Malware Investigation - Generic Deprecated Hidden
Deprecated. Use "Endpoint Malware Investigation - Generic" playbook instead. Investigate a malware using one or more integrations
Deprecated Content (Deprecated) · 10 tasks · 1 input · 0 outputs
Details
| ID | malware_investigation-_generic |
|---|---|
| From Version | 5.0.0 |
| Tasks | 10 |
README
DEPRECATED. Use “Endpoint Malware Investigation - Generic” playbook instead. Investigates malware using one or more integrations.
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
- Malware Investigation - Generic - Setup
- Entity Enrichment - Generic
- Calculate Severity - Generic
- Detonate File - Generic
Integrations
This playbook does not use any integrations.
Scripts
- CloseInvestigation
- AssignAnalystToIncident
Commands
This playbook does not use any commands.
Playbook Inputs
There are no inputs for this playbook.
Playbook Outputs
There are no outputs for this playbook.
Playbook Image
Inputs
OnCall— Set to true to assign only user that is currently on shift. Requires Cortex XSOAR v5.5 or later.
Flowchart
id: malware_investigation-_generic_-_setup version: -1 name: Malware Investigation - Generic - Setup description: |- Deprecated. Verify file sample and hostname information for the "Malware Investigation - Generic" playbook. If the file sample or hostname are missing, the playbook will attempt to retrieve them using one or more integrations fromversion: 5.0.0 starttaskid: "0" hidden: true tasks: "0": id: "0" taskid: f32e3309-cd35-442c-89bb-aedad44e51bc type: start task: id: f32e3309-cd35-442c-89bb-aedad44e51bc version: -1 name: "" description: "" iscommand: false brand: "" nexttasks: '#none#': - "1" - "12" separatecontext: false view: |- { "position": { "x": 387.5, "y": 50 } } "1": id: "1" taskid: 6cb37fdd-3179-44d7-8846-a16dcc2062f6 type: title task: id: 6cb37fdd-3179-44d7-8846-a16dcc2062f6 version: -1 name: Validate file sample description: "" type: title iscommand: false brand: "" nexttasks: '#none#': - "2" separatecontext: false view: |- { "position": { "x": 152.5, "y": 195 } } "2": id: "2" taskid: c7670e54-f3e4-4a0d-89c9-e9340888ae6b type: condition task: id: c7670e54-f3e4-4a0d-89c9-e9340888ae6b version: -1 name: Do we have a file sample? description: "" type: condition iscommand: false brand: "" nexttasks: '#default#': - "10" "yes": - "3" separatecontext: false conditions: - label: "yes" condition: - - operator: general.isExists left: value: complex: root: inputs.File filters: - - operator: general.isExists left: value: simple: inputs.File.EntryID iscontext: true iscontext: true view: |- { "position": { "x": 152.5, "y": 340 } } "3": id: "3" taskid: 3c625815-68d5-4647-8891-11ba875c03c5 type: title task: id: 3c625815-68d5-4647-8891-11ba875c03c5 version: -1 name: Done description: "" type: title iscommand: false brand: "" separatecontext: false view: |- { "position": { "x": 387.5, "y": 1527 } } "5": id: "5" taskid: a0a3c0b4-515b-4cf6-8347-cdb7faa041f3 type: playbook task: id: a0a3c0b4-515b-4cf6-8347-cdb7faa041f3 version: -1 name: Get File Sample By Hash - Generic description: "" playbookName: Get File Sample By Hash - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "18" scriptarguments: MD5: complex: root: inputs.MD5 SHA256: complex: root: inputs.SHA256 separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 view: |- { "position": { "x": 117.5, "y": 660 } } "6": id: "6" taskid: 2b71b1fe-ddb3-482a-8166-a8967829aba1 type: condition task: id: 2b71b1fe-ddb3-482a-8166-a8967829aba1 version: -1 name: Did we get a file sample? description: "" type: condition iscommand: false brand: "" nexttasks: '#default#': - "7" "yes": - "3" separatecontext: false conditions: - label: "yes" condition: - - operator: general.isExists left: value: complex: root: File filters: - - operator: general.isExists left: value: simple: File.EntryID iscontext: true iscontext: true view: |- { "position": { "x": -85, "y": 970 } } "7": id: "7" taskid: 496fdc1e-a8b5-421f-8d42-a29432859fd3 type: title task: id: 496fdc1e-a8b5-421f-8d42-a29432859fd3 version: -1 name: File sample is missing description: "" type: title iscommand: false brand: "" nexttasks: '#none#': - "8" separatecontext: false view: |- { "position": { "x": -85, "y": 1213 } } "8": id: "8" taskid: 06ca5c31-261e-40b2-826d-1e0b6b994130 type: regular task: id: 06ca5c31-261e-40b2-826d-1e0b6b994130 version: -1 name: Manually upload file sample description: "" type: regular iscommand: false brand: "" nexttasks: '#none#': - "3" separatecontext: false view: |- { "position": { "x": -85, "y": 1350 } } "10": id: "10" taskid: 52be4e01-b393-484d-8462-fc518e9dc3c2 type: title task: id: 52be4e01-b393-484d-8462-fc518e9dc3c2 version: -1 name: Try to get file sample description: "" type: title iscommand: false brand: "" nexttasks: '#none#': - "5" - "11" separatecontext: false view: |- { "position": { "x": -85, "y": 515 } } "11": id: "11" taskid: bb16ce78-06ab-4251-81a9-4a3bcd31426e type: playbook task: id: bb16ce78-06ab-4251-81a9-4a3bcd31426e version: -1 name: Get File Sample From Path - Generic description: "" playbookName: Get File Sample From Path - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "18" scriptarguments: Hostname: complex: root: inputs.Hostname Path: complex: root: inputs.Path UseD2: simple: "no" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 view: |- { "position": { "x": -290, "y": 660 } } "12": id: "12" taskid: cd33187e-1841-4fc0-82d0-92a0aff2bed1 type: title task: id: cd33187e-1841-4fc0-82d0-92a0aff2bed1 version: -1 name: Validate endpoint description: "" type: title iscommand: false brand: "" nexttasks: '#none#': - "13" separatecontext: false view: |- { "position": { "x": 645, "y": 195 } } "13": id: "13" taskid: ad325a74-79b8-49d4-8332-59488cad36d1 type: condition task: id: ad325a74-79b8-49d4-8332-59488cad36d1 version: -1 name: Do we have a Hostname? description: "" type: condition iscommand: false brand: "" nexttasks: '#default#': - "14" "yes": - "3" separatecontext: false conditions: - label: "yes" condition: - - operator: general.isExists left: value: complex: root: inputs.Hostname iscontext: true view: |- { "position": { "x": 645, "y": 340 } } "14": id: "14" taskid: 9df62264-a011-4474-8504-ec1eeeaeb32a type: playbook task: id: 9df62264-a011-4474-8504-ec1eeeaeb32a version: -1 name: Search Endpoints By Hash - Generic description: Hunt using available tools playbookName: Search Endpoints By Hash - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "15" scriptarguments: MD5Hash: complex: root: inputs.MD5 SHA1Hash: complex: root: inputs.SHA1 SHA256Hash: complex: root: inputs.SHA256 separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 view: |- { "position": { "x": 645, "y": 565 } } "15": id: "15" taskid: 5afea8b2-3723-4c9b-81e5-0a8565d11903 type: condition task: id: 5afea8b2-3723-4c9b-81e5-0a8565d11903 version: -1 name: Did we get a Hostname? description: "" type: condition iscommand: false brand: "" nexttasks: '#default#': - "16" "yes": - "3" separatecontext: false conditions: - label: "yes" condition: - - operator: general.isExists left: value: complex: root: Endpoint accessor: Hostname iscontext: true view: |- { "position": { "x": 645, "y": 755 } } "16": id: "16" taskid: 91e8996a-4e32-4041-882d-f37d07c4c54c type: title task: id: 91e8996a-4e32-4041-882d-f37d07c4c54c version: -1 name: Hostname is missing description: "" type: title iscommand: false brand: "" nexttasks: '#none#': - "17" separatecontext: false view: |- { "position": { "x": 645, "y": 1035 } } "17": id: "17" taskid: 9b2ade69-a18a-4ef6-8492-24467f71b7eb type: regular task: id: 9b2ade69-a18a-4ef6-8492-24467f71b7eb version: -1 name: Manually enter a Hostname description: "" scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: append: {} key: simple: Endpoint.Hostname value: {} separatecontext: false view: |- { "position": { "x": 645, "y": 1198 } } "18": id: "18" taskid: 98cf5f35-2be9-49ab-8e2f-aa6c5ab9873b type: title task: id: 98cf5f35-2be9-49ab-8e2f-aa6c5ab9873b version: -1 name: Check file sample results description: "" type: title iscommand: false brand: "" nexttasks: '#none#': - "6" separatecontext: false view: |- { "position": { "x": -85, "y": 825 } } view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 1542, "width": 1315, "x": -290, "y": 50 } } } inputs: - key: File value: complex: root: File required: false description: Malware sample to investigation - key: MD5 value: complex: root: File accessor: MD5 required: false description: MD5 to investigation - key: SHA1 value: complex: root: File accessor: SHA1 required: false description: SHA1 to investigation - key: SHA256 value: complex: root: File accessor: SHA256 required: false description: SHA256 to investigation - key: Hostname value: complex: root: Endpoint accessor: Hostname required: false description: Hostname to investigation - key: Path value: complex: root: File accessor: Path required: false description: File path to get sample from outputs: - contextPath: Endpoint description: The endpoint type: unknown - contextPath: Endpoint.Hostname description: Device hostname type: string - contextPath: File description: File sample object type: unknown tests: - No test - Need to do deprecated: true