SolarStorm and SUNBURST Hunting and Response Playbook
This playbook does the following: - Collect indicators to aid in your threat hunting process. - Retrieve IOCs of SUNBURST (a trojanized version of the SolarWinds Orion plugin). - Retrieve C2 domains and URLs associated with Sunburst. - Discover IOCs of associated activity related to the infection. - Generate an indicator list to block indicators with SUNBURST tags. - Hunt for the SUNBURST backdoor - Query firewall logs to detect network activity. - Search endpoint logs for Sunburst hashes to detect presence on hosts. If compromised hosts are found: - Notify security team to review and trigger remediation response actions. - Run sub-playbooks to isolate/quarantine infected hosts/endpoints and await further actions from the security team. Sources: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html https://unit42.paloaltonetworks.com/fireeye-solarstorm-sunburst/3/ https://www.splunk.com/en_us/blog/security/sunburst-backdoor-detections-in-splunk.html
Rapid Breach Response · 73 tasks · 11 inputs · 0 outputs
Details
| ID | SolarStorm and SUNBURST Hunting and Response Playbook |
|---|---|
| From Version | 6.0.0 |
| To Version | 6.4.9 |
| Tasks | 73 |
README
This playbook does the following:
- Collect indicators to aid in your threat hunting process.
- Retrieve IOCs of SUNBURST (a trojanized version of the SolarWinds Orion plugin).
- Retrieve C2 domains and URLs associated with Sunburst.
- Discover IOCs of associated activity related to the infection.
- Generate an indicator list to block indicators with SUNBURST tags.
- Hunt for the SUNBURST backdoor
- Query firewall logs to detect network activity.
- Search endpoint logs for Sunburst hashes to detect presence on hosts.
If compromised hosts are found:
- Notify security team to review and trigger remediation response actions.
- Run sub-playbooks to isolate/quarantine infected hosts/endpoints and await further actions from the security team.
Sources:
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
https://unit42.paloaltonetworks.com/fireeye-solarstorm-sunburst/3/
https://www.splunk.com/en_us/blog/security/sunburst-backdoor-detections-in-splunk.html
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
- Panorama search thread-ids in threat logs
- CVE Enrichment - Generic v2
- SolarStorm Activity Behavior Hunting playbook
- Palo Alto Networks - Hunting And Threat Detection
- Search Endpoint by CVE - Generic
- Office 365 and Azure Configuration Analysis
- Isolate Endpoint - Generic V2
- Block IP - Generic v3
- Block Indicators - Generic v2
- Search Endpoints By Hash - Generic V2
- Office 365 and Azure Hunting
- Panorama search SolarWinds App-IDs traffic logs
Integrations
This playbook does not use any integrations.
Scripts
- http
- CreateIndicatorsFromSTIX
- UnEscapeURLs
- UnEscapeIPs
- FileCreateAndUpload
- SearchIncidentsV2
Commands
- appendIndicatorField
- closeInvestigation
- extractIndicators
- expanse-get-issues
- createNewIndicator
Playbook Inputs
| Name | Description | Default Value | Required |
|---|---|---|---|
| IsolateEndpointAutomatically | Whether to automatically isolate endpoints, or opt for manual user approval. True means isolation will be done automatically. | False | Optional |
| BlockIndicatorsAutomatically | Whether to automatically indicators involved with SolarStorm. | False | Optional |
| CVEs | CVEs related to SUNBURST and SolarStorm. | CVE-2020-14005,CVE-2020-13169 | Optional |
| SunBurstSTIX | Hard-coded STIX file of SUNBURST and SolarStorm indicators. | {“id”:”bundle–60aab587-660c-4b58-89d0-efcf9cbdf8dd”,”type”:”bundle”,”spec_version”:”2.0”,”objects”:[{“created”:”2020-12-17T16:50:49.000Z”,”id”:”indicator–180de847-a4c8-4e76-b719-138ac9c9b58e”,”labels”:[“file sha-256”],”modified”:”2020-12-17T16:50:49.000Z”,”pattern”:”[file:hashes.sha256 = ‘019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.12709Z”},{“created”:”2020-12-17T16:51:42.000Z”,”id”:”indicator–8d217031-22f6-4d86-bd42-0519032d93bc”,”labels”:[“file sha-256”],”modified”:”2020-12-17T16:51:42.000Z”,”pattern”:”[file:hashes.sha256 = ‘439bcd0a17d53837bc29fb51c0abd9d52a747227f97133f8ad794d9cc0ef191e’]”,”score”:”Medium”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.144865Z”},{“created”:”2020-12-17T16:58:27.000Z”,”id”:”indicator–ff3c830a-dbe2-45ec-bfbc-dd357ae040fc”,”labels”:[“domain”],”modified”:”2020-12-17T16:58:27.000Z”,”pattern”:”[domain-name:value = ‘thedoccloud.com’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.146129Z”},{“created”:”2020-12-17T16:52:06.000Z”,”id”:”indicator–514f2faf-9572-44e3-8f67-ea782206335f”,”labels”:[“file sha-256”],”modified”:”2020-12-17T16:52:06.000Z”,”pattern”:”[file:hashes.sha256 = ‘a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.149043Z”},{“created”:”2020-12-17T16:50:28.000Z”,”id”:”indicator–2e3e39c2-757d-496f-82b1-a715e44fb682”,”labels”:[“file sha-256”],”modified”:”2020-12-17T16:50:28.000Z”,”pattern”:”[file:hashes.sha256 = ‘abe22cf0d78836c3ea072daeaf4c5eeaf9c29b6feb597741651979fc8fbd2417’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.150253Z”},{“created”:”2020-12-17T16:59:49.000Z”,”id”:”indicator–a444b6e0-da14-4a6e-8024-15cda0061a6e”,”labels”:[“domain”],”modified”:”2020-12-17T16:59:49.000Z”,”pattern”:”[domain-name:value = ‘databasegalore.com’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.151314Z”},{“created”:”2020-12-17T16:54:00.000Z”,”id”:”indicator–1fbf05cb-270c-4c0b-aac1-1ae960fb166a”,”labels”:[“file sha-256”],”modified”:”2020-12-17T16:54:00.000Z”,”pattern”:”[file:hashes.sha256 = ‘c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.152749Z”},{“created”:”2020-12-17T16:51:14.000Z”,”id”:”indicator–18561b05-1cbe-42ab-b4ae-b315e8709c02”,”labels”:[“file sha-256”],”modified”:”2020-12-17T16:51:14.000Z”,”pattern”:”[file:hashes.sha256 = ‘ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.15395Z”},{“created”:”2020-12-17T16:49:45.000Z”,”id”:”indicator–85ebd471-202b-4086-93fb-e075f70f506d”,”labels”:[“file sha-256”],”modified”:”2020-12-17T16:49:45.000Z”,”pattern”:”[file:hashes.sha256 = ‘53f8dfc65169ccda021b72a62e0c22a4db7c4077f002fa742717d41b3c40f2c7’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.155011Z”},{“created”:”2020-12-17T16:52:27.000Z”,”id”:”indicator–57f6e856-0188-4ab8-b563-f3633ec093fb”,”labels”:[“file sha-256”],”modified”:”2020-12-17T16:52:27.000Z”,”pattern”:”[file:hashes.sha256 = ‘d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.156195Z”},{“created”:”2020-12-17T16:57:26.000Z”,”id”:”indicator–bf705330-2adb-4dfa-a844-d5d1176a0ad0”,”labels”:[“url”],”modified”:”2020-12-17T16:57:26.000Z”,”pattern”:”[url:value = ‘mhdosoksaccf9sni9icp.appsync-api.eu-west-1.avsvmcloud.com \t’]”,”score”:”Medium”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.157272Z”},{“created”:”2020-12-17T16:57:06.000Z”,”id”:”indicator–2c1cfda2-2481-498f-8123-47ac1276f799”,”labels”:[“url”],”modified”:”2020-12-17T16:57:06.000Z”,”pattern”:”[url:value = ‘k5kcubuassl3alrf7gm3.appsync-api.eu-west-1.avsvmcloud.com \t’]”,”score”:”Medium”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.159475Z”},{“created”:”2020-12-17T16:59:33.000Z”,”id”:”indicator–a64f9a04-d494-40ee-bb54-9b9406b76372”,”labels”:[“domain”],”modified”:”2020-12-17T16:59:33.000Z”,”pattern”:”[domain-name:value = ‘incomeupdate.com’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.160553Z”},{“created”:”2020-12-17T16:52:52.000Z”,”id”:”indicator–8683f37c-2ea9-4253-b8c5-e138ddff40c3”,”labels”:[“file sha-256”],”modified”:”2020-12-17T16:52:52.000Z”,”pattern”:”[file:hashes.sha256 = ‘292327e5c94afa352cc5a02ca273df543f2020d0e76368ff96c84f4e90778712’]”,”score”:”Medium”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.161572Z”},{“created”:”2020-12-17T16:46:31.000Z”,”id”:”indicator–cc6f08e1-3475-43bc-ab4e-e5818e5b37b2”,”labels”:[“file sha-256”],”modified”:”2020-12-17T16:46:31.000Z”,”pattern”:”[file:hashes.sha256 = ‘32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.162783Z”},{“created”:”2020-12-17T16:47:35.000Z”,”id”:”indicator–9ca400a7-257b-4cf3-91a8-b2c9a565266b”,”labels”:[“file sha-256”],”modified”:”2020-12-17T16:47:35.000Z”,”pattern”:”[file:hashes.sha256 = ‘d0d626deb3f9484e649294a8dfa814c5568f846d5aa02d4cdad5d041a29d5600’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.163984Z”},{“created”:”2020-12-17T17:00:14.000Z”,”id”:”indicator–ea44dc42-e516-4307-9225-21ccb22a7cc2”,”labels”:[“domain”],”modified”:”2020-12-17T17:00:14.000Z”,”pattern”:”[domain-name:value = ‘panhardware.com’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.165095Z”},{“created”:”2020-12-17T16:56:41.000Z”,”id”:”indicator–45f9a437-c4ee-4a24-9ffa-35a1202d62d5”,”labels”:[“url”],”modified”:”2020-12-17T16:56:41.000Z”,”pattern”:”[url:value = ‘ihvpgv9psvq02ffo77et.appsync-api.us-east-2.avsvmcloud.com’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.166111Z”},{“created”:”2020-12-17T16:55:40.000Z”,”id”:”indicator–242b1ad9-6309-4752-bad4-abf73f641297”,”labels”:[“url”],”modified”:”2020-12-17T16:55:40.000Z”,”pattern”:”[url:value = ‘7sbvaemscs0mc925tb99.appsync-api.us-west-2.avsvmcloud.com \t’]”,”score”:”Medium”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.167169Z”},{“created”:”2020-12-17T16:55:18.000Z”,”id”:”indicator–b96ee095-a7d4-40a8-a4b4-9e7c080f5a44”,”labels”:[“url”],”modified”:”2020-12-17T16:55:18.000Z”,”pattern”:”[url:value = ‘6a57jk2ba1d9keg15cbg.appsync-api.eu-west-1.avsvmcloud.com’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.168384Z”},{“created”:”2020-12-17T16:59:14.000Z”,”id”:”indicator–e03d0075-7880-43cd-86b1-18325470be45”,”labels”:[“domain”],”modified”:”2020-12-17T16:59:14.000Z”,”pattern”:”[domain-name:value = ‘highdatabase.com’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.169586Z”},{“created”:”2020-12-17T16:58:56.000Z”,”id”:”indicator–8942bb33-e898-4a10-bfb3-64530bd973ab”,”labels”:[“domain”],”modified”:”2020-12-17T16:58:56.000Z”,”pattern”:”[domain-name:value = ‘websitetheme.com’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.170584Z”},{“created”:”2020-12-17T16:56:08.000Z”,”id”:”indicator–2be41276-00d3-4438-bbf0-4fcc56dc3076”,”labels”:[“url”],”modified”:”2020-12-17T16:56:08.000Z”,”pattern”:”[url:value = ‘gq1h856599gqh538acqn.appsync-api.us-west-2.avsvmcloud.com’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.171575Z”},{“created”:”2020-12-17T16:58:10.000Z”,”id”:”indicator–8cd838ae-6330-4fbf-b5b4-07b77d46438d”,”labels”:[“domain”],”modified”:”2020-12-17T16:58:10.000Z”,”pattern”:”[domain-name:value = ‘freescanonline.com’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.172676Z”},{“created”:”2020-12-17T16:57:52.000Z”,”id”:”indicator–646c5771-6904-4176-813f-a2ca357f0e42”,”labels”:[“domain”],”modified”:”2020-12-17T16:57:52.000Z”,”pattern”:”[domain-name:value = ‘deftsecurity.com’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.173695Z”},{“created”:”2020-12-17T16:47:15.000Z”,”id”:”indicator–4069cf11-f617-40f2-8f7f-534e225aa33b”,”labels”:[“file sha-256”],”modified”:”2020-12-17T16:47:15.000Z”,”pattern”:”[file:hashes.sha256 = ‘efbec6863f4330dbb702cc43a85a0a7c29d79fde0f7d66eac9a3be43493cab4f’]”,”score”:”Medium”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.174561Z”},{“created”:”2020-12-17T17:00:41.000Z”,”id”:”indicator–026307f7-449c-4858-a112-fc4b73c31593”,”labels”:[“domain”],”modified”:”2020-12-17T17:00:41.000Z”,”pattern”:”[domain-name:value = ‘zupertech.com’]”,”score”:”High”,”source”:””,”type”:”indicator”,”valid_from”:”2020-12-17T17:01:35.175745Z”}]} | Optional |
| KnownRelatedIOCs | Add your own custom SUNBURST and SolarStorm IOCs to hunt. |
Optional | |
| LogForwarding | PAN-OS Log Forwarding Profile Name | Optional | |
| AutoCommit | This input establishes whether to commit the configuration automatically in PAN-OS. Yes - Commit automatically. No - Commit manually. |
No | Optional |
| AutoBlockSolarWindsServer | This input establishes whether to block the SolarWinds server automatically in PAN-OS. True - Commit automatically. False - Commit manually. |
False | Optional |
| DeviceGroup | Target Device Group (Panorama only) | Optional | |
| O365_AdminRolesList | Comma-separated list of Service O365 admin roles. | Optional | |
| Mialboxes_Retrieve_Limit | The maximum number of results to retrieve. Default is 10. | 10 | Optional |
Playbook Outputs
There are no outputs for this playbook.
Playbook Image
Inputs
IsolateEndpointAutomatically— Whether to automatically isolate endpoints, or opt for manual user approval. True means isolation will be done automatically.BlockIndicatorsAutomatically— Whether to automatically indicators involved with SolarStorm.CVEs— CVEs related to SUNBURST and SolarStorm.SunBurstSTIX— Hard-coded STIX file of SUNBURST and SolarStorm indicators.KnownRelatedIOCs— Add your own custom SUNBURST and SolarStorm IOCs to hunt.LogForwarding— PAN-OS Log Forwarding Profile NameAutoCommit— This input establishes whether to commit the configuration automatically in PAN-OS. Yes - Commit automatically. No - Commit manually.AutoBlockSolarWindsServer— This input establishes whether to block the SolarWinds server automatically in PAN-OS. True - Commit automatically. False - Commit manually.DeviceGroup— Target Device Group (Panorama only)O365_AdminRolesList— Comma-separated list of Service O365 admin roles.Mialboxes_Retrieve_Limit— The maximum number of results to retrieve. Default is 10.
Commands used
appendIndicatorField
closeInvestigation
createNewIndicator
expanse-get-issues
extractIndicators
Flowchart
id: SolarStorm and SUNBURST Hunting and Response Playbook version: -1 contentitemexportablefields: contentitemfields: {} name: SolarStorm and SUNBURST Hunting and Response Playbook description: "This playbook does the following:\n- Collect indicators to aid in your threat hunting process.\n - Retrieve IOCs of SUNBURST (a trojanized version of the SolarWinds Orion plugin).\n - Retrieve C2 domains and URLs associated with Sunburst. \n - Discover IOCs of associated activity related to the infection.\n - Generate an indicator list to block indicators with SUNBURST tags.\n- Hunt for the SUNBURST backdoor\n - Query firewall logs to detect network activity. \n - Search endpoint logs for Sunburst hashes to detect presence on hosts.\nIf compromised hosts are found:\n- Notify security team to review and trigger remediation response actions. \n- Run sub-playbooks to isolate/quarantine infected hosts/endpoints and await further actions from the security team.\n\nSources:\nhttps://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html\nhttps://unit42.paloaltonetworks.com/fireeye-solarstorm-sunburst/3/\nhttps://www.splunk.com/en_us/blog/security/sunburst-backdoor-detections-in-splunk.html" starttaskid: "0" tasks: "0": id: "0" taskid: df7502eb-2e4b-4de4-8ef1-697b83012f1b type: start task: id: df7502eb-2e4b-4de4-8ef1-697b83012f1b version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "95" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 240, "y": -990 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: e72a5f88-9b96-410b-83f8-04a61daeb514 type: title task: id: e72a5f88-9b96-410b-83f8-04a61daeb514 version: -1 name: Collect and Retrieve Indicators to Hunt type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "60" - "61" - "62" - "93" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": -465 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: f6dc8e72-4e53-495f-80c8-57260deac55d type: regular task: id: f6dc8e72-4e53-495f-80c8-57260deac55d version: -1 name: Collect hashes from FireEye for installed SUNBURST backdoor description: Sends HTTP request. Returns the response as a JSON file. scriptName: http type: regular iscommand: false brand: "" nexttasks: '#none#': - "45" scriptarguments: filename: simple: fireeye_Indicator_Release_Hashes.csv method: simple: GET url: simple: https://raw.githubusercontent.com/fireeye/sunburst_countermeasures/main/indicator_release/Indicator_Release_Hashes.csv reputationcalc: 2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 970, "y": -120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "12": id: "12" taskid: d3bb2cfc-d4d3-45ac-8d51-6d176397f96c type: regular task: id: d3bb2cfc-d4d3-45ac-8d51-6d176397f96c version: -1 name: Close investigation description: commands.local.cmd.close.inv script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "13" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 4810 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: 23e1215c-26fe-4bb2-8a6a-cf5d0c558ca5 type: title task: id: 23e1215c-26fe-4bb2-8a6a-cf5d0c558ca5 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 4980 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "16": id: "16" taskid: 74ab24f0-0bd4-47eb-8d5b-13e7a94c01fa type: playbook task: id: 74ab24f0-0bd4-47eb-8d5b-13e7a94c01fa version: -1 name: Panorama Query Logs description: 'Query Panorama logs of types: traffic, threat, url, data-filtering, and wildfire.' playbookName: Panorama Query Logs type: playbook iscommand: false brand: "" nexttasks: '#none#': - "19" scriptarguments: log_type: simple: threat query: simple: (threatid eq 86237) or (threatid eq 86245) or (threatid eq 86242) or (threatid eq 86246) or (threatid eq 86249) or (threatid eq 86247) or (threatid eq 86243) or (threatid eq 86248) or (threatid eq 86244) or (threatid eq 86238) or (threatid eq 86239) or (threatid eq 86240) or (threatid eq 86251) or (threatid eq 86250) separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 2490, "y": 920 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "19": id: "19" taskid: d0b423c5-3032-4ba8-8a3a-6fb47a515de6 type: title task: id: d0b423c5-3032-4ba8-8a3a-6fb47a515de6 version: -1 name: 'Remediation ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "42" - "52" - "58" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 1830 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "23": id: "23" taskid: 915d6f50-e12b-4526-8582-8fcb4f78d60e type: regular task: id: 915d6f50-e12b-4526-8582-8fcb4f78d60e version: -1 name: Investigate further description: "Further investigate the incident (endpoints, entry point, etc.').\nIf Expanse found SolarWinds C2 connection, investigate the internal server too. " type: regular iscommand: false brand: "" nexttasks: '#none#': - "12" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 4640 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: f83d2976-e87f-4c01-8165-77423b4ca394 type: title task: id: f83d2976-e87f-4c01-8165-77423b4ca394 version: -1 name: Mitigation description: commands.local.cmd.close.inv type: title iscommand: false brand: "" nexttasks: '#none#': - "104" - "105" - "107" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 3415 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: 250497c1-30af-46c8-8335-e700e5a36318 type: regular task: id: 250497c1-30af-46c8-8335-e700e5a36318 version: -1 name: Mark hash indicators with SolarStorm tag description: commands.local.cmd.add.values.to.indicator.multi.select.field script: Builtin|||appendIndicatorField type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "53" scriptarguments: field: simple: tags fieldValue: simple: SolarStorm, SunBurst indicatorsValues: complex: root: File accessor: MD5 transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 2130 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "30": id: "30" taskid: 48472983-7092-4dfe-89f6-ceb26703829b type: playbook task: id: 48472983-7092-4dfe-89f6-ceb26703829b version: -1 name: Search Endpoints By Hash - Generic V2 description: Hunt using available tools playbookName: Search Endpoints By Hash - Generic V2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "19" scriptarguments: MD5Hash: complex: root: File accessor: MD5 transformers: - operator: uniq SHA1Hash: complex: root: File accessor: SHA1 transformers: - operator: uniq SHA256Hash: complex: root: File accessor: SHA256 transformers: - operator: uniq separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 970, "y": 920 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "31": id: "31" taskid: 55ace1d4-8de9-45ea-8ebe-6365b73836e6 type: title task: id: 55ace1d4-8de9-45ea-8ebe-6365b73836e6 version: -1 name: Hunt SolarStorm and SunBurst in Network Activity type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "16" - "46" - "36" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2490, "y": 770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: cd98aba6-c495-4a50-8875-83640d95f2f0 type: title task: id: cd98aba6-c495-4a50-8875-83640d95f2f0 version: -1 name: Hunt Backdoor SolarWinds and SunBurst in Endpoints type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "30" - "74" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 970, "y": 770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "33": id: "33" taskid: fc976106-3685-4df9-8e2c-7bbd57a0c515 type: title task: id: fc976106-3685-4df9-8e2c-7bbd57a0c515 version: -1 name: No Infections Found type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "83" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 280, "y": 2405 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "34": id: "34" taskid: ff78093a-70f4-4b4b-85d0-295d38234445 type: playbook task: id: ff78093a-70f4-4b4b-85d0-295d38234445 version: -1 name: Isolate Endpoint - Generic V2 description: |- This playbook isolates a given endpoint using various endpoint product integrations. Make sure to provide valid playbook inputs for the integration you are using. playbookName: Isolate Endpoint - Generic V2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "83" scriptarguments: Endpoint_hostname: complex: root: Endpoint accessor: Hostname transformers: - operator: append args: item: value: simple: foundIncidents.CustomFields.xdralerts.host_name iscontext: true - operator: uniq Endpoint_id: complex: root: PaloAltoNetworksXDR.Endpoint accessor: endpoint_id transformers: - operator: append args: item: value: simple: Endpoint.endpoint_id - operator: uniq Endpoint_ip: complex: root: PANWHunting accessor: DetectedInternalIPs separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1020, "y": 2490 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "36": id: "36" taskid: b37458d1-def5-4d43-80d5-fab59e932ea3 type: playbook task: id: b37458d1-def5-4d43-80d5-fab59e932ea3 version: -1 name: Panorama Query Logs description: 'Query Panorama logs of types: traffic, threat, url, data-filtering, and wildfire.' playbookName: Panorama Query Logs type: playbook iscommand: false brand: "" nexttasks: '#none#': - "19" scriptarguments: log_type: simple: traffic query: simple: (app eq solarwinds)or(app eq solarwinds-rmm)or(app eq solarwinds-msp-manager)or(app eq solarwinds-agent)or(app eq solarwinds-npm)or(app eq solarwinds-sam)or(app eq solarwinds-msp-anywhere) separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 2920, "y": 920 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "42": id: "42" taskid: 8d8e955b-0570-45b2-8846-5fb49ddd92d5 type: title task: id: 8d8e955b-0570-45b2-8846-5fb49ddd92d5 version: -1 name: Block Indicators type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "55" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2280, "y": 1975 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "43": id: "43" taskid: 20c12bed-6e5d-470e-8472-bc04e8d65808 type: condition task: id: 20c12bed-6e5d-470e-8472-bc04e8d65808 version: -1 name: Any compromised hosts found? description: | Checks whether there was a compromised host found. type: condition iscommand: false brand: "" nexttasks: '#default#': - "33" "yes": - "50" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: Endpoint iscontext: true - operator: isNotEmpty left: value: complex: root: PANWHunting accessor: DetectedInternalIPs iscontext: true - operator: isNotEmpty left: value: complex: root: PANWHunting accessor: DetectedInternalHosts iscontext: true continueonerrortype: "" view: |- { "position": { "x": 610, "y": 2130 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "45": id: "45" taskid: b23dbbf1-0265-4224-8745-0ec6fc213257 type: title task: id: b23dbbf1-0265-4224-8745-0ec6fc213257 version: -1 name: Hunting type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "100" - "101" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 450 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "46": id: "46" taskid: 838bb5a8-c5b1-42f7-814b-cdc8a9fb786b type: playbook task: id: 838bb5a8-c5b1-42f7-814b-cdc8a9fb786b version: -1 name: Palo Alto Networks - Hunting And Threat Detection playbookName: Palo Alto Networks - Hunting And Threat Detection type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "19" scriptarguments: IPAddresses: complex: root: IP accessor: Address MD5: complex: root: File accessor: MD5 SHA1: complex: root: File accessor: SHA1 SHA256: complex: root: File accessor: SHA256 URLDomain: complex: root: URL accessor: Data separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 2030, "y": 920 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "47": id: "47" taskid: ae3c46c9-ff8a-4458-83ba-abe76e20b4ee type: regular task: id: ae3c46c9-ff8a-4458-83ba-abe76e20b4ee version: -1 name: Collect domains and IPs from FireEye for installed SUNBURST backdoor description: Sends HTTP request. Returns the response as a JSON file. scriptName: http type: regular iscommand: false brand: "" nexttasks: '#none#': - "48" scriptarguments: filename: simple: Indicator_Release_NBIs.csv method: simple: GET url: simple: https://raw.githubusercontent.com/fireeye/sunburst_countermeasures/main/indicator_release/Indicator_Release_NBIs.csv separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": -120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "48": id: "48" taskid: 559abe5c-5326-4b75-8682-7e6aa4c3a6d3 type: regular task: id: 559abe5c-5326-4b75-8682-7e6aa4c3a6d3 version: -1 name: UnEscape IPs from result to indicators description: |- Remove escaping chars from IP 127[.]0[.]0[.]1 -> 127.0.0.1 scriptName: UnEscapeIPs type: regular iscommand: false brand: Builtin nexttasks: '#none#': - "49" scriptarguments: input: complex: root: HttpRequest.Response accessor: Body transformers: - operator: join args: separator: value: simple: ',' reputationcalc: 2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 45 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "49": id: "49" taskid: dcf9c17e-1de1-464e-8f79-45b45f4e6f37 type: regular task: id: dcf9c17e-1de1-464e-8f79-45b45f4e6f37 version: -1 name: UnEscape URLs from result to indicators description: |- Extract URLs redirected by security tools like Proofpoint. Changes https://urldefense.proofpoint.com/v2/url?u=https-3A__example.com_something.html -> https://example.com/something.html Also, un-escape URLs that are escaped for safety with formats like hxxps://www[.]demisto[.]com scriptName: UnEscapeURLs type: regular iscommand: false brand: "" nexttasks: '#none#': - "45" scriptarguments: input: complex: root: HttpRequest.Response accessor: Body transformers: - operator: join args: separator: value: simple: ',' reputationcalc: 2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "50": id: "50" taskid: 4a3d415c-8f04-4028-857b-d6d39b7a2c14 type: condition task: id: 4a3d415c-8f04-4028-857b-d6d39b7a2c14 version: -1 name: Whether to automatically isolate compromised hosts? description: | Checks whether files associated with the incident can be blocked automatically using various EDR integrations. type: condition iscommand: false brand: "" nexttasks: '#default#': - "57" "yes": - "34" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.IsolateEndpointAutomatically iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 810, "y": 2310 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "52": id: "52" taskid: f5255969-e3b5-4dbb-808d-28d7093ac2be type: title task: id: f5255969-e3b5-4dbb-808d-28d7093ac2be version: -1 name: Isolate Compromised Hosts type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "43" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 610, "y": 1975 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "53": id: "53" taskid: 11e03119-eb81-4efb-8f4d-32b7805d8999 type: regular task: id: 11e03119-eb81-4efb-8f4d-32b7805d8999 version: -1 name: Mark IP indicators with SolarStorm tag description: commands.local.cmd.new.indicator script: Builtin|||createNewIndicator type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "54" scriptarguments: merge: simple: "True" tags: simple: SolarStorm, SUNBURST type: simple: IP value: complex: root: IP accessor: Address transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 2310 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "54": id: "54" taskid: 7fd76e93-b362-4e9a-8ca9-86912e60e82e type: regular task: id: 7fd76e93-b362-4e9a-8ca9-86912e60e82e version: -1 name: Mark URL indicators with SolarStorm tag description: commands.local.cmd.new.indicator script: Builtin|||createNewIndicator type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "83" scriptarguments: merge: simple: "True" tags: simple: SolarStorm, SUNBURST type: simple: URL value: complex: root: URL accessor: Data transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 2490 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "55": id: "55" taskid: 9d6d6b1d-9742-461d-86b1-cd8e5e9fbfa2 type: condition task: id: 9d6d6b1d-9742-461d-86b1-cd8e5e9fbfa2 version: -1 name: Whether to block indicators automatically? description: Checks whether IOCs associated with the incident can be blocked automatically. type: condition iscommand: false brand: "" nexttasks: '#default#': - "56" "yes": - "114" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.BlockIndicatorsAutomatically iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 2280, "y": 2120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "56": id: "56" taskid: 511ceecb-ce1d-4060-8f4d-5e96475ebb41 type: regular task: id: 511ceecb-ce1d-4060-8f4d-5e96475ebb41 version: -1 name: Manually block indicators description: Manually block the IOCs in the relevant systems. type: regular iscommand: false brand: "" nexttasks: '#none#': - "83" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2040, "y": 2310 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "57": id: "57" taskid: cc2310e2-051f-46d1-8a1d-83b3a3fcb4ad type: regular task: id: cc2310e2-051f-46d1-8a1d-83b3a3fcb4ad version: -1 name: Manually isolate endpoints description: Manually isolate the compromised hosts. type: regular iscommand: false brand: "" nexttasks: '#none#': - "83" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 600, "y": 2490 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "58": id: "58" taskid: d4973066-0d77-40e4-8104-9324bd5a09cf type: title task: id: d4973066-0d77-40e4-8104-9324bd5a09cf version: -1 name: Tag SolarStorm and SUNBURST Indicators type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "27" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 1975 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "59": id: "59" taskid: 86f09a3f-2404-448a-865c-d450cdfc100c type: regular task: id: 86f09a3f-2404-448a-865c-d450cdfc100c version: -1 name: Collect IOCs from UNIT42 GIT description: Sends HTTP request. Returns the response as a JSON file. scriptName: http type: regular iscommand: false brand: "" nexttasks: '#none#': - "45" scriptarguments: method: simple: GET url: simple: https://github.com/pan-unit42/iocs/blob/master/SolarStorm/IOCs reputationcalc: 2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 570, "y": -120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "60": id: "60" taskid: 899900ab-c1d5-4b7c-80d5-3bab3cbe7ecd type: title task: id: 899900ab-c1d5-4b7c-80d5-3bab3cbe7ecd version: -1 name: Indicators from GIT Sources type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "5" - "47" - "59" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 970, "y": -290 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "61": id: "61" taskid: 185d4a76-851d-45e1-897a-dee9956f38ba type: title task: id: 185d4a76-851d-45e1-897a-dee9956f38ba version: -1 name: Indicators from STIX File type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "64" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2010, "y": -290 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "62": id: "62" taskid: fcb7d370-ad48-4f01-8f49-ebd6f8e732dd type: title task: id: fcb7d370-ad48-4f01-8f49-ebd6f8e732dd version: -1 name: CVE Indicators type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "66" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2530, "y": -290 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "64": id: "64" taskid: 31b82d2f-dc62-4dc5-8702-3f58845246ba type: regular task: id: 31b82d2f-dc62-4dc5-8702-3f58845246ba version: -1 name: Create aSTIX file description: | Creates a file (using the given data input or entry ID) and uploads it to the current investigation War Room. scriptName: FileCreateAndUploadV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "65" scriptarguments: data: complex: root: inputs.SunBurstSTIX filename: simple: SunBurst STIX separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2010, "y": -120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "65": id: "65" taskid: a1297631-2ac8-4963-873d-8c1710d5b19e type: regular task: id: a1297631-2ac8-4963-873d-8c1710d5b19e version: -1 name: Create indicators from STIX description: Creates indicators from the submitted STIX file. Supports STIX 1.0 and STIX 2.0. scriptName: CreateIndicatorsFromSTIX type: regular iscommand: false brand: "" nexttasks: '#none#': - "45" scriptarguments: entry_id: complex: root: File filters: - - operator: isExists left: value: simple: File iscontext: true accessor: EntryID separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2010, "y": 45 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "66": id: "66" taskid: 16b0b0b3-851c-4072-814a-673eb1f7b6b4 type: playbook task: id: 16b0b0b3-851c-4072-814a-673eb1f7b6b4 version: -1 name: CVE Enrichment - Generic v2 description: |- This playbook performs CVE enrichment using the following integrations: - VulnDB - CVE Search - IBM X-Force Exchange playbookName: CVE Enrichment - Generic v2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "45" scriptarguments: cve_id: complex: root: inputs.CVEs separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 2530, "y": -120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "67": id: "67" taskid: 266b5bd4-3db5-463e-86e1-00829e09df3e type: title task: id: 266b5bd4-3db5-463e-86e1-00829e09df3e version: -1 name: CVEs Hunt type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "68" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "68": id: "68" taskid: a89635fa-cc4b-4ef3-8637-2440274c72da type: playbook task: id: a89635fa-cc4b-4ef3-8637-2440274c72da version: -1 name: Search Endpoint by CVE - Generic playbookName: Search Endpoint by CVE - Generic type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "19" scriptarguments: CVE_ID: complex: root: inputs.CVEs transformers: - operator: uniq separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1500, "y": 920 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "70": id: "70" taskid: d428e0f2-294d-47ea-8e0d-40a89308f07b type: regular task: id: d428e0f2-294d-47ea-8e0d-40a89308f07b version: -1 name: Extract indicators from playbook inputs description: commands.local.cmd.extract.indicators script: Builtin|||extractIndicators type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "45" scriptarguments: text: complex: root: inputs.KnownRelatedIOCs transformers: - operator: uniq reputationcalc: 2 separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": 3400, "y": 280 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "74": id: "74" taskid: eab9c45c-7490-4f8c-8eec-d0ed2c9838ee type: regular task: id: eab9c45c-7490-4f8c-8eec-d0ed2c9838ee version: -1 name: Search XDR incidents for SUNBURST description: Search XDR incidents for SUNBURST in the network. scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "19" scriptarguments: extend-context: simple: SUNBURSTXDRincidents= query: simple: xdralerts.name:"SunBurst Module loaded" or xdralerts.name:"SunBurst domain access" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 510, "y": 920 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "75": id: "75" taskid: 95a06bdf-7d38-4c9e-81b5-d5d0e4c93783 type: condition task: id: 95a06bdf-7d38-4c9e-81b5-d5d0e4c93783 version: -1 name: 'Are there custom IOCs? ' description: Checks if there are additional IOCs from the playbook input. type: condition iscommand: false brand: "" nexttasks: '#default#': - "45" "yes": - "70" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.KnownRelatedIOCs iscontext: true continueonerrortype: "" view: |- { "position": { "x": 3120, "y": 70 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "76": id: "76" taskid: b642ac48-a581-4b86-8126-3fc37c69f495 type: regular task: id: b642ac48-a581-4b86-8126-3fc37c69f495 version: -1 name: Expanse search for SolarWinds server description: Search for vulnerable SolarWinds server with Expanse. script: '|||expanse-get-issues' type: regular iscommand: true brand: "" nexttasks: '#none#': - "19" scriptarguments: issue_type: simple: Insecure SolarWinds Orion Platform, SolarWinds Orion Platform separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3590, "y": 1310 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "81": id: "81" taskid: dc0d9da2-ba62-4849-87f6-7b2353a410ce type: title task: id: dc0d9da2-ba62-4849-87f6-7b2353a410ce version: -1 name: Expanse Search SolarWinds Server and C2 Network Connection type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "90" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3590, "y": 770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "83": id: "83" taskid: aef22b99-450a-4f3e-8078-db05a73a9eb9 type: title task: id: aef22b99-450a-4f3e-8078-db05a73a9eb9 version: -1 name: Block Access to Vulnerable SolarWinds type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "84" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 2700 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "84": id: "84" taskid: 9d66b70c-9ac8-4f0b-8d30-786e6fbd1a2c type: condition task: id: 9d66b70c-9ac8-4f0b-8d30-786e6fbd1a2c version: -1 name: Was a vulnerable SolarWinds server found? description: Checks if a vulnerable SolarWinds server was found. type: condition iscommand: false brand: "" nexttasks: '#default#': - "24" "yes": - "85" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: Expanse.Issue accessor: ip iscontext: true continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 2860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "85": id: "85" taskid: 19541626-dcaf-4f4a-89a2-45d193c85535 type: condition task: id: 19541626-dcaf-4f4a-89a2-45d193c85535 version: -1 name: Block vulnerable SolarWinds server automatically? description: Checks whether to block the vulnerable SolarWinds server automatically according to the value set for the "AutoBlockSolarWindsServer" playbook input. type: condition iscommand: false brand: "" nexttasks: '#default#': - "86" "yes": - "115" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.AutoBlockSolarWindsServer iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 2040, "y": 3040 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "86": id: "86" taskid: 5f091703-1630-4781-839b-77c8b525cc6e type: regular task: id: 5f091703-1630-4781-839b-77c8b525cc6e version: -1 name: Manually block SolarWinds server description: To protect your network, block the internet facing SolarWinds server until patch. type: regular iscommand: false brand: "" nexttasks: '#none#': - "24" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1830, "y": 3220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "90": id: "90" taskid: 9b7aec71-0f58-4d7c-8d61-b85d8f52f681 type: condition task: id: 9b7aec71-0f58-4d7c-8d61-b85d8f52f681 version: -1 name: 'Is Expanse enabled? ' description: Checks if the Expanse instance is enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "19" "yes": - "76" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active ignorecase: true - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: Expanse V2 accessor: brand iscontext: true continueonerrortype: "" view: |- { "position": { "x": 3590, "y": 920 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "92": id: "92" taskid: 7ecbe048-d99e-472b-85d6-54cc9382d5e0 type: regular task: id: 7ecbe048-d99e-472b-85d6-54cc9382d5e0 version: -1 name: Search XDR incidents for suspicious SolarStorm behavior description: Search for an XDR incident related to the suspicious SolarStorm behavior. scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "19" scriptarguments: extend-context: simple: XDRSolarStormBehaviorIncidents= query: simple: 'xdralerts.name:"Malicious NetSetupSvc.dll loaded into svchost.exe" or xdralerts.name:"ADFind queries Active Directory for Exchange groups" or xdralerts.name:"Virtual Directory configuration access via PowerShell" or xdralerts.name:"PowerShell dumps users and roles from Exchange server" or xdralerts.name:"Unverified domain added to Azure AD" or xdralerts.name:"Domain federation settings have been modified" or xdralerts.name:"Uncommon PowerShell commands used to create or alter scheduled task parameters" ' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 130, "y": 755 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "93": id: "93" taskid: de31edb7-621b-40e0-80e9-e8538ed132d9 type: title task: id: de31edb7-621b-40e0-80e9-e8538ed132d9 version: -1 name: Additional IOCs type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "94" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3120, "y": -290 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "94": id: "94" taskid: 3c50cb80-09f0-4906-8af0-768bcdd77eef type: regular task: id: 3c50cb80-09f0-4906-8af0-768bcdd77eef version: -1 name: Hard-coded related IOCs description: commands.local.cmd.extract.indicators script: Builtin|||extractIndicators type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "75" scriptarguments: text: simple: d0d626deb3f9484e649294a8dfa814c5568f846d5aa02d4cdad5d041a29d5600, efbec6863f4330dbb702cc43a85a0a7c29d79fde0f7d66eac9a3be43493cab4f, d0d626deb3f9484e649294a8dfa814c5568f846d5aa02d4cdad5d041a29d5600, efbec6863f4330dbb702cc43a85a0a7c29d79fde0f7d66eac9a3be43493cab4f, 32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77, d0d626deb3f9484e649294a8dfa814c5568f846d5aa02d4cdad5d041a29d5600, efbec6863f4330dbb702cc43a85a0a7c29d79fde0f7d66eac9a3be43493cab4f, 32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77, 019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134, ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3120, "y": -100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "95": id: "95" taskid: 5d7b85ac-5395-47ca-8c38-9d783985c1c8 type: collection task: id: 5d7b85ac-5395-47ca-8c38-9d783985c1c8 version: -1 name: Is the organization SolarWinds server version vulnerable? description: Data collection task to checks whether there is a SolarWinds server with a vulnerable version. type: collection iscommand: false brand: "" nexttasks: '#none#': - "96" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 240, "y": -830 } } note: false timertriggers: [] ignoreworker: false message: to: simple: Administrator,Analyst subject: simple: SolarWinds server version check body: simple: Please check your SolarWinds Orion Platform. methods: - email format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: false completeaftersla: false form: questions: - id: "0" label: "" labelarg: simple: "Is the version of the organization SolarWinds one of the following? \n- Orion Platform 2019.4 HF5, version 2019.4.5200.9083\n- Orion Platform 2020.2 RC1, version 2020.2.100.12219\n- Orion Platform 2020.2 RC2, version 2020.2.5200.12394\n- Orion Platform 2020.2, 2020.2 HF1, version 2020.2.5300.12432" required: true gridcolumns: [] defaultrows: [] type: singleSelect options: [] optionsarg: - simple: "Yes" - simple: "No" fieldassociated: "" placeholder: "" tooltip: "" readonly: false title: SolarWinds Server Version Check description: Checks if the SolarWinds server version is vulnerable. sender: "" expired: false totalanswers: 0 skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "96": id: "96" taskid: 923654a0-7f07-4e46-8380-23ab98694d19 type: condition task: id: 923654a0-7f07-4e46-8380-23ab98694d19 version: -1 name: 'Was SolarWinds found vulnerable? ' description: Checks whether there is a SolarWinds server with a vulnerable version. type: condition iscommand: false brand: "" nexttasks: '#default#': - "97" "yes": - "4" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: SolarWinds server version check.Answers accessor: "0" iscontext: true right: value: simple: "Yes" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 240, "y": -650 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "97": id: "97" taskid: f7dc53c2-d3bb-42a8-8e12-3e65a22bc21a type: title task: id: f7dc53c2-d3bb-42a8-8e12-3e65a22bc21a version: -1 name: SolarWinds Not Vulnerable type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "23" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1090, "y": -465 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "99": id: "99" taskid: 0e599e7e-111d-40ae-8a2b-c4c3dba27831 type: playbook task: id: 0e599e7e-111d-40ae-8a2b-c4c3dba27831 version: -1 name: SolarStorm Activity Behavior Hunting playbook description: |2- Sources: - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - https://unit42.paloaltonetworks.com/fireeye-solarstorm-sunburst/3/ - https://www.splunk.com/en_us/blog/security/sunburst-backdoor-detections-in-splunk.html playbookName: SolarStorm Activity Behavior Hunting playbook type: playbook iscommand: false brand: "" nexttasks: '#none#': - "19" separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": -320, "y": 755 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "100": id: "100" taskid: fba6698e-be59-4a22-87af-0ee37844d94d type: title task: id: fba6698e-be59-4a22-87af-0ee37844d94d version: -1 name: Hunt SolarStrom IOCs type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "32" - "67" - "31" - "81" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2490, "y": 600 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "101": id: "101" taskid: c9c188c4-20b4-490e-8b73-0baef1f24b4b type: title task: id: c9c188c4-20b4-490e-8b73-0baef1f24b4b version: -1 name: Hunt SolarStorm Activity type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "92" - "99" - "102" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -320, "y": 600 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "102": id: "102" taskid: c4833080-27d3-49be-8720-409614f5c265 type: playbook task: id: c4833080-27d3-49be-8720-409614f5c265 version: -1 name: Office 365 and Azure Hunting playbookName: Office 365 and Azure Hunting type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "19" separatecontext: true continueonerrortype: "" view: |- { "position": { "x": -770, "y": 755 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "103": id: "103" taskid: 730fc061-b36a-4810-8e3b-c3755849cc79 type: playbook task: id: 730fc061-b36a-4810-8e3b-c3755849cc79 version: -1 name: Office 365 and Azure Configuration Analysis description: This playbook helps you collect, review, and find misconfigurations with the Azure environment. playbookName: Office 365 and Azure Configuration Analysis type: playbook iscommand: false brand: "" nexttasks: '#none#': - "113" scriptarguments: Limit: complex: root: inputs.Mialboxes_Retrieve_Limit O365_AdminRolesList: complex: root: inputs.O365_AdminRolesList separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1500, "y": 3710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "104": id: "104" taskid: 9a2c8087-c99e-4854-8b9b-ef1ff564379d type: title task: id: 9a2c8087-c99e-4854-8b9b-ef1ff564379d version: -1 name: SolarWinds Mitigation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "106" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2070, "y": 3560 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "105": id: "105" taskid: 8cd27b2c-e82e-43c4-825a-5b64cace9c3a type: title task: id: 8cd27b2c-e82e-43c4-825a-5b64cace9c3a version: -1 name: Azure Mitigation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "103" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 3560 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "106": id: "106" taskid: e2a29a05-d556-456d-8808-7da11f65d3f1 type: regular task: id: e2a29a05-d556-456d-8808-7da11f65d3f1 version: -1 name: Patch Vulnerable SolarWinds Server description: |- The latest SolarWinds updates designed to protect against SUNBURST and SUPERNOVA are as follows: 2019.4 HF 6 (released December 14, 2020) 2020.2.1 HF 2 (released December 15, 2020) 2019.2 SUPERNOVA Patch (released December 23, 2020) 2018.4 SUPERNOVA Patch (released December 23, 2020) 2018.2 SUPERNOVA Patch (released December 23, 2020) type: regular iscommand: false brand: "" nexttasks: '#none#': - "108" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2070, "y": 3710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "107": id: "107" taskid: 9f4dff31-2428-4dad-811b-5c070e355325 type: title task: id: 9f4dff31-2428-4dad-811b-5c070e355325 version: -1 name: 'Compromised Organization Entities Mitigation ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "109" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 950, "y": 3560 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "108": id: "108" taskid: ee17d4d1-16a8-4135-8e82-28ee85d1c97c type: regular task: id: ee17d4d1-16a8-4135-8e82-28ee85d1c97c version: -1 name: Change the password for SolarWinds user description: Change the password for the SolarWinds user. type: regular iscommand: false brand: "" nexttasks: '#none#': - "113" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2070, "y": 3890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "109": id: "109" taskid: fd8a92e6-fd8a-4e88-8d07-4ad9904547f0 type: regular task: id: fd8a92e6-fd8a-4e88-8d07-4ad9904547f0 version: -1 name: Reset all credentials used by or stored in SolarWinds software description: It is recommended to reset all credentials used by or stored in SolarWinds software since the SolarWinds server was compromised. type: regular iscommand: false brand: "" nexttasks: '#none#': - "110" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 950, "y": 3710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "110": id: "110" taskid: b1cc79b7-0379-4bad-870b-0f4424bbb70d type: regular task: id: b1cc79b7-0379-4bad-870b-0f4424bbb70d version: -1 name: 'Replace the user account by Group Managed Service Account ' description: 'Replace the user account by Group Managed Service Account. ' type: regular iscommand: false brand: "" nexttasks: '#none#': - "111" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 950, "y": 3880 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "111": id: "111" taskid: ad25d090-f5ce-4d9b-8d72-08b54b94d01d type: regular task: id: ad25d090-f5ce-4d9b-8d72-08b54b94d01d version: -1 name: Configure encryption types allowed for Kerberos description: |+ Set the allowable encryption types to AES256_HMAC_SHA1 and Future encryption types. https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos type: regular iscommand: false brand: "" nexttasks: '#none#': - "112" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 950, "y": 4070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "112": id: "112" taskid: 2c96a4e2-48e0-4732-8ede-84852f08559c type: regular task: id: 2c96a4e2-48e0-4732-8ede-84852f08559c version: -1 name: Rebuild hosts monitored by the SolarWinds description: Treat all hosts monitored by the SolarWinds Orion monitoring software as compromised by threat actors and assume that further persistence mechanisms have been deployed. type: regular iscommand: false brand: "" nexttasks: '#none#': - "113" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 950, "y": 4260 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "113": id: "113" taskid: 2f97a38b-6815-4cc2-8e2d-5a62a5916f40 type: title task: id: 2f97a38b-6815-4cc2-8e2d-5a62a5916f40 version: -1 name: Mitigation Complete type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "23" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 4440 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "114": id: "114" taskid: dd4134b7-7d24-4e31-824e-ee5fba7ae8c7 type: playbook task: id: dd4134b7-7d24-4e31-824e-ee5fba7ae8c7 version: -1 name: Block Indicators - Generic v3 description: |+ This playbook blocks malicious Indicators using all integrations that are enabled, using the following sub-playbooks: - Block URL - Generic v2 - Block Account - Generic v2 - Block IP - Generic v3 - Block File - Generic v2 - Block Email - Generic - Block Domain - Generic playbookName: Block Indicators - Generic v3 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "83" scriptarguments: AutoBlockIndicators: complex: root: inputs.AutoBlockIndicators AutoCommit: complex: root: inputs.AutoCommit CustomBlockRule: simple: "True" CustomURLCategory: simple: Demisto Remediation - Malicious URLs IP: complex: root: PANWHunting accessor: DetectedExternalIPs transformers: - operator: append args: item: value: simple: '(item: IP.Address)' InputEnrichment: simple: "False" LogForwarding: complex: root: inputs.LogForwarding MD5: complex: root: File accessor: MD5 RuleDirection: simple: outbound RuleName: simple: XSOAR - Block Indicators playbook - ${incident.id} SHA256: complex: root: File accessor: SHA256 URL: complex: root: URL accessor: Data transformers: - operator: uniq UserVerification: complex: root: inputs.UserVerification Username: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: username ignorecase: true - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" accessor: Indicator transformers: - operator: uniq device-group: complex: root: inputs.DeviceGroup separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 2480, "y": 2310 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "115": id: "115" taskid: 48339eeb-7c30-46db-83a3-e80e890befaa type: playbook task: id: 48339eeb-7c30-46db-83a3-e80e890befaa version: -1 name: Block IP - Generic v3 description: "This playbook blocks malicious IP addresses using all integrations that are enabled. The direction of the traffic that will be blocked is determined by the XSOAR user (and set by default to outgoing)\nNote the following:\n- some of those integrations require specific parameters to run, which are based on the playbook inputs. Also, certain integrations use FW rules or appended network objects.\n- Note that the appended network objects should be specified in blocking rules inside the system later on. \n\n\nSupported integrations for this playbook [Network security products such as FW/WAF/IPs/etc.]: \n\n* Check Point Firewall\n* Palo Alto Networks PAN-OS\n* Zscaler\n* FortiGate\n* Aria Packet Intelligence\n* Cisco Firepower \n* Cisco Secure Cloud Analytics\n* Cisco ASA\n* Akamai WAF\n* F5 SilverLine\n* ThreatX\n* Signal Sciences WAF\n* Sophos Firewall\n\n" playbookName: Block IP - Generic v3 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "24" scriptarguments: AutoCommit: complex: root: inputs.AutoCommit CustomBlockRule: simple: "True" IP: complex: root: Expense.Issue accessor: ip InputEnrichment: simple: "False" InternalRange: simple: ${inputs.InternalRange} LogForwarding: complex: root: inputs.LogForwarding RuleDirection: simple: outbound RuleName: simple: XSOAR - Block IP playbook - ${incident.id} UserVerification: simple: "True" separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 2270, "y": 3220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "43_33_#default#": 0.23, "43_50_yes": 0.65, "50_34_yes": 0.5, "50_57_#default#": 0.51, "75_45_#default#": 0.15, "75_70_yes": 0.65, "84_24_#default#": 0.35, "84_85_yes": 0.28, "90_19_#default#": 0.22, "90_76_yes": 0.29, "96_4_yes": 0.18, "96_97_#default#": 0.18 }, "paper": { "dimensions": { "height": 6035, "width": 5060, "x": -1090, "y": -990 } } } inputs: - key: IsolateEndpointAutomatically value: simple: "False" required: false description: Whether to automatically isolate endpoints, or opt for manual user approval. True means isolation will be done automatically. playbookInputQuery: - key: BlockIndicatorsAutomatically value: simple: "False" required: false description: Whether to automatically indicators involved with SolarStorm. playbookInputQuery: - key: CVEs value: simple: CVE-2020-14005,CVE-2020-13169 required: false description: CVEs related to SUNBURST and SolarStorm. playbookInputQuery: - key: SunBurstSTIX value: simple: '{"id":"bundle--60aab587-660c-4b58-89d0-efcf9cbdf8dd","type":"bundle","spec_version":"2.0","objects":[{"created":"2020-12-17T16:50:49.000Z","id":"indicator--180de847-a4c8-4e76-b719-138ac9c9b58e","labels":["file sha-256"],"modified":"2020-12-17T16:50:49.000Z","pattern":"[file:hashes.sha256 = ''019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.12709Z"},{"created":"2020-12-17T16:51:42.000Z","id":"indicator--8d217031-22f6-4d86-bd42-0519032d93bc","labels":["file sha-256"],"modified":"2020-12-17T16:51:42.000Z","pattern":"[file:hashes.sha256 = ''439bcd0a17d53837bc29fb51c0abd9d52a747227f97133f8ad794d9cc0ef191e'']","score":"Medium","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.144865Z"},{"created":"2020-12-17T16:58:27.000Z","id":"indicator--ff3c830a-dbe2-45ec-bfbc-dd357ae040fc","labels":["domain"],"modified":"2020-12-17T16:58:27.000Z","pattern":"[domain-name:value = ''thedoccloud.com'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.146129Z"},{"created":"2020-12-17T16:52:06.000Z","id":"indicator--514f2faf-9572-44e3-8f67-ea782206335f","labels":["file sha-256"],"modified":"2020-12-17T16:52:06.000Z","pattern":"[file:hashes.sha256 = ''a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.149043Z"},{"created":"2020-12-17T16:50:28.000Z","id":"indicator--2e3e39c2-757d-496f-82b1-a715e44fb682","labels":["file sha-256"],"modified":"2020-12-17T16:50:28.000Z","pattern":"[file:hashes.sha256 = ''abe22cf0d78836c3ea072daeaf4c5eeaf9c29b6feb597741651979fc8fbd2417'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.150253Z"},{"created":"2020-12-17T16:59:49.000Z","id":"indicator--a444b6e0-da14-4a6e-8024-15cda0061a6e","labels":["domain"],"modified":"2020-12-17T16:59:49.000Z","pattern":"[domain-name:value = ''databasegalore.com'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.151314Z"},{"created":"2020-12-17T16:54:00.000Z","id":"indicator--1fbf05cb-270c-4c0b-aac1-1ae960fb166a","labels":["file sha-256"],"modified":"2020-12-17T16:54:00.000Z","pattern":"[file:hashes.sha256 = ''c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.152749Z"},{"created":"2020-12-17T16:51:14.000Z","id":"indicator--18561b05-1cbe-42ab-b4ae-b315e8709c02","labels":["file sha-256"],"modified":"2020-12-17T16:51:14.000Z","pattern":"[file:hashes.sha256 = ''ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.15395Z"},{"created":"2020-12-17T16:49:45.000Z","id":"indicator--85ebd471-202b-4086-93fb-e075f70f506d","labels":["file sha-256"],"modified":"2020-12-17T16:49:45.000Z","pattern":"[file:hashes.sha256 = ''53f8dfc65169ccda021b72a62e0c22a4db7c4077f002fa742717d41b3c40f2c7'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.155011Z"},{"created":"2020-12-17T16:52:27.000Z","id":"indicator--57f6e856-0188-4ab8-b563-f3633ec093fb","labels":["file sha-256"],"modified":"2020-12-17T16:52:27.000Z","pattern":"[file:hashes.sha256 = ''d3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.156195Z"},{"created":"2020-12-17T16:57:26.000Z","id":"indicator--bf705330-2adb-4dfa-a844-d5d1176a0ad0","labels":["url"],"modified":"2020-12-17T16:57:26.000Z","pattern":"[url:value = ''mhdosoksaccf9sni9icp.appsync-api.eu-west-1.avsvmcloud.com \t'']","score":"Medium","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.157272Z"},{"created":"2020-12-17T16:57:06.000Z","id":"indicator--2c1cfda2-2481-498f-8123-47ac1276f799","labels":["url"],"modified":"2020-12-17T16:57:06.000Z","pattern":"[url:value = ''k5kcubuassl3alrf7gm3.appsync-api.eu-west-1.avsvmcloud.com \t'']","score":"Medium","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.159475Z"},{"created":"2020-12-17T16:59:33.000Z","id":"indicator--a64f9a04-d494-40ee-bb54-9b9406b76372","labels":["domain"],"modified":"2020-12-17T16:59:33.000Z","pattern":"[domain-name:value = ''incomeupdate.com'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.160553Z"},{"created":"2020-12-17T16:52:52.000Z","id":"indicator--8683f37c-2ea9-4253-b8c5-e138ddff40c3","labels":["file sha-256"],"modified":"2020-12-17T16:52:52.000Z","pattern":"[file:hashes.sha256 = ''292327e5c94afa352cc5a02ca273df543f2020d0e76368ff96c84f4e90778712'']","score":"Medium","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.161572Z"},{"created":"2020-12-17T16:46:31.000Z","id":"indicator--cc6f08e1-3475-43bc-ab4e-e5818e5b37b2","labels":["file sha-256"],"modified":"2020-12-17T16:46:31.000Z","pattern":"[file:hashes.sha256 = ''32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.162783Z"},{"created":"2020-12-17T16:47:35.000Z","id":"indicator--9ca400a7-257b-4cf3-91a8-b2c9a565266b","labels":["file sha-256"],"modified":"2020-12-17T16:47:35.000Z","pattern":"[file:hashes.sha256 = ''d0d626deb3f9484e649294a8dfa814c5568f846d5aa02d4cdad5d041a29d5600'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.163984Z"},{"created":"2020-12-17T17:00:14.000Z","id":"indicator--ea44dc42-e516-4307-9225-21ccb22a7cc2","labels":["domain"],"modified":"2020-12-17T17:00:14.000Z","pattern":"[domain-name:value = ''panhardware.com'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.165095Z"},{"created":"2020-12-17T16:56:41.000Z","id":"indicator--45f9a437-c4ee-4a24-9ffa-35a1202d62d5","labels":["url"],"modified":"2020-12-17T16:56:41.000Z","pattern":"[url:value = ''ihvpgv9psvq02ffo77et.appsync-api.us-east-2.avsvmcloud.com'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.166111Z"},{"created":"2020-12-17T16:55:40.000Z","id":"indicator--242b1ad9-6309-4752-bad4-abf73f641297","labels":["url"],"modified":"2020-12-17T16:55:40.000Z","pattern":"[url:value = ''7sbvaemscs0mc925tb99.appsync-api.us-west-2.avsvmcloud.com \t'']","score":"Medium","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.167169Z"},{"created":"2020-12-17T16:55:18.000Z","id":"indicator--b96ee095-a7d4-40a8-a4b4-9e7c080f5a44","labels":["url"],"modified":"2020-12-17T16:55:18.000Z","pattern":"[url:value = ''6a57jk2ba1d9keg15cbg.appsync-api.eu-west-1.avsvmcloud.com'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.168384Z"},{"created":"2020-12-17T16:59:14.000Z","id":"indicator--e03d0075-7880-43cd-86b1-18325470be45","labels":["domain"],"modified":"2020-12-17T16:59:14.000Z","pattern":"[domain-name:value = ''highdatabase.com'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.169586Z"},{"created":"2020-12-17T16:58:56.000Z","id":"indicator--8942bb33-e898-4a10-bfb3-64530bd973ab","labels":["domain"],"modified":"2020-12-17T16:58:56.000Z","pattern":"[domain-name:value = ''websitetheme.com'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.170584Z"},{"created":"2020-12-17T16:56:08.000Z","id":"indicator--2be41276-00d3-4438-bbf0-4fcc56dc3076","labels":["url"],"modified":"2020-12-17T16:56:08.000Z","pattern":"[url:value = ''gq1h856599gqh538acqn.appsync-api.us-west-2.avsvmcloud.com'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.171575Z"},{"created":"2020-12-17T16:58:10.000Z","id":"indicator--8cd838ae-6330-4fbf-b5b4-07b77d46438d","labels":["domain"],"modified":"2020-12-17T16:58:10.000Z","pattern":"[domain-name:value = ''freescanonline.com'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.172676Z"},{"created":"2020-12-17T16:57:52.000Z","id":"indicator--646c5771-6904-4176-813f-a2ca357f0e42","labels":["domain"],"modified":"2020-12-17T16:57:52.000Z","pattern":"[domain-name:value = ''deftsecurity.com'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.173695Z"},{"created":"2020-12-17T16:47:15.000Z","id":"indicator--4069cf11-f617-40f2-8f7f-534e225aa33b","labels":["file sha-256"],"modified":"2020-12-17T16:47:15.000Z","pattern":"[file:hashes.sha256 = ''efbec6863f4330dbb702cc43a85a0a7c29d79fde0f7d66eac9a3be43493cab4f'']","score":"Medium","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.174561Z"},{"created":"2020-12-17T17:00:41.000Z","id":"indicator--026307f7-449c-4858-a112-fc4b73c31593","labels":["domain"],"modified":"2020-12-17T17:00:41.000Z","pattern":"[domain-name:value = ''zupertech.com'']","score":"High","source":"","type":"indicator","valid_from":"2020-12-17T17:01:35.175745Z"}]}' required: false description: Hard-coded STIX file of SUNBURST and SolarStorm indicators. playbookInputQuery: - key: KnownRelatedIOCs value: {} required: false description: | Add your own custom SUNBURST and SolarStorm IOCs to hunt. playbookInputQuery: - key: LogForwarding value: {} required: false description: PAN-OS Log Forwarding Profile Name playbookInputQuery: - key: AutoCommit value: simple: "No" required: false description: |- This input establishes whether to commit the configuration automatically in PAN-OS. Yes - Commit automatically. No - Commit manually. playbookInputQuery: - key: AutoBlockSolarWindsServer value: simple: "False" required: false description: |- This input establishes whether to block the SolarWinds server automatically in PAN-OS. True - Commit automatically. False - Commit manually. playbookInputQuery: - key: DeviceGroup value: {} required: false description: 'Target Device Group (Panorama only) ' playbookInputQuery: - key: O365_AdminRolesList value: {} required: false description: Comma-separated list of Service O365 admin roles. playbookInputQuery: - key: Mialboxes_Retrieve_Limit value: simple: "10" required: false description: The maximum number of results to retrieve. Default is 10. playbookInputQuery: - key: AutoBlockIndicators value: simple: "True" required: false description: 'The input setting indicates whether to Automatically Block Indicators related to the SolarStrom Attack Default: True' playbookInputQuery: - key: UserVerification value: simple: "False" required: false description: 'The input indicates whether the user should verify the indicators before continuing with the playbook Default: Fasle' playbookInputQuery: - key: InternalRange value: complex: root: lists accessor: PrivateIPs transformers: - operator: RegexExtractAll args: error_if_no_match: {} ignore_case: {} multi_line: {} period_matches_newline: {} regex: value: simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2}) unpack_matches: {} - operator: join args: separator: value: simple: ',' required: false description: 'A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).' playbookInputQuery: outputs: [] tests: - No tests (auto formatted) fromversion: 6.5.0