MITRE ATT&CK CoA - T1110 - Brute Force

description: "This playbook Remediates the Brute Force technique using intelligence-driven Courses of Action (COA) defined by Palo Alto Networks Unit 42 team.\n \n***Disclaimer: This playbook does not simulate an attack using the specified technique, but follows the steps to remediation as defined by Palo Alto Networks Unit 42 team’s Actionable Threat Objects and Mitigations (ATOMs).\nTechniques Handled:\n- T1110 : Brute Force\n\nKill Chain phases:\n- Credential Access\n\nMITRE ATT&CK Description:\n\nAdversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.\n\nPossible playbook uses:\n- The playbook can be used independently to handle and remediate the specific technique.\n- The playbook can be used as a part of the “Courses of Action - Defense Evasion” playbook to remediate techniques based on the kill chain phase.\n- The playbook can be used as a part of the “MITRE ATT&CK - Courses of Action” playbook, which can be triggered by different sources and accepts the technique MITRE ATT&CK ID as an input."
id: MITRE ATT&CK CoA - T1110 - Brute Force
inputs:
- description: Rules location. Can be 'pre-rulebase' or 'post-rulebase'. Mandatory for Panorama instances.
  key: pre_post
  playbookInputQuery:
  required: false
  value: {}
- description: The device group for which to return addresses (Panorama instances).
  key: device-group
  playbookInputQuery:
  required: false
  value: {}
- description: Tag for which to filter the results.
  key: tag
  playbookInputQuery:
  required: false
  value: {}
name: MITRE ATT&CK CoA - T1110 - Brute Force
outputs:
- contextPath: Handled.Techniques
  description: The techniques handled in this playbook
  type: unknown
starttaskid: "0"
tasks:
  "0":
    id: "0"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "10"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 1f202f20-8326-4cd4-8347-01e922174d19
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: 1f202f20-8326-4cd4-8347-01e922174d19
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
  "4":
    id: "4"
    ignoreworker: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 8856aeb0-7d98-4640-8c25-6c0b75a87bc7
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 8856aeb0-7d98-4640-8c25-6c0b75a87bc7
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1060
        }
      }
  "8":
    id: "8"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "11"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Create a rule to modify the default action for all signatures in the brute force category to block-ip address action in PAN-OS.
      id: e7bdb3ac-924b-4d36-8060-91dd153cb631
      iscommand: false
      name: Manual - Set profile with brute force category & action as block IP
      type: regular
      version: -1
    taskid: e7bdb3ac-924b-4d36-8060-91dd153cb631
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 50,
          "y": 515
        }
      }
  "9":
    id: "9"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - "8"
    note: false
    quietmode: 0
    scriptarguments:
      ApplyToRule:
        complex:
          root: inputs.ApplyToRule
      device-group:
        complex:
          root: inputs.device-group
      pre-post-rulebase:
        complex:
          root: inputs.pre_post
      rule_name:
        complex:
          root: inputs.rule_name
      tag:
        complex:
          root: inputs.tag
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: e059c111-2616-4f3c-82d5-9f4358f35a28
      iscommand: false
      name: PAN-OS - Enforce Vulnerability Protection Best Practices Profile
      playbookId: PAN-OS - Enforce Vulnerability Protection Best Practices Profile
      type: playbook
      version: -1
      description: ''
    taskid: e059c111-2616-4f3c-82d5-9f4358f35a28
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 50,
          "y": 340
        }
      }
  "10":
    id: "10"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "9"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: a5788d53-247f-4903-840e-5fe6b4d5dafa
      iscommand: false
      name: Create a rule to modify the default action for all signatures in the brute force category to block-ip address action
      type: title
      version: -1
      description: ''
    taskid: a5788d53-247f-4903-840e-5fe6b4d5dafa
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
  "11":
    id: "11"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "12"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Handled.Techniques
      stringify: {}
      value:
        simple: T1110
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered.
      id: 76d1f375-9f24-49c4-85fa-5ae8f95bba52
      iscommand: false
      name: Set technique handled
      script: Set
      type: regular
      version: -1
    taskid: 76d1f375-9f24-49c4-85fa-5ae8f95bba52
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 50,
          "y": 690
        }
      }
  "12":
    continueonerror: true
    id: "12"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "4"
    note: false
    quietmode: 0
    scriptarguments:
      columns:
        simple: technique
      context_path:
        simple: Handled.Techniques
      grid_id:
        simple: handledtechniques
      keys: {}
      overwrite: {}
      sort_by: {}
      unpack_nested_elements: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Creates a Grid table from items or key-value pairs.
      id: 360c8cfe-6d02-4a23-8341-9bf0cf9a8c83
      iscommand: false
      name: Set grid field
      script: SetGridField
      type: regular
      version: -1
    taskid: 360c8cfe-6d02-4a23-8341-9bf0cf9a8c83
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 50,
          "y": 870
        }
      }
version: -1
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1075,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
tests:
- No tests (auto formatted)
fromversion: 6.5.0