Detonate File - ThreatGrid

Details

ID	`detonate_file_-_threatgrid`
From Version	5.0.0
Tasks	10

README

Detonates one or more files using the ThreatGrid integration. This playbook returns relevant reports to the War Room and file reputations to the context data.

The detonation supports the following file types: EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

This playbook does not use any integrations.

Scripts

Set

Commands

threat-grid-get-samples-state
threat-grid-upload-sample

Playbook Inputs

Name	Description	Default Value	Source	Required
File	The file object of the file to detonate.	None	File	Optional
FileName	The name of the file to detonate.	file-detonated-via-demisto	-	Optional
VM	The VM to use (string).	-	-	Optional
playbook	The name of the Threat Grid playbook to apply to this sample run.	Default	-	Optional
Private	The sample is marked private if this is present, and set to any value other than false.	-	-	Optional
Source	The string used for identifying the source of the detonation (user defined).	-	-	Optional
Tags	The comma-separated list of tags applied to this sample.	-	-	Optional
Interval	The polling frequency. How often the polling command should run (in minutes).	1	-	Optional
Timeout	How much time to wait before a timeout occurs (in minutes).	15	-	Optional

Playbook Outputs

Path	Description	Type
File.Malicious	The file malicious description.	unknown
File.Malicious.Vendor	The vendor that made the decision that the file is malicious.	string
File.Type	The file type. For example “PE”.	string
File.Size	The file size.	number
File.MD5	The MD5 hash of the file.	string
File.Name	The filename.	string
File.SHA1	The SHA1 hash of the file.	string
File	The file object.	unknown
File.SHA256	The SHA256 hash of the file.	string
DBotScore	The DBotScore object.	unknown
DBotScore.Indicator	The indicator we tested.	string
DBotScore.Type	The type of the indicator.	string
DBotScore.Vendor	The vendor used to calculate the score.	string
DBotScore.Score	The actual score.	number
Sample.State	The sample state.	unknown
Sample.ID	The sample ID.	unknown

Playbook Image

Detonate_File_ThreatGrid

Inputs

File — File object of the file to detonate.
FileName — Name of the file to detonate.
VM — The VM to use (string)
playbook — Name of the Threat Grid playbook to apply to this sample run
Private — If the value is set to 'False', the sample will not be private. Any value other than 'False' will set the sample to private.
Source — a string used for identifying the source of the detonation (user defined)
Tags — A comma-separated list of tags applied to this sample.
Interval — Polling frequency - how often the polling command should run (minutes)
Timeout — How much time to wait before a timeout occurs (minutes)

Outputs

File.Malicious — The File malicious description
File.Malicious.Vendor — For malicious files, the vendor that made the decision
File.Type — File type e.g. "PE"
File.Size — File size
File.MD5 — MD5 hash of the file
File.Name — Filename
File.SHA1 — SHA1 hash of the file
File — The File object
File.SHA256 — SHA256 hash of the file
DBotScore — The DBotScore object
DBotScore.Indicator — The indicator we tested
DBotScore.Type — The type of the indicator
DBotScore.Vendor — Vendor used to calculate the score
DBotScore.Score — The actual score
ThreatGrid.Sample.State — The sample state.
ThreatGrid.Sample.ID — The sample ID.

Commands used

threat-grid-get-samples-state threat-grid-upload-sample

Flowchart

Source

playbook-Detonate_File_-_ThreatGrid.yml playbook-Detonate_File_-_ThreatGrid_v2.yml playbook-Detonate_File_-_ThreatGrid_v2_README.md

Download History Raw

id: Detonate File - ThreatGrid v2
version: -1
name: Detonate File - ThreatGrid v2
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f850e557-f46a-44e6-87f6-e63960e54b3c
    type: start
    task:
      id: f850e557-f46a-44e6-87f6-e63960e54b3c
      description: start
      version: -1
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 1ce459a4-b6cb-4ce1-8189-8011ab82305b
    type: condition
    task:
      id: 1ce459a4-b6cb-4ce1-8189-8011ab82305b
      description: condition
      version: -1
      name: Is ThreatGrid enabled?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: ThreatGridv2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 60aa8fdc-d576-4409-8df6-27876aa6a064
    type: condition
    task:
      id: 60aa8fdc-d576-4409-8df6-27876aa6a064
      description: condition
      version: -1
      name: Is there a file to detonate?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.File
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: ce5638fa-87ef-4436-8286-910e797bce62
    type: title
    task:
      id: ce5638fa-87ef-4436-8286-910e797bce62
      description: title
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 0f9a53c1-0acf-4957-8722-d43505a392ec
    type: condition
    task:
      id: 0f9a53c1-0acf-4957-8722-d43505a392ec
      version: -1
      name: Is the file type supported?
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: match
          left:
            value:
              simple: File.Type
            iscontext: true
          right:
            value:
              simple: .*(?:EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b
          ignorecase: true
        - operator: match
          left:
            value:
              simple: File.Extension
            iscontext: true
          right:
            value:
              simple: .*(?:EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b
          ignorecase: true
        - operator: match
          left:
            value:
              simple: File.Info
            iscontext: true
          right:
            value:
              simple: .*(?:EXE|DLL|JAR|JS|PDF|DOC|DOCX|RTF|XLS|PPT|PPTX|XML|ZIP|VBN|SEP|XZ|GZ|BZ2|TAR|MHTML|SWF|LNK|URL|MSI|JTD|JTT|JTDC|JTTC|HWP|HWT|HWPX|BAT|HTA|PS1|VBS|WSF|JSE|VBE|CHM)\b
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: e4859d43-1c66-4c82-8b80-928a72c6e94f
    type: regular
    task:
      id: e4859d43-1c66-4c82-8b80-928a72c6e94f
      version: -1
      name: ThreatGrid Upload File
      description: Submits a sample to threat grid for analysis. URL or file, not both.
      script: '|||threat-grid-sample-upload'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      file_id:
        simple: ${File.EntryID}
      interval_in_seconds:
        simple: ${inputs.interval}
      timeout_in_seconds:
        simple: ${inputs.timeout}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: e47c11b0-6f32-4b8c-85a6-ae5612f34b82
    type: regular
    task:
      id: e47c11b0-6f32-4b8c-85a6-ae5612f34b82
      version: -1
      name: Set file to context
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      key:
        simple: File
      value:
        simple: ${inputs.File}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 23811c43-493a-4db8-8450-5a100168958e
    type: condition
    task:
      id: 23811c43-493a-4db8-8450-5a100168958e
      description: Check if the file size bigger than 0
      version: -1
      name: Is the file size bigger than 0?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThan
          left:
            value:
              simple: File.Size
            iscontext: true
          right:
            value:
              simple: "0"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1260,
        "width": 717.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: File object of the file to detonate.
  playbookInputQuery: null
- key: timeout
  value:
    simple: "60"
  required: false
  description: Indicates the time in seconds until the polling sequence times out.
    Default is 60.
  playbookInputQuery: null
- key: interval
  value:
    simple: "10"
  required: false
  description: Indicates the time in seconds to wait between command execution when
    'polling' argument is true. Minimum value is 10 seconds. Default is 10.
  playbookInputQuery: null
outputs:
- contextPath: File.Type
  description: File type e.g. "PE"
  type: string
- contextPath: File.Size
  description: File Size
  type: number
- contextPath: File.Extension
  description: File Extension
  type: string
quiet: true
fromversion: 5.0.0
description: Detonate one or more files using the ThreatGrid integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types - EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM
tests:
- Detonate File - Generic Test
contentitemexportablefields:
  contentitemfields:
    propagationLabels:
    - all

Detonate File - ThreatGrid Deprecated