LSASS Credential Dumpin

id: LSASS Credential Dumpin
version: -1
name: LSASS Credential Dumpin
description: This playbook is focused on detecting Credential Dumping attack as researched
  by Accenture Security analysts and engineers.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: dcfe7b82-5d0b-4e76-8499-d26b2525e128
    type: start
    task:
      id: dcfe7b82-5d0b-4e76-8499-d26b2525e128
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: f63858a0-51f1-447a-87ab-626c9d36b877
    type: regular
    task:
      id: f63858a0-51f1-447a-87ab-626c9d36b877
      version: -1
      name: Check Allow List
      description: commands.local.cmd.is.whitelisted
      script: Builtin|||isWhitelisted
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      type: {}
      value:
        simple: ${incident.acndestinationip}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: c7ec1aa7-3835-4d1f-8487-a955a4e67210
    type: title
    task:
      id: c7ec1aa7-3835-4d1f-8487-a955a4e67210
      version: -1
      name: Information Collection
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "22"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 15d9ed55-eb35-4534-895c-714dfdd9248e
    type: condition
    task:
      id: 15d9ed55-eb35-4534-895c-714dfdd9248e
      description: ""
      version: -1
      name: Malicious Adversarial Activity Identified?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: DBotScore
                accessor: Score
            iscontext: true
          right:
            value:
              simple: "3"
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: b31bcffc-eb43-4396-83a0-8c7df9831301
    type: title
    task:
      id: b31bcffc-eb43-4396-83a0-8c7df9831301
      version: -1
      name: Containment Actions
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "24"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 790,
          "y": 1810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: b169d44f-fc0a-4040-87e7-9915e859e281
    type: regular
    task:
      id: b169d44f-fc0a-4040-87e7-9915e859e281
      version: -1
      name: Quarantine Host
      description: Quarantines a device.
      script: Carbon Black Enterprise EDR|||cb-eedr-device-quarantine
      type: regular
      iscommand: true
      brand: Carbon Black Enterprise EDR
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      device_id:
        complex:
          root: incident.labels
          accessor: dvc
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 790,
          "y": 2125
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: d6d102e2-2ffd-4a47-8f45-58417b1f4d2d
    type: title
    task:
      id: d6d102e2-2ffd-4a47-8f45-58417b1f4d2d
      version: -1
      name: Contextualization Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: 379b7734-16dc-4fe6-85ec-b9b6c00ccbc0
    type: regular
    task:
      id: 379b7734-16dc-4fe6-85ec-b9b6c00ccbc0
      version: -1
      name: Check Network Traffic - Splunk
      description: Searches Splunk for events.
      script: SplunkPy|||splunk-search
      type: regular
      iscommand: true
      brand: SplunkPy
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      app: {}
      batch_limit: {}
      earliest_time: {}
      event_limit: {}
      latest_time: {}
      query:
        complex:
          root: incident
          accessor: executablefile
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: index=pws_ecsmayne EventCode=4663 AND (ObjectName="*.dmp"
                    OR (AccessMask="0x10" ObjectName="*lsass.exe")) AND ProcessName!="werfault.exe"
                    AND ProcessName="
              suffix:
                value:
                  simple: '"'
      update_context: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "16":
    id: "16"
    taskid: 720ccf9f-941d-411a-8e3e-27819735bf2f
    type: title
    task:
      id: 720ccf9f-941d-411a-8e3e-27819735bf2f
      version: -1
      name: Alert SOC
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: 068cb167-9db6-4c28-8068-2500c4022feb
    type: regular
    task:
      id: 068cb167-9db6-4c28-8068-2500c4022feb
      version: -1
      name: Open Ticket - SNOW
      description: Creates new ServiceNow ticket.
      script: ServiceNow v2|||servicenow-create-ticket
      type: regular
      iscommand: true
      brand: ServiceNow v2
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      active:
        simple: "true"
      activity_due: {}
      additional_assignee_list: {}
      additional_fields: {}
      approval: {}
      approval_history: {}
      approval_set: {}
      assigned_to:
        simple: ${incident.owner}
      assignment_group: {}
      business_duration: {}
      business_service: {}
      business_stc: {}
      calendar_duration: {}
      caller: {}
      caller_id: {}
      category: {}
      caused_by: {}
      change_type: {}
      close_code: {}
      close_notes: {}
      closed_at: {}
      closed_by: {}
      cmdb_ci: {}
      comments: {}
      comments_and_work_notes:
        simple: 'The compromised machines are: ${Tanium.File.ConnectionName}, and
          the file path is: ${incident.filename}'
      company: {}
      contact_type: {}
      correlation_display: {}
      correlation_id: {}
      custom_fields: {}
      delivery_plan: {}
      description:
        simple: 'Credential Dumping on Hostname: ${Endpoint.Hostname}'
      display: {}
      due_date: {}
      escalation: {}
      expected_start: {}
      follow_up: {}
      group_list: {}
      impact: {}
      incident_state: {}
      input_display_value: {}
      knowledge: {}
      location: {}
      made_sla: {}
      notify: {}
      number: {}
      opened_at: {}
      order: {}
      parent: {}
      parent_incident: {}
      priority: {}
      problem_id: {}
      reassignment_count: {}
      reopen_count: {}
      resolved_at: {}
      resolved_by: {}
      rfc: {}
      severity:
        complex:
          root: incident
          accessor: severity
      short_description: {}
      sla_due: {}
      state: {}
      subcategory: {}
      sys_updated_by: {}
      sys_updated_on: {}
      template: {}
      ticket_type: {}
      urgency: {}
      user_input: {}
      watch_list: {}
      work_end: {}
      work_notes: {}
      work_notes_list: {}
      work_start: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: 9af50ace-c976-4674-8172-28ccd5f7c2b9
    type: title
    task:
      id: 9af50ace-c976-4674-8172-28ccd5f7c2b9
      version: -1
      name: 'Manual SOC Investigation '
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "26"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: c0fb3cc4-ea6d-4134-8019-a224182c5aa2
    type: playbook
    task:
      id: c0fb3cc4-ea6d-4134-8019-a224182c5aa2
      version: -1
      name: Dedup - Generic v3
      description: "This playbook identifies duplicate incidents using one of the\
        \ supported methods.\nSelect one of the following methods to identify duplicate\
        \ incidents in Cortex XSOAR.\n- ml: Machine learning model, which is trained\
        \ mostly on phishing incidents.\n-rules: Rules help identify duplicate incidents\
        \ when the logic is well defined, for example, the same label or custom fields.\n\
        -text: Statistics algorithm that compares text, which is generally useful\
        \ for phishing incidents.\nFor each method, the playbook will search for the\
        \ oldest similar incident. when there is a match for a similar incident the\
        \ playbook will close the current incident and will link it to the older incident. "
      playbookName: Dedup - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      CloseAsDuplicate:
        simple: "true"
      DuplicateMethod:
        simple: text
      DuplicateThreshold:
        simple: "0.7"
      IgnoreCloseIncidents:
        simple: "yes"
      MaxNumberOfCandidates:
        simple: "1000"
      TimeField:
        simple: created
      TimeFrameHours:
        simple: "72"
      exsitingIncidentsLookback:
        simple: 7 days ago
      fromPolicy: {}
      similarIncidentFields:
        simple: name,type,details
      similarLabelsKeys: {}
      statusScope: {}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 450,
          "y": 470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "21":
    id: "21"
    taskid: 857d6710-f96d-4da8-8aac-8514723a88c5
    type: regular
    task:
      id: 857d6710-f96d-4da8-8aac-8514723a88c5
      version: -1
      name: Extract Indicators from the File
      description: commands.local.cmd.extract.indicators
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      entryID: {}
      filePath:
        simple: ${incident.filepath}
      investigationID: {}
      text: {}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 720,
          "y": 1200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "22":
    id: "22"
    taskid: 4862508e-fbf1-495d-879c-fffef4db65c0
    type: condition
    task:
      id: 4862508e-fbf1-495d-879c-fffef4db65c0
      version: -1
      name: Is There a File
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "23"
      "yes":
      - "21"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.filename
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 970
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "23":
    id: "23"
    taskid: eba0562d-a7df-43b2-8c59-a52a1b2b543b
    type: playbook
    task:
      id: eba0562d-a7df-43b2-8c59-a52a1b2b543b
      version: -1
      name: Entity Enrichment - Generic v3
      playbookName: Entity Enrichment - Generic v3
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      CVE:
        complex:
          root: CVE
          accessor: ID
      Domain:
        complex:
          root: Domain
          accessor: Name
          transformers:
          - operator: uniq
      Email:
        complex:
          root: Account
          accessor: Email.Address
          transformers:
          - operator: uniq
      Hostname:
        complex:
          root: Endpoint
          accessor: Hostname
          transformers:
          - operator: uniq
      IP:
        complex:
          root: IP
          accessor: Address
          transformers:
          - operator: uniq
      InternalDomains: {}
      InternalRange: {}
      MD5:
        complex:
          root: File
          accessor: MD5
          transformers:
          - operator: uniq
      ResolveIP:
        simple: "False"
      SHA1:
        complex:
          root: File
          accessor: SHA1
          transformers:
          - operator: uniq
      SHA256:
        complex:
          root: File
          accessor: SHA256
          transformers:
          - operator: uniq
      URL:
        complex:
          root: URL
          accessor: Data
          transformers:
          - operator: uniq
      Username:
        complex:
          root: Account
          accessor: Username
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "24":
    id: "24"
    taskid: 110a3d56-edf3-4ebd-8e59-7e5a1be192af
    type: regular
    task:
      id: 110a3d56-edf3-4ebd-8e59-7e5a1be192af
      version: -1
      name: Set Incident Severity
      description: Optionally increases the incident severity to the new value if
        it is greater than the existing severity.
      scriptName: IncreaseIncidentSeverity
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      severity:
        simple: High
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 790,
          "y": 1940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "25":
    id: "25"
    taskid: 535181dd-5ad7-4a7c-8d83-e563933270cc
    type: regular
    task:
      id: 535181dd-5ad7-4a7c-8d83-e563933270cc
      version: -1
      name: Grab Suspected File from Endpoint Machine
      description: Gets information about a file from a remote connection.
      script: Tanium Threat Response|||tanium-tr-get-file-info
      type: regular
      iscommand: true
      brand: Tanium Threat Response
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      connection-name:
        simple: ${incident.labels.dvc}
      path:
        simple: ${incident.filepath}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "26":
    id: "26"
    taskid: 2d497326-d6d6-46dd-847c-da8507bd0008
    type: condition
    task:
      id: 2d497326-d6d6-46dd-847c-da8507bd0008
      version: -1
      name: Remove Files in Question?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "28"
      "Yes":
      - "27"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "27":
    id: "27"
    taskid: b68d7b96-062e-4689-8fd4-4ca79b19fdd8
    type: regular
    task:
      id: b68d7b96-062e-4689-8fd4-4ca79b19fdd8
      version: -1
      name: Delete File from Endpoint Machine
      description: Deletes a file from the given endpoint.
      script: Tanium Threat Response|||tanium-tr-delete-file-from-endpoint
      type: regular
      iscommand: true
      brand: Tanium Threat Response
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      connection-name:
        simple: ${Tanium.File.ConnectionName}
      path:
        simple: ${Tanium.File.Path}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 700,
          "y": 3800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "28":
    id: "28"
    taskid: 1e9f8a19-0b71-48fd-82c7-691894b32b2e
    type: regular
    task:
      id: 1e9f8a19-0b71-48fd-82c7-691894b32b2e
      version: -1
      name: Manual Remediation
      description: ""
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "33"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 220,
          "y": 3800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "29":
    id: "29"
    taskid: 0d7d5308-15fc-4665-8a39-15cd191fefab
    type: regular
    task:
      id: 0d7d5308-15fc-4665-8a39-15cd191fefab
      version: -1
      name: Update SNOW Ticket
      description: Updates the specified ticket.
      script: ServiceNow v2|||servicenow-update-ticket
      type: regular
      iscommand: true
      brand: ServiceNow v2
    nexttasks:
      '#none#':
      - "33"
    scriptarguments:
      active: {}
      activity_due: {}
      additional_assignee_list: {}
      additional_fields: {}
      approval: {}
      approval_history: {}
      approval_set: {}
      assigned_to: {}
      assignment_group: {}
      business_duration: {}
      business_service: {}
      business_stc: {}
      calendar_duration: {}
      caller: {}
      caller_id: {}
      category: {}
      caused_by: {}
      change_type: {}
      close_code: {}
      close_notes: {}
      closed_at: {}
      closed_by: {}
      cmdb_ci: {}
      comments: {}
      comments_and_work_notes:
        simple: Deleted the files from the endpoint machines
      company: {}
      contact_type: {}
      correlation_display: {}
      correlation_id: {}
      custom_fields: {}
      delivery_plan: {}
      description: {}
      display: {}
      due_date: {}
      escalation: {}
      expected_start: {}
      follow_up: {}
      group_list: {}
      id:
        simple: ${ServiceNow.Ticket.ID}
      impact: {}
      incident_state: {}
      input_display_value: {}
      knowledge: {}
      location: {}
      made_sla: {}
      notify: {}
      number: {}
      order: {}
      parent: {}
      parent_incident: {}
      priority: {}
      problem_id: {}
      reassignment_count: {}
      reopen_count: {}
      resolved_at: {}
      resolved_by: {}
      rfc: {}
      severity: {}
      short_description: {}
      sla_due: {}
      state: {}
      subcategory: {}
      sys_updated_by: {}
      sys_updated_on: {}
      ticket_type: {}
      urgency: {}
      user_input: {}
      watch_list: {}
      work_end: {}
      work_notes: {}
      work_notes_list: {}
      work_start: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 700,
          "y": 3960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "30":
    id: "30"
    taskid: 26fecf5c-1075-4c20-808a-a47605bfa6ed
    type: regular
    task:
      id: 26fecf5c-1075-4c20-808a-a47605bfa6ed
      version: -1
      name: Check for Other Machines with the same File
      type: regular
      iscommand: false
      description: ""
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "31":
    id: "31"
    taskid: ecf0a4ca-6a85-4ed3-8c5d-3ddc8d3e71bb
    type: condition
    task:
      id: ecf0a4ca-6a85-4ed3-8c5d-3ddc8d3e71bb
      version: -1
      name: Quarantine Those Machines?
      type: condition
      iscommand: false
      description: ""
      brand: ""
    nexttasks:
      "No":
      - "16"
      "Yes":
      - "32"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "32":
    id: "32"
    taskid: f41b5565-42a9-4981-8a12-3a00a8595bf8
    type: regular
    task:
      id: f41b5565-42a9-4981-8a12-3a00a8595bf8
      version: -1
      name: Quarantine
      description: Quarantines a device.
      script: Carbon Black Enterprise EDR|||cb-eedr-device-quarantine
      type: regular
      iscommand: true
      brand: Carbon Black Enterprise EDR
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      device_id: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 790,
          "y": 2960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "33":
    id: "33"
    taskid: 14f8db49-cc78-4733-8e28-26b22a7b31b8
    type: title
    task:
      id: 14f8db49-cc78-4733-8e28-26b22a7b31b8
      version: -1
      name: End Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 4150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 4065,
        "width": 950,
        "x": 220,
        "y": 150
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.0.0