USTA Account Takeover Prevention Employee Credential Incident

This playbook automates the detection and response process when compromised employee credentials are identified via USTA platform.

USTAv4 Cyber Threat Intelligence Platform · 10 tasks · 1 input · 0 outputs

Details

IDUSTA Account Takeover Prevention Employee Credential Incident
From Version6.10.0
Tasks10

README

This playbook automates the detection and response process when compromised employee credentials are identified via USTA platform.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

  • StringLength

Playbook Inputs

Name Description Default Value Required
Minimum Password Length Minimum length of password 5 Required

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

USTA Account Takeover Prevention Employee Credential Playbook

Inputs

  • MinimumPasswordLength — Minimum compromised credential's password length required for Playbook to work

Flowchart

yes yes yes Start Start Check if the credentials are valid Check if the credentials ... Perform a password reset and escalate Perform a password reset ... END END Check if the password meets the minimum length Check if the password mee... Check incident password length - StringLength Check incident password l... StringLength Done Done END END Is Corporate Credential ? Is Corporate Credential ? END END

Source

playbook-USTA_Account_Takeover_Prevention_Employee_Credential_Playbook.yml
Download History Raw 
id: USTA Account Takeover Prevention Employee Credential Incident
version: -1
fromversion: 6.10.0
name: USTA Account Takeover Prevention Employee Credential Incident
description: ' This playbook automates the detection and response process when compromised employee credentials are identified via USTA platform.'
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: c51a6743-d257-4e9c-966a-630163668797
    type: start
    task:
      id: c51a6743-d257-4e9c-966a-630163668797
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 695,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 64836d9e-7b26-4836-86dc-f9f98caad2e8
    type: condition
    task:
      id: 64836d9e-7b26-4836-86dc-f9f98caad2e8
      version: -1
      name: Check if the credentials are valid
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.ustaaccounttakeoverpreventionusername
            iscontext: true
          right:
            value: {}
        - operator: isNotEmpty
          left:
            value:
              simple: incident.ustaaccounttakeoverpreventionpassword
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: e8add26b-4b2b-4f6c-a28c-d93d06c675c1
    type: regular
    task:
      id: e8add26b-4b2b-4f6c-a28c-d93d06c675c1
      version: -1
      name: Perform a password reset and escalate
      type: regular
      iscommand: false
      description: ""
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 77518aa7-8c48-4ded-88e0-24c23ada2b01
    type: title
    task:
      id: 77518aa7-8c48-4ded-88e0-24c23ada2b01
      version: -1
      name: END
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 695,
          "y": 735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: f73c381e-e847-4f8a-8697-d17375d755b1
    type: condition
    task:
      id: f73c381e-e847-4f8a-8697-d17375d755b1
      version: -1
      name: Check if the password meets the minimum length
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: StringLength.Result
            iscontext: true
          right:
            value:
              simple: inputs.MinimumPasswordLength
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: fd6629e5-f4d2-4a97-8da6-e768a2bdf76f
    type: regular
    task:
      id: fd6629e5-f4d2-4a97-8da6-e768a2bdf76f
      version: -1
      name: Check incident password length
      description: Returns the length of  the string passed as the argument
      scriptName: StringLength
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      str:
        simple: ${incident.ustaaccounttakeoverpreventionpassword}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: ce226298-21af-4263-b5fa-76c6c17c3500
    type: title
    task:
      id: ce226298-21af-4263-b5fa-76c6c17c3500
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 2f489ffe-b050-4c7f-9a96-dbfe443c18da
    type: title
    task:
      id: 2f489ffe-b050-4c7f-9a96-dbfe443c18da
      version: -1
      name: END
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 17509d9f-7beb-4de1-be0f-8db3b68586be
    type: condition
    task:
      id: 17509d9f-7beb-4de1-be0f-8db3b68586be
      version: -1
      name: Is Corporate Credential ?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isTrue
          left:
            value:
              simple: incident.ustaaccounttakeoverpreventioniscorporate
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 695,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 012392e5-46b7-44d1-9ef5-c4765577edcb
    type: title
    task:
      id: 012392e5-46b7-44d1-9ef5-c4765577edcb
      version: -1
      name: END
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 910,
          "y": 385
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1085,
        "width": 1240,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: MinimumPasswordLength
  value:
    simple: "5"
  required: true
  description: Minimum compromised credential's password length required for Playbook to work
  playbookInputQuery:
outputs: []
quiet: true
tests:
- No tests (auto formatted)