PCAP File Carving

id: PCAP File Carving
version: -1
name: PCAP File Carving
description: This playbook is used to carve (extract) files from within PCAP files
  and perform enrichment and detonation of the extracted files. Supported PCAP file
  types are pcap, cap, pcapng. The playbook can handle one PCAP file per incident.
  Additional inputs allow the user to provide the WPA password for decrypting 802.11
  (wireless) traffic and adding an RSA certificate to decrypt SSL traffic. Additional
  options enable you to filter the files to extract according to the file extension
  or the actual file  type (MIME), and limit the amount of files to extract. Another
  feature enables you to specify a filter to create a new smaller PCAP file. To display
  the results within the relevant incident fields, the playbook needs to run in a
  PCAP Analysis incident type. For handling of PCAP files larger than 30 MB, refer
  to the PcapMinerV2 documentation.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: d34edaf4-9576-4e34-8570-778feb4741d3
    type: start
    task:
      id: d34edaf4-9576-4e34-8570-778feb4741d3
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1320,
          "y": -220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: f9e8cf57-36d2-4687-8180-0423479209d4
    type: condition
    task:
      id: f9e8cf57-36d2-4687-8180-0423479209d4
      version: -1
      name: Is there a PCAP file?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "56"
      "yes":
      - "100"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.PcapFileEntryID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1320,
          "y": -70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "56":
    id: "56"
    taskid: 86e513d1-6b86-4765-8758-46318c454083
    type: title
    task:
      id: 86e513d1-6b86-4765-8758-46318c454083
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1320,
          "y": 1920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "99":
    id: "99"
    taskid: 6df00a2f-2ec0-48f9-885e-d82c9d0b41a0
    type: regular
    task:
      id: 6df00a2f-2ec0-48f9-885e-d82c9d0b41a0
      version: -1
      name: Create new PCAP file with filter
      description: |-
        PcapMIner V2 allows you to parse PCAP files by displaying all of the relevant data within ip addresses, ports, flows, specific protocol breakdown, searching by regex, decrypting encrypted, traffic and more.
        This automation takes about a minute to process 20,000 packets (which is approximately 10MB). If you want to mine larger files you can either:
        a) Use the `pcap_filter` parameter to filter your PCAP file and thus make is smaller.
        b) Copy the automation and change the `default timeout` parameter to match your needs.
      scriptName: PcapMinerV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "102"
    scriptarguments:
      entry_id:
        simple: ${inputs.PcapFileEntryID}
      extract_ips:
        simple: "True"
      filtered_file_name:
        simple: filtered.pcap
      pcap_filter:
        simple: ${inputs.PcapFilter}
      rsa_decrypt_key_entry_id:
        simple: ${inputs.RsaDecryptKeyEntryID}
      wpa_password:
        simple: ${inputs.WpaPassword}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "100":
    id: "100"
    taskid: 5e3ed6c6-aab5-4184-8532-ee3e01440dca
    type: condition
    task:
      id: 5e3ed6c6-aab5-4184-8532-ee3e01440dca
      version: -1
      name: Is there a PCAP filter?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "101"
      "yes":
      - "99"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.PcapFilter
            iscontext: true
    view: |-
      {
        "position": {
          "x": 740,
          "y": 100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "101":
    id: "101"
    taskid: 81f8c86a-a72a-401f-842b-e667a6100c7c
    type: regular
    task:
      id: 81f8c86a-a72a-401f-842b-e667a6100c7c
      version: -1
      name: Carve files from unfiltered PCAP
      description: This automation extracts all possible files from a PCAP file.
      tags:
      - carved_pcap_file
      scriptName: PcapFileExtractor
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "109"
    scriptarguments:
      entry_id:
        simple: ${inputs.PcapFileEntryID}
      extensions:
        simple: ${inputs.FileExtensionFilter}
      inclusive_or_exclusive:
        simple: ${inputs.FileTypeFilter}
      limit:
        simple: ${inputs.ExtractedFilesLimit}
      rsa_decrypt_key_entry_id:
        simple: ${inputs.RsaDecryptKeyEntryID}
      types:
        simple: ${inputs.FileTypeFilter}
      wpa_password:
        simple: ${inputs.WpaPassword}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 990,
          "y": 270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "102":
    id: "102"
    taskid: b2f4144b-6457-475a-8e03-5b18fb7cbe08
    type: regular
    task:
      id: b2f4144b-6457-475a-8e03-5b18fb7cbe08
      version: -1
      name: Carve files from filtered PCAP
      description: This automation extracts all possible files from a PCAP file.
      tags:
      - carved_pcap_file
      scriptName: PcapFileExtractor
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "109"
    scriptarguments:
      entry_id:
        complex:
          root: File
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: File.Name
                iscontext: true
              right:
                value:
                  simple: filtered.pcap
          accessor: EntryID
      extensions:
        simple: ${inputs.FileExtensionFilter}
      inclusive_or_exclusive:
        simple: ${inputs.FilterType}
      limit:
        simple: ${inputs.ExtractedFilesLimit}
      rsa_decrypt_key_entry_id:
        simple: ${inputs.RsaDecryptKeyEntryID}
      types:
        simple: ${inputs.FileTypeFilter}
      wpa_password:
        simple: ${inputs.WpaPassword}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "104":
    id: "104"
    taskid: 5d9d20d5-9013-4609-8890-7f649f0bebc9
    type: playbook
    task:
      id: 5d9d20d5-9013-4609-8890-7f649f0bebc9
      version: -1
      name: Detonate File - Generic
      description: Detonate file through active integrations that support file detonation
      playbookName: Detonate File - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "56"
    scriptarguments:
      EntryID:
        complex:
          root: File
          filters:
          - - operator: in
              left:
                value:
                  simple: File.SHA256
                iscontext: true
              right:
                value:
                  simple: Sha256ToCheck
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: File.EntryID
                iscontext: true
          accessor: EntryID
      File:
        complex:
          root: File
          filters:
          - - operator: inList
              left:
                value:
                  simple: File.SHA256
                iscontext: true
              right:
                value:
                  simple: Sha256ToCheck
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: File.EntryID
                iscontext: true
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 790,
          "y": 1740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "105":
    id: "105"
    taskid: f313e02b-5f5c-46a6-84ff-5ffcc2f86839
    type: condition
    task:
      id: f313e02b-5f5c-46a6-84ff-5ffcc2f86839
      version: -1
      name: Are there files that don't have a good DBot score?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "56"
      "yes":
      - "107"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEqualNumber
          left:
            value:
              simple: DBotScore.Score
            iscontext: true
          right:
            value:
              simple: "1"
    view: |-
      {
        "position": {
          "x": 990,
          "y": 1400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "106":
    id: "106"
    taskid: 63bfd363-2b83-4111-8f5f-35f33b665c8d
    type: regular
    task:
      id: 63bfd363-2b83-4111-8f5f-35f33b665c8d
      version: -1
      name: Enrich extracted files
      description: Get a quick indicator of the risk associated with a file.
      script: '|||file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "108"
    scriptarguments:
      execution-timeout:
        simple: "30"
      file:
        complex:
          root: PcapExtractedFiles
          accessor: FileSHA256
          transformers:
          - operator: uniq
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 990,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "107":
    id: "107"
    taskid: d6a3868a-a875-46c6-81b0-316e7e46756c
    type: regular
    task:
      id: d6a3868a-a875-46c6-81b0-316e7e46756c
      version: -1
      name: Set SHA256 to check
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "104"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Sha256ToCheck
      value:
        complex:
          root: DBotScore
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: DBotScore.Indicator
                iscontext: true
              right:
                value:
                  simple: "64"
          - - operator: isNotEqualString
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "1"
          - - operator: inList
              left:
                value:
                  simple: DBotScore.Indicator
                iscontext: true
              right:
                value:
                  simple: PcapExtractedFiles.FileSHA256
                iscontext: true
          accessor: Indicator
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 790,
          "y": 1570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "108":
    id: "108"
    taskid: 1fa894ad-c94c-41a5-8525-9918e807ab45
    type: condition
    task:
      id: 1fa894ad-c94c-41a5-8525-9918e807ab45
      version: -1
      name: Auto detonate files?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "56"
      "yes":
      - "105"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoDetonateFiles
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 990,
          "y": 1160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "109":
    id: "109"
    taskid: 55096f3d-649a-4fae-8b96-fcfdba886bf1
    type: condition
    task:
      id: 55096f3d-649a-4fae-8b96-fcfdba886bf1
      version: -1
      name: Auto enrich files?
      description: Checks whether to enrich the files extracted from the PCAP automatically.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "56"
      "yes":
      - "106"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoEnrichFiles
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 990,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "105_56_#default#": 0.28,
      "108_105_yes": 0.52,
      "108_56_#default#": 0.17,
      "109_106_yes": 0.51,
      "109_56_#default#": 0.12,
      "2_56_#default#": 0.1
    },
    "paper": {
      "dimensions": {
        "height": 2205,
        "width": 1210,
        "x": 490,
        "y": -220
      }
    }
  }
inputs:
- key: RsaDecryptKeyEntryID
  value:
    complex:
      root: File
      filters:
      - - operator: inList
          left:
            value:
              simple: File.Name
            iscontext: true
          right:
            value:
              simple: incident.pcapencryptionkey.name
            iscontext: true
        - operator: isEqualString
          left:
            value:
              simple: File.Extension
            iscontext: true
          right:
            value:
              simple: key
      accessor: EntryID
  required: false
  description: This input specifies the file entry id for the RSA decrypt key if the
    user provided the key in the incident.
  playbookInputQuery:
- key: PcapFileEntryID
  value:
    complex:
      root: File
      filters:
      - - operator: inList
          left:
            value:
              simple: File.Name
            iscontext: true
          right:
            value:
              simple: incident.pcapfile.name
            iscontext: true
        - operator: isEqualString
          left:
            value:
              simple: File.Extension
            iscontext: true
          right:
            value:
              simple: pcap
        - operator: isEqualString
          left:
            value:
              simple: File.Extension
            iscontext: true
          right:
            value:
              simple: cap
        - operator: isEqualString
          left:
            value:
              simple: File.Extension
            iscontext: true
          right:
            value:
              simple: pcapng
      accessor: EntryID
  required: false
  description: This input specifies the file entry id for the PCAP file if the user
    provided the file in the incident. One PCAP file can run per incident.
  playbookInputQuery:
- key: WpaPassword
  value: {}
  required: false
  description: This input value is used to provide a WPA (Wi-Fi Protected Access)
    password to decrypt encrypted 802.11 Wi-FI traffic.
  playbookInputQuery:
- key: PcapFilter
  value: {}
  required: false
  description: |-
    This input specifies a search filter to be used on the PCAP file. Filters can be used to search only for a specific IP, protocols and other examples. The syntax is the same as in Wireshark which can be found here: https://www.wireshark.org/docs/man-pages/wireshark-filter.html
    For this playbook, using a PCAP filter will generate a new smaller PCAP file based on the provided filter therefor thus reducing the extraction of non relevant files.
  playbookInputQuery:
- key: ExtractedFilesLimit
  value:
    simple: "5"
  required: false
  description: This input limits the number of files to be extracted from the PCAP
    file. Default value is 5.
  playbookInputQuery:
- key: FileExtensionFilter
  value: {}
  required: false
  description: |-
    This input is used to select which file extensions to include or exclude from the PCAP file. Extensions must be comma separated, for example, png,gif,exe.
    This setting cannot be used with the FileTypeFilter.
  playbookInputQuery:
- key: FileTypeFilter
  value: {}
  required: false
  description: |-
    This input is used to select which file type (MIME type) to include or exclude from the PCAP file. Extensions must be comma separated, for example, image/jpeg,application/x-javascript
    This setting cannot be used with the FileExtensionFilter.
  playbookInputQuery:
- key: FilterType
  value:
    simple: inclusive
  required: false
  description: |-
    This input is combined with the FileExtensionFilter input or the FileTypeFilter input. It specifies if the type/extensions list is inclusive or exclusive. Can be "inclusive" or "exclusive". Default is "inclusive".
    Default value is 'inclusive'
  playbookInputQuery:
- key: AutoDetonateFiles
  value:
    simple: "True"
  required: false
  description: This input specifies whether to detonate files extracted from the PCAP.
    The default value is True. Any other value will be considered as false.
  playbookInputQuery:
- key: AutoEnrichFiles
  value:
    simple: "True"
  required: false
  description: This input specifies whether to enrich files extracted from the PCAP.
    The default value is True. Any other value will be considered as false.
  playbookInputQuery:
outputs:
- contextPath: DBotScore
  description: The DBotScore object.
  type: string
- contextPath: File
  description: The file object
  type: string
- contextPath: File.Malicious
  description: The File malicious description
  type: string
- contextPath: File.Size
  description: The file size.
  type: string
- contextPath: File.MD5
  description: The file MD5 hash.
  type: string
- contextPath: File.SHA1
  description: The file SHA1 hash.
  type: string
- contextPath: File.SHA256
  description: The file SHA256 hash.
  type: string
- contextPath: File.SHA512
  description: The file SHA512 hash.
  type: string
- contextPath: File.Name
  description: The file name.
  type: string
- contextPath: File.SSDeep
  description: The file SSDeep.
  type: string
- contextPath: File.EntryID
  description: The file entry ID.
  type: string
- contextPath: File.Info
  description: The file information.
  type: string
- contextPath: File.Type
  description: The file type.
  type: string
- contextPath: File.Extension
  description: The file extension.
  type: string
tests:
- PCAP File Carving Test
fromversion: 5.0.0