Illusive - Incident Escalation

This playbook is used for creating an automatic analysis of the Illusive's incident details, in order to end up with a certain score or a set of insights that will enable automatic decisions and actions.

Illusive Networks · 42 tasks · 7 inputs · 8 outputs

Inputs

  • proximity_threshold — The maximum number of steps from crown jewel, or domain admin credentials to determine the proximity as high-risk
  • events_threshold — The minimum number of associated events to determine this incident as a multiple-events incident
  • proximity_weight — The unified score in case the proximity to a crown jewel and/ or the proximity to domain admin credentials is under the specified threshold
  • triggering_weight — The unified score in case the triggering process has been found malicious and/ or the triggering deception is ransomware
  • events_weight — The score in case the number of events in the inspected incident is above the specified threshold
  • rdp_weight — The score in case there is an active RDP connection to the source host
  • illusive_incident_id — The incident ID of the Illusive Networks Incident

Outputs

  • Illusive.IncidentEscalationPlaybook.incidentId — The corresponding incident ID
  • Illusive.IncidentEscalationPlaybook.isCloseToCrownJewel — Whether the proximity to a crown jewel is under a certain threshold
  • Illusive.IncidentEscalationPlaybook.isCloseToAdminCredentials — Whether the proximity to domain admin credentials is under a certain threshold
  • Illusive.IncidentEscalationPlaybook.isMultipleEvents — Whether the number of associated events is above a certain threshold
  • Illusive.IncidentEscalationPlaybook.isTriggeringProcessMalicious — Whether the triggering process has been found malicious by VirusTotal
  • Illusive.IncidentEscalationPlaybook.isActiveRdpConnection — Whether there is an active RDP connection to the source host
  • Illusive.IncidentEscalationPlaybook.isRansomware — Whether the triggering deception is ransomware
  • Illusive.IncidentEscalationPlaybook.incidentScore — The accumulated score of the incident

Commands used

illusive-get-forensics-analyzers illusive-get-incident-events illusive-get-incidents setIncident

Flowchart

yes yes yes yes yes yes yes yes Critical High Informational Low Medium Start Start Whether the proximity to a crown jewel is under a threshold Whether the proximity to ... Whether the number of associated events is above the threshold Whether the number of ass... Whether the proximity to domain admin credentials is under a threshold Whether the proximity to ... Whether the triggering process has been found malicious by VirusTotal Whether the triggering pr... Whether there is a potential RDP connection Whether there is a potent... Weather the incident is a RANSOMWARE type Weather the incident is a... Set number of associated events is above the threshold condition as true - Set Set number of associated ... Set Set number of associated events is above the threshold condition as false - Set Set number of associated ... Set Set potential RDP connection conditions as true - Set Set potential RDP connect... Set Set potential RDP connection conditions as false - Set Set potential RDP connect... Set Add or skip potential RDP connection score - Set Add or skip potential RDP... Set Add or skip number of associated events score - Set Add or skip number of ass... Set Illusive - get incidents - illusive-get-incidents Illusive - get incidents illusive-get-incidents Illusive - get incident events - illusive-get-incident-events Illusive - get incident e... illusive-get-incident-events Illusive - get forensics analyzers - illusive-get-forensics-analyzers Illusive - get forensics ... illusive-get-forensics-analyzers set IllusiveEvent - Set set IllusiveEvent Set set IllusiveIncident - Set set IllusiveIncident Set Set Incident Score - Set Set Incident Score Set Set proximity to domain admin credentials condition as false - Set Set proximity to domain a... Set Set proximity to domain admin credentials condition as true - Set Set proximity to domain a... Set Set proximity to a crown jewel condition as false - Set Set proximity to a crown ... Set Set proximity to a crown jewel condition as true - Set Set proximity to a crown ... Set Check proximity to high-risk assets Check proximity to high-r... Add proximity to high-risk assets condition score - Set Add proximity to high-ris... Set Skip proximity to high-risk assets condition score - Set Skip proximity to high-ri... Set Set triggering process has been found malicious by VirusTotal condition as true - Set Set triggering process ha... Set Set triggering process has been found malicious by VirusTotal condition as false - Set Set triggering process ha... Set incident is a RANSOMWARE type condition as false - Set incident is a RANSOMWARE ... Set incident is a RANSOMWARE type condition as true - Set incident is a RANSOMWARE ... Set Check triggering conditions for incident fidelity Check triggering conditio... Skip triggering conditions for incident fidelity score - Set Skip triggering condition... Set Add triggering conditions for incident fidelity score - Set Add triggering conditions... Set Done Done Determine Incident Severity Determine Incident Severity Set incident severity to "Critical" - setIncident Set incident severity to ... setIncident Set incident severity to "Low" - setIncident Set incident severity to ... setIncident Set incident severity to "Informational" - setIncident Set incident severity to ... setIncident Set incident severity to "Medium" - setIncident Set incident severity to ... setIncident Set incident severity to "High" - setIncident Set incident severity to ... setIncident Set incident severity to "Unknown" - setIncident Set incident severity to ... setIncident Sum Incident Total Score - SetAndHandleEmpty Sum Incident Total Score SetAndHandleEmpty