InvestigationDetailedSummaryParse

Parses attacks from context, and shows them according to the MITRE technique they use.

python · Malware Investigation and Response

Details

IDInvestigationDetailedSummaryParse
Languagepython
From Version6.2.0
Docker Imagedemisto/python3:3.12.13.10404775
Tagsbasescript

README

This script parses attacks from context and shows them according to the MITRE technique they use.
The MITRE ATT&CK v2 pack (v1.1.0 or newer) is required for this automation to run properly.

Script Data

Name Description
Script Type python3
Tags basescript
Cortex XSOAR Version 6.2.0

Inputs

There are no inputs for this script.

Outputs

Path Description Type
InvestigationDetailedSummary.Execution.Command and Scripting Interpreter Whether the Command and Scripting Interpreter technique was detected. bool
InvestigationDetailedSummary.Privilege Escalation.Boot or Logon Autostart Execution Whether the Boot or Logon Autostart Execution technique was detected. bool
InvestigationDetailedSummary.Lateral Movement.Command and Scripting Interpreter Whether the Indicator Removal on Host technique was detected. bool
InvestigationDetailedSummary.Defense Evasion.Remote Services Whether the Remote Services technique was detected. bool
InvestigationDetailedSummary.Persistence.Boot or Logon Autostart Execution Whether the Boot or Logon Autostart Execution technique was detected. bool

Source

InvestigationDetailedSummaryParse.py InvestigationDetailedSummaryParse_test.py InvestigationDetailedSummaryParse.yml
Download History Raw 
args: []
comment: Parses attacks from context, and shows them according to the MITRE technique they use.
commonfields:
  id: InvestigationDetailedSummaryParse
  version: -1
name: InvestigationDetailedSummaryParse
outputs:
- contextPath: InvestigationDetailedSummary.Execution.Command and Scripting Interpreter
  description: whether Command and Scripting Interpreter technique was detected.
  type: bool
- contextPath: InvestigationDetailedSummary.Privilege Escalation.Boot or Logon Autostart Execution
  description: whether the Boot or Logon Autostart Execution technique was detected.
  type: bool
- contextPath: InvestigationDetailedSummary.Lateral Movement.Command and Scripting Interpreter
  description: whether Indicator Removal on Host technique was detected.
  type: bool
- contextPath: InvestigationDetailedSummary.Defense Evasion.Remote Services
  description: whether the Remote Services technique was detected.
  type: bool
- contextPath: InvestigationDetailedSummary.Persistence.Boot or Logon Autostart Execution
  description: whether the Boot or Logon Autostart Execution technique was detected.
  type: bool
script: '-'
tags:
- basescript
timeout: '0'
type: python
subtype: python3
dockerimage: demisto/python3:3.12.13.10404775
fromversion: 6.2.0
tests:
- No tests (auto formatted)