NOBELIUM - wide scale APT29 spear-phishing

On May 27, 2021, Microsoft reported a wide scale spear phishing campaign attributed to APT29, the same threat actor responsible for the SolarWinds campaign named SolarStorm. This attack had a wide range of targets for an APT spear phishing campaign with 3,000 email accounts targeted within 150 organizations. https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ This playbook includes the following tasks: - Collect IOCs to be used in your threat hunting process - Query FW, SIEMs, EDR, XDR to detect malicious hashes, network activity and compromised hosts - Block known indicators ** Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.

Rapid Breach Response · 34 tasks · 4 inputs · 0 outputs

Details

IDNOBELIUM - wide scale APT29 spear-phishing
From Version6.5.0
Tasks34

README

On May 27, 2021, Microsoft reported a wide scale spear phishing campaign attributed to APT29, the same threat actor responsible for the SolarWinds campaign named SolarStorm. This attack had a wide range of targets for an APT spear phishing campaign with 3,000 email accounts targeted within 150 organizations.
https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
This playbook includes the following tasks:

  • Collect IOCs to be used in your threat hunting process
  • Query FW, SIEMs, EDR, XDR to detect malicious hashes, network activity and compromised hosts
  • Block known indicators
    ** Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Splunk Indicator Hunting
  • Search Endpoints By Hash - Generic V2
  • Block Indicators - Generic v3
  • Palo Alto Networks - Hunting And Threat Detection
  • QRadar Indicator Hunting V2
  • Panorama Query Logs

Integrations

This playbook does not use any integrations.

Scripts

  • ParseHTMLIndicators
  • http
  • SearchIncidentsV2

Commands

  • extractIndicators
  • ews-search-mailbox
  • setIndicators

Playbook Inputs

Name Description Default Value Required
EWSSearchQuery The EWS query to find malicious emails related to NOBELIUM spear-phishing. From:usaid.gov or From:in.constantcontact.com Optional
BlockIndicatorsAutomatically Whether to automatically indicators involved with NOBELIUM spear-phishing. False Optional
UserVerification Whether to provide user verification for blocking IPs.

False - No prompt will be displayed to the user.
True - The server will ask the user for blocking verification and will display the blocking list.		 False Optional
AutoBlockIndicators Should the given indicators be automatically blocked, or should the user be given the option to choose?

If set to True - no prompt will appear, and all provided indicators will be blocked automatically.
If set to False - the user will be prompted to select which indicators to block.		 True Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

NOBELIUM - wide scale APT29 spear-phishing

Inputs

  • EWSSearchQuery — The EWS query to find malicious emails related to NOBELIUM spear-phishing.
  • BlockIndicatorsAutomatically — Whether to automatically indicators involved with NOBELIUM spear-phishing.
  • UserVerification — Possible values: True/False. Whether to provide user verification for blocking IPs. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.
  • AutoBlockIndicators — |- Should the given indicators be automatically blocked, or should the user be given the option to choose? If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block.

Commands used

ews-search-mailbox extractIndicators setIndicators

Flowchart

yes yes yes Start Start Collect Indicators of Compromise Collect Indicators of Com... Retrieve IOCs file from Azure GitHub repository - http Retrieve IOCs file from A... http Retrieve Volexity blog - ParseHTMLIndicators Retrieve Volexity blog ParseHTMLIndicators Hunt Indicators Hunt Indicators Extract IOCS from Volexity blog - extractIndicators Extract IOCS from Volexit... extractIndicators Extract IOCs from Azure GitHub repository - extractIndicators Extract IOCs from Azure G... extractIndicators Palo Alto Networks - Hunting And Threat Detection - Palo Alto Networks - Hunting And Threat Detection Palo Alto Networks - Hunt... Palo Alto Networks - Hunting ... SIEM Indicators Hunting SIEM Indicators Hunting Network Activity Indicators Hunt Network Activity Indicato... Panorama Query Logs - Panorama Query Logs Panorama Query Logs Panorama Query Logs QRadar Indicator Hunting V2 - QRadar Indicator Hunting V2 QRadar Indicator Hunting V2 QRadar Indicator Hunting V2 Splunk Indicator Hunting - Splunk Indicator Hunting Splunk Indicator Hunting Splunk Indicator Hunting Search XDR incidents related to NOBELIUM - SearchIncidentsV2 Search XDR incidents rela... SearchIncidentsV2 Endpoints Activity Hunt Endpoints Activity Hunt Search Endpoints By Hash - Generic V2 - Search Endpoints By Hash - Generic V2 Search Endpoints By Hash ... Search Endpoints By Hash - Ge... Is Cortex XDR enabled? Is Cortex XDR enabled? Advanced Hunting Advanced Hunting Run YARA rules Run YARA rules Run Sigma rules Run Sigma rules Cortex XDR XQL queries Cortex XDR XQL queries Malicious Email Search Malicious Email Search Is EWS enabled? Is EWS enabled? Search for emails from spoofed accounts - ews-search-mailbox Search for emails from sp... ews-search-mailbox Block Indicators Block Indicators Block indicators automatically? Block indicators automati... Done Done Block indicators manually Block indicators manually Tag Indicators Tag Indicators Tag File indicators - setIndicators Tag File indicators setIndicators Tag IP indicators - setIndicators Tag IP indicators setIndicators Tag Domain indicators - setIndicators Tag Domain indicators setIndicators Tag URL indicators - setIndicators Tag URL indicators setIndicators Block Indicators - Generic v3 - Block Indicators - Generic v3 Block Indicators - Generi... Block Indicators - Generic v3

Source

playbook-NOBELIUM_-_wide_scale_APT29_spear-phishing.yml
Download History Raw 
id: NOBELIUM - wide scale APT29 spear-phishing
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: NOBELIUM - wide scale APT29 spear-phishing
description: "On May 27, 2021, Microsoft reported a wide scale spear phishing campaign attributed to APT29, the same threat actor responsible for the SolarWinds campaign named SolarStorm. This attack had a wide range of targets for an APT spear phishing campaign with 3,000 email accounts targeted within 150 organizations. \nhttps://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/  \nThis playbook includes the following tasks:\n- Collect IOCs to be used in your threat hunting process\n- Query FW, SIEMs, EDR, XDR to detect malicious hashes, network activity and compromised hosts \n- Block known indicators\n** Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 4f30ea4a-47c0-46fd-8a46-cdcd1686a5fd
    type: start
    task:
      id: 4f30ea4a-47c0-46fd-8a46-cdcd1686a5fd
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 440,
          "y": -770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: ec9e48f1-8c12-4c45-8190-e402ac8f2b72
    type: title
    task:
      id: ec9e48f1-8c12-4c45-8190-e402ac8f2b72
      version: -1
      name: Collect Indicators of Compromise
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
      - "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 440,
          "y": -620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 8f9863ec-f861-4198-8b1b-b842e219ee7e
    type: regular
    task:
      id: 8f9863ec-f861-4198-8b1b-b842e219ee7e
      version: -1
      name: Retrieve IOCs file from Azure GitHub repository
      description: Sends http request. Returns the response as json.
      scriptName: http
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      method:
        simple: GET
      url:
        simple: https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Detections/MultipleDataSources/NOBELIUM_IOCsMay2021.yaml
    reputationcalc: 1
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 790,
          "y": -480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 951a9ee0-ff37-46e8-8e32-ce85411250ab
    type: regular
    task:
      id: 951a9ee0-ff37-46e8-8e32-ce85411250ab
      version: -1
      name: Retrieve Volexity blog
      description: This script will extract indicators from a given HTML and will handle bad top-level domains to avoid false positives caused by file extensions.
      scriptName: ParseHTMLIndicators
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      url:
        simple: https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 110,
          "y": -480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 6179d269-96f2-43bb-8320-5ff90d16cb7c
    type: title
    task:
      id: 6179d269-96f2-43bb-8320-5ff90d16cb7c
      version: -1
      name: Hunt Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
      - "9"
      - "14"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 394d0fc1-05b4-4879-87cf-fc592ea938a9
    type: regular
    task:
      id: 394d0fc1-05b4-4879-87cf-fc592ea938a9
      version: -1
      name: Extract IOCS from Volexity blog
      description: commands.local.cmd.extract.indicators
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      text:
        complex:
          root: http
          accessor: parsedBlog
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 110,
          "y": -305
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 0a26694f-dada-468d-8793-fc08ff10605c
    type: regular
    task:
      id: 0a26694f-dada-468d-8793-fc08ff10605c
      version: -1
      name: Extract IOCs from Azure GitHub repository
      description: commands.local.cmd.extract.indicators
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      text:
        complex:
          root: HttpRequest.Response
          accessor: Body
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 790,
          "y": -305
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: bb9f3fc7-49fb-4e9d-8865-f6ff81c0bfd6
    type: playbook
    task:
      id: bb9f3fc7-49fb-4e9d-8865-f6ff81c0bfd6
      version: -1
      name: Palo Alto Networks - Hunting And Threat Detection
      description: "This is a multipurpose playbook used for hunting and threat detection. The playbook receives inputs based on hashes, IP addresses, or domain names provided manually or from outputs by other playbooks. \nWith the received indicators, the playbook leverages data received by PANW products including, Cortex Data Lake, Autofocus and Pan-OS to search for IP addresses, host names and users related to the provided indicators.\nThe output provided by the playbook facilitates pivoting searches for possibly affected IP addresses or users."
      playbookName: Palo Alto Networks - Hunting And Threat Detection
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      IPAddresses:
        complex:
          root: ExtractedIndicators
          accessor: IP
          transformers:
          - operator: uniq
      MD5:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "32"
          transformers:
          - operator: uniq
      SHA1:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "40"
          transformers:
          - operator: uniq
      SHA256:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "64"
          transformers:
          - operator: uniq
      URLDomain:
        complex:
          root: ExtractedIndicators.Domain
          filters:
          - - operator: notContainsGeneral
              left:
                value:
                  simple: ExtractedIndicators.Domain
                iscontext: true
              right:
                value:
                  simple: microsoft.com
          - - operator: notContainsGeneral
              left:
                value:
                  simple: ExtractedIndicators.Domain
                iscontext: true
              right:
                value:
                  simple: github
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 117fb80b-418f-425c-8606-74d002beaa48
    type: title
    task:
      id: 117fb80b-418f-425c-8606-74d002beaa48
      version: -1
      name: SIEM Indicators Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
      - "12"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -470,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 2dbdcc23-532c-4fae-87ce-56c08434f460
    type: title
    task:
      id: 2dbdcc23-532c-4fae-87ce-56c08434f460
      version: -1
      name: Network Activity Indicators Hunt
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
      - "10"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: c607bf10-ed36-412c-82bd-cf299e415c15
    type: playbook
    task:
      id: c607bf10-ed36-412c-82bd-cf299e415c15
      version: -1
      name: Panorama Query Logs
      description: 'Query Panorama Logs of types: traffic, threat, url, data-filtering and wildfire.'
      playbookName: Panorama Query Logs
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      log_type:
        simple: threat
      query:
        simple: (threatid eq 86398)
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 680,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 0a00d050-c53a-4254-87e7-f0f914644f26
    type: playbook
    task:
      id: 0a00d050-c53a-4254-87e7-f0f914644f26
      version: -1
      name: QRadar Indicator Hunting V2
      description: 'This playbook queries QRadar SIEM for indicators such as file hashes, IP addresses, domains, or URLs. '
      playbookName: QRadar Indicator Hunting V2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      IPAddress:
        complex:
          root: ExtractedIndicators
          accessor: IP
          transformers:
          - operator: uniq
      InvestigationIPFields:
        simple: sourceip,destinationip
      InvestigationUserFields:
        simple: username
      MD5:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "32"
          transformers:
          - operator: uniq
      QradarIPfield:
        simple: sourceip,destinationip
      SHA1:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "40"
          transformers:
          - operator: uniq
      SHA256:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "64"
          transformers:
          - operator: uniq
      TimeFrame:
        simple: LAST 7 DAYS
      URLDomain:
        complex:
          root: ExtractedIndicators.Domain
          filters:
          - - operator: notContainsGeneral
              left:
                value:
                  simple: ExtractedIndicators.Domain
                iscontext: true
              right:
                value:
                  simple: github
          - - operator: notContainsGeneral
              left:
                value:
                  simple: ExtractedIndicators.Domain
                iscontext: true
              right:
                value:
                  simple: microsoft.com
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -240,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 08317731-c83c-4506-86ab-31e6cf87b8a3
    type: playbook
    task:
      id: 08317731-c83c-4506-86ab-31e6cf87b8a3
      version: -1
      name: Splunk Indicator Hunting
      description: This playbook queries Splunk for indicators such as file hashes, IP addresses, domains, or URLs. It outputs detected users, IP addresses, and hostnames related to the indicators.
      playbookName: Splunk Indicator Hunting
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      IPAddress:
        complex:
          root: ExtractedIndicators
          accessor: IP
          transformers:
          - operator: uniq
      IndexName:
        simple: '*'
      MD5:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "32"
          transformers:
          - operator: uniq
      SHA1:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "40"
          transformers:
          - operator: uniq
      SHA256:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "64"
          transformers:
          - operator: uniq
      SelectFields:
        simple: source,timestamp
      URLDomain:
        complex:
          root: ExtractedIndicators.Domain
          filters:
          - - operator: notContainsGeneral
              left:
                value:
                  simple: ExtractedIndicators.Domain
                iscontext: true
              right:
                value:
                  simple: github
          - - operator: notContainsGeneral
              left:
                value:
                  simple: ExtractedIndicators.Domain
                iscontext: true
              right:
                value:
                  simple: microsoft.com
          transformers:
          - operator: uniq
      earliest_time:
        simple: -1d
      event_limit:
        simple: "100"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -690,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 70d85026-7eea-479f-8623-813eb6c4b018
    type: regular
    task:
      id: 70d85026-7eea-479f-8623-813eb6c4b018
      version: -1
      name: Search XDR incidents related to NOBELIUM
      description: Searches Demisto incidents
      scriptName: SearchIncidentsV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      query:
        simple: 'xdralerts.name:"LOLBIN connecting to a rare host" '
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1800,
          "y": 1180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 0a0c6ec9-f2ec-4f4a-8b44-307f3bfbda35
    type: title
    task:
      id: 0a0c6ec9-f2ec-4f4a-8b44-307f3bfbda35
      version: -1
      name: Endpoints Activity Hunt
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
      - "16"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 8f352c1e-d41f-4029-895d-8b2f786cfba1
    type: playbook
    task:
      id: 8f352c1e-d41f-4029-895d-8b2f786cfba1
      version: -1
      name: Search Endpoints By Hash - Generic V2
      description: Hunt using available tools
      playbookName: Search Endpoints By Hash - Generic V2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      MD5Hash:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "32"
          transformers:
          - operator: uniq
      SHA1Hash:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "40"
          transformers:
          - operator: uniq
      SHA256Hash:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: "64"
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1150,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 2564a8d1-784c-4b23-8106-4c22862d05aa
    type: condition
    task:
      id: 2564a8d1-784c-4b23-8106-4c22862d05aa
      version: -1
      name: 'Is Cortex XDR enabled? '
      description: Checks if the Cortex XDR instance is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "17"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Cortex XDR - IR
                accessor: state
            iscontext: true
          right:
            value:
              simple: active
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1610,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 293396bd-67a7-47bc-895a-daad309237b3
    type: title
    task:
      id: 293396bd-67a7-47bc-895a-daad309237b3
      version: -1
      name: 'Advanced Hunting '
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
      - "19"
      - "20"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: addf90e4-dfca-4a98-8617-17b04b5c7403
    type: regular
    task:
      id: addf90e4-dfca-4a98-8617-17b04b5c7403
      version: -1
      name: Run YARA rules
      description: |-
        Volexity published YARA rule to detect the related malware.

        **You can find the YARA rule in their blog:**
        [Volexity blog](https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/)
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 910,
          "y": 1510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: c4cf0fb3-ad75-4f38-88d4-32905e7feba5
    type: regular
    task:
      id: c4cf0fb3-ad75-4f38-88d4-32905e7feba5
      version: -1
      name: Run Sigma rules
      description: |-
        Run Sigma rules to detected the related malicious activity:
        - [CobaltStrike Named Pipe](https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/sysmon_mal_cobaltstrike.yml)
        - [Suspicious Process Start Without DLL](https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_procs_req_dlls.yml)
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: c0ea601f-538a-405d-8d94-2da97de8cd17
    type: regular
    task:
      id: c0ea601f-538a-405d-8d94-2da97de8cd17
      version: -1
      name: Cortex XDR XQL queries
      description: |-
        Run related advanced XQL queries in Cortex XDR to find any malicious related activity.
        [Cortex XDR Hunting Blog](https://www.paloaltonetworks.com/blog/security-operations/hunting-for-apt29-spear-phishing-using-xdr/)
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -10,
          "y": 1510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 2bfc43de-1f8c-40a4-84a3-bd0b6ec1c249
    type: title
    task:
      id: 2bfc43de-1f8c-40a4-84a3-bd0b6ec1c249
      version: -1
      name: Malicious Email Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "22"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: b71f61c3-99d1-4b94-8da1-2b7fa36c465e
    type: condition
    task:
      id: b71f61c3-99d1-4b94-8da1-2b7fa36c465e
      version: -1
      name: Is EWS enabled?
      description: Checks if EWS integration enabled
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "23"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: EWS V2
                    ignorecase: true
                accessor: state
            iscontext: true
          right:
            value:
              simple: active
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: a84a2f29-7881-4d70-8f7b-bd8e5d731d3c
    type: regular
    task:
      id: a84a2f29-7881-4d70-8f7b-bd8e5d731d3c
      version: -1
      name: Search for emails from spoofed accounts
      description: Searches for items in the specified mailbox. Specific permissions are needed for this operation to search in a target mailbox other than the default.
      script: '|||ews-search-mailbox'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      query:
        complex:
          root: inputs.EWSSearchQuery
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 130,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 5f8afed1-7fa7-47bf-844b-bb31f324487a
    type: title
    task:
      id: 5f8afed1-7fa7-47bf-844b-bb31f324487a
      version: -1
      name: Block Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "26"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 12cc4d42-93b7-49ae-8c8d-2e9eca75680e
    type: condition
    task:
      id: 12cc4d42-93b7-49ae-8c8d-2e9eca75680e
      version: -1
      name: Block indicators automatically?
      description: Checks whether IOCs associated with the incident can be blocked automatically.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "35"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.BlockIndicatorsAutomatically
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 4af0be4b-2a44-438c-8579-ee068b63a1d6
    type: title
    task:
      id: 4af0be4b-2a44-438c-8579-ee068b63a1d6
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: d57ebdb3-079f-4bdf-838e-24773c30316d
    type: regular
    task:
      id: d57ebdb3-079f-4bdf-838e-24773c30316d
      version: -1
      name: Block indicators manually
      description: Manually block the IOCs in the relevant systems.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 710,
          "y": 2010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: bfcc9bc3-ba7c-41bd-890e-17700c270c58
    type: title
    task:
      id: bfcc9bc3-ba7c-41bd-890e-17700c270c58
      version: -1
      name: Tag Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "30"
      - "31"
      - "32"
      - "33"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 440,
          "y": -130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: e92b6ba2-4c59-44f9-895a-888c000c5bce
    type: regular
    task:
      id: e92b6ba2-4c59-44f9-895a-888c000c5bce
      version: -1
      name: Tag File indicators
      description: commands.local.cmd.set.indicators
      script: Builtin|||setIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "21"
    scriptarguments:
      indicatorsValues:
        complex:
          root: ExtractedIndicators
          accessor: File
          transformers:
          - operator: uniq
      tags:
        simple: NOBELIUM, APT29
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1150,
          "y": 20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 0096abb8-0558-41a4-8124-7e4a563b2f36
    type: regular
    task:
      id: 0096abb8-0558-41a4-8124-7e4a563b2f36
      version: -1
      name: Tag IP indicators
      description: commands.local.cmd.set.indicators
      script: Builtin|||setIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "21"
    scriptarguments:
      indicatorsValues:
        complex:
          root: ExtractedIndicators
          accessor: IP
          transformers:
          - operator: uniq
      tags:
        simple: NOBELIUM, APT29
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 690,
          "y": 20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: ed2b4e8b-7cc1-4ff7-8890-f9ff9fdb2c75
    type: regular
    task:
      id: ed2b4e8b-7cc1-4ff7-8890-f9ff9fdb2c75
      version: -1
      name: Tag Domain indicators
      description: commands.local.cmd.set.indicators
      script: Builtin|||setIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "21"
    scriptarguments:
      indicatorsValues:
        complex:
          root: ExtractedIndicators
          accessor: Domain
          transformers:
          - operator: uniq
      tags:
        simple: NOBELIUM, APT29
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 200,
          "y": 20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: af4e37fb-4077-4654-8258-587de5dd4139
    type: regular
    task:
      id: af4e37fb-4077-4654-8258-587de5dd4139
      version: -1
      name: Tag URL indicators
      description: commands.local.cmd.set.indicators
      script: Builtin|||setIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "21"
    scriptarguments:
      indicatorsValues:
        complex:
          root: ExtractedIndicators
          accessor: URL
          transformers:
          - operator: uniq
      tags:
        simple: NOBELIUM, APT29
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -250,
          "y": 20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 780a4e7d-b965-4a47-8066-c35417f39940
    type: playbook
    task:
      id: 780a4e7d-b965-4a47-8066-c35417f39940
      version: -1
      name: Block Indicators - Generic v3
      description: |+
        This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks:

        - Block URL - Generic v2
        - Block Account - Generic v2
        - Block IP - Generic v3
        - Block File - Generic v2
        - Block Email - Generic
        - Block Domain - Generic

      playbookName: Block Indicators - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "27"
    scriptarguments:
      AutoBlockIndicators:
        complex:
          root: inputs.AutoBlockIndicators
      AutoCommit:
        simple: "No"
      CustomBlockRule:
        simple: "True"
      CustomURLCategory:
        simple: XSOAR Remediation - Malicious URLs
      DomainToBlock:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: domain
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      EmailToBlock:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: email
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      FilesToBlock:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: file
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      IP:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: ip
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      InputEnrichment:
        simple: "False"
      MD5:
        complex:
          root: DBotScore
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: DBotScore.Indicator
                iscontext: true
              right:
                value:
                  simple: "32"
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: file
            - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: hash
          accessor: Indicator
          transformers:
          - operator: uniq
      RuleDirection:
        simple: outbound
      RuleName:
        simple: XSOAR - Block Indicators playbook - ${incident.id}
      SHA256:
        complex:
          root: DBotScore
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: DBotScore.Indicator
                iscontext: true
              right:
                value:
                  simple: "64"
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: file
            - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: hash
          accessor: Indicator
          transformers:
          - operator: uniq
      URL:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: url
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      UserVerification:
        complex:
          root: inputs.UserVerification
      Username:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: username
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 170,
          "y": 2010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "16_13_yes": 0.61,
      "16_17_#default#": 0.11
    },
    "paper": {
      "dimensions": {
        "height": 3015,
        "width": 2870,
        "x": -690,
        "y": -770
      }
    }
  }
inputs:
- key: EWSSearchQuery
  value:
    simple: From:*usaid.gov or From:*in.constantcontact.com
  required: false
  description: The EWS query to find malicious emails related to NOBELIUM spear-phishing.
  playbookInputQuery:
- key: BlockIndicatorsAutomatically
  value:
    simple: "False"
  required: false
  description: Whether to automatically indicators involved with NOBELIUM spear-phishing.
  playbookInputQuery:
- key: UserVerification
  value:
    simple: "False"
  required: false
  description: "Possible values: True/False.\nWhether to provide user verification for blocking IPs. \n\nFalse - No prompt will be displayed to the user.\nTrue - The server will ask the user for blocking verification and will display the blocking list."
  playbookInputQuery:
- key: AutoBlockIndicators
  value:
    simple: "True"
  required: false
  description: "|-
   
    Should the given indicators be automatically blocked, or should the user be given the option to choose?

    If set to True - no prompt will appear, and all provided indicators will be blocked automatically.
    If set to False - the user will be prompted to select which indicators to block."
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0