Spear Phishing Investigation

The "Spear Phishing Investigation" playbook is designed to detect patterns that indicates a spear phishing attempt by the attacker.

Phishing · 10 tasks · 3 inputs · 0 outputs

Details

ID	`Spear Phishing Investigation`
From Version	6.5.0
Tasks	10

README

The “Spear Phishing Investigation” playbook is designed to detect patterns that indicates a spear phishing attempt by the attacker.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

MatchRegexV2

Commands

setIncident

Playbook Inputs

Name	Description	Required
DomainSquattingResults	Results of the domain squatting investigation.	Optional
KeywordsToSearch	A comma-separated list of keywords to search in the email body. For example: name of the organization finance app that the attacker might impersonate.	Optional
MailBody	The phishing mail body.	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Spear Phishing Investigation

Inputs

DomainSquattingResults — Results of the domain squatting investigation.
KeywordsToSearch — A comma-separated or list of keywords to search in the email body. for example: name of the organization finance app that the attacker might impost to.
MailBody — The phishing mail body.

Commands used

setIncident

Flowchart

Source

playbook-Spear_Phishing_Investigation.yml

Download History Raw

id: Spear Phishing Investigation
version: -1
name: Spear Phishing Investigation
description: The "Spear Phishing Investigation" playbook is designed to detect patterns that indicates a spear phishing attempt by the attacker.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 56356c32-2608-4402-893d-b35280351a2a
    type: start
    task:
      id: 56356c32-2608-4402-893d-b35280351a2a
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
      - "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: a3bf8786-d0c4-47a6-8a51-c116123b39e4
    type: title
    task:
      id: a3bf8786-d0c4-47a6-8a51-c116123b39e4
      version: -1
      name: Domain Squatting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 310fa350-ca1a-4dd7-8352-d302c4ab60ff
    type: title
    task:
      id: 310fa350-ca1a-4dd7-8352-d302c4ab60ff
      version: -1
      name: Keywords Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 730,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 40ab5b82-b0fb-4e24-89d8-db5077fdfc4f
    type: condition
    task:
      id: 40ab5b82-b0fb-4e24-89d8-db5077fdfc4f
      version: -1
      name: Did DomainSquatting occur?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.DomainSquattingResults
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 4bc3e5e8-ba44-4bfe-8ccd-14ac4cf7737f
    type: regular
    task:
      id: 4bc3e5e8-ba44-4bfe-8ccd-14ac4cf7737f
      version: -1
      name: Save Domain-Squatting result to incident field
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      domainsquattingresult:
        complex:
          root: inputs.DomainSquattingResults
          transformers:
          - operator: uniq
          - operator: Cut
            args:
              delimiter:
                value:
                  simple: '@'
              fields:
                value:
                  simple: "2"
          - operator: concat
            args:
              prefix:
                value:
                  simple: The attacker used the domain **
              suffix: {}
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: '** which looks like another domain involved in this incident.'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -80,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 4451884f-d282-4519-8d98-f99098f618f1
    type: title
    task:
      id: 4451884f-d282-4519-8d98-f99098f618f1
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 440,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: c68376e6-38f2-4d3f-89c3-01e1540d3a85
    type: condition
    task:
      id: c68376e6-38f2-4d3f-89c3-01e1540d3a85
      version: -1
      name: Has list of keywords and email body?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.KeywordsToSearch
            iscontext: true
          right:
            value: {}
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.MailBody
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 730,
          "y": 330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 6981fc14-899c-4f81-8f19-27e1f0a54f8b
    type: regular
    task:
      id: 6981fc14-899c-4f81-8f19-27e1f0a54f8b
      version: -1
      name: Search if keywords exist
      description: Extracts regex data from the provided text. The script support groups and looping.
      scriptName: MatchRegexV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      contextKey:
        simple: KeyWordsFound
      data:
        complex:
          root: inputs.MailBody
      regex:
        complex:
          root: inputs.KeywordsToSearch
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 930,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: db9e774b-dacd-416d-82e6-38cc237565c8
    type: condition
    task:
      id: db9e774b-dacd-416d-82e6-38cc237565c8
      version: -1
      name: Has results?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "18"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: KeyWordsFound
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 930,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: d12e22c4-df08-46c1-84b6-b780c7cb17cc
    type: regular
    task:
      id: d12e22c4-df08-46c1-84b6-b780c7cb17cc
      version: -1
      name: Set keywords found to layout
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      emailkeywordsfound:
        complex:
          root: KeyWordsFound
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 930,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "17_5_#default#": 0.42,
      "3_5_#default#": 0.17,
      "6_5_#default#": 0.16
    },
    "paper": {
      "dimensions": {
        "height": 1025,
        "width": 1390,
        "x": -80,
        "y": 50
      }
    }
  }
inputs:
- key: DomainSquattingResults
  value: {}
  required: false
  description: Results of the domain squatting investigation.
  playbookInputQuery:
- key: KeywordsToSearch
  value: {}
  required: false
  description: |-
    A comma-separated or list of keywords to search in the email body.
    for example: name of the organization finance app that the attacker might impost to.
  playbookInputQuery:
- key: MailBody
  value: {}
  required: false
  description: The phishing mail body.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0