Malware Investigation - Manual Deprecated

Deprecated. Use 'Malware Investigation & Response Incident handler' instead. (From the 'Malware Investigation And Response Pack') Master playbook for investigating suspected malware presence on an endpoint. Labels: - System: the hostname for the endpoint being investigated

Malware Core · 91 tasks · 0 inputs · 0 outputs

Details

IDMalware Investigation - Manual
From Version5.0.0
Tasks91
TagsVirus Malware

README

Deprecated. Please use the ‘Malware Investigation & Response Incident handler (From the ‘Malware Investigation And Response’ Pack).

Master playbook for investigating suspected malware presence on an endpoint.
Labels:

  • System: the hostname for the endpoint being investigated

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Flowchart

No yes yes no yes no yes no yes Close as false positive Continue start_task start_task Initial Triage Initial Triage Get device profile Get device profile Get employee information of the machine's owner Get employee information ... Review incident details Review incident details Assess severity Assess severity Notify head of IR team via Slack and Email Notify head of IR team vi... Assign and involve appropriate personnel Assign and involve approp... Review monitoring data Review monitoring data Search for recent events related to the investigated machine Search for recent events ... Is there continuous network capture of the machine? Is there continuous netwo... Retrieve packet capture for last 24 hours or at most 200MB Retrieve packet capture f... Review antivirus logs for the affected systems Review antivirus logs for... Search UEBA solution for the relevant user's behavior Search UEBA solution for ... Search DNS server logs for investigated machine's activity Search DNS server logs fo... Search web proxy logs for recent activity from this machine Search web proxy logs for... Search firewall logs for blocked traffic from this machine Search firewall logs for ... Collect evidence from the investigated machine Collect evidence from the... Trigger a snapshot / system restore point of affected systems Trigger a snapshot / syst... Collect volatile system data Collect volatile system data Fetch the system's security event log Fetch the system's securi... Create memory dump of the system Create memory dump of the... Collect autorun data Collect autorun data Collect prefetch data Collect prefetch data Collect browser history Collect browser history Collect USB device history Collect USB device history Analyze collected evidence Analyze collected evidence Look for suspicious local Windows user accounts and groups Look for suspicious local... Look for suspicious autorun entries Look for suspicious autor... Review file reputation for all autorun items Review file reputation fo... Detonate any suspicious autorun items in sandbox Detonate any suspicious a... Check processes against existing YARA signatures Check processes against e... Volatility - search for malicious IP addresses Volatility - search for m... Volatility - Check domains in DNS cache against TIP Volatility - Check domain... Volatility - search for suspicious domains in DNS cache Volatility - search for s... Volatility - review psxview results Volatility - review psxvi... Volatility - review malfind results Volatility - review malfi... Volatility - show list of previously run system commands Volatility - show list of... Correlate recently created and modified files against TIP Correlate recently create... Review prefetch data Review prefetch data Review history of connected USB drives Review history of connect... Look for processes without executable image on disk Look for processes withou... Look for system processes with suspicious execution times Look for system processes... Look for process with short edit distance from known process Look for process with sho... Check process tree and look for suspicious relationships Check process tree and lo... Look for traces of network sniffers Look for traces of networ... Analyze network traffic for malware activity Analyze network traffic f... Review shellbag data Review shellbag data Look up hashes to find trojanized modules Look up hashes to find tr... Analyze network traffic for signs of intrusion Analyze network traffic f... Look for modifications of system files Look for modifications of... Data Leak Assessment Data Leak Assessment Assess history of C&C communication in network logs Assess history of C&C com... Assess the history of local and remote file accesses Assess the history of loc... Assess unusual activity and data access Assess unusual activity a... Was any sensitive information leaked? Was any sensitive informa... Notify Public Relations (PR) team Notify Public Relations (... Respond Respond Was malware found? Was malware found? Inform user that no malware was found Inform user that no malwa... Report malware sample to AV vendor Report malware sample to ... Disable compromised AD account(s) Disable compromised AD ac... Revoke authentication keys stored on the compromised host Revoke authentication key... Revoke VPN credentials Revoke VPN credentials Instruct the owner to change their passwords Instruct the owner to cha... Ban relevant hashes across all systems Ban relevant hashes acros... Search for malicious communications from other systems Search for malicious comm... Remediate and wrap up Remediate and wrap up Notify affected user Notify affected user Provide end-user remediation guidance and link to training Provide end-user remediat... Is the identified malware known? Is the identified malware... Document manual remediation steps Document manual remediati... Trigger remediation scripts Trigger remediation scripts Was remediation successful? Was remediation successful? Open a ticket for IT to reimage the entire system Open a ticket for IT to r... Remove temporary containment measures Remove temporary containm... Reinstate disabled user accounts with new passwords Reinstate disabled user a... Deploy generated IoCs in relevant controls Deploy generated IoCs in ... Share generated IoCs with partner organizations Share generated IoCs with... Email report to CISO Email report to CISO Continue with the investigation or close as false positive? Continue with the investi... False Positive False Positive Continue with the investigation Continue with the investi... Update incident with findings Update incident with find... Memory Dump Investigation Memory Dump Investigation Device Investigation Device Investigation Autorun Investigation Autorun Investigation Processes Investigation Processes Investigation Network Investigation Network Investigation Done Done No Malware Found No Malware Found

Source

playbook-Malware_Investigation_-_Manual.yml
Download History Raw 
id: Malware Investigation - Manual
version: -1
name: Malware Investigation - Manual
deprecated: true
description: |-
  Deprecated. Use 'Malware Investigation & Response Incident handler' instead. (From the 'Malware Investigation And Response Pack')
  Master playbook for investigating suspected malware presence on an endpoint.
  Labels:
   - System: the hostname for the endpoint being investigated
tags:
- Virus
- Malware
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 8b39414f-fe78-4ae6-8ac6-2f13a86f1d22
    type: start
    task:
      id: 8b39414f-fe78-4ae6-8ac6-2f13a86f1d22
      version: -1
      name: start_task
      type: start
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 0
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 81a539cd-6e78-4b61-880c-8c8e2e175748
    type: title
    task:
      id: 81a539cd-6e78-4b61-880c-8c8e2e175748
      version: -1
      name: Initial Triage
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 157
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: ff3af5dc-70b9-4e2a-8b4a-37e3de619553
    type: regular
    task:
      id: ff3af5dc-70b9-4e2a-8b4a-37e3de619553
      version: -1
      name: Get device profile
      description: Retrieve the device profile from IT asset management software to
        consider the asset criticality in the triage process.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: ef3c5802-4fa4-4219-830e-e2aa13721503
    type: regular
    task:
      id: ef3c5802-4fa4-4219-830e-e2aa13721503
      version: -1
      name: Get employee information of the machine's owner
      description: Retrieve employee information of the machine's owner from HR software
        to consider the asset criticality in the triage process.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 30,
          "y": 300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 1f9ec386-92a7-49bc-8e66-748a356ac1fa
    type: regular
    task:
      id: 1f9ec386-92a7-49bc-8e66-748a356ac1fa
      version: -1
      name: Review incident details
      description: |-
        Understand the initial context of the investigation. If any data is missing, collect it and add it to the incident data.
        * system name
        * people involved
        * usernames involved
        * initial severity as reported
        * initial known events and the time of occurrence
        * review the incident with the data collected from the previous tests.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 475
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: e8f50674-3458-4acb-8b0f-e3a6e35344a9
    type: regular
    task:
      id: e8f50674-3458-4acb-8b0f-e3a6e35344a9
      version: -1
      name: Assess severity
      description: Based on the end user affected and other information, assess the severity and
        change it, if needed. 
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "89"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: c7534d44-77d8-48a8-8e97-4ed170468555
    type: regular
    task:
      id: c7534d44-77d8-48a8-8e97-4ed170468555
      version: -1
      name: Notify head of IR team via Slack and Email
      description: Notify relevant stakeholders that we are investigating a suspicious endpoint.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 1175
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: b396740c-364f-45aa-8620-878b3fdb94c4
    type: regular
    task:
      id: b396740c-364f-45aa-8620-878b3fdb94c4
      version: -1
      name: Assign and involve appropriate personnel
      description: Invite the relevant users for investigation - malware and
        network experts as required.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: 257c9d0c-7451-41b5-8dcc-788f14d219f8
    type: title
    task:
      id: 257c9d0c-7451-41b5-8dcc-788f14d219f8
      version: -1
      name: Review monitoring data
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "22"
      - "19"
      - "16"
      - "20"
      - "21"
      - "17"
      - "23"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 1545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "16":
    id: "16"
    taskid: 36798078-47e5-45ab-8a97-ab21a408fd9d
    type: regular
    task:
      id: 36798078-47e5-45ab-8a97-ab21a408fd9d
      version: -1
      name: Search for recent events related to the investigated machine
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "92"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "17":
    id: "17"
    taskid: ce364337-b6a6-4c84-8cab-739f2bce1d3a
    type: condition
    task:
      id: ce364337-b6a6-4c84-8cab-739f2bce1d3a
      version: -1
      name: Is there continuous network capture of the machine?
      description: Is there a continuous network capture of the investigated machine?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "92"
      "yes":
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1360,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "18":
    id: "18"
    taskid: b71db0d8-506b-4c63-88dc-b932e1b06797
    type: regular
    task:
      id: b71db0d8-506b-4c63-88dc-b932e1b06797
      version: -1
      name: Retrieve packet capture for last 24 hours or at most 200MB
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "92"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1610,
          "y": 1870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "19":
    id: "19"
    taskid: 6a05f4ba-e303-4dd8-8173-614ac405cb03
    type: regular
    task:
      id: 6a05f4ba-e303-4dd8-8173-614ac405cb03
      version: -1
      name: Review antivirus logs for the affected systems
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "92"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 890,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "20":
    id: "20"
    taskid: 3b12df3b-6b21-4ef2-8367-ea18df029f35
    type: regular
    task:
      id: 3b12df3b-6b21-4ef2-8367-ea18df029f35
      version: -1
      name: Search UEBA solution for the relevant user's behavior
      description: Search UEBA solution for the relevant user's behavior in the past
        24 hours.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "92"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -450,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "21":
    id: "21"
    taskid: 14e1b624-8c2f-4634-8800-ad8debca322b
    type: regular
    task:
      id: 14e1b624-8c2f-4634-8800-ad8debca322b
      version: -1
      name: Search DNS server logs for investigated machine's activity
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "92"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -910,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "22":
    id: "22"
    taskid: b9fecbb1-1eb9-49d8-831c-f4efc369e8e2
    type: regular
    task:
      id: b9fecbb1-1eb9-49d8-831c-f4efc369e8e2
      version: -1
      name: Search web proxy logs for recent activity from this machine
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "92"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1345,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "23":
    id: "23"
    taskid: c6210378-5eb5-4c3d-8341-39d6cc47236a
    type: regular
    task:
      id: c6210378-5eb5-4c3d-8341-39d6cc47236a
      version: -1
      name: Search firewall logs for blocked traffic from this machine
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "92"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "24":
    id: "24"
    taskid: ae70f6b0-7209-478d-81c7-2c8280ceae04
    type: title
    task:
      id: ae70f6b0-7209-478d-81c7-2c8280ceae04
      version: -1
      name: Collect evidence from the investigated machine
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 2240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "27":
    id: "27"
    taskid: d19990dc-1722-4880-845d-40ed16acc744
    type: regular
    task:
      id: d19990dc-1722-4880-845d-40ed16acc744
      version: -1
      name: Trigger a snapshot / system restore point of affected systems
      description: Create a complete backup of affected systems for recovery and forensics.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 2390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "28":
    id: "28"
    taskid: ebc663ab-0eea-4ae5-81eb-a858bd7aa651
    type: regular
    task:
      id: ebc663ab-0eea-4ae5-81eb-a858bd7aa651
      version: -1
      name: Collect volatile system data
      description: Collect system data like running processes, network connections,
        and files changed. 
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 2760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "29":
    id: "29"
    taskid: 471e4599-6990-454e-8ff3-01a855e0289a
    type: regular
    task:
      id: 471e4599-6990-454e-8ff3-01a855e0289a
      version: -1
      name: Fetch the system's security event log
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -382.5,
          "y": 2760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "30":
    id: "30"
    taskid: b63229fd-f742-4bc6-8ef7-fb87a52136c4
    type: regular
    task:
      id: b63229fd-f742-4bc6-8ef7-fb87a52136c4
      version: -1
      name: Create memory dump of the system
      description: In addition to a full backup, create a memory dump of the system.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
      - "32"
      - "29"
      - "33"
      - "31"
      - "34"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 2580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "31":
    id: "31"
    taskid: 61cdff3c-1422-4faf-8801-e70deee5e67c
    type: regular
    task:
      id: 61cdff3c-1422-4faf-8801-e70deee5e67c
      version: -1
      name: Collect autorun data
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -830,
          "y": 3110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "32":
    id: "32"
    taskid: 8084f1a6-fe26-4633-8ab2-5520e1eba12b
    type: regular
    task:
      id: 8084f1a6-fe26-4633-8ab2-5520e1eba12b
      version: -1
      name: Collect prefetch data
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 559,
          "y": 2940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "33":
    id: "33"
    taskid: 64589fd9-7afc-46cc-8a9d-52e837d5077e
    type: regular
    task:
      id: 64589fd9-7afc-46cc-8a9d-52e837d5077e
      version: -1
      name: Collect browser history
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -582.5,
          "y": 2940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "34":
    id: "34"
    taskid: b9a66bb9-9d7b-4d6f-8c01-41c64488109c
    type: regular
    task:
      id: b9a66bb9-9d7b-4d6f-8c01-41c64488109c
      version: -1
      name: Collect USB device history
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 757.5,
          "y": 3110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "35":
    id: "35"
    taskid: dd777994-1a09-4240-8376-cf29fff6bf53
    type: title
    task:
      id: dd777994-1a09-4240-8376-cf29fff6bf53
      version: -1
      name: Analyze collected evidence
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "93"
      - "94"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 3290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "36":
    id: "36"
    taskid: 4922cf38-a22b-403e-8762-37c601afb928
    type: regular
    task:
      id: 4922cf38-a22b-403e-8762-37c601afb928
      version: -1
      name: Look for suspicious local Windows user accounts and groups
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "95"
      - "47"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 3575
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "37":
    id: "37"
    taskid: 5af97dbe-6575-4b2a-8b98-205008047a89
    type: regular
    task:
      id: 5af97dbe-6575-4b2a-8b98-205008047a89
      version: -1
      name: Look for suspicious autorun entries
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 720,
          "y": 3915
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "38":
    id: "38"
    taskid: ee3e976a-ddce-447c-8a51-adb5518b4ee0
    type: regular
    task:
      id: ee3e976a-ddce-447c-8a51-adb5518b4ee0
      version: -1
      name: Review file reputation for all autorun items
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "39"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 720,
          "y": 4100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "39":
    id: "39"
    taskid: 6c5fbac6-f91d-4abc-860a-310eac3fd71b
    type: regular
    task:
      id: 6c5fbac6-f91d-4abc-860a-310eac3fd71b
      version: -1
      name: Detonate any suspicious autorun items in sandbox
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "96"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 720,
          "y": 4270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "40":
    id: "40"
    taskid: db34b3ad-3999-4acf-8096-5c3eb0ae98f7
    type: regular
    task:
      id: db34b3ad-3999-4acf-8096-5c3eb0ae98f7
      version: -1
      name: Check processes against existing YARA signatures
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "50"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 4790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "41":
    id: "41"
    taskid: 71181b4c-d4d7-468f-848a-d7fb0a7f2cc7
    type: regular
    task:
      id: 71181b4c-d4d7-468f-848a-d7fb0a7f2cc7
      version: -1
      name: Volatility - search for malicious IP addresses
      description: Search for malicious IP addresses in network connection artifacts
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "45"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -240,
          "y": 3745
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "42":
    id: "42"
    taskid: 4036d3b4-3f1c-4611-83e1-0e69ffca5169
    type: regular
    task:
      id: 4036d3b4-3f1c-4611-83e1-0e69ffca5169
      version: -1
      name: Volatility - Check domains in DNS cache against TIP
      description: Check domains in DNS cache against threat intelligence platforms.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "96"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -240,
          "y": 4440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "43":
    id: "43"
    taskid: d2c7636c-933f-4f6a-84e2-52f3c296be29
    type: regular
    task:
      id: d2c7636c-933f-4f6a-84e2-52f3c296be29
      version: -1
      name: Volatility - search for suspicious domains in DNS cache
      description: Search for suspicious domains in DNS cache artifacts.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "42"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -240,
          "y": 4270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "44":
    id: "44"
    taskid: 6665b205-7497-4b6a-893c-645109d6d500
    type: regular
    task:
      id: 6665b205-7497-4b6a-893c-645109d6d500
      version: -1
      name: Volatility - review psxview results
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "41"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -240,
          "y": 3575
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "45":
    id: "45"
    taskid: 82ecf76f-def1-4b11-8b73-99484690428f
    type: regular
    task:
      id: 82ecf76f-def1-4b11-8b73-99484690428f
      version: -1
      name: Volatility - review malfind results
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "46"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -240,
          "y": 3915
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "46":
    id: "46"
    taskid: b050b4fd-cbc9-40b8-8064-4015468b0b01
    type: regular
    task:
      id: b050b4fd-cbc9-40b8-8064-4015468b0b01
      version: -1
      name: Volatility - show list of previously run system commands
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -240,
          "y": 4090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "47":
    id: "47"
    taskid: 4fbfb75a-0a8a-4a97-8358-0b0009733d1d
    type: regular
    task:
      id: 4fbfb75a-0a8a-4a97-8358-0b0009733d1d
      version: -1
      name: Correlate recently created and modified files against TIP
      description: Research current threat intelligence for file activity, and correlate
        recently created and modified files against threat intelligence platform.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "59"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 3745
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "48":
    id: "48"
    taskid: 35291803-ac50-45b9-8af6-24f0b33b3318
    type: regular
    task:
      id: 35291803-ac50-45b9-8af6-24f0b33b3318
      version: -1
      name: Review prefetch data
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "56"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 4270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "49":
    id: "49"
    taskid: bb921d3d-5e52-4c81-8927-d681a630c867
    type: regular
    task:
      id: bb921d3d-5e52-4c81-8927-d681a630c867
      version: -1
      name: Review history of connected USB drives
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 4090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "50":
    id: "50"
    taskid: 877fbae1-4c48-4d48-8816-721664190449
    type: regular
    task:
      id: 877fbae1-4c48-4d48-8816-721664190449
      version: -1
      name: Look for processes without executable image on disk
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "51"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 4970
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "51":
    id: "51"
    taskid: dd74cc90-5dc9-4d88-8c57-79a0112d9639
    type: regular
    task:
      id: dd74cc90-5dc9-4d88-8c57-79a0112d9639
      version: -1
      name: Look for system processes with suspicious execution times
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "52"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 5160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "52":
    id: "52"
    taskid: cee5bf18-f43e-4352-8d45-75ab67439b66
    type: regular
    task:
      id: cee5bf18-f43e-4352-8d45-75ab67439b66
      version: -1
      name: Look for process with short edit distance from known process
      description: |-
        Look for process names with similar names to known processes.
        These may be attempts to fool a human investigator (e.g., scvhost.exe )
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "57"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 5360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "53":
    id: "53"
    taskid: 787e778d-9767-4e62-8632-d305fc0f4928
    type: regular
    task:
      id: 787e778d-9767-4e62-8632-d305fc0f4928
      version: -1
      name: Check process tree and look for suspicious relationships
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "97"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 5735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "54":
    id: "54"
    taskid: ef35ed3e-d934-4fe7-8f29-e3eb1ba39c65
    type: regular
    task:
      id: ef35ed3e-d934-4fe7-8f29-e3eb1ba39c65
      version: -1
      name: Look for traces of network sniffers
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "58"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 6240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "55":
    id: "55"
    taskid: 5aa42e88-5617-444b-8e8c-78f3190bc0e8
    type: regular
    task:
      id: 5aa42e88-5617-444b-8e8c-78f3190bc0e8
      version: -1
      name: Analyze network traffic for malware activity
      description: Analyze the network traffic from/to this system for malware activity
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "54"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 6060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "56":
    id: "56"
    taskid: 459bccb7-3041-41bc-8c82-a59b98ada625
    type: regular
    task:
      id: 459bccb7-3041-41bc-8c82-a59b98ada625
      version: -1
      name: Review shellbag data
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "96"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 4440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "57":
    id: "57"
    taskid: c8f5e2c2-320c-4064-8daf-771ad53b1d79
    type: regular
    task:
      id: c8f5e2c2-320c-4064-8daf-771ad53b1d79
      version: -1
      name: Look up hashes to find trojanized modules
      description: Look up hashes of all running processes and loaded modules to find
        trojanized modules
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "53"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 5550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "58":
    id: "58"
    taskid: 569ff1da-d920-48a6-86b8-e1823b6129a2
    type: regular
    task:
      id: 569ff1da-d920-48a6-86b8-e1823b6129a2
      version: -1
      name: Analyze network traffic for signs of intrusion
      description: Analyze the network traffic from/to this system for signs of intrusion.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "60"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 6430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "59":
    id: "59"
    taskid: 72d9f37f-663d-4a6a-8622-1f56cfce8e1b
    type: regular
    task:
      id: 72d9f37f-663d-4a6a-8622-1f56cfce8e1b
      version: -1
      name: Look for modifications of system files
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "49"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 3925
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "60":
    id: "60"
    taskid: bc465242-756c-44ad-8546-b004ca98190c
    type: title
    task:
      id: bc465242-756c-44ad-8546-b004ca98190c
      version: -1
      name: Data Leak Assessment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "61"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 6630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "61":
    id: "61"
    taskid: 2458ef66-2cdc-4890-88a6-91c367f270fa
    type: regular
    task:
      id: 2458ef66-2cdc-4890-88a6-91c367f270fa
      version: -1
      name: Assess history of C&C communication in network logs
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "62"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 6780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "62":
    id: "62"
    taskid: b29724fe-1dc2-469d-85da-158998cf8406
    type: regular
    task:
      id: b29724fe-1dc2-469d-85da-158998cf8406
      version: -1
      name: Assess the history of local and remote file accesses
      description: Assess the history of local and remote file accesses by the malware.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "63"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 6970
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "63":
    id: "63"
    taskid: 86d9bb9e-cea8-4707-816e-874a263b6ab8
    type: regular
    task:
      id: 86d9bb9e-cea8-4707-816e-874a263b6ab8
      version: -1
      name: Assess unusual activity and data access
      description: Assess unusual activity and data access by compromised user accounts
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "64"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 7155
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "64":
    id: "64"
    taskid: ee0ea26d-63f9-4a4a-80e8-e81a0e3f8ace
    type: condition
    task:
      id: ee0ea26d-63f9-4a4a-80e8-e81a0e3f8ace
      version: -1
      name: Was any sensitive information leaked?
      description: '-'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "66"
      "yes":
      - "65"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 7340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "65":
    id: "65"
    taskid: d8cabc70-1020-4212-8afb-fbb44052c69b
    type: regular
    task:
      id: d8cabc70-1020-4212-8afb-fbb44052c69b
      version: -1
      name: Notify Public Relations (PR) team
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "66"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 400,
          "y": 7510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "66":
    id: "66"
    taskid: 2b290909-b729-46a4-8c09-212bee8f6094
    type: title
    task:
      id: 2b290909-b729-46a4-8c09-212bee8f6094
      version: -1
      name: Respond
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "67"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 7702
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "67":
    id: "67"
    taskid: 9e7d4c09-71b1-48a7-8e81-c6d68f711e77
    type: condition
    task:
      id: 9e7d4c09-71b1-48a7-8e81-c6d68f711e77
      version: -1
      name: Was malware found?
      description: '-'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "68"
      "yes":
      - "69"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 7860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "68":
    id: "68"
    taskid: 9a0c6e9b-e8fb-4623-8204-99fb18b77342
    type: regular
    task:
      id: 9a0c6e9b-e8fb-4623-8204-99fb18b77342
      version: -1
      name: Inform user that no malware was found
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "99"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 330,
          "y": 8030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "69":
    id: "69"
    taskid: 2e0b8f19-ff26-4b74-8b60-400ba0541490
    type: regular
    task:
      id: 2e0b8f19-ff26-4b74-8b60-400ba0541490
      version: -1
      name: Report malware sample to AV vendor
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "70"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 8030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "70":
    id: "70"
    taskid: b2f270d0-9aa0-4419-8726-3e77e3648713
    type: regular
    task:
      id: b2f270d0-9aa0-4419-8726-3e77e3648713
      version: -1
      name: Disable compromised AD account(s)
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "71"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 8205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "71":
    id: "71"
    taskid: 07ff3526-c090-44fc-8ed1-5968703ab1f1
    type: regular
    task:
      id: 07ff3526-c090-44fc-8ed1-5968703ab1f1
      version: -1
      name: Revoke authentication keys stored on the compromised host
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "72"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 8390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "72":
    id: "72"
    taskid: 06089652-2295-4aaa-8832-bf81b8ea9805
    type: regular
    task:
      id: 06089652-2295-4aaa-8832-bf81b8ea9805
      version: -1
      name: Revoke VPN credentials
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "73"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 8580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "73":
    id: "73"
    taskid: 6c344872-4f8a-429e-85bc-5b19cc896675
    type: regular
    task:
      id: 6c344872-4f8a-429e-85bc-5b19cc896675
      version: -1
      name: Instruct the owner to change their passwords
      description: |-
        Instruct the owner to change their passwords for any personal accounts.
        Personal email, social media, LinkedIn profile - these are in the control of the employee and they must be involved to change passwords. IT/Security staff can help to expedite.

        This is not only for the benefit of the employee - there is a real danger to the organization: access to these accounts could allow malicious actors to convincingly impersonate the owner of the device to engage in social engineering against other employees and further attack the organization.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "74"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 8780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "74":
    id: "74"
    taskid: 063654e6-36ff-4f1a-8f64-d2b46828e72a
    type: regular
    task:
      id: 063654e6-36ff-4f1a-8f64-d2b46828e72a
      version: -1
      name: Ban relevant hashes across all systems
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "75"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 8970
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "75":
    id: "75"
    taskid: c220e27d-0def-43b1-8c8e-81f49c17123f
    type: regular
    task:
      id: c220e27d-0def-43b1-8c8e-81f49c17123f
      version: -1
      name: Search for malicious communications from other systems
      description: Search for the same malicious communications from other systems
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "76"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 9160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "76":
    id: "76"
    taskid: b32d3cb5-4029-413b-8b4b-52f415dab2c9
    type: title
    task:
      id: b32d3cb5-4029-413b-8b4b-52f415dab2c9
      version: -1
      name: Remediate and wrap up
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "77"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 9360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "77":
    id: "77"
    taskid: 3f738a4c-9f58-4616-8dcf-eced645d27bd
    type: regular
    task:
      id: 3f738a4c-9f58-4616-8dcf-eced645d27bd
      version: -1
      name: Notify affected user
      description: Notify affected user about the outcome of investigation.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "78"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 9540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "78":
    id: "78"
    taskid: 05fff135-c0f1-4f03-8ee0-46cbc0c0db9d
    type: regular
    task:
      id: 05fff135-c0f1-4f03-8ee0-46cbc0c0db9d
      version: -1
      name: Provide end-user remediation guidance and link to training
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "79"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 9700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "79":
    id: "79"
    taskid: 27b6724e-e6c1-4e2c-8f82-ce90b4d10a8e
    type: condition
    task:
      id: 27b6724e-e6c1-4e2c-8f82-ce90b4d10a8e
      version: -1
      name: Is the identified malware known?
      description: Is the identified malware known? (with automated remediation steps)
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "80"
      "yes":
      - "81"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 9880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "80":
    id: "80"
    taskid: 96d00c65-e637-4b21-8289-0faf6f6d2175
    type: regular
    task:
      id: 96d00c65-e637-4b21-8289-0faf6f6d2175
      version: -1
      name: Document manual remediation steps
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "82"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -420,
          "y": 10055
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "81":
    id: "81"
    taskid: 4aa3a1fd-18e0-41d3-8d60-618a4ce3ee17
    type: regular
    task:
      id: 4aa3a1fd-18e0-41d3-8d60-618a4ce3ee17
      version: -1
      name: Trigger remediation scripts
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "82"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 10055
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "82":
    id: "82"
    taskid: 54e276f9-cbb7-44dc-8853-00a775994162
    type: condition
    task:
      id: 54e276f9-cbb7-44dc-8853-00a775994162
      version: -1
      name: Was remediation successful?
      description: '-'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "83"
      "yes":
      - "84"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 10240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "83":
    id: "83"
    taskid: d18f40f3-bba1-46c5-8835-71dec77bd47d
    type: regular
    task:
      id: d18f40f3-bba1-46c5-8835-71dec77bd47d
      version: -1
      name: Open a ticket for IT to reimage the entire system
      description: Open a ticket for IT to reimage the entire system and restore from
        backup
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "86"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -420,
          "y": 10415
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "84":
    id: "84"
    taskid: c7768e6d-1c42-49a1-8c27-884b6990513a
    type: regular
    task:
      id: c7768e6d-1c42-49a1-8c27-884b6990513a
      version: -1
      name: Remove temporary containment measures
      description: Remove the temporary containment measures that were placed.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "85"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 60,
          "y": 10415
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "85":
    id: "85"
    taskid: 006fc8ba-dfb1-4b86-8487-02c44f90533a
    type: regular
    task:
      id: 006fc8ba-dfb1-4b86-8487-02c44f90533a
      version: -1
      name: Reinstate disabled user accounts with new passwords
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "86"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 60,
          "y": 10590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "86":
    id: "86"
    taskid: b04e8eeb-e625-43db-8bd2-f4121690896a
    type: regular
    task:
      id: b04e8eeb-e625-43db-8bd2-f4121690896a
      version: -1
      name: Deploy generated IoCs in relevant controls
      description: Deploy generated IoCs in relevant controls to prevent future attacks.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "87"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 10770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "87":
    id: "87"
    taskid: f47a10eb-d8db-4be4-852a-3f0ff02d0020
    type: regular
    task:
      id: f47a10eb-d8db-4be4-852a-3f0ff02d0020
      version: -1
      name: Share generated IoCs with partner organizations
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "88"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 10950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "88":
    id: "88"
    taskid: aad7a976-2f78-405a-8fab-ec357b779ebb
    type: regular
    task:
      id: aad7a976-2f78-405a-8fab-ec357b779ebb
      version: -1
      name: Email report to CISO
      description: Email investigation report to CISO
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "98"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 11120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "89":
    id: "89"
    taskid: 78635828-3c6e-42d2-868d-db9d66b7839e
    type: condition
    task:
      id: 78635828-3c6e-42d2-868d-db9d66b7839e
      version: -1
      name: Continue with the investigation or close as false positive?
      description: After analyzing the incident data, the involved users, and the
        device profile, should the investigation continue?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Close as false positive:
      - "90"
      Continue:
      - "91"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "90":
    id: "90"
    taskid: ece0f835-7c6f-4112-8dc5-38d2e9a3e7ac
    type: title
    task:
      id: ece0f835-7c6f-4112-8dc5-38d2e9a3e7ac
      version: -1
      name: False Positive
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "98"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1600,
          "y": 1020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "91":
    id: "91"
    taskid: 411bc5b8-09b5-4697-82b2-6b875ce62998
    type: title
    task:
      id: 411bc5b8-09b5-4697-82b2-6b875ce62998
      version: -1
      name: Continue with the investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 1020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "92":
    id: "92"
    taskid: 53d87877-197c-47fb-8fe9-121d3bfe8273
    type: regular
    task:
      id: 53d87877-197c-47fb-8fe9-121d3bfe8273
      version: -1
      name: Update incident with findings
      description: Update the incident data with the newly collected data from the
        monitoring systems.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 2060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "93":
    id: "93"
    taskid: 6401f6bb-bf6f-4b22-8d61-e24e0f1b8847
    type: title
    task:
      id: 6401f6bb-bf6f-4b22-8d61-e24e0f1b8847
      version: -1
      name: Memory Dump Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "44"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -240,
          "y": 3430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "94":
    id: "94"
    taskid: 4758a1d0-2c7d-41bf-86cd-d209bfb5ec79
    type: title
    task:
      id: 4758a1d0-2c7d-41bf-86cd-d209bfb5ec79
      version: -1
      name: Device Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "36"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 3430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "95":
    id: "95"
    taskid: 319bf6e3-0a3f-4af1-8e61-95432973fbec
    type: title
    task:
      id: 319bf6e3-0a3f-4af1-8e61-95432973fbec
      version: -1
      name: Autorun Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "37"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 720,
          "y": 3760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "96":
    id: "96"
    taskid: 109ad297-0b52-43a9-861b-c7f0b0fd0a04
    type: title
    task:
      id: 109ad297-0b52-43a9-861b-c7f0b0fd0a04
      version: -1
      name: Processes Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "40"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 4640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "97":
    id: "97"
    taskid: 589abee6-9c1e-4ba4-8491-0e7d3201a305
    type: title
    task:
      id: 589abee6-9c1e-4ba4-8491-0e7d3201a305
      version: -1
      name: Network Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "55"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 5905
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "98":
    id: "98"
    taskid: 9a90315d-f0b2-438a-830f-a58dab6ab708
    type: title
    task:
      id: 9a90315d-f0b2-438a-830f-a58dab6ab708
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1600,
          "y": 11300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "99":
    id: "99"
    taskid: 5d3cd6bc-d5b1-48a8-829d-d30f69fac276
    type: title
    task:
      id: 5d3cd6bc-d5b1-48a8-829d-d30f69fac276
      version: -1
      name: No Malware Found
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "98"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 330,
          "y": 8220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {
      "17_18_yes": 0.52,
      "17_92_No": 0.1,
      "64_65_yes": 0.31,
      "64_66_#default#": 0.38,
      "67_68_no": 0.82,
      "79_80_no": 0.43,
      "79_81_yes": 0.42,
      "82_83_no": 0.43,
      "82_84_yes": 0.5,
      "89_90_Close as false positive": 0.14,
      "89_91_Continue": 0.41
    },
    "paper": {
      "dimensions": {
        "height": 11365,
        "width": 3590,
        "x": -1610,
        "y": 0
      }
    }
  }
inputs: []
outputs: []
fromversion: 5.0.0
tests:
- No tests