Malware Investigation - Generic - Setup Deprecated Hidden

Deprecated. Verify file sample and hostname information for the "Malware Investigation - Generic" playbook. If the file sample or hostname are missing, the playbook will attempt to retrieve them using one or more integrations

Deprecated Content (Deprecated) · 17 tasks · 6 inputs · 3 outputs

Details

IDmalware_investigation-_generic_-_setup
From Version5.0.0
Tasks17

README

DEPRECATED. Verifies a file sample and hostname information for the “Malware Investigation - Generic” playbook.
If the file sample or hostname are missing, the playbook will attempt to retrieve them using one or more integrations.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Get File Sample By Hash - Generic
  • Get File Sample From Path - Generic
  • Search Endpoints By Hash - Generic

Integrations

This playbook does not use any integrations.

Scripts

  • Set

Commands

This playbook does not use any commands.

Playbook Inputs

Name Description Default Value Source Required
File The malware sample to investigate. None File Optional
MD5 The MD5 hash to investigate. MD5 File Optional
SHA1 The SHA1 hash to investigate. SHA1 File Optional
SHA256 The SHA256 hash to investigate. SHA256 File Optional
Hostname The hostname to investigate Hostname Endpoint Optional
Path The file path to get the sample from. Path File Optional

Playbook Outputs

Path Description Type
Endpoint The endpoint. unknown
Endpoint.Hostname The device hostname. string
File The file sample object. unknown

Playbook Image

Malware_Investigation_Generic_Setup

Inputs

  • File — Malware sample to investigation
  • MD5 — MD5 to investigation
  • SHA1 — SHA1 to investigation
  • SHA256 — SHA256 to investigation
  • Hostname — Hostname to investigation
  • Path — File path to get sample from

Outputs

  • Endpoint — The endpoint
  • Endpoint.Hostname — Device hostname
  • File — File sample object

Flowchart

yes yes yes yes Start Start Validate file sample Validate file sample Do we have a file sample? Do we have a file sample? Done Done Get File Sample By Hash - Generic - Get File Sample By Hash - Generic Get File Sample By Hash -... Get File Sample By Hash - Gen... Did we get a file sample? Did we get a file sample? File sample is missing File sample is missing Manually upload file sample Manually upload file sample Try to get file sample Try to get file sample Get File Sample From Path - Generic - Get File Sample From Path - Generic Get File Sample From Path... Get File Sample From Path - G... Validate endpoint Validate endpoint Do we have a Hostname? Do we have a Hostname? Search Endpoints By Hash - Generic - Search Endpoints By Hash - Generic Search Endpoints By Hash ... Search Endpoints By Hash - Ge... Did we get a Hostname? Did we get a Hostname? Hostname is missing Hostname is missing Manually enter a Hostname - Set Manually enter a Hostname Set Check file sample results Check file sample results

Source

playbook-Malware_Investigation_-_Generic_-_Setup.yml
Download History Raw 
id: malware_investigation-_generic_-_setup
version: -1
name: Malware Investigation - Generic - Setup
description: |-
  Deprecated. Verify file sample and hostname information for the "Malware Investigation - Generic" playbook.
  If the file sample or hostname are missing, the playbook will attempt to retrieve them using one or more integrations
fromversion: 5.0.0
starttaskid: "0"
hidden: true
tasks:
  "0":
    id: "0"
    taskid: f32e3309-cd35-442c-89bb-aedad44e51bc
    type: start
    task:
      id: f32e3309-cd35-442c-89bb-aedad44e51bc
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 50
        }
      }
  "1":
    id: "1"
    taskid: 6cb37fdd-3179-44d7-8846-a16dcc2062f6
    type: title
    task:
      id: 6cb37fdd-3179-44d7-8846-a16dcc2062f6
      version: -1
      name: Validate file sample
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 152.5,
          "y": 195
        }
      }
  "2":
    id: "2"
    taskid: c7670e54-f3e4-4a0d-89c9-e9340888ae6b
    type: condition
    task:
      id: c7670e54-f3e4-4a0d-89c9-e9340888ae6b
      version: -1
      name: Do we have a file sample?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: inputs.File
                filters:
                - - operator: general.isExists
                    left:
                      value:
                        simple: inputs.File.EntryID
                      iscontext: true
            iscontext: true
    view: |-
      {
        "position": {
          "x": 152.5,
          "y": 340
        }
      }
  "3":
    id: "3"
    taskid: 3c625815-68d5-4647-8891-11ba875c03c5
    type: title
    task:
      id: 3c625815-68d5-4647-8891-11ba875c03c5
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1527
        }
      }
  "5":
    id: "5"
    taskid: a0a3c0b4-515b-4cf6-8347-cdb7faa041f3
    type: playbook
    task:
      id: a0a3c0b4-515b-4cf6-8347-cdb7faa041f3
      version: -1
      name: Get File Sample By Hash - Generic
      description: ""
      playbookName: Get File Sample By Hash - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      MD5:
        complex:
          root: inputs.MD5
      SHA256:
        complex:
          root: inputs.SHA256
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 117.5,
          "y": 660
        }
      }
  "6":
    id: "6"
    taskid: 2b71b1fe-ddb3-482a-8166-a8967829aba1
    type: condition
    task:
      id: 2b71b1fe-ddb3-482a-8166-a8967829aba1
      version: -1
      name: Did we get a file sample?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: File
                filters:
                - - operator: general.isExists
                    left:
                      value:
                        simple: File.EntryID
                      iscontext: true
            iscontext: true
    view: |-
      {
        "position": {
          "x": -85,
          "y": 970
        }
      }
  "7":
    id: "7"
    taskid: 496fdc1e-a8b5-421f-8d42-a29432859fd3
    type: title
    task:
      id: 496fdc1e-a8b5-421f-8d42-a29432859fd3
      version: -1
      name: File sample is missing
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -85,
          "y": 1213
        }
      }
  "8":
    id: "8"
    taskid: 06ca5c31-261e-40b2-826d-1e0b6b994130
    type: regular
    task:
      id: 06ca5c31-261e-40b2-826d-1e0b6b994130
      version: -1
      name: Manually upload file sample
      description: ""
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -85,
          "y": 1350
        }
      }
  "10":
    id: "10"
    taskid: 52be4e01-b393-484d-8462-fc518e9dc3c2
    type: title
    task:
      id: 52be4e01-b393-484d-8462-fc518e9dc3c2
      version: -1
      name: Try to get file sample
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -85,
          "y": 515
        }
      }
  "11":
    id: "11"
    taskid: bb16ce78-06ab-4251-81a9-4a3bcd31426e
    type: playbook
    task:
      id: bb16ce78-06ab-4251-81a9-4a3bcd31426e
      version: -1
      name: Get File Sample From Path - Generic
      description: ""
      playbookName: Get File Sample From Path - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      Hostname:
        complex:
          root: inputs.Hostname
      Path:
        complex:
          root: inputs.Path
      UseD2:
        simple: "no"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": -290,
          "y": 660
        }
      }
  "12":
    id: "12"
    taskid: cd33187e-1841-4fc0-82d0-92a0aff2bed1
    type: title
    task:
      id: cd33187e-1841-4fc0-82d0-92a0aff2bed1
      version: -1
      name: Validate endpoint
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 645,
          "y": 195
        }
      }
  "13":
    id: "13"
    taskid: ad325a74-79b8-49d4-8332-59488cad36d1
    type: condition
    task:
      id: ad325a74-79b8-49d4-8332-59488cad36d1
      version: -1
      name: Do we have a Hostname?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: inputs.Hostname
            iscontext: true
    view: |-
      {
        "position": {
          "x": 645,
          "y": 340
        }
      }
  "14":
    id: "14"
    taskid: 9df62264-a011-4474-8504-ec1eeeaeb32a
    type: playbook
    task:
      id: 9df62264-a011-4474-8504-ec1eeeaeb32a
      version: -1
      name: Search Endpoints By Hash - Generic
      description: Hunt using available tools
      playbookName: Search Endpoints By Hash - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      MD5Hash:
        complex:
          root: inputs.MD5
      SHA1Hash:
        complex:
          root: inputs.SHA1
      SHA256Hash:
        complex:
          root: inputs.SHA256
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 645,
          "y": 565
        }
      }
  "15":
    id: "15"
    taskid: 5afea8b2-3723-4c9b-81e5-0a8565d11903
    type: condition
    task:
      id: 5afea8b2-3723-4c9b-81e5-0a8565d11903
      version: -1
      name: Did we get a Hostname?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "16"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: Endpoint
                accessor: Hostname
            iscontext: true
    view: |-
      {
        "position": {
          "x": 645,
          "y": 755
        }
      }
  "16":
    id: "16"
    taskid: 91e8996a-4e32-4041-882d-f37d07c4c54c
    type: title
    task:
      id: 91e8996a-4e32-4041-882d-f37d07c4c54c
      version: -1
      name: Hostname is missing
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 645,
          "y": 1035
        }
      }
  "17":
    id: "17"
    taskid: 9b2ade69-a18a-4ef6-8492-24467f71b7eb
    type: regular
    task:
      id: 9b2ade69-a18a-4ef6-8492-24467f71b7eb
      version: -1
      name: Manually enter a Hostname
      description: ""
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      append: {}
      key:
        simple: Endpoint.Hostname
      value: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 645,
          "y": 1198
        }
      }
  "18":
    id: "18"
    taskid: 98cf5f35-2be9-49ab-8e2f-aa6c5ab9873b
    type: title
    task:
      id: 98cf5f35-2be9-49ab-8e2f-aa6c5ab9873b
      version: -1
      name: Check file sample results
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -85,
          "y": 825
        }
      }
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1542,
        "width": 1315,
        "x": -290,
        "y": 50
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: Malware sample to investigation
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
  required: false
  description: MD5 to investigation
- key: SHA1
  value:
    complex:
      root: File
      accessor: SHA1
  required: false
  description: SHA1 to investigation
- key: SHA256
  value:
    complex:
      root: File
      accessor: SHA256
  required: false
  description: SHA256 to investigation
- key: Hostname
  value:
    complex:
      root: Endpoint
      accessor: Hostname
  required: false
  description: Hostname to investigation
- key: Path
  value:
    complex:
      root: File
      accessor: Path
  required: false
  description: File path to get sample from
outputs:
- contextPath: Endpoint
  description: The endpoint
  type: unknown
- contextPath: Endpoint.Hostname
  description: Device hostname
  type: string
- contextPath: File
  description: File sample object
  type: unknown
tests:
- No test - Need to do
deprecated: true