SpyCloud - Malware Incident Enrichment

SpyCloud Malware Playbook executes the spycloud-compass-device-data command when any incident of the SpyCloud Malware Data type is created, and sets the corresponding incident field.

SpyCloud Enterprise Protection · 7 tasks · 1 input · 24 outputs

Details

ID	`SpyCloud - Malware Incident Enrichment`
From Version	6.10.0
Tasks	7

README

SpyCloud - Malware Incident Enrichment

This playbook enables the enrichment of SpyCloud malware incidents. This playbook fetches the infected machine ID from the incident and if the organization has access to SpyCloud compass data, then it will pull all the additional records for the infected machine ID using spycloud-compass-device-data-get command and adds the data to the incident.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

SpyCloud Enterprise Protection

Scripts

This playbook does not use any scripts.

Commands

spycloud-compass-device-data-get
setIncident

Playbook Inputs

| Name | Description | Default Value | Required |
|————————| — | — |————–|
| Infected Machine ID | A unique identifier either extracted from an infostealer log, when present, or an RFC 4122-compliant universally unique identifier (UUID) generated by SpyCloud, when no identifier is present in an infected record. | ${incident.spycloudinfectedmachineid} | Required. |

Playbook Outputs

Path	Type	Description
SpyCloud.CompassDeviceData.username	String	Username.
SpyCloud.CompassDeviceData.password	String	Account password.
SpyCloud.CompassDeviceData.password_plaintext	String	The cracked, plaintext version of the password (where the password is crackable).
SpyCloud.CompassDeviceData.password_type	String	Password type for original password as found in the data breach. This will either be plaintext or one of the many password hash/encryption types (SHA1, MD5, 3DES, etc).
SpyCloud.CompassDeviceData.target_url	String	URL extracted from Botnet data. This is the URL that is captured from a key logger installed on an infected user’s system.
SpyCloud.CompassDeviceData.user_browser	String	Browser name.
SpyCloud.CompassDeviceData.ip_addresses	String	List of one or more IP addresses in alphanumeric format. Both IPV4 and IPv6 addresses are supported.
SpyCloud.CompassDeviceData.infected_machine_id	String	A unique identifier either extracted from an infostealer log, when present, or an RFC 4122-compliant universally unique identifier (UUID) generated by SpyCloud, when no identifier is present in an infected record. The method of generation of these identifiers varies by malware family and may or may not conform to a UUID format. For the ID’s in the aforementioned UUID format, there is not currently any way to determine whether an infected_machine_id was extracted from a malware log or generated by SpyCloud.
SpyCloud.CompassDeviceData.infected_path	String	The local path to the malicious software installed on the infected user’s system.
SpyCloud.CompassDeviceData.infected_time	Date	The time at which the user’s system was infected with malicious software.
SpyCloud.CompassDeviceData.user_sys_domain	String	System domain. This usually comes from Botnet data.
SpyCloud.CompassDeviceData.user_hostname	String	System hostname. This usually comes from Botnet data.
SpyCloud.CompassDeviceData.user_os	String	System OS name. This usually comes from Botnet data.
SpyCloud.CompassDeviceData.user_sys_registered_owner	String	System registered owner name. This usually comes from Botnet data.
SpyCloud.CompassDeviceData.source_id	Number	Numerical breach ID. This correlates directly with the id field in Breach Catalog objects.
SpyCloud.CompassDeviceData.spycloud_publish_date	Date	The date on which we ingested the breached data into our systems. This is the same date on which the data becomes publicly available to our customers.
SpyCloud.CompassDeviceData.target_domain	String	SLD extracted from ‘target_url’ field.
SpyCloud.CompassDeviceData.target_subdomain	String	Subdomain and SLD extracted from ‘target_url’ field.
SpyCloud.CompassDeviceData.severity	Number	Severity is a numeric code representing severity of a breach record. This can be used in API requests to ensure only Breach Records with plaintext password are returned. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 -> High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address.
SpyCloud.CompassDeviceData.document_id	String	UUID v4 string which uniquely identifies this breach record in our data set.
SpyCloud.CompassDeviceData.email	String	Email address.
SpyCloud.CompassDeviceData.email_domain	String	Domain extracted from ‘email_address’ field. This is not a SLD, but everything after the ‘@’ symbol.
SpyCloud.CompassDeviceData.email_username	String	Username extracted from ‘email’ field. This is everything before the ‘@’ symbol.
SpyCloud.CompassDeviceData.domain	String	Domain name.

Playbook Image

SpyCloud Malware

Inputs

Infected Machine Id —

Outputs

SpyCloud.CompassDeviceData.username — Username.
SpyCloud.CompassDeviceData.password — Account password.
SpyCloud.CompassDeviceData.password_plaintext — The cracked, plaintext version of the password (where the password is crackable).
SpyCloud.CompassDeviceData.password_type — Password type for original password as found in the data breach. This will either be plaintext or one of the many password hash/encryption types (SHA1, MD5, 3DES, etc).
SpyCloud.CompassDeviceData.target_url — URL extracted from Botnet data. This is the URL that is captured from a key logger installed on an infected user's system.
SpyCloud.CompassDeviceData.user_browser — Browser name.
SpyCloud.CompassDeviceData.ip_addresses — List of one or more IP addresses in alphanumeric format. Both IPV4 and IPv6 addresses are supported.
SpyCloud.CompassDeviceData.infected_machine_id — A unique identifier either extracted from an infostealer log, when present, or an RFC 4122-compliant universally unique identifier (UUID) generated by SpyCloud, when no identifier is present in an infected record. The method of generation of these identifiers varies by malware family and may or may not conform to a UUID format. For the ID's in the aforementioned UUID format, there is not currently any way to determine whether an infected_machine_id was extracted from a malware log or generated by SpyCloud.
SpyCloud.CompassDeviceData.infected_path — The local path to the malicious software installed on the infected user's system.
SpyCloud.CompassDeviceData.infected_time — The time at which the user's system was infected with malicious software.
SpyCloud.CompassDeviceData.user_sys_domain — System domain. This usually comes from Botnet data.
SpyCloud.CompassDeviceData.user_hostname — System hostname. This usually comes from Botnet data.
SpyCloud.CompassDeviceData.user_os — System OS name. This usually comes from Botnet data.
SpyCloud.CompassDeviceData.user_sys_registered_owner — System registered owner name. This usually comes from Botnet data.
SpyCloud.CompassDeviceData.source_id — Numerical breach ID. This correlates directly with the id field in Breach Catalog objects.
SpyCloud.CompassDeviceData.spycloud_publish_date — The date on which we ingested the breached data into our systems. This is the same date on which the data becomes publicly available to our customers.
SpyCloud.CompassDeviceData.target_domain — SLD extracted from 'target_url' field.
SpyCloud.CompassDeviceData.target_subdomain — Subdomain and SLD extracted from 'target_url' field.
SpyCloud.CompassDeviceData.severity — Severity is a numeric code representing severity of a breach record. This can be used in API requests to ensure only Breach Records with plaintext password are returned. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 -> High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address.
SpyCloud.CompassDeviceData.document_id — UUID v4 string which uniquely identifies this breach record in our data set.
SpyCloud.CompassDeviceData.email — Email address.
SpyCloud.CompassDeviceData.email_domain — Domain extracted from 'email_address' field. This is not a SLD, but everything after the '@' symbol.
SpyCloud.CompassDeviceData.email_username — Username extracted from 'email' field. This is everything before the '@' symbol.
SpyCloud.CompassDeviceData.domain — Domain name.

Commands used

setIncident

Flowchart

Source

playbook-SpyCloud_Malware_Playbook.yml

Download History Raw

id: SpyCloud - Malware Incident Enrichment
version: -1
name: SpyCloud - Malware Incident Enrichment
description: SpyCloud Malware Playbook executes the spycloud-compass-device-data command when any incident of the SpyCloud Malware Data type is created, and sets the corresponding incident field.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 8a27604c-038d-4981-8a49-8aa39754918f
    type: start
    task:
      id: 8a27604c-038d-4981-8a49-8aa39754918f
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 4f95906b-a735-4bff-8a44-d270c482b54b
    type: regular
    task:
      id: 4f95906b-a735-4bff-8a44-d270c482b54b
      version: -1
      name: Adding compass data to the incident
      description: Change the properties of an incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      spycloudcompassdevicedata:
        simple: ${SpyCloud.CompassDeviceData}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 2d2f68f6-2661-46ab-8578-9448639cc980
    type: title
    task:
      id: 2d2f68f6-2661-46ab-8578-9448639cc980
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 47abe58e-54f5-4127-8697-543402bef4dc
    type: regular
    task:
      id: 47abe58e-54f5-4127-8697-543402bef4dc
      version: -1
      name: Fetch compass data for the infected machine id
      description: Get compass device data by infected_machine_id.
      script: spycloud-compass-device-data-get
      type: regular
      iscommand: true
      brand: SpyCloudEnterpriseProtectionEnrichment
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      infected_machine_id:
        simple: ${inputs.Infected Machine Id}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 21deb50f-d4ac-4edf-88f4-528bf09f77d7
    type: condition
    task:
      id: 21deb50f-d4ac-4edf-88f4-528bf09f77d7
      version: -1
      name: Check if compass data exist
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: SpyCloud.CompassDeviceData
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 977509ea-e6a1-46b3-88e5-4105a2bc889b
    type: regular
    task:
      id: 977509ea-e6a1-46b3-88e5-4105a2bc889b
      version: -1
      name: Add comment to the incident
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      comment:
        simple: 'Do not have compass data for this Infected Machine ID: ${inputs.Infected
          Machine Id}.'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 317ab2e7-d665-4fa0-8208-f4bc77b699d6
    type: title
    task:
      id: 317ab2e7-d665-4fa0-8208-f4bc77b699d6
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 735,
        "width": 810,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: Infected Machine Id
  value:
    simple: ${incident.spycloudinfectedmachineid}
  required: false
  description: ""
  playbookInputQuery:
outputs:
    - contextPath: SpyCloud.CompassDeviceData.username
      description: Username.
      type: String
    - contextPath: SpyCloud.CompassDeviceData.password
      description: Account password.
      type: String
    - contextPath: SpyCloud.CompassDeviceData.password_plaintext
      description: The cracked, plaintext version of the password (where the password is crackable).
      type: String
    - contextPath: SpyCloud.CompassDeviceData.password_type
      description: Password type for original password as found in the data breach. This will either be plaintext or one of the many password hash/encryption types (SHA1, MD5, 3DES, etc).
      type: String
    - contextPath: SpyCloud.CompassDeviceData.target_url
      description: URL extracted from Botnet data. This is the URL that is captured from a key logger installed on an infected user's system.
      type: String
    - contextPath: SpyCloud.CompassDeviceData.user_browser
      description: Browser name.
      type: String
    - contextPath: SpyCloud.CompassDeviceData.ip_addresses
      description: List of one or more IP addresses in alphanumeric format. Both IPV4 and IPv6 addresses are supported.
      type: String
    - contextPath: SpyCloud.CompassDeviceData.infected_machine_id
      description: A unique identifier either extracted from an infostealer log, when present, or an RFC 4122-compliant universally unique identifier (UUID) generated by SpyCloud, when no identifier is present in an infected record. The method of generation of these identifiers varies by malware family and may or may not conform to a UUID format. For the ID's in the aforementioned UUID format, there is not currently any way to determine whether an infected_machine_id was extracted from a malware log or generated by SpyCloud.
      type: String
    - contextPath: SpyCloud.CompassDeviceData.infected_path
      description: The local path to the malicious software installed on the infected user's system.
      type: String
    - contextPath: SpyCloud.CompassDeviceData.infected_time
      description: The time at which the user's system was infected with malicious software.
      type: Date
    - contextPath: SpyCloud.CompassDeviceData.user_sys_domain
      description: System domain. This usually comes from Botnet data.
      type: String
    - contextPath: SpyCloud.CompassDeviceData.user_hostname
      description: System hostname. This usually comes from Botnet data.
      type: String
    - contextPath: SpyCloud.CompassDeviceData.user_os
      description: System OS name. This usually comes from Botnet data.
      type: String
    - contextPath: SpyCloud.CompassDeviceData.user_sys_registered_owner
      description: System registered owner name. This usually comes from Botnet data.
      type: String
    - contextPath: SpyCloud.CompassDeviceData.source_id
      description: Numerical breach ID. This correlates directly with the id field in Breach Catalog objects.
      type: Number
    - contextPath: SpyCloud.CompassDeviceData.spycloud_publish_date
      description: The date on which we ingested the breached data into our systems. This is the same date on which the data becomes publicly available to our customers.
      type: Date
    - contextPath: SpyCloud.CompassDeviceData.target_domain
      description: SLD extracted from 'target_url' field.
      type: String
    - contextPath: SpyCloud.CompassDeviceData.target_subdomain
      description: Subdomain and SLD extracted from 'target_url' field.
      type: String
    - contextPath: SpyCloud.CompassDeviceData.severity
      description: 'Severity is a numeric code representing severity of a breach record. This can be used in API requests to ensure only Breach Records with plaintext password are returned. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 -> High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address.'
      type: Number
    - contextPath: SpyCloud.CompassDeviceData.document_id
      description: UUID v4 string which uniquely identifies this breach record in our data set.
      type: String
    - contextPath: SpyCloud.CompassDeviceData.email
      description: Email address.
      type: String
    - contextPath: SpyCloud.CompassDeviceData.email_domain
      description: Domain extracted from 'email_address' field. This is not a SLD, but everything after the '@' symbol.
      type: String
    - contextPath: SpyCloud.CompassDeviceData.email_username
      description: Username extracted from 'email' field. This is everything before the '@' symbol.
      type: String
    - contextPath: SpyCloud.CompassDeviceData.domain
      description: Domain name.
      type: String
quiet: true
tests:
- No tests (auto formatted)
fromversion: 6.10.0