Microsoft Defender for Endpoint - Malware Detected

This playbook investigates “Malware detected by Microsoft Defender for Endpoint” by gathering Hash and User information and performing remediation based on the information gathered and received from the enrichment. Used Sub-playbooks: * Enrichment for Verdict To link this playbook to the relevant alerts automatically, we recommend using the following filters when configuring the playbook triggers: Alert Source = Correlation AND Alert Name = Malware detected by Microsoft Defender for Endpoint

Microsoft Defender for Endpoint · 12 tasks · 0 inputs · 0 outputs

Details

ID	`Microsoft Defender for Endpoint - Malware Detected`
From Version	6.6.0
Tasks	12

README

Used Sub-playbooks:

Enrichment for Verdict

To link this playbook to the relevant alerts automatically, we recommend using the following filters when configuring the playbook triggers: Alert Source = Correlation AND Alert Name = Malware detected by Microsoft Defender for Endpoint

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Enrichment for Verdict

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

closeInvestigation
setAlert

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Microsoft Defender for Endpoint - Malware Detected

Commands used

closeInvestigation setAlert

Flowchart

Source

playbook-Microsoft_Defender_for_Endpoint_-_Malware_Detected.yml

Download History Raw

id: Microsoft Defender for Endpoint - Malware Detected
version: -1
name: Microsoft Defender for Endpoint - Malware Detected
description: |-
  This playbook investigates “Malware detected by Microsoft Defender for Endpoint” by gathering Hash and User information and performing remediation based on the information gathered and received from the enrichment.

  Used Sub-playbooks:
  * Enrichment for Verdict

  To link this playbook to the relevant alerts automatically, we recommend using the following filters when configuring the playbook triggers: Alert Source = Correlation AND Alert Name = Malware detected by Microsoft Defender for Endpoint
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: dff7841b-d85a-4e59-893c-44b5388f18fe
    type: start
    task:
      id: dff7841b-d85a-4e59-893c-44b5388f18fe
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 460,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: ee3f6422-3b2d-4f0e-8870-b0b0a0ce2787
    type: title
    task:
      id: ee3f6422-3b2d-4f0e-8870-b0b0a0ce2787
      version: -1
      name: Enrich Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 460,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 9d7b49be-2e04-4015-84dd-2ce8eee14869
    type: playbook
    task:
      id: 9d7b49be-2e04-4015-84dd-2ce8eee14869
      version: -1
      name: Enrichment for Verdict
      description: This playbook checks prior alert closing reasons and performs enrichment and prevalence checks on different IOC types. It then returns the information needed to establish the alert's verdict.
      playbookName: Enrichment for Verdict
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      CloseReason:
        simple: Resolved - False Positive,Resolved - Duplicate Incident,Resolved - Known Issue
      Domain:
        complex:
          root: alert
          accessor: domainname
      FileSHA256:
        complex:
          root: alert
          accessor: initiatorsha256
      IP:
        complex:
          root: alert
          accessor: hostip
      URL:
        complex:
          root: alert
          accessor: url
      User:
        complex:
          root: alert
          accessor: username
      query:
        simple: (initiatorsha256:${alert.initiatorsha256} or hostname:${alert.hostname}) and alertsource:${alert.sourceBrand} and alertname:${alert.name}
      threshold:
        simple: "2"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 460,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 8d39b058-6168-4c73-80f6-b7818e1994db
    type: condition
    task:
      id: 8d39b058-6168-4c73-80f6-b7818e1994db
      version: -1
      name: Continue based on verdict
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      Malicious File:
      - "5"
    separatecontext: false
    conditions:
    - label: Malicious File
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: FileVerdict
            iscontext: true
          right:
            value:
              simple: Suspicious
          ignorecase: true
      - - operator: isEqualString
          left:
            value:
              simple: Core.AnalyticsPrevalence.Hash
            iscontext: true
          right:
            value:
              simple: "false"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 460,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: d3b38e68-ea6e-44f7-8b1e-a3c73be61951
    type: title
    task:
      id: d3b38e68-ea6e-44f7-8b1e-a3c73be61951
      version: -1
      name: True Positive
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: df2fc347-9a1e-4f26-8c8d-b4cb9cecf7cd
    type: regular
    task:
      id: df2fc347-9a1e-4f26-8c8d-b4cb9cecf7cd
      version: -1
      name: Continue manual investigation
      description: |-
        Continue investigating the alert manually and check the followings:
        1 - Check the Microsoft Defender Alert action status and file quarantine status.
        2 - Check user permissions (Local Administrator or Domain Admin for example).
        3 - Run the "Collect Investigation Package" on the investigated device if needed.
        4 - Search the malicious indicators on other Hosts in your organization (via the Advanced Hunting module for example).
        5 - Isolate the host if needed.
        6 - Block the malicious indicators if needed.
        7 - Malware analysis.
        8- Recovery.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: ac24518c-0b76-4d16-8a4a-5eb6bc496336
    type: title
    task:
      id: ac24518c-0b76-4d16-8a4a-5eb6bc496336
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 460,
          "y": 1750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 99c023a9-2e91-4896-8fef-e867a254d560
    type: title
    task:
      id: 99c023a9-2e91-4896-8fef-e867a254d560
      version: -1
      name: False Positive
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 1060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: c7dbf16e-fa98-4c8a-8db1-85889b598713
    type: regular
    task:
      id: c7dbf16e-fa98-4c8a-8db1-85889b598713
      version: -1
      name: |
        Lower alert severity
      description: commands.local.cmd.set.incident
      script: Builtin|||setAlert
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      severity:
        simple: Low
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 1210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 3924e0b3-3d51-46e4-86a6-b3643791fb36
    type: regular
    task:
      id: 3924e0b3-3d51-46e4-86a6-b3643791fb36
      version: -1
      name: |
        Close the alert as False Positive
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      closeNotes:
        simple: 'False Positive '
      closeReason:
        simple: False Positive
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 1370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: bdd28d00-2252-4eed-89f2-38911b986aec
    type: regular
    task:
      id: bdd28d00-2252-4eed-89f2-38911b986aec
      version: -1
      name: |
        Close the alert as True Positive
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      closeNotes:
        simple: ${Enter the Investigation details.Answers}
      closeReason:
        simple: 'True Positive '
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 9df39b52-8efb-489f-8fad-d03bc6b0a430
    type: collection
    task:
      id: 9df39b52-8efb-489f-8fad-d03bc6b0a430
      version: -1
      name: Enter the Investigation details
      description: ''
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body: {}
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Enter the Investigation details
        required: false
        gridcolumns: []
        defaultrows: []
        type: longText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Enter the Investigation details
      description: Enter the investigation details.
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "3_10_#default#": 0.36,
      "3_5_Malicious File": 0.38
    },
    "paper": {
      "dimensions": {
        "height": 1645,
        "width": 1230,
        "x": 50,
        "y": 170
      }
    }
  }
inputs: []
outputs: []
quiet: true
marketplaces: ["marketplacev2", "platform"]
tests:
- No tests (auto formatted)
fromversion: 6.6.0