Proactive Threat Hunting - SDO Threat Hunting

This playbook will be executed when the analyst chooses to perform SDO hunting. The playbook receives an SDO type indicator and executes the following steps: - Searches IOCs related to the SDO indicator - IPs, Hashes, Domains, URLs. - Hunts for the found IOCs using the "Threat Hunting - Generic" sub-playbook. - Searches attack patterns that are related to the SDO indicator. - Searches LOLBAS tools that are related to the found attack patterns. - Hunts for LOLBin executions command-line arguments that are similar to LOLBAS malicious commands patterns.

Proactive Threat Hunting · 26 tasks · 4 inputs · 0 outputs

Inputs

  • SDOName — The SDO name.
  • SDOType — The SDO type.
  • HuntingTimeFrame — Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.
  • StringSimilarityThreshold — StringSimilarity automation threshold. StringSimilarity is being used in this playbook to compare between pattern of malicious use in a tool and command-line arguments found in the environment. Please provide number between 0 and 1, where 1 represents the most similar results of string comparisons. The automation will output only the results with a similarity score equal to or greater than the specified threshold.

Commands used

appendIndicatorField associateIndicatorsToIncident setIncident

Flowchart

yes yes yes yes yes yes yes Start Start Get SDO from TIM - SearchIndicator Get SDO from TIM SearchIndicator Choose Campaign to hunt Choose Campaign to hunt TIM - Indicator Relationships Analysis - TIM - Indicator Relationships Analysis TIM - Indicator Relations... TIM - Indicator Relationships... Done Done Threat Hunting - Generic - Threat Hunting - Generic Threat Hunting - Generic Threat Hunting - Generic Has SDO name input? Has SDO name input? Set chosen campaign to layout - associateIndicatorsToIncident Set chosen campaign to la... associateIndicatorsToIncident Add tags to indicators - appendIndicatorField Add tags to indicators appendIndicatorField Get attack pattern related tools - SearchIndicatorRelationships Get attack pattern relate... SearchIndicatorRelationships Search LOLBAS Tools By Name - Search LOLBAS Tools By Name Search LOLBAS Tools By Name Search LOLBAS Tools By Name Set Tools - setIncident Set Tools setIncident Set StringSimilarity Results To Layout - JsonToTable Set StringSimilarity Resu... JsonToTable Associate indicators to incident - associateIndicatorsToIncident Associate indicators to i... associateIndicatorsToIncident Has Related IOC's? Has Related IOC's? Suspicious Lolbin executions found? Suspicious Lolbin executi... Set SDO name - Set Set SDO name Set Print hunt executed message to notes - Print Print hunt executed messa... Print IOCs found? IOCs found? Set tag on IOCs found - appendIndicatorField Set tag on IOCs found appendIndicatorField Print Hunt Completed To Notes - Print Print Hunt Completed To N... Print Has Lotl tools? Has Lotl tools? Search and Compare Process Executions - Generic - Search and Compare Process Executions - Generic Search and Compare Proces... Search and Compare Process Ex... Set suspicious executions to layout - JsonToTable Set suspicious executions... JsonToTable Has related attack patterns? Has related attack patterns? Set no results found - setIncident Set no results found setIncident