Malware Playbook - Manual Deprecated Hidden

Deprecated. Use "Malware Investigation - Manual" playbook instead. Master playbook for investigating suspected malware presence on an endpoint. Labels: - System: the hostname for the endpoint being investigated

Deprecated Content (Deprecated) · 89 tasks · 0 inputs · 0 outputs

Details

IDplaybook1
From Version5.0.0
Tasks89
TagsVirus Malware

README

Deprecated. Investigates suspected malware presence on an endpoint. This is a master playbook.

Labels:

  • System: the hostname for the endpoint being investigated

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

  • ExposeModules
  • Exists
  • Autoruns

Commands

This playbook does not use any commands.

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Flowchart

yes yes yes yes yes yes no yes no yes no yes start_task start_task Initial Triage Initial Triage Retrieve device profile from IT asset management software Retrieve device profile f... Retrieve employee information of the machine's owner from HR software Retrieve employee informa... Review incident details Review incident details Assess severity Assess severity Notify head of IR team via Slack and Email Notify head of IR team vi... Assign and involve appropriate personnel Assign and involve approp... Review monitoring data Review monitoring data Is Carbon Black available? - Exists Is Carbon Black available? Exists Query Carbon Black for events around the time of the incident Query Carbon Black for ev... Is ProtectWise available? - Exists Is ProtectWise available? Exists Retrieve observations related to the investigated machine Retrieve observations rel... Retrieve events related to the investigated machine Retrieve events related t... Is Splunk available? - Exists Is Splunk available? Exists Search Splunk for recent events related to the investigated machine Search Splunk for recent ... Do we have a continuous network capture of the investigated machine? Do we have a continuous n... Retrieve packet capture for last 24 hours or at most 200MB Retrieve packet capture f... Review antivirus logs for the affected systems Review antivirus logs for... Search UEBA solution for the relevant user's behavior in past 24 hours Search UEBA solution for ... Search DNS server logs for investigated machine's activity Search DNS server logs fo... Search web proxy logs for recent activity from this machine Search web proxy logs for... Search firewall logs for blocked traffic from this machine Search firewall logs for ... Collect evidence from the investigated machine Collect evidence from the... Is Tanium available? Is Tanium available? Collect system information using Tanium Collect system informatio... Trigger a snapshot / sytem restore point of affected systems Trigger a snapshot / syte... Collect volatile system data Collect volatile system data Fetch the system's security event log Fetch the system's securi... Create memory dump of the system Create memory dump of the... Collect autorun data - Autoruns Collect autorun data Autoruns Collect prefetch data Collect prefetch data Collect browser history Collect browser history Collect USB device history Collect USB device history Analyze collected evidence Analyze collected evidence Look for suspicious local Windows user accounts and groups Look for suspicious local... Look for suspicious autorun entries Look for suspicious autor... Review file reputation for all autorun items Review file reputation fo... Detonate any suspicious autorun items in sandbox Detonate any suspicious a... Check processes against our arsenal of YARA signatures Check processes against o... Volatility - search for malicious IP addresses in network connection artifacts Volatility - search for m... Volatility - Check domains in DNS cache against threat intelligence Volatility - Check domain... Volatility - Search for suspicious domains in DNS cache artifacts Volatility - Search for s... Volatility - review psxview results Volatility - review psxvi... Volatility - review malfind results Volatility - review malfi... Volatility - show list of previously run system commands Volatility - show list of... Correlate recently created and modified files against threat intelligence Correlate recently create... Review prefetch data Review prefetch data Review history of connected USB drives Review history of connect... Look for processes without executable image on disk Look for processes withou... Look for system processes with suspicious execution times Look for system processes... Look for process names with short edit distance from known process names Look for process names wi... Check process tree and look for suspicious relations Check process tree and lo... Look for traces of network sniffers Look for traces of networ... Analyze network traffic for malware activity Analyze network traffic f... Review shellbag data Review shellbag data Look up hashes of all running processes and loaded modules to find trojanized modules Look up hashes of all run... Analyze network traffic for signs of intrusion Analyze network traffic f... Look for modifications of system files Look for modifications of... Data Leak Assessment Data Leak Assessment Assess history of C&C communication in network logs Assess history of C&C com... Assess history of local and remote file accesses by the malware Assess history of local a... Assess unusual activity and data access by compromised user accounts Assess unusual activity a... Was any sensitive information leaked? Was any sensitive informa... Notify Public Relations (PR) team Notify Public Relations (... Respond Respond Was malware found? Was malware found? Inform user that no malware was found Inform user that no malwa... Report malware sample to AV vendor Report malware sample to ... Disable compromised AD account(s) Disable compromised AD ac... Revoke authentication keys stored on the compromised host Revoke authentication key... Revoke VPN credentials Revoke VPN credentials Instruct owner to change passwords for any personal accounts Instruct owner to change ... Ban relevant hashes across all systems Ban relevant hashes acros... Search for same malicious communications from other systems Search for same malicious... Remediate and wrap up Remediate and wrap up Notify affected user Notify affected user Provide end-user remediation guidance and link to training Provide end-user remediat... Is the identified malware known? (with automated remediation steps) Is the identified malware... Document manual remediation steps Document manual remediati... Trigger remediation scripts Trigger remediation scripts Was remediation successful? Was remediation successful? Open a ticket for IT to reimage the entire system and restore from backup Open a ticket for IT to r... Remove temporary containment measures Remove temporary containm... Reinstate disabled user accounts with new passwords Reinstate disabled user a... Deploy generated IoCs in relevant controls to prevent future attacks Deploy generated IoCs in ... Share generated IoCs with partner organizations Share generated IoCs with... Email report to CISO Email report to CISO Expose Configured Integrations - ExposeModules Expose Configured Integra... ExposeModules

Source

playbook-malware.yml
Download History Raw 
id: playbook1
version: -1
system: true
fromversion: 5.0.0
name: Malware Playbook - Manual
description: |-
  Deprecated. Use "Malware Investigation - Manual" playbook instead. Master playbook for investigating suspected malware presence on an endpoint.
  Labels:
   - System: the hostname for the endpoint being investigated
tags:
- Virus
- Malware
starttaskid: "0"
hidden: true
tasks:
  "0":
    id: "0"
    taskid: 8b39414f-fe78-4ae6-8ac6-2f13a86f1d22
    type: start
    task:
      id: 8b39414f-fe78-4ae6-8ac6-2f13a86f1d22
      description: ""
      version: -1
      name: start_task
      type: start
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "89"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 81a539cd-6e78-4b61-880c-8c8e2e175748
    type: title
    task:
      id: 81a539cd-6e78-4b61-880c-8c8e2e175748
      version: -1
      description: ""
      name: Initial Triage
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 367
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 2b1a676a-d81d-40fd-8a66-c2617d9b3e01
    type: regular
    task:
      id: 2b1a676a-d81d-40fd-8a66-c2617d9b3e01
      version: -1
      description: ""
      name: Retrieve device profile from IT asset management software
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 7871d191-1fa1-438e-8ebd-7f1a3c47926a
    type: regular
    task:
      id: 7871d191-1fa1-438e-8ebd-7f1a3c47926a
      version: -1
      description: ""
      name: Retrieve employee information of the machine's owner from HR software
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 4af9306c-9545-455b-840f-11f78528471d
    type: regular
    task:
      id: 4af9306c-9545-455b-840f-11f78528471d
      version: -1
      name: Review incident details
      description: |-
        Understand initial context of investigation. If any data is missing, collect it.
        * system name
        * people involved
        * usernames involved
        * initial severity as reported
        * initial known events and the time of occurrence
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: cd85115e-4379-4319-853b-f518e9aa98bc
    type: regular
    task:
      id: cd85115e-4379-4319-853b-f518e9aa98bc
      version: -1
      name: Assess severity
      description: 'Based on the end user affected, and other information assess and change the severity if needed. '
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: bad41bb4-018b-47bb-8d0d-81831bb09ed7
    type: regular
    task:
      id: bad41bb4-018b-47bb-8d0d-81831bb09ed7
      version: -1
      name: Notify head of IR team via Slack and Email
      description: 'Notify that we are investigating a suspicious workstation '
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 8135a8aa-6d2c-4cf1-80c4-c5cf4bf136a8
    type: regular
    task:
      id: 8135a8aa-6d2c-4cf1-80c4-c5cf4bf136a8
      version: -1
      name: Assign and involve appropriate personnel
      description: 'Invite the relevant users for investigation - malware expert and network experts if needed. '
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 257c9d0c-7451-41b5-8dcc-788f14d219f8
    type: title
    task:
      id: 257c9d0c-7451-41b5-8dcc-788f14d219f8
      version: -1
      description: ""
      name: Review monitoring data
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1565
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: 0547ea00-5d6d-4234-83ee-47b25b6243fa
    type: condition
    task:
      id: 0547ea00-5d6d-4234-83ee-47b25b6243fa
      version: -1
      description: ""
      name: Is Carbon Black available?
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "11"
    scriptarguments:
      brandname: {}
      value:
        simple: ${modules.brand(val==='carbonblack')}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 55dad16e-31b0-4f56-8c98-4e0cf181a5fc
    type: regular
    task:
      id: 55dad16e-31b0-4f56-8c98-4e0cf181a5fc
      version: -1
      description: ""
      name: Query Carbon Black for events around the time of the incident
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 652,
          "y": 1889
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 4451d7c1-6ba4-41b5-8d9b-f85bc0be115e
    type: condition
    task:
      id: 4451d7c1-6ba4-41b5-8d9b-f85bc0be115e
      version: -1
      description: ""
      name: Is ProtectWise available?
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "15"
      "yes":
      - "13"
    scriptarguments:
      value:
        simple: ${modules.brand(val==='ProtectWise')}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 430,
          "y": 2066
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: 13fc59c2-b4b4-4520-882a-c0a062d7cd4c
    type: regular
    task:
      id: 13fc59c2-b4b4-4520-882a-c0a062d7cd4c
      version: -1
      description: ""
      name: Retrieve observations related to the investigated machine
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 711,
          "y": 2248
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: 4845f050-3621-49bf-8c43-0fbbb89fccbc
    type: regular
    task:
      id: 4845f050-3621-49bf-8c43-0fbbb89fccbc
      version: -1
      description: ""
      name: Retrieve events related to the investigated machine
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      brandname:
        simple: protectwise
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 711,
          "y": 2423
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: a2ab2707-061d-4267-86ff-6c22f258b436
    type: condition
    task:
      id: a2ab2707-061d-4267-86ff-6c22f258b436
      version: -1
      description: ""
      name: Is Splunk available?
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "17"
      "yes":
      - "16"
    scriptarguments:
      brandname:
        simple: splunk
      value:
        simple: ${modules.brand(val==='splunk')}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 2603
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: 72c00e35-7582-4e2e-8451-3028be309a6b
    type: regular
    task:
      id: 72c00e35-7582-4e2e-8451-3028be309a6b
      version: -1
      description: ""
      name: Search Splunk for recent events related to the investigated machine
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 634,
          "y": 2768
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: 0f276a60-c08b-4de3-8433-247cad04286c
    type: condition
    task:
      id: 0f276a60-c08b-4de3-8433-247cad04286c
      version: -1
      description: ""
      name: Do we have a continuous network capture of the investigated machine?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "19"
      "yes":
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 331,
          "y": 2923
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: 6aaae678-3a19-4fa4-8c8c-aba06097817a
    type: regular
    task:
      id: 6aaae678-3a19-4fa4-8c8c-aba06097817a
      version: -1
      description: ""
      name: Retrieve packet capture for last 24 hours or at most 200MB
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 559,
          "y": 3122
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: 746fcae3-95db-4f12-83fe-1919ade361a0
    type: regular
    task:
      id: 746fcae3-95db-4f12-83fe-1919ade361a0
      version: -1
      description: ""
      name: Review antivirus logs for the affected systems
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "20"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 3299
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: aaa0755f-1b8c-46b4-8880-ac5890f6f79b
    type: regular
    task:
      id: aaa0755f-1b8c-46b4-8880-ac5890f6f79b
      version: -1
      description: ""
      name: Search UEBA solution for the relevant user's behavior in past 24 hours
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 3460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "21":
    id: "21"
    taskid: 728e302a-32f6-4c93-8712-eb993b585daa
    type: regular
    task:
      id: 728e302a-32f6-4c93-8712-eb993b585daa
      version: -1
      description: ""
      name: Search DNS server logs for investigated machine's activity
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 3635
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "22":
    id: "22"
    taskid: 33771c7a-b1c6-4af2-8fdb-86f5a9aeb1b1
    type: regular
    task:
      id: 33771c7a-b1c6-4af2-8fdb-86f5a9aeb1b1
      version: -1
      description: ""
      name: Search web proxy logs for recent activity from this machine
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 3810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "23":
    id: "23"
    taskid: 35b26857-fd74-451d-8938-e47d5add5f84
    type: regular
    task:
      id: 35b26857-fd74-451d-8938-e47d5add5f84
      version: -1
      description: ""
      name: Search firewall logs for blocked traffic from this machine
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 3985
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "24":
    id: "24"
    taskid: ae70f6b0-7209-478d-81c7-2c8280ceae04
    type: title
    task:
      id: ae70f6b0-7209-478d-81c7-2c8280ceae04
      version: -1
      description: ""
      name: Collect evidence from the investigated machine
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 4160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "25":
    id: "25"
    taskid: f7a6e782-a13d-405a-875b-ce3a5dbfaab0
    type: condition
    task:
      id: f7a6e782-a13d-405a-875b-ce3a5dbfaab0
      version: -1
      description: ""
      name: Is Tanium available?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "27"
      "yes":
      - "26"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 4305
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "26":
    id: "26"
    taskid: 8203f0a5-8647-4297-8222-1ca1216fb5fb
    type: regular
    task:
      id: 8203f0a5-8647-4297-8222-1ca1216fb5fb
      version: -1
      description: ""
      name: Collect system information using Tanium
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 4480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "27":
    id: "27"
    taskid: 49b75c73-56d3-4077-84c6-54abf60e78d4
    type: regular
    task:
      id: 49b75c73-56d3-4077-84c6-54abf60e78d4
      version: -1
      name: Trigger a snapshot / sytem restore point of affected systems
      description: Create complete backup of affected systems for recovery and forensics.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 4655
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "28":
    id: "28"
    taskid: c31637b7-02f1-4868-865c-ca5d5805c46a
    type: regular
    task:
      id: c31637b7-02f1-4868-865c-ca5d5805c46a
      version: -1
      name: Collect volatile system data
      description: 'Collect system data like running processes, network connections and files changed. '
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 4830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "29":
    id: "29"
    taskid: 1c695f04-34ac-4eac-8495-e6881873715c
    type: regular
    task:
      id: 1c695f04-34ac-4eac-8495-e6881873715c
      version: -1
      description: ""
      name: Fetch the system's security event log
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 5005
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "30":
    id: "30"
    taskid: 05339003-481a-4ba6-85cd-a4fc9a2d15a0
    type: regular
    task:
      id: 05339003-481a-4ba6-85cd-a4fc9a2d15a0
      version: -1
      name: Create memory dump of the system
      description: 'In addition to a full backup create a memory dump of the system. '
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 5180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "31":
    id: "31"
    taskid: a07ebc12-2fe8-4a94-803b-5de91ab58bb5
    type: regular
    task:
      id: a07ebc12-2fe8-4a94-803b-5de91ab58bb5
      version: -1
      description: ""
      name: Collect autorun data
      scriptName: Autoruns
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "32"
    scriptarguments:
      system:
        simple: ${incident.labels.System}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 5355
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "32":
    id: "32"
    taskid: 8db75f38-b006-4863-8587-3fb56ac6a1c8
    type: regular
    task:
      id: 8db75f38-b006-4863-8587-3fb56ac6a1c8
      version: -1
      description: ""
      name: Collect prefetch data
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "33"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 5530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "33":
    id: "33"
    taskid: 336842d5-ac9a-4b2f-8e88-44fc6dc1e50a
    type: regular
    task:
      id: 336842d5-ac9a-4b2f-8e88-44fc6dc1e50a
      version: -1
      description: ""
      name: Collect browser history
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 5705
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "34":
    id: "34"
    taskid: 91f9a299-dcba-42cc-83b7-2de72925da8b
    type: regular
    task:
      id: 91f9a299-dcba-42cc-83b7-2de72925da8b
      version: -1
      description: ""
      name: Collect USB device history
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 5880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "35":
    id: "35"
    taskid: dd777994-1a09-4240-8376-cf29fff6bf53
    type: title
    task:
      id: dd777994-1a09-4240-8376-cf29fff6bf53
      version: -1
      description: ""
      name: Analyze collected evidence
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "36"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 6055
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "36":
    id: "36"
    taskid: 29f3b7f7-d78f-48ab-8b14-c427b8a9021e
    type: regular
    task:
      id: 29f3b7f7-d78f-48ab-8b14-c427b8a9021e
      version: -1
      description: ""
      name: Look for suspicious local Windows user accounts and groups
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "37"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 6200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "37":
    id: "37"
    taskid: dc65bda0-b8a8-43d5-894d-b0198cbf06c6
    type: regular
    task:
      id: dc65bda0-b8a8-43d5-894d-b0198cbf06c6
      version: -1
      description: ""
      name: Look for suspicious autorun entries
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 6375
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "38":
    id: "38"
    taskid: 562f06bb-a9ea-475b-8409-3d87bd19d1ea
    type: regular
    task:
      id: 562f06bb-a9ea-475b-8409-3d87bd19d1ea
      version: -1
      description: ""
      name: Review file reputation for all autorun items
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "39"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 6550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "39":
    id: "39"
    taskid: f07e21aa-7254-4ae1-8346-a14c5baefcf0
    type: regular
    task:
      id: f07e21aa-7254-4ae1-8346-a14c5baefcf0
      version: -1
      description: ""
      name: Detonate any suspicious autorun items in sandbox
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 6725
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "40":
    id: "40"
    taskid: e7824c43-d362-4f3c-8d0e-02d9375316d0
    type: regular
    task:
      id: e7824c43-d362-4f3c-8d0e-02d9375316d0
      version: -1
      description: ""
      name: Check processes against our arsenal of YARA signatures
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "41"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 6900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "41":
    id: "41"
    taskid: ea65b582-5b2f-4bee-8477-f27d059ffd18
    type: regular
    task:
      id: ea65b582-5b2f-4bee-8477-f27d059ffd18
      version: -1
      description: ""
      name: Volatility - search for malicious IP addresses in network connection artifacts
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "42"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 7075
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "42":
    id: "42"
    taskid: cef5c9f5-6813-4c91-81e7-bf36cbeac589
    type: regular
    task:
      id: cef5c9f5-6813-4c91-81e7-bf36cbeac589
      version: -1
      description: ""
      name: Volatility - Check domains in DNS cache against threat intelligence
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 7250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "43":
    id: "43"
    taskid: 1fe6d8ac-8736-49d4-8237-8674083d9286
    type: regular
    task:
      id: 1fe6d8ac-8736-49d4-8237-8674083d9286
      version: -1
      description: ""
      name: Volatility - Search for suspicious domains in DNS cache artifacts
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "44"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 7425
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "44":
    id: "44"
    taskid: b1de25d6-b960-4d5c-8cac-ed24ec1d1d7b
    type: regular
    task:
      id: b1de25d6-b960-4d5c-8cac-ed24ec1d1d7b
      version: -1
      description: ""
      name: Volatility - review psxview results
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "45"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 7600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "45":
    id: "45"
    taskid: 11a98d40-72b5-4269-891d-bb72839eec63
    type: regular
    task:
      id: 11a98d40-72b5-4269-891d-bb72839eec63
      version: -1
      description: ""
      name: Volatility - review malfind results
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "46"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 7775
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "46":
    id: "46"
    taskid: 5d610cd9-2f2c-4d9b-8a39-7163512c5342
    type: regular
    task:
      id: 5d610cd9-2f2c-4d9b-8a39-7163512c5342
      version: -1
      description: ""
      name: Volatility - show list of previously run system commands
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "47"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 7950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "47":
    id: "47"
    taskid: b0ed2a23-e4c0-4f21-833e-10e3d63cd1e8
    type: regular
    task:
      id: b0ed2a23-e4c0-4f21-833e-10e3d63cd1e8
      version: -1
      name: Correlate recently created and modified files against threat intelligence
      description: |
        Research current threat intelligence for file activity
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 8125
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "48":
    id: "48"
    taskid: 5633d7bf-71ae-4580-819f-6ec527c3653d
    type: regular
    task:
      id: 5633d7bf-71ae-4580-819f-6ec527c3653d
      version: -1
      description: ""
      name: Review prefetch data
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "49"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 8300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "49":
    id: "49"
    taskid: aa5bb718-4a92-4879-842d-4f1109a9b197
    type: regular
    task:
      id: aa5bb718-4a92-4879-842d-4f1109a9b197
      version: -1
      description: ""
      name: Review history of connected USB drives
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "50"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 8475
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "50":
    id: "50"
    taskid: dcd48bb4-9192-4684-80be-9d9cc9ccce0c
    type: regular
    task:
      id: dcd48bb4-9192-4684-80be-9d9cc9ccce0c
      version: -1
      description: ""
      name: Look for processes without executable image on disk
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "51"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 8650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "51":
    id: "51"
    taskid: fc64c7a0-81e6-4bad-8c1a-e53fba7ae410
    type: regular
    task:
      id: fc64c7a0-81e6-4bad-8c1a-e53fba7ae410
      version: -1
      description: ""
      name: Look for system processes with suspicious execution times
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "52"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 8825
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "52":
    id: "52"
    taskid: f606fe45-0b28-470e-815d-58011a976a5f
    type: regular
    task:
      id: f606fe45-0b28-470e-815d-58011a976a5f
      version: -1
      name: Look for process names with short edit distance from known process names
      description: These may be attempts to fool a human investigator (e.g. scvhost.exe )
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "53"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 9000
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "53":
    id: "53"
    taskid: 3da9dbf5-1973-4b2e-8d6f-b245a27d9f50
    type: regular
    task:
      id: 3da9dbf5-1973-4b2e-8d6f-b245a27d9f50
      version: -1
      description: ""
      name: Check process tree and look for suspicious relations
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "54"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 9175
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "54":
    id: "54"
    taskid: 7d3de1a4-dabf-485b-87d1-b4b42de754dd
    type: regular
    task:
      id: 7d3de1a4-dabf-485b-87d1-b4b42de754dd
      version: -1
      description: ""
      name: Look for traces of network sniffers
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "55"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 9350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "55":
    id: "55"
    taskid: 5f142333-7e70-4884-8fd6-aadc40fdfa54
    type: regular
    task:
      id: 5f142333-7e70-4884-8fd6-aadc40fdfa54
      version: -1
      name: Analyze network traffic for malware activity
      description: Analyze the network traffic from/to this system for malware activity
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "56"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 9525
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "56":
    id: "56"
    taskid: 1d90dc84-7336-422d-8bee-d4d05bbfa6d6
    type: regular
    task:
      id: 1d90dc84-7336-422d-8bee-d4d05bbfa6d6
      version: -1
      description: ""
      name: Review shellbag data
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "57"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 9700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "57":
    id: "57"
    taskid: 02d90455-9847-4c94-8587-c808102dd7c8
    type: regular
    task:
      id: 02d90455-9847-4c94-8587-c808102dd7c8
      version: -1
      description: ""
      name: Look up hashes of all running processes and loaded modules to find trojanized modules
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "58"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 9875
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "58":
    id: "58"
    taskid: 3233684b-e31c-4ad8-86c4-274a6205208c
    type: regular
    task:
      id: 3233684b-e31c-4ad8-86c4-274a6205208c
      version: -1
      name: Analyze network traffic for signs of intrusion
      description: Analyze the network traffic from/to this system for signs of intrusion.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "59"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 10050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "59":
    id: "59"
    taskid: 11df018f-d953-4597-810e-8e56ef57d5c1
    type: regular
    task:
      id: 11df018f-d953-4597-810e-8e56ef57d5c1
      version: -1
      description: ""
      name: Look for modifications of system files
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "60"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 10225
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "60":
    id: "60"
    taskid: bc465242-756c-44ad-8546-b004ca98190c
    type: title
    task:
      id: bc465242-756c-44ad-8546-b004ca98190c
      version: -1
      description: ""
      name: Data Leak Assessment
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "61"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 10400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "61":
    id: "61"
    taskid: 4f517c9c-3514-40b8-863a-8a599902896f
    type: regular
    task:
      id: 4f517c9c-3514-40b8-863a-8a599902896f
      version: -1
      description: ""
      name: Assess history of C&C communication in network logs
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "62"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 10545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "62":
    id: "62"
    taskid: fc8f6c5f-8779-4f11-81a7-e2ba19afb729
    type: regular
    task:
      id: fc8f6c5f-8779-4f11-81a7-e2ba19afb729
      version: -1
      description: ""
      name: Assess history of local and remote file accesses by the malware
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "63"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 10720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "63":
    id: "63"
    taskid: e8cd12ce-0d13-40eb-8a3a-9453927b2665
    type: regular
    task:
      id: e8cd12ce-0d13-40eb-8a3a-9453927b2665
      version: -1
      description: ""
      name: Assess unusual activity and data access by compromised user accounts
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "64"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 10895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "64":
    id: "64"
    taskid: 77134e96-d810-4fe9-8573-0dae9701905c
    type: condition
    task:
      id: 77134e96-d810-4fe9-8573-0dae9701905c
      version: -1
      description: ""
      name: Was any sensitive information leaked?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "66"
      "yes":
      - "65"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 11070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "65":
    id: "65"
    taskid: 79473708-5b11-44ae-86ad-1f05ec3ae75c
    type: regular
    task:
      id: 79473708-5b11-44ae-86ad-1f05ec3ae75c
      version: -1
      description: ""
      name: Notify Public Relations (PR) team
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "66"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 559,
          "y": 11256
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "66":
    id: "66"
    taskid: 2b290909-b729-46a4-8c09-212bee8f6094
    type: title
    task:
      id: 2b290909-b729-46a4-8c09-212bee8f6094
      version: -1
      description: ""
      name: Respond
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "67"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 11422
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "67":
    id: "67"
    taskid: 5e48a7f1-8c3d-4472-8edd-43ad2ef061ce
    type: condition
    task:
      id: 5e48a7f1-8c3d-4472-8edd-43ad2ef061ce
      version: -1
      description: ""
      name: Was malware found?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "68"
      "yes":
      - "69"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 11565
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "68":
    id: "68"
    taskid: 79732f56-83e8-428c-8a96-c9f0e853b45f
    type: regular
    task:
      id: 79732f56-83e8-428c-8a96-c9f0e853b45f
      version: -1
      description: ""
      name: Inform user that no malware was found
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "76"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 12790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "69":
    id: "69"
    taskid: 9a73f01e-6096-4daf-80d3-0b671e74f619
    type: regular
    task:
      id: 9a73f01e-6096-4daf-80d3-0b671e74f619
      version: -1
      description: ""
      name: Report malware sample to AV vendor
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "70"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 11740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "70":
    id: "70"
    taskid: 490a1dcc-ec5a-439c-8812-3a2ab1e00532
    type: regular
    task:
      id: 490a1dcc-ec5a-439c-8812-3a2ab1e00532
      version: -1
      description: ""
      name: Disable compromised AD account(s)
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "71"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 11915
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "71":
    id: "71"
    taskid: 6c53cf14-51ae-4899-8e01-714dfd00cfc7
    type: regular
    task:
      id: 6c53cf14-51ae-4899-8e01-714dfd00cfc7
      version: -1
      description: ""
      name: Revoke authentication keys stored on the compromised host
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "72"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 12090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "72":
    id: "72"
    taskid: 5d152b2c-067d-47ec-829b-fa56b8960307
    type: regular
    task:
      id: 5d152b2c-067d-47ec-829b-fa56b8960307
      version: -1
      description: ""
      name: Revoke VPN credentials
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "73"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 12265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "73":
    id: "73"
    taskid: 8b83a98e-4916-4a76-80e5-8736a5a207ba
    type: regular
    task:
      id: 8b83a98e-4916-4a76-80e5-8736a5a207ba
      version: -1
      name: Instruct owner to change passwords for any personal accounts
      description: |-
        Personal email, social media, LinkedIn profile - these are in the control of the employee and they must be involved in order to change passwords. IT/Security staff can help to expedite.

        This is not only for the benefit of the employee - there is a real danger to the organization: access to these accounts could allow the thief to convincingly impersonate the owner of the device in order to engage in Social Engineering against our other employees and further attack the organization.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "74"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 12440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "74":
    id: "74"
    taskid: 39408b0b-ff1c-448a-817d-a2b1bda82bc1
    type: regular
    task:
      id: 39408b0b-ff1c-448a-817d-a2b1bda82bc1
      version: -1
      description: ""
      name: Ban relevant hashes across all systems
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "75"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 12615
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "75":
    id: "75"
    taskid: c0b9dff1-ba08-400c-8dfd-af616aad2d16
    type: regular
    task:
      id: c0b9dff1-ba08-400c-8dfd-af616aad2d16
      version: -1
      description: ""
      name: Search for same malicious communications from other systems
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "76"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 12790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "76":
    id: "76"
    taskid: b32d3cb5-4029-413b-8b4b-52f415dab2c9
    type: title
    task:
      id: b32d3cb5-4029-413b-8b4b-52f415dab2c9
      version: -1
      description: ""
      name: Remediate and wrap up
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "77"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 12965
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "77":
    id: "77"
    taskid: 5b96fdcb-14af-434b-8c89-ebbb3b344145
    type: regular
    task:
      id: 5b96fdcb-14af-434b-8c89-ebbb3b344145
      version: -1
      name: Notify affected user
      description: Notify affected user about the outcome of investigation.
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "78"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 13110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "78":
    id: "78"
    taskid: 35c0d3b2-d9cd-460c-88be-6d7a229e9906
    type: regular
    task:
      id: 35c0d3b2-d9cd-460c-88be-6d7a229e9906
      version: -1
      description: ""
      name: Provide end-user remediation guidance and link to training
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "79"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 13285
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "79":
    id: "79"
    taskid: f68ec944-041d-4288-80fd-d4593bceb52b
    type: condition
    task:
      id: f68ec944-041d-4288-80fd-d4593bceb52b
      version: -1
      description: ""
      name: Is the identified malware known? (with automated remediation steps)
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "80"
      "yes":
      - "81"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 13460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "80":
    id: "80"
    taskid: f13d62e8-15a2-4240-8245-9537c0c7aa83
    type: regular
    task:
      id: f13d62e8-15a2-4240-8245-9537c0c7aa83
      version: -1
      description: ""
      name: Document manual remediation steps
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "82"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 13635
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "81":
    id: "81"
    taskid: 91223da8-3e5b-432e-85d6-b05a8e614f83
    type: regular
    task:
      id: 91223da8-3e5b-432e-85d6-b05a8e614f83
      version: -1
      description: ""
      name: Trigger remediation scripts
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "82"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 13635
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "82":
    id: "82"
    taskid: 36ba1145-5eb5-4bc4-85f6-d5c9f4495cca
    type: condition
    task:
      id: 36ba1145-5eb5-4bc4-85f6-d5c9f4495cca
      version: -1
      description: ""
      name: Was remediation successful?
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "83"
      "yes":
      - "84"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 13810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "83":
    id: "83"
    taskid: ea16d8dc-d539-4b3e-864a-b8e34f4a2fcc
    type: regular
    task:
      id: ea16d8dc-d539-4b3e-864a-b8e34f4a2fcc
      version: -1
      description: ""
      name: Open a ticket for IT to reimage the entire system and restore from backup
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "86"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 14160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "84":
    id: "84"
    taskid: b32992a7-f5e0-4b95-8dd2-5c70e938c715
    type: regular
    task:
      id: b32992a7-f5e0-4b95-8dd2-5c70e938c715
      version: -1
      name: Remove temporary containment measures
      description: Remove the temporary containment measures that were placed.
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "85"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 13985
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "85":
    id: "85"
    taskid: 01b813e8-99a6-4988-8a32-5592c61b438d
    type: regular
    task:
      id: 01b813e8-99a6-4988-8a32-5592c61b438d
      version: -1
      description: ""
      name: Reinstate disabled user accounts with new passwords
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "86"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 14160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "86":
    id: "86"
    taskid: d01ad182-bf69-4edf-8021-0bf3a6521340
    type: regular
    task:
      id: d01ad182-bf69-4edf-8021-0bf3a6521340
      version: -1
      description: ""
      name: Deploy generated IoCs in relevant controls to prevent future attacks
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "87"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 14335
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "87":
    id: "87"
    taskid: 582e26b0-93d3-44d3-8a51-975d84ccdd9f
    type: regular
    task:
      id: 582e26b0-93d3-44d3-8a51-975d84ccdd9f
      version: -1
      description: ""
      name: Share generated IoCs with partner organizations
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "88"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 14510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "88":
    id: "88"
    taskid: 2b7c48b3-cf1f-4a55-86bf-290cbcdebe49
    type: regular
    task:
      id: 2b7c48b3-cf1f-4a55-86bf-290cbcdebe49
      version: -1
      description: ""
      name: Email report to CISO
      type: regular
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 14685
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "89":
    id: "89"
    taskid: d98a411a-e6ca-493d-83cb-564ecec2c156
    type: regular
    task:
      id: d98a411a-e6ca-493d-83cb-564ecec2c156
      version: -1
      description: ""
      name: Expose Configured Integrations
      scriptName: ExposeModules
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 184
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "67_68_no": 0.82
    },
    "paper": {
      "dimensions": {
        "height": 14730,
        "width": 1041,
        "x": 50,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
tests:
- No Tests
deprecated: true