Possible External RDP Brute-Force

This playbook investigates a “Possible External RDP Brute Force” XDR Alert by gathering user, IP, and hostname information, and investigating if the following suspicious elements exists: - "IP Reputation" - DBot Score is 2-3 - "Source geolocation" - RDP Connection made from rare geo-location - Related to campaign - IP address is related to campaign, based on TIM module - Hunting results - the hunt for indicators related to the source IP and the related campaign returned results - XDR Alert search - XDR Alerts that related to the same username and endpoint, and to the MITRE tactics that comes after "Credential Access", were found. - Risky User - The user that was identified in the attack was given a medium or high score by the Core integration's ITDR module. - Risky Host - The destination host that was identified in the attack was given a medium or high score by the Core integration's ITDR module. Set verdict method: * Critical Element - The "Critical Element" input allows you to select a specific element that, if identified as suspicious, the investigation's final verdict will be deemed a "True Positive". * Final Verdict - Each suspicious element is being added to an array called "Suspicious Elements", which is used to count potential security threats. The array size will be compared to a final threshold. If the size is greater than or equal to the threshold, the investigation's final verdict will be deemed a "True Positive". * User Engagement - The "UserEngagementThreshold" input allows you to set the number of suspicious elements that trigger user engagement. When this threshold is met, an email will be sent to the user and their manager asking for authorization of RDP activity. If the RDP activity is not authorized by the user, the investigation's final verdict will be deemed a "True Positive".

Core · 51 tasks · 12 inputs · 0 outputs

Details

ID	`Possible External RDP Brute-Force`
From Version	6.8.0
Tasks	51

README

This playbook investigates a “Possible External RDP Brute Force” XDR Alert by gathering user, IP, and hostname information, and investigating if the following suspicious elements exists:

“IP Reputation” - DBot Score is 2-3
“Source geolocation” - RDP Connection made from rare geo-location
Related to campaign - IP address is related to campaign, based on TIM module
Hunting results - the hunt for indicators related to the source IP and the related campaign returned results
XDR Alert search - XDR Alerts that related to the same username and endpoint, and to the MITRE tactics that comes after “Credential Access”, were found.
Risky User - The user that was identified in the attack was given a medium or high score by the Core integration’s ITDR module.
Risky Host - The destination host that was identified in the attack was given a medium or high score by the Core integration’s ITDR module.

Set verdict method:

Critical Element - The “Critical Element” input allows you to select a specific element that, if identified as suspicious, the investigation’s final verdict will be deemed a “True Positive”.
Final Verdict - Each suspicious element is being added to an array called “Suspicious Elements”, which is used to count potential security threats. The array size will be compared to a final threshold. If the size is greater than or equal to the threshold, the investigation’s final verdict will be deemed a “True Positive”.
User Engagement - The “UserEngagementThreshold” input allows you to set the number of suspicious elements that trigger user engagement. When this threshold is met, an email will be sent to the user and their manager asking for authorization of RDP activity. If the RDP activity is not authorized by the user, the investigation’s final verdict will be deemed a “True Positive”.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Block Indicators - Generic v3
Threat Hunting - Generic
Get entity alerts by MITRE tactics
TIM - Indicator Relationships Analysis
Endpoint Enrichment - Generic v2.1
Possible External RDP Brute-Force - Set Verdict
Account Enrichment - Generic v2.1
User Investigation - Generic

Integrations

CoreIOCs
CortexCoreIR

Scripts

Set
IsIntegrationAvailable

Commands

core-isolate-endpoint
ip
ad-expire-password
setIncident

Playbook Inputs

Name	Description	Default Value	Required
Username	RDP connection username.	alert.username	Optional
ExternalIP	Source external IP address.	alert.localip	Optional
AutoRemediation	Set this value to “true” to enable auto remediation (IP Block and User Block).	false	Optional
FinalThreshold	The threshold number of suspicious elements required to determine a ‘True Positive’ verdict.	2	Optional
CriticalElement	You can select a specific element that, if identified as suspicious, will automatically set the final verdict as true positive. The following options are available: IP Reputation Related Campaign Hunting Results Related Alerts Unusual Country Risky User Risky Host NOTE: You can read about the meaning of every element in the playbook description.		Optional
UserEngagementThreshold	The threshold number of suspicious elements that will trigger a user engagement. Set 0 to disable user engagement. NOTICE: If this threshold is equal to or higher than “FinalThreshold”, the final verdict will be deemed by the user response and not by the FinalThreshold calculation.	1	Optional
Hostname	RDP connection destination hostname.	alert.hostname	Optional
EndpointID	RDP connection destination endpoint ID.	alert.agentid	Optional
Country	Source external IP country.	alert.country	Optional
IsolateEndpoint	Set this value to “true” to enable endpoint isolation in case of a true positive.	false	Optional
SOCEmailAddress	The SOC email address to use for the user engagement section.		Optional
EarlyContainment	Set this value to “true” to allow early containment when the IP is known malicious	true	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Possible External RDP Brute-Force

Inputs

Username — RDP connection username.
ExternalIP — Source external IP address.
AutoRemediation — Set this value to "true" to enable auto remediation (IP Block and User Block).
FinalThreshold — The threshold number of suspicious elements required to determine a 'True Positive' verdict.
CriticalElement — You can select a specific element that, if identified as suspicious, will automatically set the final verdict as true positive. The following options are available: IP Reputation Related Campaign Hunting Results Related Alerts Unusual Country Risky User Risky Host NOTE: You can read about the meaning of every element in the playbook description.
UserEngagementThreshold — The threshold number of suspicious elements that will trigger a user engagement. Set 0 to disable user engagement. NOTICE: If this threshold is equal to or higher than "FinalThreshold", the final verdict will be deemed by the user response and not by the FinalThreshold calculation.
Hostname — RDP connection destination hostname.
EndpointID — RDP connection destination endpoint ID.
Country — Source external IP country.
IsolateEndpoint — Set this value to "true" to enable endpoint isolation in case of a true positive.
SOCEmailAddress — The SOC email address to use for the user engagement section.
EarlyContainment — Set this value to "true" to allow early containment when the IP is known malicious

Commands used

ad-expire-password core-isolate-endpoint ip setIncident

Flowchart

Source

playbook-Possible_External_RDP_Brute-Force.yml playbook-Possible_External_RDP_Brute-Force_-_Set_Verdict.yml playbook-Possible_External_RDP_Brute-Force_-_Set_Verdict_README.md

Download History Raw

id: Possible External RDP Brute-Force - Set Verdict
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Possible External RDP Brute-Force - Set Verdict
description: "This playbook creating an array called \"Suspicious Elements\", which is used to count potential security threats. The following elements can be added to the array:\n\n- \"IP Reputation\" - DBot Score is 2-3 \n- \"Source geolocation\" - RDP Connection made from rare geo-location \n-  Related to campaign - IP address is related to campaign, based on TIM module\n-  Hunting results - the hunt for indicators related to the source IP and the related campaign returned results\n-  XDR Alert search - XDR Alerts that related to the same username and endpoint, and to the MITRE tactics that comes after \"Credential Access\", were found.\n- Risky User - one or more risky users are involved in the incident, as identified by the Cortex Core - IR integration's ITDR module.\n- Risky Host - one or more risky hosts are involved in the incident, as identified by the Cortex Core - IR integration's ITDR module.\n\nThe array will then be outputted and its size will be compared to a final threshold. If the size is greater than or equal to the threshold, the investigation's final verdict will be deemed a \"True Positive.\""
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 446f9247-e57a-430f-8aeb-02d0e5f53cae
    type: start
    task:
      id: 446f9247-e57a-430f-8aeb-02d0e5f53cae
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
      - "4"
      - "1"
      - "2"
      - "10"
      - "12"
      - "13"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 56055fa9-a5d2-4c5a-8f16-fa9f84262480
    type: condition
    task:
      id: 56055fa9-a5d2-4c5a-8f16-fa9f84262480
      version: -1
      name: Related to specific campaign?
      description: Check if a related campaign exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.RelatedCampaign
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 30,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: f92cdec9-e639-463f-8b27-90e97920209e
    type: condition
    task:
      id: f92cdec9-e639-463f-8b27-90e97920209e
      version: -1
      name: Has Hunting Results?
      description: Check if hunting results exist.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.HuntResults
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: d82ac18e-cec4-486a-8fca-9e877d3a1e37
    type: condition
    task:
      id: d82ac18e-cec4-486a-8fca-9e877d3a1e37
      version: -1
      name: Has related alerts?
      description: Check if XDR related alerts exist.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.RelatedAlerts
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 880,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: d3816b97-2a2f-4539-83ee-af6592faad20
    type: condition
    task:
      id: d3816b97-2a2f-4539-83ee-af6592faad20
      version: -1
      name: Connection from unusual country?
      description: Check if the connection was made from an unusual country.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.UnusualGeoLocation
            iscontext: true
          right:
            value:
              simple: "false"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1300,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 5408731d-6b13-46de-8490-f196f1890360
    type: regular
    task:
      id: 5408731d-6b13-46de-8490-f196f1890360
      version: -1
      name: Set unusual country
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: Unusual Country
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1300,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Source Geolocation
      output:
        simple: Connection from unusual country
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: bc3eca1f-c99b-4630-884d-9e573739a061
    type: regular
    task:
      id: bc3eca1f-c99b-4630-884d-9e573739a061
      version: -1
      name: Set related alerts
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: Related Alerts
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 880,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Alert Search Results
      output:
        complex:
          root: inputs.RelatedAlerts
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 0e017a52-2083-4c77-8f32-542c271a1761
    type: regular
    task:
      id: 0e017a52-2083-4c77-8f32-542c271a1761
      version: -1
      name: Set hunting results
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: Hunting Results
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Hunt Results Count
      output:
        simple: Has campaign hunt results
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 0cfadcf4-e302-4714-8cdf-c22fe1640354
    type: regular
    task:
      id: 0cfadcf4-e302-4714-8cdf-c22fe1640354
      version: -1
      name: Set campaign
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: Related Campaign
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 30,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Part of Campaign
      output:
        complex:
          root: inputs.RelatedCampaign
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: d18b4c9c-408b-4155-8a49-c07e400508b3
    type: title
    task:
      id: d18b4c9c-408b-4155-8a49-c07e400508b3
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 8e87df54-e1ee-4dcb-8911-0da0077e8b65
    type: condition
    task:
      id: 8e87df54-e1ee-4dcb-8911-0da0077e8b65
      version: -1
      name: IP Reputation is suspicious?
      description: Check if the IP reputation is suspicious or higher.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: inputs.IpReputation
            iscontext: true
          right:
            value:
              simple: "2"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -390,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 2820bf44-fc60-4781-84ef-fe725a1b3628
    type: regular
    task:
      id: 2820bf44-fc60-4781-84ef-fe725a1b3628
      version: -1
      name: Set IP Reputation
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: IP Reputation
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -390,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 16c9bbda-5247-47c2-81d5-2909757ab287
    type: condition
    task:
      id: 16c9bbda-5247-47c2-81d5-2909757ab287
      version: -1
      name: Risky user involved?
      description: Checks if a risky user is involved in the incident.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.RiskyUser
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -800,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 03fb3ebe-d5d6-4695-81d2-5ceab496655b
    type: condition
    task:
      id: 03fb3ebe-d5d6-4695-81d2-5ceab496655b
      version: -1
      name: Risky host involved?
      description: Checks if a risky user is involved in the incident.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.RiskyHost
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1210,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: f480c89c-1647-44ec-8e9e-d1af77bcb52e
    type: regular
    task:
      id: f480c89c-1647-44ec-8e9e-d1af77bcb52e
      version: -1
      name: Add risky user to suspicious elements
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: Risky User
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -800,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 93f3be3f-29e0-499f-8cc3-ac8fb5e8fa06
    type: regular
    task:
      id: 93f3be3f-29e0-499f-8cc3-ac8fb5e8fa06
      version: -1
      name: Add risky host to suspicious elements
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: Risky Host
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1210,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "10_9_#default#": 0.28,
      "3_9_#default#": 0.19,
      "4_9_#default#": 0.2
    },
    "paper": {
      "dimensions": {
        "height": 535,
        "width": 2890,
        "x": -1210,
        "y": 50
      }
    }
  }
inputs:
- key: RelatedAlerts
  value: {}
  required: false
  description: Number of XDR alerts that are related to the same user or endpoint.
  playbookInputQuery:
- key: RelatedCampaign
  value: {}
  required: false
  description: Campaign related to the external IP.
  playbookInputQuery:
- key: HuntResults
  value: {}
  required: false
  description: Determine whether hunting results exist. The input value should be true or false.
  playbookInputQuery:
- key: UnusualGeoLocation
  value: {}
  required: false
  description: ' determine whether the RDP connection has made RDP Connection made from rare geo-location. the input value should be true or false.'
  playbookInputQuery:
- key: IpReputation
  value: {}
  required: false
  description: The external IP reputation.
  playbookInputQuery:
- key: RiskyUser
  value:
    complex:
      root: Core.RiskyUser
      filters:
      - - operator: isEqualString
          left:
            value:
              simple: Core.RiskyUser.risk_level
            iscontext: true
          right:
            value:
              simple: MED
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              simple: Core.RiskyUser.risk_level
            iscontext: true
          right:
            value:
              simple: HIGH
          ignorecase: true
      accessor: id
  required: false
  description: Usernames of users that were found as risky by Cortex Core IR.
  playbookInputQuery:
- key: RiskyHost
  value:
    complex:
      root: Core.RiskyHost
      filters:
      - - operator: isEqualString
          left:
            value:
              simple: Core.RiskyHost.risk_level
            iscontext: true
          right:
            value:
              simple: MED
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              simple: Core.RiskyHost.risk_level
            iscontext: true
          right:
            value:
              simple: HIGH
          ignorecase: true
      accessor: id
  required: false
  description: Hostnames that were found as risky by Cortex Core IR.
  playbookInputQuery:
outputs:
- contextPath: Suspicious_Elements
  description: Array that contains all the suspicious elements.
  type: unknown
tests:
- No tests (auto formatted)
marketplaces:
- marketplacev2
- platform
fromversion: 6.8.0
system: true


supportedModules:
- agentix
- cloud
- cloud_posture
- cloud_runtime_security
- edr
- xsiam