T1059 - Command and Scripting Interpreter
This playbook handles command and scripting interpreter alerts based on the MITRE T1059 technique. An attacker might abuse command and script interpreters to execute commands, scripts, or binaries. Most systems come with some kind of built-in command line interface and scripting capabilities. For example, macOS and Linux distributions include some form of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. **Attacker's Goals:** An attacker can abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in initial access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. An attacker may also execute commands through interactive terminals/shells, as well as utilize various remote services to achieve remote execution. **Analysis** Due to the nature of this technique and the usage of built-in command line interfaces, the first step of the playbook is to analyze the command line. The command line analysis does the following: - Checks and decodes base64 - Extracts and enriches indicators from the command line - Checks specific arguments for malicious usage **Investigative Actions:** The playbook checks for additional activity using the 'Endpoint Investigation Plan' playbook and utilizes the power of insight alerts. **Response Actions** After analyzing the data, the playbook's first response action is to contain the threat based on the initial data provided within the alert. In this phase, the playbook will: * Isolate the endpoint based on playbook inputs. When the playbook proceeds, it checks for additional activity using the 'Endpoint Investigation Plan' playbook. It then continues with the next stage, which includes, containment and eradication. This phase executes the following containment actions: * Automatically isolates the endpoint It then continues with the following eradication actions: * process termination
Core · 29 tasks · 23 inputs · 0 outputs
Details
| ID | T1059 - Command and Scripting Interpreter |
|---|---|
| From Version | 6.6.0 |
| Tasks | 29 |
README
This playbook handles command and scripting interpreter alerts based on the MITRE T1059 technique.
An attacker might abuse command and script interpreters to execute commands, scripts, or binaries.
Most systems come with some kind of built-in command line interface and scripting capabilities. For example, macOS and Linux distributions include some form of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.
Attacker’s Goals:
An attacker can abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in initial access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. An attacker may also execute commands through interactive terminals/shells, as well as utilize various remote services to achieve remote execution.
Analysis
Due to the nature of this technique and the usage of built-in command line interfaces, the first step of the playbook is to analyze the command line.
The command line analysis does the following:
- Checks and decodes base64
- Extracts and enriches indicators from the command line
- Checks specific arguments for malicious usage
Investigative Actions:
The playbook checks for additional activity using the ‘Endpoint Investigation Plan’ playbook and utilizes the power of insight alerts.
Response Actions
After analyzing the data, the playbook’s first response action is to contain the threat based on the initial data provided within the alert. In this phase, the playbook will:
- Isolate the endpoint based on playbook inputs.
When the playbook proceeds, it checks for additional activity using the ‘Endpoint Investigation Plan’ playbook. It then continues with the next stage, which includes, containment and eradication.
This phase executes the following containment actions:
- Automatically isolates the endpoint
It then continues with the following eradication actions:
- process termination
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
- Command-Line Analysis
- Containment Plan
- Recovery Plan
- Handle False Positive Alerts
- Eradication Plan
- Ticket Management - Generic
- Endpoint Investigation Plan
Integrations
- CortexCoreIR
- Cortex Core - IR
Scripts
This playbook does not use any scripts.
Commands
- core-get-cmd-analytics-prevalence
- closeInvestigation
- setParentIncidentFields
- core-get-dynamic-analysis
Playbook Inputs
| Name | Description | Default Value | Required |
|---|---|---|---|
| ShouldCloseAutomatically | Whether to close the alert automatically or manually, after an analyst’s review. | False | Optional |
| AutoRestoreEndpoint | Whether to execute the Recovery playbook. | False | Optional |
| AutoContainment | Whether to execute automatically or manually the containment plan tasks: * Block indicators * Quarantine file * Disable user |
Optional | |
| FileRemediation | Can be ‘Quarantine’ or ‘Delete’. | Optional | |
| ShouldOpenTicket | Whether to open a ticket automatically in a ticketing system. (True/False). | False | Optional |
| serviceNowShortDescription | A short description of the ticket. | XSIAM Incident ID - ${parentIncidentFields.incident_id} | Optional |
| serviceNowImpact | The impact for the new ticket. Leave empty for ServiceNow default impact. | Optional | |
| serviceNowUrgency | The urgency of the new ticket. Leave empty for ServiceNow default urgency. | Optional | |
| serviceNowSeverity | The severity of the new ticket. Leave empty for ServiceNow default severity. | Optional | |
| serviceNowTicketType | The ServiceNow ticket type. Options are “incident”, “problem”, “change_request”, “sc_request”, “sc_task”, or “sc_req_item”. Default is “incident”. | Optional | |
| serviceNowCategory | The category of the ServiceNow ticket. | Optional | |
| serviceNowAssignmentGroup | The group to which to assign the new ticket. | Optional | |
| ZendeskPriority | The urgency with which the ticket should be addressed. Allowed values are “urgent”, “high”, “normal”, or “low”. | Optional | |
| ZendeskRequester | The user who requested this ticket. | Optional | |
| ZendeskStatus | The state of the ticket. Allowed values are “new”, “open”, “pending”, “hold”, “solved”, or “closed”. | Optional | |
| ZendeskSubject | The value of the subject field for this ticket. | XSIAM Incident ID - ${parentIncidentFields.incident_id} | Optional |
| ZendeskTags | The array of tags applied to this ticket. | Optional | |
| ZendeskType | The type of this ticket. Allowed values are “problem”, “incident”, “question”, or “task”. | Optional | |
| ZendeskAssigne | The agent currently assigned to the ticket. | Optional | |
| ZendeskCollaborators | The users currently CC’ed on the ticket. | Optional | |
| description | The ticket description. | ${parentIncidentFields.description}. ${parentIncidentFields.xdr_url} | Optional |
| addCommentPerEndpoint | Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False. | True | Optional |
| CommentToAdd | Comment for the ticket. | ${alert.name}. Alert ID: ${alert.id} | Optional |
Playbook Outputs
There are no outputs for this playbook.
Playbook Image
Inputs
ShouldCloseAutomatically— Whether to close the alert automatically or manually, after an analyst's review.AutoRestoreEndpoint— Whether to execute the Recovery playbook.AutoContainment— Whether to execute automatically or manually the containment plan tasks: * Block indicators * Quarantine file * Disable userFileRemediation— Can be 'Quarantine' or 'Delete'.ShouldOpenTicket— Whether to open a ticket automatically in a ticketing system. (True/False).serviceNowShortDescription— A short description of the ticket.serviceNowImpact— The impact for the new ticket. Leave empty for ServiceNow default impact.serviceNowUrgency— The urgency of the new ticket. Leave empty for ServiceNow default urgency.serviceNowSeverity— The severity of the new ticket. Leave empty for ServiceNow default severity.serviceNowTicketType— The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident".serviceNowCategory— The category of the ServiceNow ticket.serviceNowAssignmentGroup— The group to which to assign the new ticket.ZendeskPriority— The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low".ZendeskRequester— The user who requested this ticket.ZendeskStatus— The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed".ZendeskSubject— The value of the subject field for this ticket.ZendeskTags— The array of tags applied to this ticket.ZendeskType— The type of this ticket. Allowed values are "problem", "incident", "question", or "task".ZendeskAssigne— The agent currently assigned to the ticket.ZendeskCollaborators— The users currently CC'ed on the ticket.description— The ticket description.addCommentPerEndpoint— Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.CommentToAdd— Comment for the ticket.
Commands used
closeInvestigation
core-get-cmd-analytics-prevalence
core-get-dynamic-analysis
setParentIncidentFields
Flowchart
id: T1059 - Command and Scripting Interpreter version: -1 name: T1059 - Command and Scripting Interpreter description: "This playbook handles command and scripting interpreter alerts based on the MITRE T1059 technique.\nAn attacker might abuse command and script interpreters to execute commands, scripts, or binaries.\nMost systems come with some kind of built-in command line interface and scripting capabilities. For example, macOS and Linux distributions include some form of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.\n\n\n**Attacker's Goals:**\n\nAn attacker can abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in initial access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. An attacker may also execute commands through interactive terminals/shells, as well as utilize various remote services to achieve remote execution.\n\n**Analysis**\n\nDue to the nature of this technique and the usage of built-in command line interfaces, the first step of the playbook is to analyze the command line. \nThe command line analysis does the following:\n- Checks and decodes base64\n- Extracts and enriches indicators from the command line\n- Checks specific arguments for malicious usage \n\n**Investigative Actions:**\nThe playbook checks for additional activity using the 'Endpoint Investigation Plan' playbook and utilizes the power of insight alerts.\n\n**Response Actions**\n\nAfter analyzing the data, the playbook's first response action is to contain the threat based on the initial data provided within the alert. In this phase, the playbook will:\n\n* Isolate the endpoint based on playbook inputs.\n\nWhen the playbook proceeds, it checks for additional activity using the 'Endpoint Investigation Plan' playbook. It then continues with the next stage, which includes, containment and eradication.\n\nThis phase executes the following containment actions:\n\n* Automatically isolates the endpoint\n\nIt then continues with the following eradication actions:\n\n* process termination" starttaskid: "0" tasks: "0": id: "0" taskid: 8a695fbb-5cd5-4fed-8c05-2de37b374f02 type: start task: id: 8a695fbb-5cd5-4fed-8c05-2de37b374f02 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "3" separatecontext: false view: |- { "position": { "x": 1140, "y": -240 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "3": id: "3" taskid: 2eca42b7-3c92-4b5a-8395-9696e76b2eca type: title task: id: 2eca42b7-3c92-4b5a-8395-9696e76b2eca version: -1 name: Analysis type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "54" separatecontext: false view: |- { "position": { "x": 1140, "y": -85 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "14": id: "14" taskid: e41ef180-47df-4fc3-8661-b9c760d51cbd type: title task: id: e41ef180-47df-4fc3-8661-b9c760d51cbd version: -1 name: 'Containment ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "51" separatecontext: false view: |- { "position": { "x": 1140, "y": 2050 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "15": id: "15" taskid: 93ddf2dd-f186-4e8f-8600-d63d0008f0be type: title task: id: 93ddf2dd-f186-4e8f-8600-d63d0008f0be version: -1 name: Finding type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "39" separatecontext: false view: |- { "position": { "x": 1140, "y": 590 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "16": id: "16" taskid: 9bcab523-2706-4c67-8a92-bd215b33334a type: condition task: id: 9bcab523-2706-4c67-8a92-bd215b33334a version: -1 name: Manual review - was it your security vendor? description: |+ Check the script that ran and verify: Was it your security vendor? Was it a script from your IT, or a known file? type: condition iscommand: false brand: "" nexttasks: "No": - "57" "Yes": - "44" separatecontext: false view: |- { "position": { "x": 720, "y": 1320 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "17": id: "17" taskid: 44575d80-9fe5-4a34-877a-e0aebb078ffb type: regular task: id: 44575d80-9fe5-4a34-877a-e0aebb078ffb version: -1 name: close alert description: Closes the alert in Cortex XSIAM script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "29" scriptarguments: closeReason: simple: Resolved - Threat Handled separatecontext: false view: |- { "position": { "x": 1140, "y": 3890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "19": id: "19" taskid: c71ad1c3-4763-48f8-8924-a5829300da3a type: title task: id: c71ad1c3-4763-48f8-8924-a5829300da3a version: -1 name: Investigation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "50" separatecontext: false view: |- { "position": { "x": 1140, "y": 2375 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "27": id: "27" taskid: 9584a013-1f93-4b4f-8e0f-9dfc08f4fd77 type: title task: id: 9584a013-1f93-4b4f-8e0f-9dfc08f4fd77 version: -1 name: 'Remediation ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "42" - "52" separatecontext: false view: |- { "position": { "x": 1140, "y": 2910 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "28": id: "28" taskid: 65b1e124-5960-4978-8951-db9ab7ec1b66 type: condition task: id: 65b1e124-5960-4978-8951-db9ab7ec1b66 version: -1 name: Should restore affected endpoint? description: Checks if it should release the affected endpoint from isolation. type: condition iscommand: false brand: "" nexttasks: '#default#': - "34" "yes": - "43" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.AutoRestoreEndpoint iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 800, "y": 3365 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "29": id: "29" taskid: a0944a44-9352-42db-8c79-7efb05810cb0 type: title task: id: a0944a44-9352-42db-8c79-7efb05810cb0 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 450, "y": 4080 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "34": id: "34" taskid: efb795f3-f412-4285-86d3-c5993ab4affd type: condition task: id: efb795f3-f412-4285-86d3-c5993ab4affd version: -1 name: Should close alert automatically? description: Whether to close the alert automatically or manually. type: condition iscommand: false brand: "" nexttasks: '#default#': - "29" "yes": - "17" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.ShouldCloseAutomatically iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 800, "y": 3720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "39": id: "39" taskid: b1838b4e-9970-4c49-8018-6145798ee35d type: condition task: id: b1838b4e-9970-4c49-8018-6145798ee35d version: -1 name: 'Found any malicious behavior? ' description: Checks if malicious behavior was found. type: condition iscommand: false brand: "" nexttasks: '#default#': - "55" "yes": - "57" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: CommandlineVerdict iscontext: true right: value: {} view: |- { "position": { "x": 1140, "y": 730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "42": id: "42" taskid: 7f4600b1-e7eb-4e39-8d1f-d4a60f0f01e4 type: playbook task: id: 7f4600b1-e7eb-4e39-8d1f-d4a60f0f01e4 version: -1 name: Eradication Plan description: |- This playbook handles all the eradication actions available with Cortex XSIAM. The playbook allows you to eradicate the incident with one of the following tasks: * Reset user password * Delete file * Kill process (currently, the playbook supports terminating a process by name). The playbook inputs allows you to manipulate the execution flow, please pay attention to the inputs description. playbookName: Eradication Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "49" scriptarguments: AutoEradicate: simple: "false" EndpointID: complex: root: alert accessor: agentid FilePath: complex: root: foundIncidents.CustomFields accessor: initiatorpath FileRemediation: simple: Quarantine Username: complex: root: foundIncidents.CustomFields accessor: username separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1140, "y": 3050 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "43": id: "43" taskid: 7dd85db5-f1ee-48ac-8c44-2d953ce9e43d type: playbook task: id: 7dd85db5-f1ee-48ac-8c44-2d953ce9e43d version: -1 name: Recovery Plan description: |- This playbook handles all the recovery actions available with Cortex XSIAM. The playbook allows to recover from the incident with one of the following tasks: * Unisolate endpoint * Restore quarantined file The playbook inputs allows you to manipulate the execution flow, please pay attention to the inputs description. playbookName: Recovery Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "34" scriptarguments: endpointID: complex: root: alert accessor: agentid releaseFile: simple: "false" unIsolateEndpoint: simple: "true" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1140, "y": 3540 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "44": id: "44" taskid: b7f1d891-9d2e-4dd2-8926-5c3606a9c7f3 type: playbook task: id: b7f1d891-9d2e-4dd2-8926-5c3606a9c7f3 version: -1 name: Handle False Positive Alerts description: | This playbook handles false positive alerts. playbookName: Handle False Positive Alerts type: playbook iscommand: false brand: "" nexttasks: '#none#': - "29" scriptarguments: FileSHA256: complex: root: alert accessor: initiatorsha256 ShouldCloseAutomatically: complex: root: inputs.ShouldCloseAutomatically alertName: complex: root: alert accessor: name sourceIP: complex: root: alert accessor: hostip username: complex: root: alert accessor: username separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 450, "y": 1500 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "47": id: "47" taskid: 2b789413-c965-4c6f-867f-bf3525a2d620 type: playbook task: id: 2b789413-c965-4c6f-867f-bf3525a2d620 version: -1 name: Command-Line Analysis description: "This playbook takes the command line from the alert and performs the following actions:\n- Checks for base64 string and decodes if exists\n- Extracts and enriches indicators from the command line\n- Checks specific arguments for malicious usage \n\nAt the end of the playbook, it sets a possible verdict for the command line, based on the finding:\n1. Indicators found in the command line\n2. Found AMSI techniques\n3. Found suspicious parameters\n4. Usage of malicious tools\n5. Indication of network activity" playbookName: Command-Line Analysis type: playbook iscommand: false brand: "" nexttasks: '#none#': - "15" scriptarguments: Commandline: complex: root: Core.DynamicAnalysis.internals.attributes accessor: content transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: ${Core.DynamicAnalysis.internals.attributes.scriptblock_text} - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: ${Core.DynamicAnalysis.internals.attributes.original_command_line} - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: ${alert.targetprocesscmd} separatecontext: false loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1140, "y": 410 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "48": id: "48" taskid: ccddf57e-2637-434a-8bb1-2ac71c2111dc type: condition task: id: ccddf57e-2637-434a-8bb1-2ac71c2111dc version: -1 name: Found relevant information? description: Checks whether relevant information is found. type: condition iscommand: false brand: "" nexttasks: '#default#': - "49" "yes": - "27" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: foundIncidents iscontext: true view: |- { "position": { "x": 1140, "y": 2700 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "49": id: "49" taskid: ec9ef19d-b6cf-4245-862b-0aecee3d7fb1 type: title task: id: ec9ef19d-b6cf-4245-862b-0aecee3d7fb1 version: -1 name: Recovery type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "28" separatecontext: false view: |- { "position": { "x": 800, "y": 3220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "50": id: "50" taskid: 9a7af198-01cb-4a8c-8a67-55cf63a473a2 type: playbook task: id: 9a7af198-01cb-4a8c-8a67-55cf63a473a2 version: -1 name: Endpoint Investigation Plan description: |- This playbook handles all the endpoint investigation actions available with Cortex XSIAM. The playbook allows you to investigate and hunt for more information using one of the following tasks: * Pre-defined MITRE Tactics * Host fields (Host ID) * Attacker fields (Attacker IP, External host) * MITRE techniques * File hash (currently, the playbook supports only SHA256) The playbook inputs allows you to manipulate the execution flow, please pay attention to the inputs description. playbookName: Endpoint Investigation Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "48" scriptarguments: HuntCnCTechniques: simple: "True" HuntCollectionTechniques: simple: "True" HuntDefenseEvasionTechniques: simple: "True" HuntDiscoveryTechniques: simple: "True" HuntExecutionTechniques: simple: "True" HuntImpactTechniques: simple: "True" HuntInitialAccessTechniques: simple: "True" HuntLateralMovementTechniques: simple: "True" HuntPersistenceTechniques: simple: "True" HuntPrivilegeEscalationTechniques: simple: "True" HuntReconnaissanceTechniques: simple: "True" agentID: complex: root: alert accessor: agentid separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1140, "y": 2520 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "51": id: "51" taskid: 54fef140-47c3-4dfb-846a-8783124320b4 type: playbook task: id: 54fef140-47c3-4dfb-846a-8783124320b4 version: -1 name: Containment Plan description: |- This playbook handles all the containment actions available with XSIAM. The playbook allows to contain the incident with one of the following tasks: * Isolate endpoint * Disable account * Quarantine file * Block indicators * Clear user session (currently, the playbook supports only Okta) The playbook inputs allows you to manipulate the execution flow, please pay attention to the inputs description. playbookName: Containment Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "19" scriptarguments: AutoContainment: complex: root: inputs.AutoContainment transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: "false" BlockIndicators: simple: "True" ClearUserSessions: simple: "False" Domain: complex: root: ExtractedIndicators accessor: Domain EndpointID: complex: root: alert accessor: agentid FileContainment: simple: "False" FileRemediation: simple: Quarantine IP: complex: root: ExtractedIndicators accessor: IP URL: complex: root: ExtractedIndicators accessor: URL UserContainment: simple: "False" separatecontext: true loop: iscommand: false scriptArguments: AutoContainment: complex: root: inputs.AutoContainment transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: "false" BlockIndicators: simple: "True" ClearUserSessions: simple: "False" EndpointID: complex: root: alert accessor: agentid FileContainment: simple: "True" FileHash: complex: root: alert filters: - - operator: isNotEqualString left: value: simple: alert.initiatorpath iscontext: true right: value: simple: c:\windows\explorer.exe ignorecase: true accessor: initiatorsha256 transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: alert.targetprocesssha256 iscontext: true FilePath: complex: root: alert.initiatorpath filters: - - operator: isNotEqualString left: value: simple: alert.initiatorpath iscontext: true right: value: simple: c:\windows\explorer.exe ignorecase: true transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: alert.targetprocesscmd iscontext: true - operator: replaceMatch args: regex: value: simple: \" replaceWith: {} - operator: uniq FileRemediation: simple: Quarantine IAMUserDomain: {} UserContainment: simple: "False" Username: complex: root: alert accessor: username exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1140, "y": 2200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "52": id: "52" taskid: f9aa1d02-285d-4299-8cbc-6ed55d11a413 type: playbook task: id: f9aa1d02-285d-4299-8cbc-6ed55d11a413 version: -1 name: Containment Plan description: |- This playbook handles all the containment actions available with XSIAM. The playbook allows to contain the incident with one of the following tasks: * Isolate endpoint * Disable account * Quarantine file * Block indicators * Clear user session (currently, the playbook supports only Okta) The playbook inputs allows you to manipulate the execution flow, please pay attention to the inputs description. playbookName: Containment Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "49" scriptarguments: AutoContainment: complex: root: inputs.AutoContainment transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: "false" BlockIndicators: simple: "True" ClearUserSessions: simple: "False" EndpointID: complex: root: alert accessor: agentid FileContainment: simple: "True" FileHash: complex: root: foundIncidents.CustomFields filters: - - operator: isNotEqualString left: value: simple: foundIncidents.CustomFields.initiatorpath iscontext: true right: value: simple: c:\windows\explorer.exe ignorecase: true accessor: initiatorsha256 FilePath: complex: root: foundIncidents.CustomFields.initiatorpath filters: - - operator: isNotEqualString left: value: simple: foundIncidents.CustomFields.initiatorpath iscontext: true right: value: simple: c:\windows\explorer.exe ignorecase: true transformers: - operator: uniq FileRemediation: complex: root: inputs.FileRemediation transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: "false" UserContainment: simple: "False" separatecontext: true loop: iscommand: false scriptArguments: AutoContainment: complex: root: inputs.AutoContainment transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: "false" BlockIndicators: simple: "True" ClearUserSessions: simple: "False" EndpointID: complex: root: alert accessor: agentid FileContainment: simple: "True" FileHash: complex: root: foundIncidents.CustomFields filters: - - operator: isNotEqualString left: value: simple: foundIncidents.CustomFields.initiatorpath iscontext: true right: value: simple: c:\windows\explorer.exe ignorecase: true accessor: initiatorsha256 FilePath: complex: root: foundIncidents.CustomFields.initiatorpath filters: - - operator: isNotEqualString left: value: simple: foundIncidents.CustomFields.initiatorpath iscontext: true right: value: simple: c:\windows\explorer.exe ignorecase: true transformers: - operator: uniq FileRemediation: complex: root: inputs.FileRemediation IAMUserDomain: {} UserContainment: simple: "False" exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1580, "y": 3050 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "54": id: "54" taskid: 2af58fe8-289d-4589-80bf-e2807e68813c type: regular task: id: 2af58fe8-289d-4589-80bf-e2807e68813c version: -1 name: Get commandline description: Returns a dynamic analysis of each alert ID. script: '|||core-get-dynamic-analysis' type: regular iscommand: true brand: "" nexttasks: '#none#': - "61" scriptarguments: alert_ids: complex: root: alert accessor: id separatecontext: false view: |- { "position": { "x": 1140, "y": 50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "55": id: "55" taskid: c16a3995-ec20-430a-84f3-1a71844b1316 type: regular task: id: c16a3995-ec20-430a-84f3-1a71844b1316 version: -1 name: Get CMD prevalence description: Get the prevalence of a process_command_line, identified by process_command_line. script: Cortex Core - IR|||core-get-cmd-analytics-prevalence type: regular iscommand: true brand: Cortex Core - IR nexttasks: '#none#': - "56" scriptarguments: process_command_line: complex: root: commandline accessor: original separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 720, "y": 910 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "56": id: "56" taskid: 0102cdcc-b833-47d4-860e-60ce26596881 type: condition task: id: 0102cdcc-b833-47d4-860e-60ce26596881 version: -1 name: Found CMD to be prevalent? description: Check if command line is prevalent or not type: condition iscommand: false brand: "" nexttasks: '#default#': - "16" "yes": - "44" separatecontext: false conditions: - label: "yes" condition: - - operator: containsGeneral left: value: complex: root: Core.AnalyticsPrevalence.Cmd accessor: value iscontext: true right: value: simple: "true" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 720, "y": 1090 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "57": id: "57" taskid: 364ca85b-06b6-4383-8050-9bf92fe041d8 type: regular task: id: 364ca85b-06b6-4383-8050-9bf92fe041d8 version: -1 name: Set Incident Severity to High description: commands.local.cmd.set.parent.incident.field script: Builtin|||setParentIncidentFields type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "58" scriptarguments: manual_severity: simple: high separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1140, "y": 1500 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 2 isoversize: false isautoswitchedtoquietmode: false "58": id: "58" taskid: e85e2d6c-f75d-49a2-8bc9-320480b2752e type: condition task: id: e85e2d6c-f75d-49a2-8bc9-320480b2752e version: -1 name: Should open a ticket automatically in a ticketing system? description: Checks whether to open a ticket automatically in a ticketing system. type: condition iscommand: false brand: "" nexttasks: '#default#': - "14" "yes": - "59" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.ShouldOpenTicket iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 1140, "y": 1660 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "59": id: "59" taskid: 79072a9a-573a-4d19-868b-03a05447f7f9 type: playbook task: id: 79072a9a-573a-4d19-868b-03a05447f7f9 version: -1 name: Ticket Management - Generic description: "`Ticket Management - Generic` allows you to open new tickets or update comments to the existing ticket in the following ticketing systems:\n-ServiceNow \n-Zendesk \nusing the following sub-playbooks:\n-`ServiceNow - Ticket Management`\n-`Zendesk - Ticket Management`\n" playbookName: Ticket Management - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "14" scriptarguments: CommentToAdd: complex: root: inputs.CommentToAdd ZendeskAssigne: complex: root: inputs.ZendeskAssigne ZendeskCollaborators: complex: root: inputs.ZendeskCollaborators ZendeskPriority: complex: root: inputs.ZendeskPriority ZendeskRequester: complex: root: inputs.ZendeskRequester ZendeskStatus: complex: root: inputs.ZendeskStatus ZendeskSubject: complex: root: inputs.ZendeskSubject ZendeskTags: complex: root: inputs.ZendeskTags ZendeskType: complex: root: inputs.ZendeskType addCommentPerEndpoint: complex: root: inputs.addCommentPerEndpoint description: complex: root: inputs.description serviceNowAssignmentGroup: complex: root: inputs.serviceNowAssignmentGroup serviceNowCategory: complex: root: inputs.serviceNowCategory serviceNowImpact: complex: root: inputs.serviceNowImpact serviceNowSeverity: complex: root: inputs.serviceNowSeverity serviceNowShortDescription: complex: root: inputs.serviceNowShortDescription serviceNowTicketType: complex: root: inputs.serviceNowTicketType serviceNowUrgency: complex: root: inputs.serviceNowUrgency separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1390, "y": 1840 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "61": id: "61" taskid: 6c95fc1f-ffd0-4de4-818f-41e07987c215 type: condition task: id: 6c95fc1f-ffd0-4de4-818f-41e07987c215 version: -1 name: Is the CMD defined? description: Checks the existence of the command line parameters. type: condition iscommand: false brand: "" nexttasks: '#default#': - "62" "yes": - "47" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: Core.DynamicAnalysis.internals.attributes.content iscontext: true - operator: isNotEmpty left: value: simple: Core.DynamicAnalysis.internals.attributes.scriptblock_text iscontext: true - operator: isNotEmpty left: value: simple: Core.DynamicAnalysis.internals.attributes.original_command_line iscontext: true - operator: isNotEmpty left: value: simple: alert.targetprocesscmd iscontext: true continueonerrortype: "" view: |- { "position": { "x": 1140, "y": 220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "62": id: "62" taskid: 77940295-f899-43d3-8b41-40fef01d6993 type: title task: id: 77940295-f899-43d3-8b41-40fef01d6993 version: -1 name: No CMD Parameters found type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "29" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 170, "y": 440 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "16_44_Yes": 0.53, "28_34_#default#": 0.51, "28_43_yes": 0.43, "34_29_#default#": 0.25, "48_27_yes": 0.62, "48_49_#default#": 0.47, "56_16_#default#": 0.46, "61_47_yes": 0.5, "61_62_#default#": 0.52 }, "paper": { "dimensions": { "height": 4385, "width": 1790, "x": 170, "y": -240 } } } inputs: - key: ShouldCloseAutomatically value: simple: "False" required: false description: "Whether to close the alert automatically or manually, after an analyst's review." playbookInputQuery: - key: AutoRestoreEndpoint value: simple: "False" required: false description: Whether to execute the Recovery playbook. playbookInputQuery: - key: AutoContainment value: {} required: false description: "Whether to execute automatically or manually the containment plan tasks:\n* Block indicators\n* Quarantine file\n* Disable user " playbookInputQuery: - key: FileRemediation value: {} required: false description: Can be 'Quarantine' or 'Delete'. playbookInputQuery: - key: ShouldOpenTicket value: simple: "False" required: false description: Whether to open a ticket automatically in a ticketing system. (True/False). playbookInputQuery: - key: serviceNowShortDescription value: simple: XSIAM Incident ID - ${parentIncidentFields.incident_id} required: false description: A short description of the ticket. playbookInputQuery: - key: serviceNowImpact value: {} required: false description: The impact for the new ticket. Leave empty for ServiceNow default impact. playbookInputQuery: - key: serviceNowUrgency value: {} required: false description: The urgency of the new ticket. Leave empty for ServiceNow default urgency. playbookInputQuery: - key: serviceNowSeverity value: {} required: false description: The severity of the new ticket. Leave empty for ServiceNow default severity. playbookInputQuery: - key: serviceNowTicketType value: {} required: false description: The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident". playbookInputQuery: - key: serviceNowCategory value: {} required: false description: The category of the ServiceNow ticket. playbookInputQuery: - key: serviceNowAssignmentGroup value: {} required: false description: The group to which to assign the new ticket. playbookInputQuery: - key: ZendeskPriority value: {} required: false description: The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low". playbookInputQuery: - key: ZendeskRequester value: {} required: false description: The user who requested this ticket. playbookInputQuery: - key: ZendeskStatus value: {} required: false description: The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed". playbookInputQuery: - key: ZendeskSubject value: simple: XSIAM Incident ID - ${parentIncidentFields.incident_id} required: false description: The value of the subject field for this ticket. playbookInputQuery: - key: ZendeskTags value: {} required: false description: The array of tags applied to this ticket. playbookInputQuery: - key: ZendeskType value: {} required: false description: The type of this ticket. Allowed values are "problem", "incident", "question", or "task". playbookInputQuery: - key: ZendeskAssigne value: {} required: false description: The agent currently assigned to the ticket. playbookInputQuery: - key: ZendeskCollaborators value: {} required: false description: The users currently CC'ed on the ticket. playbookInputQuery: - key: description value: simple: ${parentIncidentFields.description}. ${parentIncidentFields.xdr_url} required: false description: The ticket description. playbookInputQuery: - key: addCommentPerEndpoint value: simple: "True" required: false description: 'Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.' playbookInputQuery: - key: CommentToAdd value: simple: '${alert.name}. Alert ID: ${alert.id}' required: false description: Comment for the ticket. playbookInputQuery: inputSections: - inputs: - ShouldCloseAutomatically name: Alert Management description: Alert management settings and data, including escalation processes, and user engagements. - inputs: - AutoContainment - FileRemediation - AutoRestoreEndpoint name: Remediation description: Remediation settings and data, including containment, eradication, and recovery. - inputs: - ShouldOpenTicket - serviceNowShortDescription - serviceNowImpact - serviceNowUrgency - serviceNowSeverity - serviceNowTicketType - serviceNowCategory - serviceNowAssignmentGroup - ZendeskPriority - ZendeskRequester - ZendeskStatus - ZendeskSubject - ZendeskTags - ZendeskType - ZendeskAssigne - ZendeskCollaborators - description - addCommentPerEndpoint - CommentToAdd name: Ticket Management description: Ticket management settings and data. outputSections: - outputs: [] name: General (Outputs group) description: Generic group for outputs outputs: [] tests: - T1059 - Command and Scripting Interpreter - Test fromversion: 6.6.0 contentitemexportablefields: contentitemfields: {} marketplaces: - marketplacev2 - platform supportedModules: - agentix - cloud - cloud_posture - cloud_runtime_security - edr - xsiam