Hunting C&C Communication Playbook Deprecated Hidden

Deprecated. A playbook to use the latest Threat Intelligence to hunt across your infrastructure and look for malicious C&C communications.

Deprecated Content (Deprecated) · 50 tasks · 0 inputs · 0 outputs

Commands used

slack-send

Flowchart

yes yes yes yes yes no yes no yes no yes no yes no yes start_task start_task Prepare Prepare Trigger an update of our IoC repository from all available Threat Intel sources Trigger an update of our ... Retrieve fresh lists of C&C IoCs from repository Retrieve fresh lists of C... Hunt Hunt Query netflow records for traffic to C&C IPs Query netflow records for... Search web proxy logs for C&C URLs Search web proxy logs for... Search the organization's DNS server logs for C&C domains Search the organization's... Search Endpoint monitoring infrastructure for communication with C&C IPs Search Endpoint monitorin... Search Firewall and IPS logs for C&C IPs Search Firewall and IPS l... Validate findings Validate findings Did we uncover any suspected C&C communication? Did we uncover any suspec... Review correlations with past investigations in case management / incident tracking Review correlations with ... Review reputation data for each indicator Review reputation data fo... Is PassiveTotal Available? - Exists Is PassiveTotal Available? Exists Review PassiveTotal enrichment data for the indicators Review PassiveTotal enric... Is CrowdStrike Intel Available? - Exists Is CrowdStrike Intel Avai... Exists Get and review CrowdStrike indicator information Get and review CrowdStrik... Do the found IoCs include domain names? Do the found IoCs include... Review the domains' Whois information Review the domains' Whois... Retrieve DNS history for these domains Retrieve DNS history for ... Review IP reputation for the IPs to which this domain resolved at the time Review IP reputation for ... Summarize the list of validated malicious indicators Summarize the list of val... Respond Respond Have any machines been confirmed as compromised? Have any machines been co... Isolate compromised hosts from network Isolate compromised hosts... Disable compromised AD user account(s) Disable compromised AD us... Lock / Rotate any other compromised accounts, keys and credentials Lock / Rotate any other c... Is Slack Available? - Exists Is Slack Available? Exists Retrieve the user's phone number from Active Directory Retrieve the user's phone... Is Twilio Available? - Exists Is Twilio Available? Exists Call the user and tell them that their machine is being isolated and investigated Call the user and tell th... SMS the user that their machine is being isolated and investigated SMS the user that their m... Tell the user on Slack that their machine is being isolated and investigated Tell the user on Slack th... Open separate incidents to further investigate each compromised host Open separate incidents t... Remediate and Wrap up Remediate and Wrap up Have the machines been cleaned successfully? Have the machines been cl... Open a ticket for IT to reimage the machine Open a ticket for IT to r... Restore network access for cleaned up hosts Restore network access fo... Reinstate locked user accounts with new credentials Reinstate locked user acc... Is Slack Available? - IsIntegrationAvailable Is Slack Available? IsIntegrationAvailable Retrieve the user's phone number from Active Directory Retrieve the user's phone... Is Twilio Available? - Exists Is Twilio Available? Exists Call the user and tell them that their accounts have been reinstated Call the user and tell th... SMS the user that their account has been reinstated SMS the user that their a... Notify the user via Slack that their account has been reinstated - slack-send Notify the user via Slack... slack-send Deploy validated IoCs with high confidence rating against future attacks Deploy validated IoCs wit... Share the validated IoCs with partner organizations Share the validated IoCs ... Issue report to CISO by email Issue report to CISO by e... Expose Configured Integrations - ExposeModules Expose Configured Integra... ExposeModules