Hunting C&C Communication Playbook Deprecated Hidden

Deprecated. A playbook to use the latest Threat Intelligence to hunt across your infrastructure and look for malicious C&C communications.

Deprecated Content (Deprecated) · 50 tasks · 0 inputs · 0 outputs

Details

IDplaybook7
From Version5.0.0
Tasks50

README

Deprecated. Uses the latest Threat Intelligence to look for malicious C&C communications.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • slack

Scripts

  • IsIntegrationAvailable
  • Exists

Commands

  • slack-send

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

C_and_C_Communication_Hunting

Commands used

slack-send

Flowchart

yes yes yes yes yes no yes no yes no yes no yes no yes start_task start_task Prepare Prepare Trigger an update of our IoC repository from all available Threat Intel sources Trigger an update of our ... Retrieve fresh lists of C&C IoCs from repository Retrieve fresh lists of C... Hunt Hunt Query netflow records for traffic to C&C IPs Query netflow records for... Search web proxy logs for C&C URLs Search web proxy logs for... Search the organization's DNS server logs for C&C domains Search the organization's... Search Endpoint monitoring infrastructure for communication with C&C IPs Search Endpoint monitorin... Search Firewall and IPS logs for C&C IPs Search Firewall and IPS l... Validate findings Validate findings Did we uncover any suspected C&C communication? Did we uncover any suspec... Review correlations with past investigations in case management / incident tracking Review correlations with ... Review reputation data for each indicator Review reputation data fo... Is PassiveTotal Available? - Exists Is PassiveTotal Available? Exists Review PassiveTotal enrichment data for the indicators Review PassiveTotal enric... Is CrowdStrike Intel Available? - Exists Is CrowdStrike Intel Avai... Exists Get and review CrowdStrike indicator information Get and review CrowdStrik... Do the found IoCs include domain names? Do the found IoCs include... Review the domains' Whois information Review the domains' Whois... Retrieve DNS history for these domains Retrieve DNS history for ... Review IP reputation for the IPs to which this domain resolved at the time Review IP reputation for ... Summarize the list of validated malicious indicators Summarize the list of val... Respond Respond Have any machines been confirmed as compromised? Have any machines been co... Isolate compromised hosts from network Isolate compromised hosts... Disable compromised AD user account(s) Disable compromised AD us... Lock / Rotate any other compromised accounts, keys and credentials Lock / Rotate any other c... Is Slack Available? - Exists Is Slack Available? Exists Retrieve the user's phone number from Active Directory Retrieve the user's phone... Is Twilio Available? - Exists Is Twilio Available? Exists Call the user and tell them that their machine is being isolated and investigated Call the user and tell th... SMS the user that their machine is being isolated and investigated SMS the user that their m... Tell the user on Slack that their machine is being isolated and investigated Tell the user on Slack th... Open separate incidents to further investigate each compromised host Open separate incidents t... Remediate and Wrap up Remediate and Wrap up Have the machines been cleaned successfully? Have the machines been cl... Open a ticket for IT to reimage the machine Open a ticket for IT to r... Restore network access for cleaned up hosts Restore network access fo... Reinstate locked user accounts with new credentials Reinstate locked user acc... Is Slack Available? - IsIntegrationAvailable Is Slack Available? IsIntegrationAvailable Retrieve the user's phone number from Active Directory Retrieve the user's phone... Is Twilio Available? - Exists Is Twilio Available? Exists Call the user and tell them that their accounts have been reinstated Call the user and tell th... SMS the user that their account has been reinstated SMS the user that their a... Notify the user via Slack that their account has been reinstated - slack-send Notify the user via Slack... slack-send Deploy validated IoCs with high confidence rating against future attacks Deploy validated IoCs wit... Share the validated IoCs with partner organizations Share the validated IoCs ... Issue report to CISO by email Issue report to CISO by e... Expose Configured Integrations - ExposeModules Expose Configured Integra... ExposeModules

Source

playbook-C&C-Communication-Hunting.yml
Download History Raw 
id: playbook7
version: -1
name: Hunting C&C Communication Playbook
description: Deprecated. A playbook to use the latest Threat Intelligence to hunt across your infrastructure and look for malicious C&C communications.
system: true
fromversion: 5.0.0
starttaskid: "0"
hidden: true
tasks:
  "0":
    id: "0"
    taskid: b0106ff2-1f84-4336-811c-501b301327a3
    type: start
    task:
      id: b0106ff2-1f84-4336-811c-501b301327a3
      description: ""
      version: -1
      name: start_task
      type: start
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "49"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 6bb644a4-ab7a-4f6c-82ff-c2543048a30d
    type: title
    task:
      id: 6bb644a4-ab7a-4f6c-82ff-c2543048a30d
      version: -1
      description: ""
      name: Prepare
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 3608118f-e307-4a7e-8478-a74fe26a8747
    type: regular
    task:
      id: 3608118f-e307-4a7e-8478-a74fe26a8747
      description: ""
      version: -1
      name: Trigger an update of our IoC repository from all available Threat Intel sources
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 2ec8a165-89f6-44b7-8329-8258b97edec4
    type: regular
    task:
      id: 2ec8a165-89f6-44b7-8329-8258b97edec4
      version: -1
      name: Retrieve fresh lists of C&C IoCs from repository
      description: Retrieve IoCs from repository into the incident context - IP addresses, domains, URLs
      issystemtask: true
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: e0c2eca8-a6bd-4924-835b-4264c1d5a673
    type: title
    task:
      id: e0c2eca8-a6bd-4924-835b-4264c1d5a673
      description: ""
      version: -1
      name: Hunt
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: efa206e7-f25b-44fe-8c31-8a8a8b322336
    type: regular
    task:
      id: efa206e7-f25b-44fe-8c31-8a8a8b322336
      version: -1
      name: Query netflow records for traffic to C&C IPs
      description: Query the data repository where netflow records are continuously aggregated.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 4ddbe71f-9a61-4f7c-8dd4-50673f386a1a
    type: regular
    task:
      id: 4ddbe71f-9a61-4f7c-8dd4-50673f386a1a
      version: -1
      description: ""
      name: Search web proxy logs for C&C URLs
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 1185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: bbefe0d0-cde1-4f50-8bdc-f469f3c80264
    type: regular
    task:
      id: bbefe0d0-cde1-4f50-8bdc-f469f3c80264
      version: -1
      description: ""
      name: Search the organization's DNS server logs for C&C domains
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 388ef341-1a5b-4352-8328-2af51d604196
    type: regular
    task:
      id: 388ef341-1a5b-4352-8328-2af51d604196
      version: -1
      description: ""
      name: Search Endpoint monitoring infrastructure for communication with C&C IPs
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: d36f548c-3e55-42e5-8059-73e1adf0371e
    type: regular
    task:
      id: d36f548c-3e55-42e5-8059-73e1adf0371e
      version: -1
      name: Search Firewall and IPS logs for C&C IPs
      description: Check if any traffic was attempted to a C&C IP and blocked by our Network Security controls such as Firewalls and IPSs
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: e8beb59e-d7fd-4bc4-8c5d-f29bfa3370ce
    type: title
    task:
      id: e8beb59e-d7fd-4bc4-8c5d-f29bfa3370ce
      version: -1
      description: ""
      name: Validate findings
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 1885
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 20253d8e-c1d5-4918-82d1-aeac6837d061
    type: condition
    task:
      id: 20253d8e-c1d5-4918-82d1-aeac6837d061
      version: -1
      description: ""
      name: Did we uncover any suspected C&C communication?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "23"
      "yes":
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 2030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 66696f7e-2a82-4d91-880d-a68502b214a5
    type: regular
    task:
      id: 66696f7e-2a82-4d91-880d-a68502b214a5
      version: -1
      name: Review correlations with past investigations in case management / incident tracking
      description: Have any of our IoCs appeared in a past investigation? What did we know about them then, and what was the conclusion?
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 941,
          "y": 2202
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: 45237e6a-0780-41c5-8f55-d6aeefda3db1
    type: regular
    task:
      id: 45237e6a-0780-41c5-8f55-d6aeefda3db1
      version: -1
      name: Review reputation data for each indicator
      description: Review displayed reputation data for IPs, domains and URLs using all reputation sources
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 941,
          "y": 2375
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: 69cd0199-8b53-4358-89ed-63677ad5c20c
    type: condition
    task:
      id: 69cd0199-8b53-4358-89ed-63677ad5c20c
      version: -1
      description: ""
      name: Is PassiveTotal Available?
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "16"
      "yes":
      - "15"
    scriptarguments:
      brandname: {}
      value:
        simple: ${modules.brand(val==='PassiveTotal')}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 941,
          "y": 2550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: 0f052e94-da1b-49b1-898f-4de332126b3f
    type: regular
    task:
      id: 0f052e94-da1b-49b1-898f-4de332126b3f
      version: -1
      name: Review PassiveTotal enrichment data for the indicators
      description: Has PassiveTotal marked the domain as "ever compromised"? Does it associate the domain with a known malware?
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1187,
          "y": 2737
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: 0d2eda66-3682-4884-892e-82d33324855d
    type: condition
    task:
      id: 0d2eda66-3682-4884-892e-82d33324855d
      version: -1
      description: ""
      name: Is CrowdStrike Intel Available?
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "18"
      "yes":
      - "17"
    scriptarguments:
      brandname: {}
      value:
        simple: ${modules.brand(val==='FalconIntel')}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 842,
          "y": 2918
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: 2676407a-39f4-4dae-8f1e-b72e52bcd409
    type: regular
    task:
      id: 2676407a-39f4-4dae-8f1e-b72e52bcd409
      version: -1
      description: ""
      name: Get and review CrowdStrike indicator information
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1187,
          "y": 3083
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: 1127e16d-2f20-4090-89a2-e000f2cd9461
    type: condition
    task:
      id: 1127e16d-2f20-4090-89a2-e000f2cd9461
      version: -1
      description: ""
      name: Do the found IoCs include domain names?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "22"
      "yes":
      - "19"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 870,
          "y": 3289
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: a71b6494-370c-486a-84ac-1a3c58118c11
    type: regular
    task:
      id: a71b6494-370c-486a-84ac-1a3c58118c11
      version: -1
      description: ""
      name: Review the domains' Whois information
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "20"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1197.5,
          "y": 3450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: caae4dd9-e7c0-458c-84a9-90db5c2e6fac
    type: regular
    task:
      id: caae4dd9-e7c0-458c-84a9-90db5c2e6fac
      version: -1
      description: ""
      name: Retrieve DNS history for these domains
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1197.5,
          "y": 3625
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "21":
    id: "21"
    taskid: c91818be-5898-46ee-8263-a2f531216e5e
    type: regular
    task:
      id: c91818be-5898-46ee-8263-a2f531216e5e
      version: -1
      description: ""
      name: Review IP reputation for the IPs to which this domain resolved at the time
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1197.5,
          "y": 3792
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "22":
    id: "22"
    taskid: 5823c9d5-90cc-41cf-87c5-7b94b692f96e
    type: regular
    task:
      id: 5823c9d5-90cc-41cf-87c5-7b94b692f96e
      version: -1
      description: ""
      name: Summarize the list of validated malicious indicators
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 807,
          "y": 3973
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "23":
    id: "23"
    taskid: b7ee6752-2787-4142-8802-0d3ae23033c7
    type: title
    task:
      id: b7ee6752-2787-4142-8802-0d3ae23033c7
      version: -1
      description: ""
      name: Respond
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 4189
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "24":
    id: "24"
    taskid: 9ac6e273-1fa9-42e3-8367-031ce8a663f3
    type: condition
    task:
      id: 9ac6e273-1fa9-42e3-8367-031ce8a663f3
      version: -1
      description: ""
      name: Have any machines been confirmed as compromised?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "35"
      "yes":
      - "25"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 4385
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "25":
    id: "25"
    taskid: 7b632ce1-d607-40a1-8704-1097f5df2e72
    type: regular
    task:
      id: 7b632ce1-d607-40a1-8704-1097f5df2e72
      description: ""
      version: -1
      name: Isolate compromised hosts from network
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1113,
          "y": 4545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "26":
    id: "26"
    taskid: 1a83ba02-3043-423b-8f6e-b91e3ed5de09
    type: regular
    task:
      id: 1a83ba02-3043-423b-8f6e-b91e3ed5de09
      version: -1
      name: Disable compromised AD user account(s)
      description: Block access to the compromised user account in AD pending investigation and cleanup, after which the account will be reinstated by an Active Directory administrator with the required permissions.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1113,
          "y": 4737
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "27":
    id: "27"
    taskid: bd9b46ea-07eb-46ee-8308-46888a11640b
    type: regular
    task:
      id: bd9b46ea-07eb-46ee-8308-46888a11640b
      version: -1
      name: Lock / Rotate any other compromised accounts, keys and credentials
      description: If the machine contained any authentication keys, accounts to internal company resources and information systems, these should be locked and revoked, and reinstated later with new passwords.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1113,
          "y": 4917
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "28":
    id: "28"
    taskid: 00d3bb90-f069-4f86-8b0d-b68573ec9ddc
    type: condition
    task:
      id: 00d3bb90-f069-4f86-8b0d-b68573ec9ddc
      description: ""
      version: -1
      name: Is Slack Available?
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "29"
      "yes":
      - "33"
    scriptarguments:
      value:
        simple: ${modules.brand(val==='slack')}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1113,
          "y": 5101
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "29":
    id: "29"
    taskid: e7c70fba-f94f-4a02-8041-ef0bbf35baf0
    type: regular
    task:
      id: e7c70fba-f94f-4a02-8041-ef0bbf35baf0
      description: ""
      version: -1
      name: Retrieve the user's phone number from Active Directory
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 897,
          "y": 5305
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "30":
    id: "30"
    taskid: 9f4c6dba-dd4b-4673-86a8-19de7b29b237
    type: condition
    task:
      id: 9f4c6dba-dd4b-4673-86a8-19de7b29b237
      description: ""
      version: -1
      name: Is Twilio Available?
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "31"
      "yes":
      - "32"
    scriptarguments:
      brandname: {}
      value:
        simple: ${modules.brand(val==='Twilio')}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 897,
          "y": 5481
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "31":
    id: "31"
    taskid: dcf67394-61f2-49bb-8e0d-bc4fe64777b8
    type: regular
    task:
      id: dcf67394-61f2-49bb-8e0d-bc4fe64777b8
      version: -1
      description: ""
      name: Call the user and tell them that their machine is being isolated and investigated
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 680,
          "y": 5678
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "32":
    id: "32"
    taskid: 322e404d-bfed-49fd-824d-67dc96c95596
    type: regular
    task:
      id: 322e404d-bfed-49fd-824d-67dc96c95596
      version: -1
      description: ""
      name: SMS the user that their machine is being isolated and investigated
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1085,
          "y": 5678
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "33":
    id: "33"
    taskid: 3c17b8bd-e79e-4a02-8b1d-83e10fd749a8
    type: regular
    task:
      id: 3c17b8bd-e79e-4a02-8b1d-83e10fd749a8
      version: -1
      description: ""
      name: Tell the user on Slack that their machine is being isolated and investigated
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1547,
          "y": 5305
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "34":
    id: "34"
    taskid: c43c578d-8337-42b4-8fbc-73e178f6d0d5
    type: regular
    task:
      id: c43c578d-8337-42b4-8fbc-73e178f6d0d5
      version: -1
      description: ""
      name: Open separate incidents to further investigate each compromised host
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1352,
          "y": 6075
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "35":
    id: "35"
    taskid: 789a66bc-3116-4084-8c04-61b840d818ce
    type: title
    task:
      id: 789a66bc-3116-4084-8c04-61b840d818ce
      version: -1
      description: ""
      name: Remediate and Wrap up
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "36"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 733,
          "y": 6234
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "36":
    id: "36"
    taskid: 6f288fd3-3fb2-49af-8036-96f1063cd098
    type: condition
    task:
      id: 6f288fd3-3fb2-49af-8036-96f1063cd098
      version: -1
      description: ""
      name: Have the machines been cleaned successfully?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "37"
      "yes":
      - "38"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 733,
          "y": 6393
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "37":
    id: "37"
    taskid: ba3b890e-71b4-4f4d-8fd1-b33f295fd72e
    type: regular
    task:
      id: ba3b890e-71b4-4f4d-8fd1-b33f295fd72e
      version: -1
      description: ""
      name: Open a ticket for IT to reimage the machine
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "39"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 6587
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "38":
    id: "38"
    taskid: c3330605-13ed-4282-8d71-6150364e16d2
    type: regular
    task:
      id: c3330605-13ed-4282-8d71-6150364e16d2
      version: -1
      description: ""
      name: Restore network access for cleaned up hosts
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "39"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1151,
          "y": 6587
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "39":
    id: "39"
    taskid: bd76719e-c055-464d-868f-da361e6d134c
    type: regular
    task:
      id: bd76719e-c055-464d-868f-da361e6d134c
      version: -1
      description: ""
      name: Reinstate locked user accounts with new credentials
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 733,
          "y": 6857
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "40":
    id: "40"
    taskid: a80fd4c5-d1b2-4095-88a8-242e4ae17db5
    type: condition
    task:
      id: a80fd4c5-d1b2-4095-88a8-242e4ae17db5
      version: -1
      description: ""
      name: Is Slack Available?
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "41"
      "yes":
      - "45"
    scriptarguments:
      brandname:
        simple: slack
    results:
    - brandInstances
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 733,
          "y": 7028
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "41":
    id: "41"
    taskid: b195772e-ba3d-4283-8cd5-2103d953285d
    type: regular
    task:
      id: b195772e-ba3d-4283-8cd5-2103d953285d
      version: -1
      description: ""
      name: Retrieve the user's phone number from Active Directory
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "42"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 475,
          "y": 7244
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "42":
    id: "42"
    taskid: 18edd09f-be16-4da9-872c-3934845a255d
    type: condition
    task:
      id: 18edd09f-be16-4da9-872c-3934845a255d
      version: -1
      description: ""
      name: Is Twilio Available?
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "43"
      "yes":
      - "44"
    scriptarguments:
      brandname: {}
      value:
        simple: ${modules.brand(val==='Twilio')}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 475,
          "y": 7434
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "43":
    id: "43"
    taskid: 2c7bfecc-9b5d-43ba-8e1b-a35265824fef
    type: regular
    task:
      id: 2c7bfecc-9b5d-43ba-8e1b-a35265824fef
      version: -1
      description: ""
      name: Call the user and tell them that their accounts have been reinstated
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "46"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 212.5,
          "y": 7614
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "44":
    id: "44"
    taskid: 59e491df-f254-42fe-8e01-5956b8eba874
    type: regular
    task:
      id: 59e491df-f254-42fe-8e01-5956b8eba874
      version: -1
      name: SMS the user that their account has been reinstated
      description: Optionally - include the temporary random password generated for the account. The user will have to choose a new password on first login.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "46"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 637,
          "y": 7614
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "45":
    id: "45"
    taskid: 5d519042-711d-4b60-826c-c3566049f1e6
    type: regular
    task:
      id: 5d519042-711d-4b60-826c-c3566049f1e6
      version: -1
      name: Notify the user via Slack that their account has been reinstated
      description: Optionally - include the temporary random password generated for the account. The user will have to choose a new password on first login.
      script: slack|||slack-send
      type: regular
      iscommand: true
      brand: slack
    nexttasks:
      '#none#':
      - "46"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1060,
          "y": 7244
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "46":
    id: "46"
    taskid: 1a2dbd58-f17d-437d-8573-54a8339d3ccb
    type: regular
    task:
      id: 1a2dbd58-f17d-437d-8573-54a8339d3ccb
      version: -1
      description: ""
      name: Deploy validated IoCs with high confidence rating against future attacks
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "47"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 961,
          "y": 8033
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "47":
    id: "47"
    taskid: e1c5da88-1515-496c-8501-1b5b4c504f93
    type: regular
    task:
      id: e1c5da88-1515-496c-8501-1b5b4c504f93
      version: -1
      name: Share the validated IoCs with partner organizations
      description: Include any information gleaned about attribution to a known threat actor, especially if the actor is known to be targeting your industrial sector.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 961,
          "y": 8237
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "48":
    id: "48"
    taskid: a5a8e072-2d12-46ad-8448-1c958924aa4d
    type: regular
    task:
      id: a5a8e072-2d12-46ad-8448-1c958924aa4d
      version: -1
      description: ""
      name: Issue report to CISO by email
      type: regular
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 961,
          "y": 8435
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "49":
    id: "49"
    taskid: a38ffd8c-2fc9-4c28-8726-a9f59033aaca
    type: regular
    task:
      id: a38ffd8c-2fc9-4c28-8726-a9f59033aaca
      version: -1
      description: ""
      name: Expose Configured Integrations
      scriptName: ExposeModules
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "11_23_#default#": 0.88,
      "24_35_#default#": 0.76,
      "42_43_no": 0.61
    },
    "paper": {
      "dimensions": {
        "height": 8480,
        "width": 1714.5,
        "x": 212.5,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
tests:
- no test
deprecated: true