HAFNIUM - Exchange 0-day exploits

This playbook includes the following tasks: Collect indicators to be used in your threat hunting process Retrieve IOCs related to HAFNIUM and the exploited exchange 0-day vulnerabilities Discover IOCs related to the attack Query firewall logs to detect malicious network activity Search endpoint logs for malicious hashes to detect compromised hosts (Available from Cortex XSOAR 5.5.0). Block indicators Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve. Read more about the attack on our Unit42 blog: https://unit42.paloaltonetworks.com/microsoft-exchange-server-vulnerabilities/ Sources: https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

Rapid Breach Response · 62 tasks · 1 input · 0 outputs

Details

IDHAFNIUM - Exchange 0-day exploits
From Version6.0.0
To Version6.4.9
Tasks62

README

This playbook includes the following tasks:
Collect indicators to be used in your threat hunting process. Retrieve IOCs related to HAFNIUM and the exploited exchange 0-day vulnerabilities. Discover IOCs related to the attack. Query firewall logs to detect malicious network activity. Search endpoint logs for malicious hashes to detect compromised hosts. (Available from Cortex XSOAR 5.5.0). Block indicators Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve. Read more about the attack on our Unit42 blog: https://unit42.paloaltonetworks.com/microsoft-exchange-server-vulnerabilities/ Sources: https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Splunk Indicator Hunting
  • QRadar Indicator Hunting V2
  • Search Endpoints By Hash - Generic V2
  • Palo Alto Networks - Hunting And Threat Detection
  • QRadarFullSearch
  • Search Endpoint by CVE - Generic
  • Block Indicators - Generic v3

Integrations

This playbook does not use any integrations.

Scripts

  • Set
  • SearchIncidentsV2
  • http

Commands

  • linkIncidents
  • setIndicators
  • extractIndicators
  • splunk-search
  • expanse-get-issues

Playbook Inputs

Name Description Default Value Required
BlockIndicatorsAutomatically Whether to automatically block indicators involved with HAFNIUM exploits. False Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

HAFNIUM - Exchange 0-day exploits

Inputs

  • BlockIndicatorsAutomatically — Whether to automatically indicators involved with HAFNIUM exploits

Commands used

expanse-get-issues extractIndicators linkIncidents setIndicators splunk-search

Flowchart

yes yes No Yes yes No Yes yes Qradar Splunk Start Start Collect and Enrich IOCs Collect and Enrich IOCs Retrieve IOCs from Microsoft blog - http Retrieve IOCs from Micros... http Retrieve IOCs from Volexity blog - http Retrieve IOCs from Volexi... http Tag Indicators Tag Indicators Tag CVE's indicators - setIndicators Tag CVE's indicators setIndicators Tag IP's indicators - setIndicators Tag IP's indicators setIndicators Tag file hashes indicators - setIndicators Tag file hashes indicators setIndicators Hunt IOCs Hunt IOCs Search Endpoint by CVE - Generic - Search Endpoint by CVE - Generic Search Endpoint by CVE - ... Search Endpoint by CVE - Generic Search Endpoints By Hash - Generic V2 - Search Endpoints By Hash - Generic V2 Search Endpoints By Hash ... Search Endpoints By Hash - Ge... Palo Alto Networks - Hunting And Threat Detection - Palo Alto Networks - Hunting And Threat Detection Palo Alto Networks - Hunt... Palo Alto Networks - Hunting ... Investigate further Investigate further Done Done Search XDR incidents for HAFNIUM activity - SearchIncidentsV2 Search XDR incidents for ... SearchIncidentsV2 Remediation Remediation Block Indicators - Generic v2 - Block Indicators - Generic v2 Block Indicators - Generi... Block Indicators - Generic v2 Expanse Issues Search Expanse Issues Search Is Expanse enabled? Is Expanse enabled? Search Activities Related To the 0-Day Exploits Search Activities Related... XDR Related Incidents XDR Related Incidents Search issues related to Exchange and OWA - expanse-get-issues Search issues related to ... expanse-get-issues Retrieve indicators from Azure GitHub - http Retrieve indicators from ... http Block indicators automatically? Block indicators automati... Manually block indicators Manually block indicators Check Patch Level Check Patch Level Check patch levels of Exchange Server Check patch levels of Exc... Set Exchange patched flag to true - Set Set Exchange patched flag... Set Set Exchange patched flag to false - Set Set Exchange patched flag... Set Is the Exchange Server patched? Is the Exchange Server pa... Is it possible to patch the Exchange Server? Is it possible to patch t... Install March 2021 Exchange security patches Install March 2021 Exchan... Mitigation Mitigation Interim mitigations Interim mitigations Is Cortex XDR enabled? Is Cortex XDR enabled? Manually Hunt Windows Event Logs Manually Hunt Windows Eve... Nishang PowerShell framework Nishang PowerShell framework Powercat detection Powercat detection UMWorkerProcess.exe in Exchange creating abnormal content UMWorkerProcess.exe in Ex... UMWorkerProcess.exe spawning UMWorkerProcess.exe spawning Hunt Windows Events Hunt Windows Events Nishang PowerShell event 4104 - splunk-search Nishang PowerShell event ... splunk-search Powercat detection - splunk-search Powercat detection splunk-search UMWorkerProcess.exe in Exchange creating abnormal content - splunk-search UMWorkerProcess.exe in Ex... splunk-search UMWorkerProcess.exe spawning - splunk-search UMWorkerProcess.exe spawning splunk-search IIS authentication bypass vulnerability IIS authentication bypass... IIS authentication bypass vulnerability - splunk-search IIS authentication bypass... splunk-search Is SIEM Enabled? Is SIEM Enabled? Nishang PowerShell event 4688 - splunk-search Nishang PowerShell event ... splunk-search SIEM Indicators Hunting SIEM Indicators Hunting Splunk Indicator Hunting - Splunk Indicator Hunting Splunk Indicator Hunting Splunk Indicator Hunting Search for related Expanse incident - SearchIncidentsV2 Search for related Expans... SearchIncidentsV2 Link related incidents - linkIncidents Link related incidents linkIncidents QRadar Indicator Hunting V2 - QRadar Indicator Hunting V2 QRadar Indicator Hunting V2 QRadar Indicator Hunting V2 Hunt Using Splunk Hunt Using Splunk Hunt Using Qradar Hunt Using Qradar QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch QRadarFullSearch - QRadarFullSearch QRadarFullSearch QRadarFullSearch Extract IOCs from blogs - extractIndicators Extract IOCs from blogs extractIndicators

Source

playbook-HAFNIUM_-_Exchange_0-day_exploits_6.yml playbook-HAFNIUM_-_Exchange_0-day_exploits_6_5.yml playbook-HAFNIUM_-_Exchange_0-day_exploits_6_5_README.md
Download History Raw 
id: HAFNIUM - Exchange 0-day exploits
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: HAFNIUM - Exchange 0-day exploits
description: "This playbook includes the following tasks:

                           Collect indicators to be used in your threat hunting process
                           Retrieve IOCs related to HAFNIUM and the exploited exchange 0-day vulnerabilities
                           Discover IOCs related to the attack
                           Query firewall logs to detect malicious network activity
                           Search endpoint logs for malicious hashes to detect compromised hosts (Available from Cortex XSOAR 5.5.0).
                           Block indicators
                           Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.
                           Read more about the attack on our Unit42 blog: https://unit42.paloaltonetworks.com/microsoft-exchange-server-vulnerabilities/
                           Sources:
                              https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html
                              https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 23724197-3ddc-4d4c-86f9-62af787ab59d
    type: start
    task:
      id: 23724197-3ddc-4d4c-86f9-62af787ab59d
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 470,
          "y": 70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: c221171d-22b4-4f75-8a38-e4a296c8a8bc
    type: title
    task:
      id: c221171d-22b4-4f75-8a38-e4a296c8a8bc
      version: -1
      name: Collect and Enrich IOCs
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
      - "6"
      - "34"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 470,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 0851b947-8882-4c02-8cf1-fcead06eec66
    type: regular
    task:
      id: 0851b947-8882-4c02-8cf1-fcead06eec66
      version: -1
      name: Retrieve IOCs from Microsoft blog
      description: Sends http request. Returns the response as json to collect the
        indicators from Microsoft blog post
      scriptName: http
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "73"
    scriptarguments:
      body: {}
      filename: {}
      headers: {}
      insecure: {}
      method:
        simple: GET
      password: {}
      proxy: {}
      saveAsFile: {}
      unsecure: {}
      url:
        simple: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
      username: {}
    reputationcalc: 2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 470,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 5fb7a03a-0f98-4e84-8757-b2b64d3bbce6
    type: regular
    task:
      id: 5fb7a03a-0f98-4e84-8757-b2b64d3bbce6
      version: -1
      name: Retrieve IOCs from Volexity blog
      description: Sends http request. Returns the response as json to collect the
        indicators from Volexity blog post
      scriptName: http
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "73"
    scriptarguments:
      body: {}
      filename: {}
      headers: {}
      insecure: {}
      method:
        simple: GET
      password: {}
      proxy: {}
      saveAsFile: {}
      unsecure: {}
      url:
        simple: https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
      username: {}
    reputationcalc: 2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 0,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 555f5b82-dd7a-465a-8f88-c83462c87107
    type: title
    task:
      id: 555f5b82-dd7a-465a-8f88-c83462c87107
      version: -1
      name: Tag Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "13"
      - "12"
      - "15"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 470,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: f0b1f95e-9ca5-455f-81b0-5aaa35e6e865
    type: regular
    task:
      id: f0b1f95e-9ca5-455f-81b0-5aaa35e6e865
      version: -1
      name: Tag CVE's indicators
      description: commands.local.cmd.set.indicators
      script: Builtin|||setIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      indicatorsValues:
        complex:
          root: ExtractedIndicators
          accessor: CVE
          transformers:
          - operator: uniq
      tags:
        simple: HAFNIUM, 0Day, ExchangeExploits
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 920,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: 088c8c88-7c98-40fa-802a-fe1f126a7522
    type: regular
    task:
      id: 088c8c88-7c98-40fa-802a-fe1f126a7522
      version: -1
      name: Tag IP's indicators
      description: commands.local.cmd.set.indicators
      script: Builtin|||setIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      indicatorsValues:
        complex:
          root: ExtractedIndicators
          accessor: IP
          transformers:
          - operator: uniq
      tags:
        simple: HAFNIUM, 0Day, ExchangeExploits
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 470,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: 00aeec53-ca51-4fd9-8741-48256ce90c2c
    type: regular
    task:
      id: 00aeec53-ca51-4fd9-8741-48256ce90c2c
      version: -1
      name: Tag file hashes indicators
      description: commands.local.cmd.set.indicators
      script: Builtin|||setIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      indicatorsValues:
        complex:
          root: ExtractedIndicators
          accessor: File
          transformers:
          - operator: uniq
      tags:
        simple: HAFNIUM, 0Day, ExchangeExploits
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 20,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: 0d74272c-04ef-41a4-84b5-e558e4a36fba
    type: title
    task:
      id: 0d74272c-04ef-41a4-84b5-e558e4a36fba
      version: -1
      name: Hunt IOCs
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "19"
      - "17"
      - "18"
      - "61"
      - "31"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 470,
          "y": 1080
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: 912e8f4e-0ee2-42bb-88de-b22cccdbb48b
    type: playbook
    task:
      id: 912e8f4e-0ee2-42bb-88de-b22cccdbb48b
      version: -1
      name: Search Endpoint by CVE - Generic
      description: Hunt for assets with a given CVE using available tools
      playbookName: Search Endpoint by CVE - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      CVE_ID:
        complex:
          root: ExtractedIndicators
          accessor: CVE
          transformers:
          - operator: uniq
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 790,
          "y": 1370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "18":
    id: "18"
    taskid: 1fc4b6cb-7580-44cb-86f3-271ae4e6c9df
    type: playbook
    task:
      id: 1fc4b6cb-7580-44cb-86f3-271ae4e6c9df
      version: -1
      name: Search Endpoints By Hash - Generic V2
      description: Hunt using available tools
      playbookName: Search Endpoints By Hash - Generic V2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      MD5Hash:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "32"
          transformers:
          - operator: uniq
      SHA1Hash:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "40"
          transformers:
          - operator: uniq
      SHA256Hash:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "64"
          transformers:
          - operator: uniq
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 150,
          "y": 1370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "19":
    id: "19"
    taskid: 8c11fd43-d437-4eab-8ed6-5752f9080c74
    type: playbook
    task:
      id: 8c11fd43-d437-4eab-8ed6-5752f9080c74
      version: -1
      name: Palo Alto Networks - Hunting And Threat Detection
      description: "This is a multipurpose playbook used for hunting and threat detection.\
        \ The playbook receives inputs based on hashes, IP addresses, or domain names\
        \ provided manually or from outputs by other playbooks. \nWith the received\
        \ indicators, the playbook leverages data received by PANW products including,\
        \ Cortex Data Lake, Autofocus and Pan-OS to search for IP addresses, host\
        \ names and users related to the provided indicators.\nThe output provided\
        \ by the playbook facilitates pivoting searches for possibly affected IP addresses\
        \ or users."
      playbookName: Palo Alto Networks - Hunting And Threat Detection
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      IPAddresses:
        complex:
          root: ExtractedIndicators
          accessor: IP
          transformers:
          - operator: uniq
      InternalDomainName: {}
      InternalHostRegex: {}
      InternalRange: {}
      MD5:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "32"
          transformers:
          - operator: uniq
      SHA1: {}
      SHA256:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: hasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "64"
          transformers:
          - operator: uniq
      URLDomain: {}
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 470,
          "y": 1230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "23":
    id: "23"
    taskid: 2e8ee0c9-14be-4281-84ba-205f6d06fdda
    type: regular
    task:
      id: 2e8ee0c9-14be-4281-84ba-205f6d06fdda
      version: -1
      name: Investigate further
      description: |
        Further investigate the incident (endpoints, the entry point, etc’)
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 470,
          "y": 5035
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "24":
    id: "24"
    taskid: 1d312252-568b-479b-87a7-a374268d0594
    type: title
    task:
      id: 1d312252-568b-479b-87a7-a374268d0594
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 470,
          "y": 5200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "25":
    id: "25"
    taskid: 05318f08-b93b-4eeb-8162-71b9b0bed4d0
    type: regular
    task:
      id: 05318f08-b93b-4eeb-8162-71b9b0bed4d0
      version: -1
      name: Search XDR incidents for HAFNIUM activity
      description: |
        Search XDR incidents for HAFNIUM
      scriptName: SearchIncidentsV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "64"
    scriptarguments:
      details: {}
      fromclosedate: {}
      fromdate: {}
      fromduedate: {}
      id: {}
      level: {}
      name: {}
      notstatus: {}
      owner: {}
      page: {}
      query:
        simple: xdralerts.name:"Uncommon net group execution" or xdralerts.name:"Multiple
          Discovery Commands" or xdralerts.name:"Exchange process writing aspx files"
          or xdralerts.name:"Behavioral Threat Detected" or xdralerts.name:"Suspicious
          Process Creation" or xdralerts.name:"Uncommon remote service start via sc.exe"
          or xdralerts.name:"Rare SSH Session" or xdralerts.name:"Uncommon ARP cache
          listing via arp.exe" or xdralerts.name:"Uncommon user management via net.exe"
          or xdralerts.name:"WmiPrvSe.exe Rare Child Command Line" or xdralerts.name:"Script
          Connecting to Rare External Host" or xdralerts.name:"Remote process execution
          using WMI" or xdralerts.name:"64-bit PowerShell spawning a 32-bit PowerShell"
          or xdralerts.name:"Suspicious PowerShell Command Line" or xdralerts.name:"Dumping
          Registry hives with passwords"
      reason: {}
      size: {}
      sort: {}
      status: {}
      toclosedate: {}
      todate: {}
      toduedate: {}
      type: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1100,
          "y": 1985
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "26":
    id: "26"
    taskid: 99be9722-03ff-4d7f-8b12-96829d11238f
    type: title
    task:
      id: 99be9722-03ff-4d7f-8b12-96829d11238f
      version: -1
      name: 'Remediation '
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 470,
          "y": 3260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "27":
    id: "27"
    taskid: d051db21-2304-4756-873e-697cbd748f10
    type: playbook
    task:
      id: d051db21-2304-4756-873e-697cbd748f10
      version: -1
      name: Block Indicators - Generic v2
      description: |+
        This playbook blocks malicious Indicators using all integrations that are enabled, using the following sub-playbooks:

        - Block URL - Generic
        - Block Account - Generic
        - Block IP - Generic v2
        - Block File - Generic v2

      playbookName: Block Indicators - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "37"
    scriptarguments:
      AutoCommit:
        simple: "No"
      CustomBlockRule:
        simple: "True"
      CustomURLCategory:
        simple: Demisto Remediation - Malicious URLs
      DAG: {}
      EDLServerIP: {}
      EmailToBlock: {}
      IP:
        complex:
          root: ExtractedIndicators
          accessor: IP
          transformers:
          - operator: uniq
      IPBlacklistMiner: {}
      IPListName: {}
      LogForwarding: {}
      MD5:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "32"
          transformers:
          - operator: uniq
      SHA256:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "64"
          transformers:
          - operator: uniq
      StaticAddressGroup: {}
      URL: {}
      URLBlacklistMiner: {}
      URLListName:
        simple: Demisto Remediation - URL EDL
      Username: {}
      categories: {}
      device-group: {}
      type: {}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 720,
          "y": 3680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "29":
    id: "29"
    taskid: 08aa4511-473f-4ead-82d5-bdb7d25ba745
    type: title
    task:
      id: 08aa4511-473f-4ead-82d5-bdb7d25ba745
      version: -1
      name: Expanse Issues Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "30"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1470,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "30":
    id: "30"
    taskid: 6c41e9e8-a326-44ab-8494-d930b98f249c
    type: condition
    task:
      id: 6c41e9e8-a326-44ab-8494-d930b98f249c
      version: -1
      name: 'Is Expanse enabled? '
      description: Checks if the Expanse instance is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "26"
      "yes":
      - "33"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: ExpanseV2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: Active
                    ignorecase: true
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1470,
          "y": 1810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "31":
    id: "31"
    taskid: a4658468-e6cc-4151-89b6-a43768122dbd
    type: title
    task:
      id: a4658468-e6cc-4151-89b6-a43768122dbd
      version: -1
      name: Search Activities Related To the 0-Day Exploits
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "32"
      - "52"
      - "29"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1140,
          "y": 1540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "32":
    id: "32"
    taskid: 7d21b118-b31d-43af-83bc-de2affaa5222
    type: title
    task:
      id: 7d21b118-b31d-43af-83bc-de2affaa5222
      version: -1
      name: XDR Related Incidents
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "46"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 890,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "33":
    id: "33"
    taskid: 22319772-3a5f-4319-87ea-293150f8c51e
    type: regular
    task:
      id: 22319772-3a5f-4319-87ea-293150f8c51e
      version: -1
      name: Search issues related to Exchange and OWA
      description: Retrieve issues
      script: '|||expanse-get-issues'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "63"
    scriptarguments:
      activity_status: {}
      assignee: {}
      business_unit: {}
      content_search: {}
      created_after: {}
      created_before: {}
      domain_search: {}
      inet_search: {}
      issue_type:
        simple: Microsoft OWA Server, Microsoft Exchange Server, Insecure Microsoft
          Exchange Server
      limit: {}
      modified_after: {}
      modified_before: {}
      port_number: {}
      priority: {}
      progress_status: {}
      provider: {}
      sort: {}
      tag: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1730,
          "y": 1985
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "34":
    id: "34"
    taskid: d0b29943-dba8-41e6-8a2d-183fdef37261
    type: regular
    task:
      id: d0b29943-dba8-41e6-8a2d-183fdef37261
      version: -1
      name: Retrieve indicators from Azure GitHub
      description: Sends http request. Returns the response as json.
      scriptName: http
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "73"
    scriptarguments:
      body: {}
      filename: {}
      headers: {}
      insecure: {}
      method:
        simple: GET
      password: {}
      proxy: {}
      saveAsFile: {}
      unsecure: {}
      url:
        simple: https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv
      username: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 940,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "35":
    id: "35"
    taskid: 650c74ff-19bc-45ee-8387-f43a89de29f6
    type: condition
    task:
      id: 650c74ff-19bc-45ee-8387-f43a89de29f6
      version: -1
      name: Block indicators automatically?
      description: Checks whether IOCs associated with the incident can be blocked
        automatically.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "36"
      "yes":
      - "27"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.BlockIndicatorsAutomatically
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 470,
          "y": 3490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "36":
    id: "36"
    taskid: 5d7c31c2-5278-4feb-8925-67085c003173
    type: regular
    task:
      id: 5d7c31c2-5278-4feb-8925-67085c003173
      version: -1
      name: Manually block indicators
      description: Manually block the IOCs in the relevant systems.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "37"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 3680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "37":
    id: "37"
    taskid: 34307bab-7bbc-4d7b-87db-207786e132f2
    type: title
    task:
      id: 34307bab-7bbc-4d7b-87db-207786e132f2
      version: -1
      name: Check Patch Level
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "38"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 470,
          "y": 3850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "38":
    id: "38"
    taskid: 0da9ab04-aea3-4d68-827e-f4be717d3d33
    type: condition
    task:
      id: 0da9ab04-aea3-4d68-827e-f4be717d3d33
      version: -1
      name: Check patch levels of Exchange Server
      description: "Is the Exchange patched with the March 2021 security updates?\n\
        If needed, refer to Microsoft post about the patches: \nhttps://techcommunity.microsoft.com/t5/exchange-team-blog/released-march-2021-exchange-server-security-updates/ba-p/2175901\n\
        \ "
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "40"
      "Yes":
      - "39"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 470,
          "y": 4000
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "39":
    id: "39"
    taskid: 36f3308c-e690-4d00-8a3d-374e59a53ef0
    type: regular
    task:
      id: 36f3308c-e690-4d00-8a3d-374e59a53ef0
      version: -1
      name: Set Exchange patched flag to true
      description: Sets Exchange patched flag to true.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "44"
    scriptarguments:
      append: {}
      key:
        simple: ExchangesPatched
      stringify: {}
      value:
        simple: "True"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 4180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "40":
    id: "40"
    taskid: 8b7f376b-5b7d-457a-8c87-71b69591f9e3
    type: regular
    task:
      id: 8b7f376b-5b7d-457a-8c87-71b69591f9e3
      version: -1
      name: Set Exchange patched flag to false
      description: Sets Exchange patched flag to false.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "44"
    scriptarguments:
      append: {}
      key:
        simple: ExchangesPatched
      stringify: {}
      value:
        simple: "False"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 720,
          "y": 4180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "41":
    id: "41"
    taskid: b50533ab-561a-4f4b-86d3-5a7582aaa4f2
    type: condition
    task:
      id: b50533ab-561a-4f4b-86d3-5a7582aaa4f2
      version: -1
      name: Is the Exchange Server patched?
      description: Checks the user answer if the Exchange Server patched
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "42"
      "yes":
      - "23"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: ExchangesPatched
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 470,
          "y": 4510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "42":
    id: "42"
    taskid: 9286e773-b14d-430d-8489-b5a0bcc0f36b
    type: condition
    task:
      id: 9286e773-b14d-430d-8489-b5a0bcc0f36b
      version: -1
      name: Is it possible to patch the Exchange Server?
      description: Check whether it is possible to patch the Exchange Server
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "45"
      "Yes":
      - "43"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -10,
          "y": 4690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "43":
    id: "43"
    taskid: 0d7d13b7-690d-464f-8e73-66ac2d7e92f4
    type: regular
    task:
      id: 0d7d13b7-690d-464f-8e73-66ac2d7e92f4
      version: -1
      name: Install March 2021 Exchange security patches
      description: |-
        The March 2021 security patches found here:
        https://techcommunity.microsoft.com/t5/exchange-team-blog/released-march-2021-exchange-server-security-updates/ba-p/2175901
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 230,
          "y": 4860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "44":
    id: "44"
    taskid: 11fe1ea6-3119-47b4-82fc-9351b7ae858a
    type: title
    task:
      id: 11fe1ea6-3119-47b4-82fc-9351b7ae858a
      version: -1
      name: Mitigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "41"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 470,
          "y": 4350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "45":
    id: "45"
    taskid: 2c9da488-1bb4-44e9-8d41-efa87042f141
    type: regular
    task:
      id: 2c9da488-1bb4-44e9-8d41-efa87042f141
      version: -1
      name: Interim mitigations
      description: "Follow Microsoft blog post about the interim mitigations.\nThe\
        \ blog post explains how to configure the interim mitigations and their rollback\
        \ if needed. \nhttps://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/\n\
        \nNotes:\n- These mitigations are not a remediation if your Exchange servers\
        \ have already been compromised, nor are they full protection against attack\n\
        - This should only be used as a temporary mitigation until Exchange servers\
        \ can be fully patched. \n"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -260,
          "y": 4860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "46":
    id: "46"
    taskid: 83b0f1b8-bbb8-4ec2-812f-9b5d05bcdcf3
    type: condition
    task:
      id: 83b0f1b8-bbb8-4ec2-812f-9b5d05bcdcf3
      version: -1
      name: 'Is Cortex XDR enabled? '
      description: Checks if the Cortex XDR instance is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "26"
      "yes":
      - "25"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Cortex XDR - IR
                    ignorecase: true
            iscontext: true
    view: |-
      {
        "position": {
          "x": 890,
          "y": 1810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "47":
    id: "47"
    taskid: 1ec43324-e0c1-4c72-8875-bd281293fdc0
    type: title
    task:
      id: 1ec43324-e0c1-4c72-8875-bd281293fdc0
      version: -1
      name: 'Manually Hunt Windows Event Logs '
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "48"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2210,
          "y": 2000
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "48":
    id: "48"
    taskid: 8a97955f-7d4c-4915-82f6-0538b9481217
    type: regular
    task:
      id: 8a97955f-7d4c-4915-82f6-0538b9481217
      version: -1
      name: Nishang PowerShell framework
      description: |
        Look for Nishang Invoke-PowerShellTcpOneLine in Windows Event Logging:

        SecurityEvent  | where EventID == 4688  | where Process has_any ("powershell.exe", "PowerShell_ISE.exe")  | where CommandLine has "$client = New-Object System.Net.Sockets.TCPClient"

        Splunk query example:

        index="*" sourcetype="WinEventLog" source="WinEventLog:Security" EventCode=4104 Message="* Invoke-PowerShellTCP*"

        index="*" sourcetype="WinEventLog" source="WinEventLog:Security" EventCode=4688 Creator_Process_Name="powershell.exe" System.Net.Sockets.TCPClient
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "49"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2210,
          "y": 2140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "49":
    id: "49"
    taskid: fedada54-ba62-4843-881c-eb4c74163ad6
    type: regular
    task:
      id: fedada54-ba62-4843-881c-eb4c74163ad6
      version: -1
      name: Powercat detection
      description: |
        Look for downloads of PowerCat in cmd and Powershell command line logging in Windows Event Logs:

        SecurityEvent  | where EventID == 4688  | where Process has_any ("cmd.exe", "powershell.exe", "PowerShell_ISE.exe")  | where CommandLine has "https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1"

        Splunk query example:
        index="*" sourcetype="WinEventLog" source="WinEventLog:Security" EventCode=4104 Message="*powercat*"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "50"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2210,
          "y": 2320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "50":
    id: "50"
    taskid: 7bed501c-fcdc-4c76-8236-0775fa91f492
    type: regular
    task:
      id: 7bed501c-fcdc-4c76-8236-0775fa91f492
      version: -1
      name: UMWorkerProcess.exe in Exchange creating abnormal content
      description: "Look for Microsoft Exchange Server’s Unified Messaging service\
        \ creating non-standard content on disk, which could indicate web shells or\
        \ other malicious content, suggesting exploitation of CVE-2021-26858 vulnerability:\n\
        \nDeviceFileEvents | where InitiatingProcessFileName == \"UMWorkerProcess.exe\"\
        \ | where FileName != \"CacheCleanup.bin\" | where FileName !endswith \".txt\"\
        \ | where FileName !endswith \".LOG\" | where FileName !endswith \".cfg\"\
        \ | where FileName != \"cleanup.bin\"\n\nSplunk query example:\nindex=* sourcetype=WinEventLog\
        \ source=\"WinEventLog:Security\" EventCode=4663 Object_Type=\"File\" (Object_Name=\"\
        *.php\" OR Object_Name=\"*.jsp\" OR Object_Name=\"*.js\" OR Object_Name=\"\
        *.aspx\" OR Object_Name=\"*.asmx\" OR Object_Name=\"*.cfm\" OR Object_Name=\"\
        *.shtml\") (Process_Name=\"*umworkerprocess.exe*\" OR Process_Name=\"*UMService.exe*\"\
        ) \n"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "51"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2210,
          "y": 2500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "51":
    id: "51"
    taskid: af589419-1059-4cd8-85ff-917c122a842e
    type: regular
    task:
      id: af589419-1059-4cd8-85ff-917c122a842e
      version: -1
      name: UMWorkerProcess.exe spawning
      description: |-
        Look for Microsoft Exchange Server’s Unified Messaging service spawning abnormal subprocesses, suggesting exploitation of CVE-2021-26857 vulnerability:

        DeviceProcessEvents | where InitiatingProcessFileName == "UMWorkerProcess.exe" | where FileName != "wermgr.exe" | where FileName != "WerFault.exe"

        Splunk Query example:
        index=* sourcetype="WinEventLog" source="WinEventLog:Security" EventCode=4688 (Creator_Process_Name="*umworkerprocess.exe*" OR Creator_Process_Name="*UMService.exe*") NOT New_Process_Name="*UMWorkerProcess.exe*"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "57"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2210,
          "y": 2680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "52":
    id: "52"
    taskid: 93265b0c-9f91-465d-8d63-42b1808d5586
    type: title
    task:
      id: 93265b0c-9f91-465d-8d63-42b1808d5586
      version: -1
      name: Hunt Windows Events
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "59"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2710,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "53":
    id: "53"
    taskid: 28e4eb5b-e158-4e84-8f50-5fcc25a95952
    type: regular
    task:
      id: 28e4eb5b-e158-4e84-8f50-5fcc25a95952
      version: -1
      name: Nishang PowerShell event 4104
      description: Searches Splunk for events.
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "60"
    scriptarguments:
      app: {}
      batch_limit: {}
      earliest_time: {}
      event_limit: {}
      latest_time: {}
      query:
        simple: index="*" sourcetype="WinEventLog" source="WinEventLog:Security" EventCode=4104
          Message="* Invoke-PowerShellTCP*"
      update_context: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2710,
          "y": 2140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "54":
    id: "54"
    taskid: 7cb58baa-5d8a-475f-867a-43ecb6269d3b
    type: regular
    task:
      id: 7cb58baa-5d8a-475f-867a-43ecb6269d3b
      version: -1
      name: Powercat detection
      description: Searches Splunk for events.
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "55"
    scriptarguments:
      app: {}
      batch_limit: {}
      earliest_time: {}
      event_limit: {}
      latest_time: {}
      query:
        simple: index="*" sourcetype="WinEventLog" source="WinEventLog:Security" EventCode=4104
          Message="*powercat*"
      update_context: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2710,
          "y": 2500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "55":
    id: "55"
    taskid: ba412446-8bf3-476f-869a-42762c873825
    type: regular
    task:
      id: ba412446-8bf3-476f-869a-42762c873825
      version: -1
      name: UMWorkerProcess.exe in Exchange creating abnormal content
      description: Searches Splunk for events.
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "56"
    scriptarguments:
      app: {}
      batch_limit: {}
      earliest_time: {}
      event_limit: {}
      latest_time: {}
      query:
        simple: 'index=* sourcetype=WinEventLog source="WinEventLog:Security" EventCode=4663
          Object_Type="File" (Object_Name="*.php" OR Object_Name="*.jsp" OR Object_Name="*.js"
          OR Object_Name="*.aspx" OR Object_Name="*.asmx" OR Object_Name="*.cfm" OR
          Object_Name="*.shtml") (Process_Name="*umworkerprocess.exe*" OR Process_Name="*UMService.exe*") '
      update_context: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2710,
          "y": 2680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "56":
    id: "56"
    taskid: 19b74702-83fd-415b-8cee-49dfc6578c38
    type: regular
    task:
      id: 19b74702-83fd-415b-8cee-49dfc6578c38
      version: -1
      name: UMWorkerProcess.exe spawning
      description: Searches Splunk for events.
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "58"
    scriptarguments:
      app: {}
      batch_limit: {}
      earliest_time: {}
      event_limit: {}
      latest_time: {}
      query:
        simple: index=* sourcetype="WinEventLog" source="WinEventLog:Security" EventCode=4688
          (Creator_Process_Name="*umworkerprocess.exe*" OR Creator_Process_Name="*UMService.exe*")
          NOT New_Process_Name="*UMWorkerProcess.exe*"
      update_context: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2710,
          "y": 2860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "57":
    id: "57"
    taskid: 4b99ee3e-bd3d-4b62-8838-d921c34e190d
    type: regular
    task:
      id: 4b99ee3e-bd3d-4b62-8838-d921c34e190d
      version: -1
      name: IIS authentication bypass vulnerability
      description: |-
        Look for Microsoft Exchange Server’s Unified Messaging service spawning abnormal subprocesses, suggesting exploitation of CVE-2021-26857 vulnerability:

        DeviceProcessEvents | where InitiatingProcessFileName == "UMWorkerProcess.exe" | where FileName != "wermgr.exe" | where FileName != "WerFault.exe"

        Splunk Query example:
        index=* sourcetype="WinEventLog" source="WinEventLog:Security" EventCode=4688 (Creator_Process_Name="*umworkerprocess.exe*" OR Creator_Process_Name="*UMService.exe*") NOT New_Process_Name="*UMWorkerProcess.exe*"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2210,
          "y": 2860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "58":
    id: "58"
    taskid: 400ec611-fe38-44d3-826b-02e9d747859f
    type: regular
    task:
      id: 400ec611-fe38-44d3-826b-02e9d747859f
      version: -1
      name: IIS authentication bypass vulnerability
      description: Searches Splunk for events.
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      app: {}
      batch_limit: {}
      earliest_time: {}
      event_limit: {}
      latest_time: {}
      query:
        simple: |-
          index=* sourcetype="ms:iis:auto" http_method=POST uri_path="/owa/auth/Current/themes/resources/*"
          | stats count by src_ip, http_user_agent, uri_path, http_method, uri_query
      update_context: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2710,
          "y": 3050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "59":
    id: "59"
    taskid: 806e022a-9d4d-408d-8ac7-8a5e174dafa9
    type: condition
    task:
      id: 806e022a-9d4d-408d-8ac7-8a5e174dafa9
      version: -1
      name: Is SIEM Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns
        'no'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "47"
      Qradar:
      - "67"
      Splunk:
      - "66"
    separatecontext: false
    conditions:
    - label: Splunk
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: SplunkPy
                accessor: state
            iscontext: true
          right:
            value:
              simple: active
          ignorecase: true
    - label: Qradar
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: QRadar_v2
                accessor: state
            iscontext: true
          right:
            value:
              simple: active
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 2710,
          "y": 1810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "60":
    id: "60"
    taskid: 9ebf3494-6f23-4b77-899f-6ae43b3db35c
    type: regular
    task:
      id: 9ebf3494-6f23-4b77-899f-6ae43b3db35c
      version: -1
      name: Nishang PowerShell event 4688
      description: Searches Splunk for events.
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "54"
    scriptarguments:
      app: {}
      batch_limit: {}
      earliest_time: {}
      event_limit: {}
      latest_time: {}
      query:
        simple: index="*" sourcetype="WinEventLog" source="WinEventLog:Security" EventCode=4688
          Creator_Process_Name="powershell.exe" System.Net.Sockets.TCPClient
      update_context: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2710,
          "y": 2320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "61":
    id: "61"
    taskid: 8ba9d00f-6a49-4b48-8f4c-f6a2c0bc3959
    type: title
    task:
      id: 8ba9d00f-6a49-4b48-8f4c-f6a2c0bc3959
      version: -1
      name: SIEM Indicators Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "62"
      - "65"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -110,
          "y": 1540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "62":
    id: "62"
    taskid: 6700d586-5574-490b-8310-835b5fbb402d
    type: playbook
    task:
      id: 6700d586-5574-490b-8310-835b5fbb402d
      version: -1
      name: Splunk Indicator Hunting
      description: This playbook queries Splunk for indicators such as file hashes,
        IP addresses, domains, or urls. It outputs detected users, ip addresses, and
        hostnames related to the indicators.
      playbookName: Splunk Indicator Hunting
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      HostFieldsToReturn: {}
      IPAddress: {}
      IPFieldsToReturn: {}
      IndexName:
        simple: '*'
      InternalDomainName: {}
      InternalHostRegex: {}
      InternalIPRange: {}
      MD5:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "32"
          transformers:
          - operator: uniq
      SHA1: {}
      SHA256:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "64"
          transformers:
          - operator: uniq
      SelectFields:
        simple: source,timestamp
      SplunkIPField: {}
      SplunkMD5Field: {}
      SplunkSHA1Field: {}
      SplunkSHA256Field: {}
      SplunkURLDomainField: {}
      URLDomain: {}
      UserFieldsToReturn: {}
      earliest_time:
        simple: -1d
      event_limit:
        simple: "100"
      latest_time: {}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 120,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "63":
    id: "63"
    taskid: 2b2f0ced-3b95-4850-88f2-c3d803f14210
    type: regular
    task:
      id: 2b2f0ced-3b95-4850-88f2-c3d803f14210
      version: -1
      name: Search for related Expanse incident
      description: Searches for Expanse related incidents
      scriptName: SearchIncidentsV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "64"
    scriptarguments:
      details: {}
      fromclosedate: {}
      fromdate: {}
      fromduedate: {}
      id: {}
      level: {}
      name: {}
      notstatus: {}
      owner: {}
      page: {}
      query:
        simple: type:"Expanse Issue" and name:Insecure Microsoft IIS Web or name:Microsoft
          Exchange Server or name:Microsoft OWA Server
      reason: {}
      size: {}
      sort: {}
      status: {}
      toclosedate: {}
      todate: {}
      toduedate: {}
      type: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1730,
          "y": 2140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "64":
    id: "64"
    taskid: 451c142c-b9b4-4c35-8ab7-3be304c8692e
    type: regular
    task:
      id: 451c142c-b9b4-4c35-8ab7-3be304c8692e
      version: -1
      name: Link related incidents
      description: Link related Expanse and Cortex XDR incident to HAFNIUM incident,
      script: Builtin|||linkIncidents
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      action: {}
      incidentId: {}
      linkedIncidentIDs:
        complex:
          root: foundIncidents
          accessor: id
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1420,
          "y": 2320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "65":
    id: "65"
    taskid: 32533035-a3f1-40e8-856a-3929716ba852
    type: playbook
    task:
      id: 32533035-a3f1-40e8-856a-3929716ba852
      version: -1
      name: QRadar Indicator Hunting V2
      description: 'The Playbook queries QRadar SIEM for indicators such as file hashes,
        IP addresses, domains, or urls. '
      playbookName: QRadar Indicator Hunting V2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      IPAddress: {}
      InternalRange: {}
      InvestigationIPFields:
        simple: sourceip,destinationip
      InvestigationUserFields:
        simple: username
      MD5:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "32"
          transformers:
          - operator: uniq
      QradarIPfield:
        simple: sourceip,destinationip
      QradarMD5Field: {}
      QradarSHA1Field: {}
      QradarSHA256Field: {}
      QradarURLDomainField: {}
      SHA1: {}
      SHA256:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "64"
          transformers:
          - operator: uniq
      TimeFrame:
        simple: LAST 7 DAYS
      URLDomain: {}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -330,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "66":
    id: "66"
    taskid: 0aac6bf1-07e7-4a18-8c6a-4f3b03f4cf01
    type: title
    task:
      id: 0aac6bf1-07e7-4a18-8c6a-4f3b03f4cf01
      version: -1
      name: Hunt Using Splunk
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "53"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2710,
          "y": 2000
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "67":
    id: "67"
    taskid: 1790a168-6f54-4824-84e3-236a5875576a
    type: title
    task:
      id: 1790a168-6f54-4824-84e3-236a5875576a
      version: -1
      name: Hunt Using Qradar
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "68"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3280,
          "y": 2000
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "68":
    id: "68"
    taskid: 78c25af9-ce4e-4fc3-80ee-5b3a618f20a6
    type: playbook
    task:
      id: 78c25af9-ce4e-4fc3-80ee-5b3a618f20a6
      version: -1
      name: QRadarFullSearch
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "69"
    scriptarguments:
      headers: {}
      interval:
        simple: "1"
      query_expression:
        simple: select * from events WHERE LogSourceTypeName(deviceType) = 'Microsoft
          Windows Security Event Log' and UTF8(payload) LIKE '%4688%'  and UTF8(payload)
          LIKE '%powershell.exe%' and UTF8(payload) LIKE '%System.Net.Sockets.TCPClient%'  Last
          7 days
      range: {}
      timeout:
        simple: "600"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 3280,
          "y": 2140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "69":
    id: "69"
    taskid: 77bf00db-c194-408f-8320-550fe23f0bbc
    type: playbook
    task:
      id: 77bf00db-c194-408f-8320-550fe23f0bbc
      version: -1
      name: QRadarFullSearch
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "70"
    scriptarguments:
      headers: {}
      interval:
        simple: "1"
      query_expression:
        simple: select * from events WHERE LogSourceTypeName(deviceType) = 'Microsoft
          Windows Security Event Log' and UTF8(payload) LIKE '%4104%' and UTF8(payload)
          LIKE '% Invoke-PowerShellTCP%'  Last 7 days
      range: {}
      timeout:
        simple: "600"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 3280,
          "y": 2320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "70":
    id: "70"
    taskid: d9df6e57-2823-451b-8eba-124b6944e91b
    type: playbook
    task:
      id: d9df6e57-2823-451b-8eba-124b6944e91b
      version: -1
      name: QRadarFullSearch
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "71"
    scriptarguments:
      headers: {}
      interval:
        simple: "1"
      query_expression:
        simple: select * from events WHERE LogSourceTypeName(deviceType) = 'Microsoft
          Windows Security Event Log' and UTF8(payload) LIKE '%4104%' and UTF8(payload)
          LIKE '% powercat%' Last 7 days
      range: {}
      timeout:
        simple: "600"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 3280,
          "y": 2500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "71":
    id: "71"
    taskid: b5541854-af48-45a2-8a12-0833d2723350
    type: playbook
    task:
      id: b5541854-af48-45a2-8a12-0833d2723350
      version: -1
      name: QRadarFullSearch
      description: This playbook runs a QRadar query and return its results to the
        context.
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "72"
    scriptarguments:
      headers: {}
      interval:
        simple: "1"
      query_expression:
        simple: select * from events WHERE LogSourceTypeName(deviceType) = 'Microsoft
          Windows Security Event Log' and UTF8(payload) LIKE '%4633%' and ( UTF8(payload)
          LIKE '%.php%' or UTF8(payload) LIKE '%.jsp%' or UTF8(payload) LIKE '%.js%'
          or UTF8(payload) LIKE '%.aspx%' or UTF8(payload) LIKE '%.asmx%' or UTF8(payload)
          LIKE '%.cfm%' or UTF8(payload) LIKE '%.shtlm%') AND ( UTF8(payload) LIKE
          '%umworkerprocess.exe%' or UTF8(payload) LIKE '%UMService.exe%')  Last 7
          days
      range: {}
      timeout:
        simple: "600"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 3280,
          "y": 2680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "72":
    id: "72"
    taskid: 22f325df-6b94-47ea-87f0-f8bcecadea52
    type: playbook
    task:
      id: 22f325df-6b94-47ea-87f0-f8bcecadea52
      version: -1
      name: QRadarFullSearch
      description: This playbook runs a QRadar query and return its results to the
        context.
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      headers: {}
      interval:
        simple: "1"
      query_expression:
        simple: select * from events WHERE LogSourceTypeName(deviceType) = 'Microsoft
          IIS' and UTF8(payload) LIKE '%POST%' and UTF8(payload) LIKE '%/owa/auth/Current/themes/resources/*%'
          Last 7 days
      range: {}
      timeout:
        simple: "600"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 3280,
          "y": 2860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "73":
    id: "73"
    taskid: a9793c85-9c17-4636-8ed6-f225729d602a
    type: regular
    task:
      id: a9793c85-9c17-4636-8ed6-f225729d602a
      version: -1
      name: Extract IOCs from blogs
      description: commands.local.cmd.extract.indicators
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      entryID: {}
      filePath: {}
      investigationID: {}
      text:
        complex:
          root: HttpRequest.Response
          accessor: Body
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 470,
          "y": 550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
system: true
view: |-
  {
    "linkLabelsPosition": {
      "30_26_#default#": 0.12,
      "41_23_yes": 0.21,
      "41_42_#default#": 0.33,
      "46_26_#default#": 0.16
    },
    "paper": {
      "dimensions": {
        "height": 5195,
        "width": 3990,
        "x": -330,
        "y": 70
      }
    }
  }
inputs:
- key: BlockIndicatorsAutomatically
  value:
    simple: "False"
  required: false
  description: Whether to automatically indicators involved with HAFNIUM exploits
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.0.0
toversion: 6.4.9