEye Red Team Tools Investigation and Response`
From Version	5.5.0
Tasks	27

README

This playbook does the following:

Collect indicators to aid in your threat hunting process.

Retrieve IOCs of FireEye red team tools.
Discover IOCs of associated activity related to the infection.
Generate an indicator list to block indicators with SUNBURST tags.

Hunt for the indicators

Search endpoints with the FireEye red team tools CVEs.
Search endpoint logs for FireEye red team tools hashes.
Search and link previous incidents with the FireEye hashes.

If compromised hosts are found, fire off sub-playbooks to isolate/quarantine infected hosts/endpoints and await further actions from the security team.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Search Endpoint by CVE - Generic
Search Endpoints By Hash - Generic V2
Isolate Endpoint - Generic V2

Integrations

This playbook does not use any integrations.

Scripts

http
findIncidentsWithIndicator

Commands

extractIndicators
enrichIndicators
appendIndicatorField
createNewIndicator
cve
closeInvestigation
linkIncidents

Playbook Inputs

Name	Description	Default Value	Required
FireEyeToolsCVE	CVE-2019-0708 ,CVE-2017-11774	CVE-2018-15961,CVE-2019-19781 ,CVE-2019-3398,CVE-2019-11580 ,CVE-2018-13379,CVE-2020-0688 ,CVE-2019-11510,CVE-2019-0604 ,CVE-2020-10189,CVE-2019-8394 ,CVE-2020-1472,CVE-2018-8581 ,CVE-2016-0167,CVE-2014-1812	Optional
FireEyeRedTeamToolsCVEsURL	The URL of FireEye red team tools CVEs	https://github.com/fireeye/red_team_tool_countermeasures/blob/master/all-hashes.csv	Optional
IsolateEndpointAutomatically	Whether to automatically isolate endpoints, or opt for manual user approval. True means isolation will be done automatically.	False	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

FireEye Red Team Tools Investigation and Response

Inputs

FireEyeToolsCVE — CVE-2019-0708 ,CVE-2017-11774
FireEyeRedTeamToolsCVEsURL — The URL of FireEye red team tools CVEs
IsolateEndpointAutomatically — Whether to automatically isolate endpoints, or opt for manual user approval. True means isolation will be done automatically.

Commands used

appendIndicatorField closeInvestigation createNewIndicator cve enrichIndicators extractIndicators linkIncidents

Flowchart

Source

playbook-FireEye_Red_Team_Tools_Investigation_and_Response.yml

Download History Raw

id: FireEye Red Team Tools Investigation and Response
version: -1
name: FireEye Red Team Tools Investigation and Response
description: |-
  This playbook does the following:

  Collect indicators to aid in your threat hunting process.
  - Retrieve IOCs of FireEye red team tools.
  - Discover IOCs of associated activity related to the infection.
  - Generate an indicator list to block indicators with SUNBURST tags.

  Hunt for the indicators
  - Search endpoints with the FireEye red team tools CVEs.
  - Search endpoint logs for FireEye red team tools hashes.
  - Search and link previous incidents with the FireEye hashes.

  If compromised hosts are found, fire off sub-playbooks to isolate/quarantine infected hosts/endpoints and await further actions from the security team.

starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 9276769d-1bf3-4561-8644-ab81dcf1e280
    type: start
    task:
      id: 9276769d-1bf3-4561-8644-ab81dcf1e280
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": 0
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 162bc6c7-5645-4605-8cbb-7dfd2a606898
    type: condition
    task:
      id: 162bc6c7-5645-4605-8cbb-7dfd2a606898
      version: -1
      name: Are there CVEs?
      description: Check if there are CVEs in the playbook input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: 'inputs.FireEyeToolsCVE '
            iscontext: true
    view: |-
      {
        "position": {
          "x": 340,
          "y": 140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 45cbc029-69ba-4945-8e90-382efc7072a9
    type: title
    task:
      id: 45cbc029-69ba-4945-8e90-382efc7072a9
      version: -1
      name: CVE Enrichments
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 130,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 4a5a2aa6-5de9-4164-83d4-63b2185c317f
    type: title
    task:
      id: 4a5a2aa6-5de9-4164-83d4-63b2185c317f
      version: -1
      name: Hunt IOC's
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
      - "13"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": 970
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: a0e945ba-77a0-4c73-8550-049a7aebc605
    type: regular
    task:
      id: a0e945ba-77a0-4c73-8550-049a7aebc605
      version: -1
      name: Create indicators
      description: Create indicators for the FireEye red team tools CVEs.
      script: Builtin|||createNewIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      accounttype: {}
      actor: {}
      admincountry: {}
      adminemail: {}
      adminname: {}
      adminphone: {}
      asn: {}
      assignedrole: {}
      assigneduser: {}
      associatedfilenames: {}
      associations: {}
      biosversion: {}
      campaign: {}
      category: {}
      certificatenames: {}
      certificatesignature: {}
      certificatevalidationchecks: {}
      city: {}
      costcenter: {}
      costcentercode: {}
      countryname: {}
      creationdate: {}
      customFields: {}
      cvedescription:
        complex:
          root: CVE
          accessor: Description
      cvemodified:
        complex:
          root: CVE
          accessor: Modified
      cvss:
        complex:
          root: CVE
          accessor: CVSS
      department: {}
      description:
        simple: FireEye Red Team Tools CVEs
      detectionengines: {}
      devicemodel: {}
      dhcpserver: {}
      displayname: {}
      dns: {}
      domainidnname: {}
      domainname: {}
      domainreferringips: {}
      domainreferringsubnets: {}
      domainstatus: {}
      email: {}
      emailaddress: {}
      entryid: {}
      expanseassettype: {}
      expansebusinessunits: {}
      expansecertificateadvertisementstatus: {}
      expansedateadded: {}
      expansednsresolutionstatus: {}
      expansedomain: {}
      expansefirstobserved: {}
      expanselastobserved: {}
      expanseproperties: {}
      expanseprovidername: {}
      expanseservicestatus: {}
      expansesourcedomain: {}
      expansetags: {}
      expansetenantname: {}
      expansetype: {}
      expirationdate: {}
      extension: {}
      feedrelatedindicators: {}
      fileextension: {}
      filetype: {}
      firstseenbysource:
        complex:
          root: CVE
          accessor: Published
      geocountry: {}
      geolocation: {}
      givenname: {}
      groups: {}
      hostname: {}
      imphash: {}
      indicatoridentification: {}
      internal: {}
      ipaddress: {}
      issuerdn: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      lastseenbysource: {}
      leadership: {}
      location: {}
      locationregion: {}
      macaddress: {}
      malwarefamily: {}
      malwaretypes: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      memory: {}
      merge: {}
      mobilephone: {}
      name: {}
      namefield: {}
      nameservers: {}
      office365category: {}
      office365expressroute: {}
      office365required: {}
      operatingsystem: {}
      operatingsystemversion: {}
      organization: {}
      organizationalunitou: {}
      osversion: {}
      path: {}
      pem: {}
      personalemail: {}
      port: {}
      positivedetections: {}
      primarymotivation: {}
      processor: {}
      processors: {}
      publickey: {}
      published: {}
      quarantined: {}
      region: {}
      registrantcountry: {}
      registrantemail: {}
      registrantname: {}
      registrantphone: {}
      registrarabuseemail: {}
      registrarabusephone: {}
      registrarname: {}
      relateToIncident: {}
      relatedIncidents: {}
      reportedby: {}
      reputation: {}
      seenNow: {}
      serialnumber: {}
      service: {}
      sha1: {}
      sha256: {}
      sha512: {}
      signatureauthentihash: {}
      signaturecopyright: {}
      signaturedescription: {}
      signaturefileversion: {}
      signatureinternalname: {}
      signed: {}
      size: {}
      source: {}
      sourceTimeStamp: {}
      sourceoriginalseverity: {}
      spkisha256: {}
      ssdeep: {}
      state: {}
      stixaliases: {}
      stixdescription: {}
      stixgoals: {}
      stixid: {}
      stixismalwarefamily: {}
      stixkillchainphases: {}
      stixmalwaretypes: {}
      stixprimarymotivation: {}
      stixresourcelevel: {}
      stixroles: {}
      stixsecondarymotivations: {}
      stixsophistication: {}
      stixthreatactortypes: {}
      stixtooltypes: {}
      stixtoolversion: {}
      streetaddress: {}
      subdomains: {}
      subjectalternativenames: {}
      subjectdn: {}
      surname: {}
      tags: {}
      threattypes: {}
      title: {}
      trafficlightprotocol: {}
      type:
        simple: CVE
      updateddate: {}
      username: {}
      validitynotafter: {}
      validitynotbefore: {}
      value:
        complex:
          root: CVE
          accessor: ID
      workphone: {}
      xdrstatus: {}
      zipcode: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 130,
          "y": 620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 47b437f5-2ce3-4750-8278-81c5778e6048
    type: regular
    task:
      id: 47b437f5-2ce3-4750-8278-81c5778e6048
      version: -1
      name: Enrich indicators
      description: Enrich the FireEye red team tools CVEs indicators.
      script: Builtin|||enrichIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      indicatorsValues:
        complex:
          root: CVE
          accessor: ID
      using-brand: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 130,
          "y": 780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 0328b1be-7619-4416-8da4-4f3c7fe0b789
    type: title
    task:
      id: 0328b1be-7619-4416-8da4-4f3c7fe0b789
      version: -1
      name: Search CVE's
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 340,
          "y": 1110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 759f3b17-9d21-4d35-8f03-8c5f4bc8dad3
    type: playbook
    task:
      id: 759f3b17-9d21-4d35-8f03-8c5f4bc8dad3
      version: -1
      name: Search Endpoint by CVE - Generic
      description: Hunt for assets with a given CVE using available tools.
      playbookName: Search Endpoint by CVE - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      CVE_ID:
        complex:
          root: 'inputs.FireEyeToolsCVE '
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 340,
          "y": 1260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 9d0f587c-e8e2-4c6e-8f41-06ea7f64cf6b
    type: title
    task:
      id: 9d0f587c-e8e2-4c6e-8f41-06ea7f64cf6b
      version: -1
      name: Red team tools hashes
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 980,
          "y": 140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: d52123f4-4fe0-4aaf-8fe7-a2f0246b8511
    type: regular
    task:
      id: d52123f4-4fe0-4aaf-8fe7-a2f0246b8511
      version: -1
      name: Collect Hashes from FireEye for red team tools
      description: Use an HTTP request to get the hash related to FireEye for the red team tools.
      scriptName: http
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      body: {}
      filename:
        simple: all-hashes.csv
      headers: {}
      insecure: {}
      method:
        simple: GET
      password: {}
      proxy: {}
      saveAsFile: {}
      unsecure: {}
      url:
        complex:
          root: inputs.FireEyeRedTeamToolsCVEsURL
      username: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 980,
          "y": 290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 05c06fe1-2148-4887-8028-94568fb43df5
    type: regular
    task:
      id: 05c06fe1-2148-4887-8028-94568fb43df5
      version: -1
      name: Create red team tools hash indicators
      description: Extract and create FireEye red team tools hash indicators.
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      entryID: {}
      filePath: {}
      investigationID: {}
      text:
        complex:
          root: HttpRequest
          accessor: Response
    reputationcalc: 2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 980,
          "y": 450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: ec32410b-bd2d-4b71-8419-a31a7b7b9037
    type: regular
    task:
      id: ec32410b-bd2d-4b71-8419-a31a7b7b9037
      version: -1
      name: Add red team tools tag
      description: Add the tag "FireEye Red Team Tools" for the FireEye red team tools hashes.
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: FireEye Red Team Tools
      indicatorsValues:
        complex:
          root: ExtractedIndicators
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: ExtractedIndicators
                iscontext: true
          accessor: File
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 980,
          "y": 620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: 9f8ff0aa-a2af-42f8-8ff2-4e7f3c40c4e5
    type: title
    task:
      id: 9f8ff0aa-a2af-42f8-8ff2-4e7f3c40c4e5
      version: -1
      name: Search red team tools hashes
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "14"
      - "24"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 920,
          "y": 1110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: 7548454a-bd21-4be4-81a4-f55d0619fe2e
    type: playbook
    task:
      id: 7548454a-bd21-4be4-81a4-f55d0619fe2e
      version: -1
      name: Search Endpoints By Hash - Generic V2
      description: Hunt using available tools.
      playbookName: Search Endpoints By Hash - Generic V2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      MD5Hash:
        complex:
          root: File
          accessor: MD5
      SHA1Hash:
        complex:
          root: File
          accessor: SHA1
      SHA256Hash:
        complex:
          root: File
          accessor: SHA256
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 920,
          "y": 1250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: 872990d4-a542-44b5-8961-2ae376d7c8c1
    type: title
    task:
      id: 872990d4-a542-44b5-8961-2ae376d7c8c1
      version: -1
      name: Remediation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 920,
          "y": 1800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: 3bf08ec5-416b-47fd-89db-d0e5c2042a40
    type: condition
    task:
      id: 3bf08ec5-416b-47fd-89db-d0e5c2042a40
      version: -1
      name: Any compromised hosts found?
      description: |
        Check whether compromised hosts were found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "19"
      "yes":
      - "17"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Endpoint
            iscontext: true
    view: |-
      {
        "position": {
          "x": 920,
          "y": 1960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: 14bb0783-da07-4cd4-88a8-cb0cf5831974
    type: condition
    task:
      id: 14bb0783-da07-4cd4-88a8-cb0cf5831974
      version: -1
      name: Should isolate automatically compromised hosts?
      description: |
        Check whether files associated with the incident can be blocked automatically using various EDR integrations.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "20"
      "yes":
      - "18"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.IsolateEndpointAutomatically
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 1350,
          "y": 2130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: 9d270ed1-773b-43a0-8bab-3a8821895516
    type: playbook
    task:
      id: 9d270ed1-773b-43a0-8bab-3a8821895516
      version: -1
      name: Isolate Endpoint - Generic V2
      description: |-
        This playbook isolates a given endpoint using various endpoint product integrations.
        Make sure to provide valid playbook inputs for the integration you are using.
      playbookName: Isolate Endpoint - Generic V2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      Endpoint_hostname:
        complex:
          root: Endpoint
          accessor: Hostname
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1620,
          "y": 2315
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: 42595549-64b9-4850-878a-f12047f0f264
    type: title
    task:
      id: 42595549-64b9-4850-878a-f12047f0f264
      version: -1
      name: Investigate
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 920,
          "y": 2510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: dd67ba41-5a3d-48f9-8039-7c8c60386478
    type: regular
    task:
      id: dd67ba41-5a3d-48f9-8039-7c8c60386478
      version: -1
      name: Manually isolate endpoints
      description: Manually isolate the compromised hosts.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1140,
          "y": 2315
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "21":
    id: "21"
    taskid: 1b3be322-7b30-4ce5-8e7c-3c87eefe170f
    type: regular
    task:
      id: 1b3be322-7b30-4ce5-8e7c-3c87eefe170f
      version: -1
      name: Investigate further
      description: Further investigate the incident (endpoints, the entry point, etc.).
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 920,
          "y": 2680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "22":
    id: "22"
    taskid: c8f2f7ad-774c-427f-8f18-57204609b146
    type: regular
    task:
      id: c8f2f7ad-774c-427f-8f18-57204609b146
      version: -1
      name: Close investigation
      description: Close the current incident.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      assetid: {}
      closeNotes: {}
      closeReason: {}
      emailclassification: {}
      id: {}
      phishingsubtype: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 920,
          "y": 2890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "23":
    id: "23"
    taskid: c72f7b03-9d64-4898-821c-6ec51309f5b6
    type: title
    task:
      id: c72f7b03-9d64-4898-821c-6ec51309f5b6
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 920,
          "y": 3060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "24":
    id: "24"
    taskid: 22aa5735-fd45-4f63-82e3-9a18a5ca66ce
    type: regular
    task:
      id: 22aa5735-fd45-4f63-82e3-9a18a5ca66ce
      version: -1
      name: Find incidents with indicators
      description: Find existing incidents with the FireEye red team tools indicators.
      scriptName: findIncidentsWithIndicator
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      indicator:
        complex:
          root: ExtractedIndicators
          accessor: File
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1390,
          "y": 1250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "25":
    id: "25"
    taskid: d8962d7d-dd1b-4650-8864-1e26aaa8940b
    type: condition
    task:
      id: d8962d7d-dd1b-4650-8864-1e26aaa8940b
      version: -1
      name: Found incident with indicators?
      description: Check if incidents were found with the FireEye red team tools indicators.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "15"
      "yes":
      - "26"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: IncidentsWithIndicator
                accessor: incidentIDs
                transformers:
                - operator: uniq
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1390,
          "y": 1410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "26":
    id: "26"
    taskid: 4376bcab-c688-49e7-8a20-076ece1222b2
    type: regular
    task:
      id: 4376bcab-c688-49e7-8a20-076ece1222b2
      version: -1
      name: Link incidents
      description: Link existing incidents with the FireEye red team tools indicators to this incident.
      script: Builtin|||linkIncidents
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      action:
        simple: link
      incidentId:
        complex:
          root: incident
          accessor: id
      linkedIncidentIDs:
        complex:
          root: IncidentsWithIndicator
          accessor: incidentIDs
          transformers:
          - operator: join
            args:
              separator:
                value:
                  simple: ','
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1600,
          "y": 1620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "27":
    id: "27"
    taskid: ee194d26-05e6-468b-8312-f6f4416936bf
    type: regular
    task:
      id: ee194d26-05e6-468b-8312-f6f4416936bf
      version: -1
      name: Enrich FireEye red team tools CVEs
      description: Returns CVE information by the CVE ID.
      script: '|||cve'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      cve_id:
        complex:
          root: 'inputs.FireEyeToolsCVE '
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 130,
          "y": 450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "16_17_yes": 0.37,
      "16_19_#default#": 0.31,
      "1_3_yes": 0.68,
      "1_4_#default#": 0.1,
      "25_15_#default#": 0.15
    },
    "paper": {
      "dimensions": {
        "height": 3125,
        "width": 1870,
        "x": 130,
        "y": 0
      }
    }
  }
inputs:
- key: 'FireEyeToolsCVE '
  value:
    simple: "CVE-2018-15961,CVE-2019-19781\t,CVE-2019-3398,CVE-2019-11580\t,CVE-2018-13379,CVE-2020-0688\t\
      ,CVE-2019-11510,CVE-2019-0604\t,CVE-2020-10189,CVE-2019-8394\t,CVE-2020-1472,CVE-2018-8581\t\
      ,CVE-2016-0167,CVE-2014-1812"
  required: false
  description: "CVE-2019-0708\t,CVE-2017-11774"
  playbookInputQuery:
- key: FireEyeRedTeamToolsCVEsURL
  value:
    simple: https://github.com/fireeye/red_team_tool_countermeasures/blob/master/all-hashes.csv
  required: false
  description: The URL of FireEye red team tools CVEs
  playbookInputQuery:
- key: IsolateEndpointAutomatically
  value:
    simple: "False"
  required: false
  description: Whether to automatically isolate endpoints, or opt for manual user
    approval. True means isolation will be done automatically.
  playbookInputQuery:
outputs: []
tests:
- No tests
fromversion: 5.5.0