T1036 - Masquerading

This playbook handles masquerading alerts based on the MITRE T1036 technique. An attacker might leverage Microsoft Windows well-known image names to run malicious processes without being caught. **Attacker's Goals:** An attacker is attempting to masquerade as standard windows images by using a trusted name to execute malicious code. **Investigative Actions:** Investigate the executed process image and verify if it is malicious using: * XDR trusted signers * VT trusted signers * VT detection rate * NSRL DB **Response Actions** The playbook's first response action is a containment plan which is based on the initial data provided within the alert. In that phase, the playbook will execute: * Auto block indicators * Auto file quarantine * Manual endpoint isolation When the playbook executes, it checks for additional activity using the Endpoint Investigation Plan playbook, and another phase, which includes containment and eradication, is executed. This phase will execute the following containment actions: * Manual block indicators * Manual file quarantine * Auto endpoint isolation And the following eradication actions: * Manual process termination * Manual file deletion * Manual reset of the user’s password External resources: [MITRE Technique T1036](https://attack.mitre.org/techniques/T1036/) [Possible Microsoft process masquerading](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Analytics-Alert-Reference/Possible-Microsoft-process-masquerading)

Core · 26 tasks · 27 inputs · 0 outputs

Details

IDT1036 - Masquerading
From Version6.6.0
Tasks26

README

This playbook handles masquerading alerts based on the MITRE T1036 technique.
An attacker might leverage Microsoft Windows well-known image names to run malicious processes without being caught.

Attacker’s Goals:

An attacker is attempting to masquerade as standard windows images by using a trusted name to execute malicious code.

Investigative Actions:

Investigate the executed process image and verify if it is malicious using:

  • XDR trusted signers
  • VT trusted signers
  • VT detection rate
  • NSRL DB

Response Actions

The playbook’s first response action is a containment plan which is based on the initial data provided within the alert. In that phase, the playbook will execute:

  • Auto block indicators
  • Auto file quarantine
  • Manual endpoint isolation

When the playbook executes, it checks for additional activity using the Endpoint Investigation Plan playbook, and another phase, which includes containment and eradication, is executed.

This phase will execute the following containment actions:

  • Manual block indicators
  • Manual file quarantine
  • Auto endpoint isolation

And the following eradication actions:

  • Manual process termination
  • Manual file deletion
  • Manual reset of the user’s password

External resources:

MITRE Technique T1036

Possible Microsoft process masquerading

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Handle False Positive Alerts
  • Endpoint Investigation Plan
  • Containment Plan
  • Ticket Management - Generic
  • Eradication Plan
  • Enrichment for Verdict
  • Recovery Plan

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

  • setParentIncidentFields
  • closeInvestigation

Playbook Inputs

Name Description Default Value Required
FileRemediation Should be either ‘Quarantine’ or ‘Delete’. Quarantine Required
AutoCloseAlert Whether to close the alert automatically or manually, after an analyst’s review. False Optional
AutoRecovery Whether to execute the Recovery playbook. False Optional
AutoContainment Setting this input will impact both Containment Plan sub-playbooks. Without setting this input, the default values are True for the first occurrence and False for the second.
Whether to execute automatically or manually the containment plan tasks:
* Isolate endpoint
* Block indicators
* Quarantine file
* Disable user		   Optional
AutoEradication Whether to execute automatically or manually the eradication plan tasks:
* Terminate process
* Delete file
* Reset the user’s password		 False Optional
FileSHA256 The file SHA256 to investigate. alert.initiatorsha256 Optional
FilePath The file path to investigate. alert.initiatorpath Optional
IP The IP address to investigate. alert.hostip Optional
ShouldOpenTicket Whether to open a ticket automatically in a ticketing system. (True/False). False Optional
serviceNowShortDescription A short description of the ticket. XSIAM Incident ID - ${parentIncidentFields.incident_id} Optional
serviceNowImpact The impact for the new ticket. Leave empty for ServiceNow default impact.   Optional
serviceNowUrgency The urgency of the new ticket. Leave empty for ServiceNow default urgency.   Optional
serviceNowSeverity The severity of the new ticket. Leave empty for ServiceNow default severity.   Optional
serviceNowTicketType The ServiceNow ticket type. Options are “incident”, “problem”, “change_request”, “sc_request”, “sc_task”, or “sc_req_item”. Default is “incident”.   Optional
serviceNowCategory The category of the ServiceNow ticket.   Optional
serviceNowAssignmentGroup The group to which to assign the new ticket.   Optional
ZendeskPriority The urgency with which the ticket should be addressed. Allowed values are “urgent”, “high”, “normal”, or “low”.   Optional
ZendeskRequester The user who requested this ticket.   Optional
ZendeskStatus The state of the ticket. Allowed values are “new”, “open”, “pending”, “hold”, “solved”, or “closed”.   Optional
ZendeskSubject The value of the subject field for this ticket. XSIAM Incident ID - ${parentIncidentFields.incident_id} Optional
ZendeskTags The array of tags applied to this ticket.   Optional
ZendeskType The type of this ticket. Allowed values are “problem”, “incident”, “question”, or “task”.   Optional
ZendeskAssigne The agent currently assigned to the ticket.   Optional
ZendeskCollaborators The users currently CC’ed on the ticket.   Optional
description The ticket description. ${parentIncidentFields.description}. ${parentIncidentFields.xdr_url} Optional
addCommentPerEndpoint Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False. True Optional
CommentToAdd Comment for the ticket. ${alert.name}. Alert ID: ${alert.id} Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

T1036 - Masquerading

Inputs

  • FileRemediation — Should be either 'Quarantine' or 'Delete'.
  • AutoCloseAlert — Whether to close the alert automatically or manually, after an analyst's review.
  • AutoRecovery — Whether to execute the Recovery playbook.
  • AutoContainment — Setting this input will impact both Containment Plan sub-playbooks. Without setting this input, the default values are True for the first occurrence and False for the second. Whether to execute automatically or manually the containment plan tasks: * Isolate endpoint * Block indicators * Quarantine file * Disable user
  • AutoEradication — Whether to execute automatically or manually the eradication plan tasks: * Terminate process * Delete file * Reset the user's password
  • FileSHA256 — The file SHA256 to investigate.
  • FilePath — The file path to investigate.
  • IP — The IP address to investigate.
  • ShouldOpenTicket — Whether to open a ticket automatically in a ticketing system. (True/False).
  • serviceNowShortDescription — A short description of the ticket.
  • serviceNowImpact — The impact for the new ticket. Leave empty for ServiceNow default impact.
  • serviceNowUrgency — The urgency of the new ticket. Leave empty for ServiceNow default urgency.
  • serviceNowSeverity — The severity of the new ticket. Leave empty for ServiceNow default severity.
  • serviceNowTicketType — The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident".
  • serviceNowCategory — The category of the ServiceNow ticket.
  • serviceNowAssignmentGroup — The group to which to assign the new ticket.
  • ZendeskPriority — The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low".
  • ZendeskRequester — The user who requested this ticket.
  • ZendeskStatus — The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed".
  • ZendeskSubject — The value of the subject field for this ticket.
  • ZendeskTags — The array of tags applied to this ticket.
  • ZendeskType — The type of this ticket. Allowed values are "problem", "incident", "question", or "task".
  • ZendeskAssigne — The agent currently assigned to the ticket.
  • ZendeskCollaborators — The users currently CC'ed on the ticket.
  • description — The ticket description.
  • addCommentPerEndpoint — Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.
  • CommentToAdd — Comment for the ticket.

Commands used

closeInvestigation setParentIncidentFields

Flowchart

Yes yes False Positive Possible False Positive True Positive yes yes yes Start Start Handle False Positive Handle False Positive Investigation Investigation Findings Findings Manuel Review - Should continue to investigate? Manuel Review - Should co... Containment Containment Are there investigation findings? Are there investigation f... Done Done Remediation Remediation Containment Plan - Containment Plan Containment Plan Containment Plan Eradication Plan - Eradication Plan Eradication Plan Eradication Plan Enrichment for Verdict - Enrichment for Verdict Enrichment for Verdict Enrichment for Verdict Got possible verdict? Got possible verdict? Analysis Analysis Containment Plan - Containment Plan Containment Plan Containment Plan Handle False Positive Alerts - Handle False Positive Alerts Handle False Positive Alerts Handle False Positive Alerts Close alert - closeInvestigation Close alert closeInvestigation Should execute recovery plan? Should execute recovery p... Should close alert automatically? Should close alert automa... Recovery Plan - Recovery Plan Recovery Plan Recovery Plan Recovery Recovery Endpoint Investigation Plan - Endpoint Investigation Plan Endpoint Investigation Plan Endpoint Investigation Plan Set Incident Severity to High - setParentIncidentFields Set Incident Severity to ... setParentIncidentFields Set Incident Severity to High - setParentIncidentFields Set Incident Severity to ... setParentIncidentFields Should open a ticket automatically in a ticketing system? Should open a ticket auto... Ticket Management - Generic - Ticket Management - Generic Ticket Management - Generic Ticket Management - Generic

Source

playbook-T1036_-_Masquerading.yml
Download History Raw 
id: T1036 - Masquerading
version: -1
name: T1036 - Masquerading
description: |-
  This playbook handles masquerading alerts based on the MITRE T1036 technique.
  An attacker might leverage Microsoft Windows well-known image names to run malicious processes without being caught.

  **Attacker's Goals:**

  An attacker is attempting to masquerade as standard windows images by using a trusted name to execute malicious code.

  **Investigative Actions:**

  Investigate the executed process image and verify if it is malicious using:

  * XDR trusted signers
  * VT trusted signers
  * VT detection rate
  * NSRL DB

  **Response Actions**

  The playbook's first response action is a containment plan which is based on the initial data provided within the alert. In that phase, the playbook will execute:

  * Auto block indicators
  * Auto file quarantine
  * Manual endpoint isolation

  When the playbook executes, it checks for additional activity using the Endpoint Investigation Plan playbook, and another phase, which includes containment and eradication, is executed.

  This phase will execute the following containment actions:

  * Manual block indicators
  * Manual file quarantine
  * Auto endpoint isolation

  And the following eradication actions:

  * Manual process termination
  * Manual file deletion
  * Manual reset of the user’s password

  External resources:

  [MITRE Technique T1036](https://attack.mitre.org/techniques/T1036/)

  [Possible Microsoft process masquerading](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Analytics-Alert-Reference/Possible-Microsoft-process-masquerading)
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 71c58368-f81a-4c7c-8dc8-30515abf9379
    type: start
    task:
      id: 71c58368-f81a-4c7c-8dc8-30515abf9379
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "82"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 70,
          "y": 1280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "7":
    id: "7"
    taskid: a7b815bf-2633-458f-83e9-5c3a29ba790a
    type: title
    task:
      id: a7b815bf-2633-458f-83e9-5c3a29ba790a
      version: -1
      name: Handle False Positive
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "86"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -330,
          "y": 2240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "14":
    id: "14"
    taskid: 7d91e62b-9a20-41c3-80ed-a7a284c567d1
    type: title
    task:
      id: 7d91e62b-9a20-41c3-80ed-a7a284c567d1
      version: -1
      name: Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "94"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 2895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "26":
    id: "26"
    taskid: f0cd4a3c-3ad9-432f-80f1-f836f59a1949
    type: title
    task:
      id: f0cd4a3c-3ad9-432f-80f1-f836f59a1949
      version: -1
      name: 'Findings '
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "37"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 3210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "28":
    id: "28"
    taskid: 35d35d70-6bb9-4932-84e9-33955870fe0b
    type: condition
    task:
      id: 35d35d70-6bb9-4932-84e9-33955870fe0b
      version: -1
      name: Manuel Review - Should continue to investigate?
      description: Whether to continue the investigation in case the verdict is a possible false positive.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "Yes":
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 70,
          "y": 2040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "33":
    id: "33"
    taskid: 0723776b-3e10-42c6-8792-1e06d5eaf59a
    type: title
    task:
      id: 0723776b-3e10-42c6-8792-1e06d5eaf59a
      version: -1
      name: Containment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "83"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 2550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "37":
    id: "37"
    taskid: 912ebd4d-99b4-4959-8308-475233cfd60b
    type: condition
    task:
      id: 912ebd4d-99b4-4959-8308-475233cfd60b
      version: -1
      name: Are there investigation findings?
      description: Checks if there are results for the Endpoint Investigation Plan.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "93"
      "yes":
      - "96"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: foundIncidents
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 490,
          "y": 3350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "41":
    id: "41"
    taskid: db863fa1-d2cc-46bc-8ed7-53adaa19714d
    type: title
    task:
      id: db863fa1-d2cc-46bc-8ed7-53adaa19714d
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -330,
          "y": 4870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "42":
    id: "42"
    taskid: d28118db-63f1-46ba-8490-63a8ddf9bd61
    type: title
    task:
      id: d28118db-63f1-46ba-8490-63a8ddf9bd61
      version: -1
      name: Remediation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "67"
      - "68"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 920,
          "y": 3710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "67":
    id: "67"
    taskid: 424947cb-b0a5-49da-813c-b5b9368090ed
    type: playbook
    task:
      id: 424947cb-b0a5-49da-813c-b5b9368090ed
      version: -1
      name: Containment Plan
      description: |-
        This playbook handles all the containment actions available with Cortex XSIAM.
        The playbook enables you to contain the incident with one of the following tasks:
        * Isolate endpoint
        * Disable account
        * Quarantine file
        * Block indicators
        * Clear user session (currently, the playbook supports only Okta)

        The playbook inputs enable you to manipulate the execution flow. Review the inputs description.
      playbookName: Containment Plan
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "93"
    scriptarguments:
      AutoContainment:
        complex:
          root: inputs.AutoContainment
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: "false"
      BlockIndicators:
        simple: "True"
      ClearUserSessions:
        simple: "False"
      EndpointID:
        complex:
          root: alert
          accessor: agentid
      FileContainment:
        simple: "True"
      FileHash:
        complex:
          root: foundIncidents.CustomFields
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: foundIncidents.CustomFields.initiatorpath
                iscontext: true
              right:
                value:
                  simple: c:\windows\explorer.exe
              ignorecase: true
          accessor: initiatorsha256
      FilePath:
        complex:
          root: foundIncidents.CustomFields.initiatorpath
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: foundIncidents.CustomFields.initiatorpath
                iscontext: true
              right:
                value:
                  simple: c:\windows\explorer.exe
              ignorecase: true
          transformers:
          - operator: uniq
      FileRemediation:
        complex:
          root: inputs.FileRemediation
      UserContainment:
        simple: "False"
      Username:
        complex:
          root: foundIncidents.CustomFields
          accessor: username
    separatecontext: true
    loop:
      iscommand: false
      scriptArguments:
        BlockIndicators:
          simple: "True"
        ContainmentType:
          simple: Auto
        EndpointContainment:
          simple: "False"
        FileContainment:
          simple: "True"
        ScheduledTaskConatinment:
          simple: "True"
        UserContainment:
          simple: "True"
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 700,
          "y": 3850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "68":
    id: "68"
    taskid: ea8d4b0e-9f11-4f4b-8c2f-5de458310029
    type: playbook
    task:
      id: ea8d4b0e-9f11-4f4b-8c2f-5de458310029
      version: -1
      name: Eradication Plan
      description: |-
        This playbook handles all the eradication actions available with Cortex XSIAM.
        The playbook enables you to eradicate the incident with one of the following tasks:
        * Reset user password
        * Delete file
        * Kill process (currently, the playbook supports terminating a process by name)

        The playbook inputs enable you to manipulate the execution flow. Review the inputs description.
      playbookName: Eradication Plan
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "93"
    scriptarguments:
      AutoEradicate:
        complex:
          root: inputs.AutoEradication
      EndpointID:
        complex:
          root: alert
          accessor: agentid
      FilePath:
        complex:
          root: foundIncidents.CustomFields
          accessor: initiatorpath
          transformers:
          - operator: uniq
      FileRemediation:
        complex:
          root: inputs.FileRemediation
      Username:
        complex:
          root: foundIncidents.CustomFields
          accessor: username
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      scriptArguments:
        DeleteFile:
          simple: "True"
        EradicationType:
          simple: Auto
        KillProcess:
          simple: "True"
        RemoveTasks:
          simple: "True"
        ResetPassword:
          simple: "True"
        RevertRegistry:
          simple: "True"
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1140,
          "y": 3850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "71":
    id: "71"
    taskid: 08a821d2-8fc5-49bb-8bbc-97df50c37d8a
    type: playbook
    task:
      id: 08a821d2-8fc5-49bb-8bbc-97df50c37d8a
      version: -1
      name: Enrichment for Verdict
      playbookName: Enrichment for Verdict
      type: playbook
      iscommand: false
      brand: ""
      description: 'This playbook checks prior alert closing reasons and performs enrichment and prevalence checks on different IOC types. It then  returns the information needed to establish the alert''s verdict.'
    nexttasks:
      '#none#':
      - "72"
    scriptarguments:
      CloseReason:
        simple: Resolved - False Positive,Resolved - Duplicate Incident,Resolved - Known Issue
      Domain:
        complex:
          root: alert
          accessor: domainname
      FileSHA256:
        complex:
          root: inputs.FileSHA256
      IP:
        complex:
          root: inputs.IP
      URL:
        complex:
          root: alert
          accessor: url
      User:
        complex:
          root: alert
          accessor: username
      query:
        simple: (initiatorsha256:${inputs.FileSHA256} or hostip:${inputs.IP}) and sourceBrand:"${alert.sourceBrand}" and name:"${alert.name}"
      threshold:
        simple: "5"
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 70,
          "y": 1555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "72":
    id: "72"
    taskid: 59fea646-7ac7-49d2-8d99-97f0313d895a
    type: condition
    task:
      id: 59fea646-7ac7-49d2-8d99-97f0313d895a
      version: -1
      name: Got possible verdict?
      description: Checks the verdict received from the Enrichment for Verdict sub-playbook.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      False Positive:
      - "7"
      Possible False Positive:
      - "28"
      True Positive:
      - "95"
    separatecontext: false
    conditions:
    - label: True Positive
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: VTFileVerdict
            iscontext: true
          right:
            value:
              simple: malicious
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              complex:
                root: FileVerdict
            iscontext: true
          right:
            value:
              simple: suspicious
          ignorecase: true
    - label: Possible False Positive
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: VTFileVerdict
            iscontext: true
          right:
            value:
              simple: benign
          ignorecase: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: NSRLFileVerdict
            iscontext: true
          right:
            value:
              simple: isNotNSRL
          ignorecase: true
        - operator: containsGeneral
          left:
            value:
              complex:
                root: VTFileSigners
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: XDRFileSigners
                      iscontext: true
                - operator: uniq
            iscontext: true
          right:
            value:
              simple: unTrusted
          ignorecase: true
      - - operator: containsGeneral
          left:
            value:
              complex:
                root: Core.AnalyticsPrevalence.Hash
                accessor: value
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
    - label: False Positive
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: VTFileVerdict
            iscontext: true
          right:
            value:
              simple: benign
          ignorecase: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: NSRLFileVerdict
            iscontext: true
          right:
            value:
              simple: isNSRL
          ignorecase: true
        - operator: notContainsGeneral
          left:
            value:
              complex:
                root: VTFileSigners
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: XDRFileSigners
                      iscontext: true
                - operator: uniq
            iscontext: true
          right:
            value:
              simple: unTrusted
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 70,
          "y": 1720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "82":
    id: "82"
    taskid: 49cd1abf-45e6-49bf-8974-c7be41d8a8f6
    type: title
    task:
      id: 49cd1abf-45e6-49bf-8974-c7be41d8a8f6
      version: -1
      name: Analysis
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "71"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 70,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "83":
    id: "83"
    taskid: 42bdace5-daa8-4c32-8d51-7ab46b210345
    type: playbook
    task:
      id: 42bdace5-daa8-4c32-8d51-7ab46b210345
      version: -1
      name: Containment Plan
      description: |-
        This playbook handles all the containment actions available with Cortex XSIAM.
        The playbook enables you to contain the incident with one of the following tasks:
        * Isolate endpoint
        * Disable account
        * Quarantine file
        * Block indicators
        * Clear user session (currently, the playbook supports only Okta)

        The playbook inputs enable you to manipulate the execution flow. Review the inputs description.
      playbookName: Containment Plan
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      AutoContainment:
        complex:
          root: inputs.AutoContainment
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: "false"
      BlockIndicators:
        simple: "True"
      ClearUserSessions:
        simple: "False"
      EndpointID:
        complex:
          root: alert
          accessor: agentid
      FileContainment:
        simple: "True"
      FileHash:
        complex:
          root: inputs
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: inputs.FilePath
                iscontext: true
              right:
                value:
                  simple: c:\windows\explorer.exe
              ignorecase: true
          accessor: FileSHA256
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: alert.targetprocesssha256
                iscontext: true
      FilePath:
        complex:
          root: inputs
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: inputs.FilePath
                iscontext: true
              right:
                value:
                  simple: c:\windows\explorer.exe
              ignorecase: true
          accessor: FilePath
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: alert.targetprocesscmd
                iscontext: true
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: \"
              replaceWith: {}
          - operator: uniq
      FileRemediation:
        simple: Quarantine
      HostContainment:
        simple: "True"
      UserContainment:
        simple: "False"
      UserVerification:
        simple: "False"
      Username:
        complex:
          root: alert
          accessor: username
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 490,
          "y": 2705
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "86":
    id: "86"
    taskid: 8dbb433f-6540-4a14-8ae4-69b27894189a
    type: playbook
    task:
      id: 8dbb433f-6540-4a14-8ae4-69b27894189a
      version: -1
      name: Handle False Positive Alerts
      description: |
        This playbook handles false positive alerts.
      playbookName: Handle False Positive Alerts
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "41"
    scriptarguments:
      FileSHA256:
        complex:
          root: inputs.FileSHA256
      ShouldCloseAutomatically:
        complex:
          root: inputs.AutoCloseAlert
      alertName:
        complex:
          root: alert
          accessor: name
      sourceIP:
        complex:
          root: inputs.IP
      username:
        complex:
          root: alert
          accessor: username
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -330,
          "y": 2395
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "88":
    id: "88"
    taskid: 75ff8953-ad02-4356-8215-1c564ddef450
    type: regular
    task:
      id: 75ff8953-ad02-4356-8215-1c564ddef450
      version: -1
      name: Close alert
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "41"
    scriptarguments:
      closeReason:
        simple: Resolved - Threat Handled
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 750,
          "y": 4700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "89":
    id: "89"
    taskid: cce1446a-20a3-4b0d-855c-9ef077a9931b
    type: condition
    task:
      id: cce1446a-20a3-4b0d-855c-9ef077a9931b
      version: -1
      name: Should execute recovery plan?
      description: Checks the user input for whether to run the Recovery Plan sub-playbook.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "90"
      "yes":
      - "92"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoRecovery
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 490,
          "y": 4155
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "90":
    id: "90"
    taskid: 7b6b27ef-db7d-4461-8e67-2e6c0a5e8ffb
    type: condition
    task:
      id: 7b6b27ef-db7d-4461-8e67-2e6c0a5e8ffb
      version: -1
      name: Should close alert automatically?
      description: Checks the user input for whether to close the alert automatically.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "41"
      "yes":
      - "88"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoCloseAlert
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 490,
          "y": 4500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "92":
    id: "92"
    taskid: f3cbc913-4c83-49ac-8a03-a11e4b25c457
    type: playbook
    task:
      id: f3cbc913-4c83-49ac-8a03-a11e4b25c457
      version: -1
      name: Recovery Plan
      description: |-
        This playbook handles all the recovery actions available with Cortex XSIAM.
        The playbook enables you to recover  from the incident with one of the following tasks:
        * Unisolate endpoint
        * Restore quarantined file

        The playbook inputs enables you to manipulate the execution flow. Review the inputs description.
      playbookName: Recovery Plan
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "90"
    scriptarguments:
      FileHash:
        complex:
          root: inputs.FileSHA256
      endpointID:
        complex:
          root: alert
          accessor: agentid
      releaseFile:
        simple: "false"
      unIsolateEndpoint:
        simple: "true"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 920,
          "y": 4330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "93":
    id: "93"
    taskid: fe7a10cc-d284-424b-8f51-c7420a4f0404
    type: title
    task:
      id: fe7a10cc-d284-424b-8f51-c7420a4f0404
      version: -1
      name: Recovery
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "89"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 4020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "94":
    id: "94"
    taskid: b5c5394f-5fa0-4fdc-8292-8c8ba2f4acba
    type: playbook
    task:
      id: b5c5394f-5fa0-4fdc-8292-8c8ba2f4acba
      version: -1
      name: Endpoint Investigation Plan
      description: |-
        This playbook handles all the endpoint investigation actions available with Cortex XSIAM.
        The playbook enables you to investigate and hunt for more information using one of the following tasks:
        * Pre-defined MITRE Tactics
        * Host fields (Host ID)
        * Attacker fields (Attacker IP, External host)
        * MITRE techniques
        * File hash (currently, the playbook supports only SHA256)

        The playbook inputs enables you to manipulate the execution flow. Review the inputs description.
      playbookName: Endpoint Investigation Plan
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      HuntCnCTechniques:
        simple: "True"
      HuntCollectionTechniques:
        simple: "True"
      HuntDefenseEvasionTechniques:
        simple: "True"
      HuntDiscoveryTechniques:
        simple: "True"
      HuntExecutionTechniques:
        simple: "True"
      HuntImpactTechniques:
        simple: "True"
      HuntInitialAccessTechniques:
        simple: "True"
      HuntLateralMovementTechniques:
        simple: "True"
      HuntPersistenceTechniques:
        simple: "True"
      HuntPrivilegeEscalationTechniques:
        simple: "True"
      HuntReconnaissanceTechniques:
        simple: "True"
      agentID:
        complex:
          root: alert
          accessor: agentid
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 490,
          "y": 3040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "95":
    id: "95"
    taskid: 21534fb3-d5b2-40c7-8d6a-39bb1586a71f
    type: regular
    task:
      id: 21534fb3-d5b2-40c7-8d6a-39bb1586a71f
      version: -1
      name: Set Incident Severity to High
      description: commands.local.cmd.set.parent.incident.field
      script: Builtin|||setParentIncidentFields
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "97"
    scriptarguments:
      manual_severity:
        simple: high
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": 2040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "96":
    id: "96"
    taskid: 38ebacd7-790f-4711-87bf-f8eb8f42cad3
    type: regular
    task:
      id: 38ebacd7-790f-4711-87bf-f8eb8f42cad3
      version: -1
      name: Set Incident Severity to High
      description: commands.local.cmd.set.parent.incident.field
      script: Builtin|||setParentIncidentFields
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "42"
    scriptarguments:
      manual_severity:
        simple: high
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 920,
          "y": 3535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "97":
    id: "97"
    taskid: f62e9909-3fa8-43f7-8ad7-0b666e08659b
    type: condition
    task:
      id: f62e9909-3fa8-43f7-8ad7-0b666e08659b
      version: -1
      name: Should open a ticket automatically in a ticketing system?
      description: Checks whether to open a ticket automatically in a ticketing system.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "33"
      "yes":
      - "98"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.ShouldOpenTicket
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": 2210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "98":
    id: "98"
    taskid: f00603bc-1e1c-42ab-8f3b-3e7a3999e3c2
    type: playbook
    task:
      id: f00603bc-1e1c-42ab-8f3b-3e7a3999e3c2
      version: -1
      name: Ticket Management - Generic
      description: "`Ticket Management - Generic` allows you to open new tickets or update comments to the existing ticket in the following ticketing systems:\n-ServiceNow \n-Zendesk \nusing the following sub-playbooks:\n-`ServiceNow - Ticket Management`\n-`Zendesk - Ticket Management`\n"
      playbookName: Ticket Management - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "33"
    scriptarguments:
      CommentToAdd:
        complex:
          root: inputs.CommentToAdd
      ZendeskAssigne:
        complex:
          root: inputs.ZendeskAssigne
      ZendeskCollaborators:
        complex:
          root: inputs.ZendeskCollaborators
      ZendeskPriority:
        complex:
          root: inputs.ZendeskPriority
      ZendeskRequester:
        complex:
          root: inputs.ZendeskRequester
      ZendeskStatus:
        complex:
          root: inputs.ZendeskStatus
      ZendeskSubject:
        complex:
          root: inputs.ZendeskSubject
      ZendeskTags:
        complex:
          root: inputs.ZendeskTags
      ZendeskType:
        complex:
          root: inputs.ZendeskType
      addCommentPerEndpoint:
        complex:
          root: inputs.addCommentPerEndpoint
      description:
        complex:
          root: inputs.description
      serviceNowAssignmentGroup:
        complex:
          root: inputs.serviceNowAssignmentGroup
      serviceNowCategory:
        complex:
          root: inputs.serviceNowCategory
      serviceNowImpact:
        complex:
          root: inputs.serviceNowImpact
      serviceNowSeverity:
        complex:
          root: inputs.serviceNowSeverity
      serviceNowShortDescription:
        complex:
          root: inputs.serviceNowShortDescription
      serviceNowTicketType:
        complex:
          root: inputs.serviceNowTicketType
      serviceNowUrgency:
        complex:
          root: inputs.serviceNowUrgency
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 760,
          "y": 2380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "28_14_Yes": 0.2,
      "28_7_#default#": 0.3,
      "37_93_#default#": 0.24,
      "72_28_Possible False Positive": 0.72,
      "72_7_False Positive": 0.57,
      "89_90_#default#": 0.51,
      "89_92_yes": 0.6,
      "90_88_yes": 0.49
    },
    "paper": {
      "dimensions": {
        "height": 3655,
        "width": 1850,
        "x": -330,
        "y": 1280
      }
    }
  }
inputs:
- key: FileRemediation
  value:
    simple: Quarantine
  required: true
  description: Should be either 'Quarantine' or 'Delete'.
  playbookInputQuery:
- key: AutoCloseAlert
  value:
    simple: "False"
  required: false
  description: Whether to close the alert automatically or manually, after an analyst's review.
  playbookInputQuery:
- key: AutoRecovery
  value:
    simple: "False"
  required: false
  description: Whether to execute the Recovery playbook.
  playbookInputQuery:
- key: AutoContainment
  value: {}
  required: false
  description: |-
    Setting this input will impact both Containment Plan sub-playbooks. Without setting this input, the default values are True for the first occurrence and False for the second.
    Whether to execute automatically or manually the containment plan tasks:
    * Isolate endpoint
    * Block indicators
    * Quarantine file
    * Disable user
  playbookInputQuery:
- key: AutoEradication
  value:
    simple: "False"
  required: false
  description: |-
    Whether to execute automatically or manually the eradication plan tasks:
    * Terminate process
    * Delete file
    * Reset the user's password
  playbookInputQuery:
- key: FileSHA256
  value:
    complex:
      root: alert
      accessor: initiatorsha256
  required: false
  description: The file SHA256 to investigate.
  playbookInputQuery:
- key: FilePath
  value:
    complex:
      root: alert
      accessor: initiatorpath
  required: false
  description: The file path to investigate.
  playbookInputQuery:
- key: IP
  value:
    complex:
      root: alert
      accessor: hostip
  required: false
  description: The IP address to investigate.
  playbookInputQuery:
- key: ShouldOpenTicket
  value:
    simple: "False"
  required: false
  description: Whether to open a ticket automatically in a ticketing system. (True/False).
  playbookInputQuery:
- key: serviceNowShortDescription
  value:
    simple: XSIAM Incident ID - ${parentIncidentFields.incident_id}
  required: false
  description: A short description of the ticket.
  playbookInputQuery:
- key: serviceNowImpact
  value: {}
  required: false
  description: The impact for the new ticket. Leave empty for ServiceNow default impact.
  playbookInputQuery:
- key: serviceNowUrgency
  value: {}
  required: false
  description: The urgency of the new ticket. Leave empty for ServiceNow default urgency.
  playbookInputQuery:
- key: serviceNowSeverity
  value: {}
  required: false
  description: The severity of the new ticket. Leave empty for ServiceNow default severity.
  playbookInputQuery:
- key: serviceNowTicketType
  value: {}
  required: false
  description: The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident".
  playbookInputQuery:
- key: serviceNowCategory
  value: {}
  required: false
  description: The category of the ServiceNow ticket.
  playbookInputQuery:
- key: serviceNowAssignmentGroup
  value: {}
  required: false
  description: The group to which to assign the new ticket.
  playbookInputQuery:
- key: ZendeskPriority
  value: {}
  required: false
  description: The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low".
  playbookInputQuery:
- key: ZendeskRequester
  value: {}
  required: false
  description: The user who requested this ticket.
  playbookInputQuery:
- key: ZendeskStatus
  value: {}
  required: false
  description: The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed".
  playbookInputQuery:
- key: ZendeskSubject
  value:
    simple: XSIAM Incident ID - ${parentIncidentFields.incident_id}
  required: false
  description: The value of the subject field for this ticket.
  playbookInputQuery:
- key: ZendeskTags
  value: {}
  required: false
  description: The array of tags applied to this ticket.
  playbookInputQuery:
- key: ZendeskType
  value: {}
  required: false
  description: The type of this ticket. Allowed values are "problem", "incident", "question", or "task".
  playbookInputQuery:
- key: ZendeskAssigne
  value: {}
  required: false
  description: The agent currently assigned to the ticket.
  playbookInputQuery:
- key: ZendeskCollaborators
  value: {}
  required: false
  description: The users currently CC'ed on the ticket.
  playbookInputQuery:
- key: description
  value:
    simple: ${parentIncidentFields.description}. ${parentIncidentFields.xdr_url}
  required: false
  description: The ticket description.
  playbookInputQuery:
- key: addCommentPerEndpoint
  value:
    simple: "True"
  required: false
  description: 'Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.'
  playbookInputQuery:
- key: CommentToAdd
  value:
    simple: '${alert.name}. Alert ID: ${alert.id}'
  required: false
  description: Comment for the ticket.
  playbookInputQuery:
inputSections:
- inputs:
  - AutoCloseAlert
  name: Alert Management
  description: Alert management settings and data, including escalation processes, and user engagements.
- inputs:
  - FileSHA256
  - FilePath
  - IP
  name: Enrichment
  description: Enrichment settings and data, including assets and indicators enrichment using third-party enrichers.
- inputs:
  - AutoContainment
  - AutoEradication
  - FileRemediation
  - AutoRecovery
  name: Remediation
  description: Remediation settings and data, including containment, eradication, and recovery.
- inputs:
  - ShouldOpenTicket
  - serviceNowShortDescription
  - serviceNowImpact
  - serviceNowUrgency
  - serviceNowSeverity
  - serviceNowTicketType
  - serviceNowCategory
  - serviceNowAssignmentGroup
  - ZendeskPriority
  - ZendeskRequester
  - ZendeskStatus
  - ZendeskSubject
  - ZendeskTags
  - ZendeskType
  - ZendeskAssigne
  - ZendeskCollaborators
  - description
  - addCommentPerEndpoint
  - CommentToAdd
  name: Ticket Management
  description: Ticket management settings and data.
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
tests:
- T1036 - Masquerading - Test
marketplaces:
- marketplacev2
- platform
fromversion: 6.6.0
contentitemexportablefields:
  contentitemfields: {}
supportedModules:
- agentix
- cloud
- cloud_posture
- cloud_runtime_security
- edr
- xsiam