Recorded Future Sandbox

Template playbook utilizing Hatching.io to sandbox a given file and generate an analysis report. Indicators from the given report are then extracted and enriched with Recorded Future data.

Recorded Future Intelligence · 26 tasks · 1 input · 5 outputs

Inputs

  • File —

Outputs

  • DBotScore — The DBotScore object.
  • DBotScore.Indicator — Triage analysis target
  • DBotScore.Type — The indicator type - File or URL
  • DBotScore.Vendor — The integration used to generate the indicator
  • DBotScore.Score — Analysis verdict as score from 1 to 10

Commands used

domain extractIndicators ip recordedfuture-malware-search triage-get-report-triage triage-get-sample-summary triage-get-static-report triage-submit-sample url

Flowchart

yes yes yes yes behavioral1 static yes yes yes Start Start Get Report (behavioral1) - triage-get-report-triage Get Report (behavioral1) triage-get-report-triage Extract Indicators from Report - extractIndicators Extract Indicators from R... extractIndicators Recorded Future IP Enrich - ip Recorded Future IP Enrich ip Submit File Sample - triage-submit-sample Submit File Sample triage-submit-sample Recorded Future Malware Lookup - recordedfuture-malware-search Recorded Future Malware L... recordedfuture-malware-search Recorded Future Domain Enrich - domain Recorded Future Domain En... domain Is there a domain? Is there a domain? Is there an ip? Is there an ip? Is there a malware family? Is there a malware family? Done Done Is there a URL? Is there a URL? Recorded Future URL Enrich - url Recorded Future URL Enrich url GenericPolling - GenericPolling GenericPolling GenericPolling Get Sample Summary - triage-get-sample-summary Get Sample Summary triage-get-sample-summary Get Report (static) - triage-get-static-report Get Report (static) triage-get-static-report Get Report (behavioral2) - triage-get-report-triage Get Report (behavioral2) triage-get-report-triage Choose Report Type Choose Report Type Which Report Type? Which Report Type? Extract Indicators from Report - extractIndicators Extract Indicators from R... extractIndicators Is there a domain? Is there a domain? Is there an ip? Is there an ip? Is there a URL? Is there a URL? Recorded Future Domain Enrich - domain Recorded Future Domain En... domain Recorded Future IP Enrich - ip Recorded Future IP Enrich ip Recorded Future URL Enrich - url Recorded Future URL Enrich url