id: ATD - Detonate File
version: -1
name: ATD - Detonate File
fromversion: 5.0.0
description: |-
  Detonates a File using the McAfee Advanced Threat Defense sandbox.
  Advanced Threat Defense supports the following File Types:
  32-bit Portable Executables (PE)files; 64-bit PE+files
  exe, sys, dll, com, scr, cpl, ocx, cgi
  Microsoft Office Suite documents
  doc,dotm, docx, dotx, xls, ppam, xlsx, pps, xlsb, ppsx, xlsm, ppsm, ppt, ppt, pptx, pptm, rtf, shs, xltm, sldm, xltx, sldx, xlam, thmx, docm, xar
  Just Systems Ichitaro documents
  jtd, jtdc
  Adobe
  pdf, swf
  Compressed files
  gz, 7z, tgz, msi, zip, lzh, cab, lzma, rar
  Android application package
  apk, Java, JAR, CLASS, Java Script, Java bin files
  Image files
  jpeg, png, gif
  Other file types
  cmd, ace, bat, arj, vbs, chm, xml, lnk, url, mof, htm, ocx, html, potm, eml, potx, msg, ps1, vb, reg, vba, wsc, vbe, wsf, vbs, wsh
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 489b704c-bef9-40e7-8aa8-f74cca308a94
    type: start
    task:
      id: 489b704c-bef9-40e7-8aa8-f74cca308a94
      version: -1
      name: ""
      description: '-'
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: a846a181-2b08-4280-8508-58e628e10a73
    type: playbook
    task:
      id: a846a181-2b08-4280-8508-58e628e10a73
      version: -1
      name: GenericPolling
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      AdditionalPollingCommandArgNames: {}
      AdditionalPollingCommandArgValues: {}
      Ids:
        complex:
          root: ATD.Task.taskId
          filters:
          - - operator: isNotEqualNumber
              left:
                value:
                  simple: ATD.Task.taskId
                iscontext: true
              right:
                value:
                  simple: "-1"
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: taskId
      PollingCommandName:
        simple: atd-check-status
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: ATD.Task(val.status != 'Completed').taskId
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: e73794b6-a925-4e53-83f5-d1d764b62a48
    type: regular
    task:
      id: e73794b6-a925-4e53-83f5-d1d764b62a48
      version: -1
      name: McAfee ATD Get Report
      description: Retrieve the reports from McAfee ATD.
      script: '|||atd-get-report'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      jobId: {}
      taskId:
        complex:
          root: ATDTask
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: ATDTask.status
                iscontext: true
              right:
                value:
                  simple: Completed
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: taskId
      threshold: {}
      type:
        simple: pdf
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: e589b774-3cee-4dff-8e14-788ef3590dfa
    type: title
    task:
      id: e589b774-3cee-4dff-8e14-788ef3590dfa
      version: -1
      name: Done
      description: finished
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 70,
          "y": 1945
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: fddc93e3-f6fc-481c-8696-1bdaaf591562
    type: condition
    task:
      id: fddc93e3-f6fc-481c-8696-1bdaaf591562
      version: -1
      name: Is McAfee ATD sandbox enabled?
      description: |
        Verify that there is a valid instance of McAfee ATD enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: McAfee Advanced Threat Defense
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: ac109c6f-fb89-498f-8ba7-877e50ee9019
    type: condition
    task:
      id: ac109c6f-fb89-498f-8ba7-877e50ee9019
      version: -1
      name: Filter taskId
      description: Checks that valid files only have been sent to detonation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: ATD.Task.taskId(val != -1)
            iscontext: true
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: 7543cf0f-a33a-4bf3-8bac-7a5669cb4f44
    type: regular
    task:
      id: 7543cf0f-a33a-4bf3-8bac-7a5669cb4f44
      version: -1
      name: atd-check-status
      description: Updates the status of the tasks in the context.
      script: '|||atd-check-status'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      jobId: {}
      taskId:
        complex:
          root: ATD.Task.taskId
          filters:
          - - operator: isNotEqualNumber
              left:
                value:
                  simple: ATD.Task.taskId
                iscontext: true
              right:
                value:
                  simple: "-1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: d8e19b0c-3dfa-41f8-86fa-2d12ff711340
    type: condition
    task:
      id: d8e19b0c-3dfa-41f8-86fa-2d12ff711340
      version: -1
      name: Is File type supported?
      description: Check if file type is supported.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                filters:
                - - operator: match
                    left:
                      value:
                        simple: File.Type
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:EXE|SYS|DLL|COM|SCR|CPL|OCX|CGI|DOC|DOTM|DOCX|DOTX|XLS|PPAM|XSLX|PPS|XLSB|PPSX|XLSM|PPSM|PPT|PPTX|PPTM|RTF|SHS|XLTM|SLDM|XLTX|SLDX|XLAM|THMX|DOCM|XAR|JTD|JTDC|PDF|SWF|GZ|7Z|TGZ|MSI|ZIP|LZH|CAB|LZMA|APK|JAR|CLASS|JPEG|PNG|GIF|CMD|ACE|BAT|ARJ|VBS|CHM|XML|LNK|URL|MOF|HTM|OCX|HTML|POTM|EML|POTX|MSG|PS1|VB|REG|VBA|WSC|VBE|WSF|VBS|WSH)\b
                    ignorecase: true
                  - operator: match
                    left:
                      value:
                        simple: File.Extension
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:EXE|SYS|DLL|COM|SCR|CPL|OCX|CGI|DOC|DOTM|DOCX|DOTX|XLS|PPAM|XSLX|PPS|XLSB|PPSX|XLSM|PPSM|PPT|PPTX|PPTM|RTF|SHS|XLTM|SLDM|XLTX|SLDX|XLAM|THMX|DOCM|XAR|JTD|JTDC|PDF|SWF|GZ|7Z|TGZ|MSI|ZIP|LZH|CAB|LZMA|APK|JAR|CLASS|JPEG|PNG|GIF|CMD|ACE|BAT|ARJ|VBS|CHM|XML|LNK|URL|MOF|HTM|OCX|HTML|POTM|EML|POTX|MSG|PS1|VB|REG|VBA|WSC|VBE|WSF|VBS|WSH)\b
                    ignorecase: true
                  - operator: match
                    left:
                      value:
                        simple: File.Info
                      iscontext: true
                    right:
                      value:
                        simple: .*(?:EXE|SYS|DLL|COM|SCR|CPL|OCX|CGI|DOC|DOTM|DOCX|DOTX|XLS|PPAM|XSLX|PPS|XLSB|PPSX|XLSM|PPSM|PPT|PPTX|PPTM|RTF|SHS|XLTM|SLDM|XLTX|SLDX|XLAM|THMX|DOCM|XAR|JTD|JTDC|PDF|SWF|GZ|7Z|TGZ|MSI|ZIP|LZH|CAB|LZMA|APK|JAR|CLASS|JPEG|PNG|GIF|CMD|ACE|BAT|ARJ|VBS|CHM|XML|LNK|URL|MOF|HTM|OCX|HTML|POTM|EML|POTX|MSG|PS1|VB|REG|VBA|WSC|VBE|WSF|VBS|WSH)\b
                    ignorecase: true
                accessor: EntryID
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: 3814f559-a639-4e80-8d6e-c74b9e96e495
    type: regular
    task:
      id: 3814f559-a639-4e80-8d6e-c74b9e96e495
      version: -1
      name: Set File to context
      description: Set the file object into context.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      append: {}
      key:
        simple: File
      value:
        complex:
          root: inputs.File
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "12":
    id: "12"
    taskid: 9b8022fc-dfd0-4806-8ead-65f53804065f
    type: condition
    task:
      id: 9b8022fc-dfd0-4806-8ead-65f53804065f
      version: -1
      name: Is there a File to Detonate?
      description: Checks that there is a file in the playbook’s input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.File
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "13":
    id: "13"
    taskid: 5ae9c6b1-314f-44c8-8f95-8aa76fc6e658
    type: regular
    task:
      id: 5ae9c6b1-314f-44c8-8f95-8aa76fc6e658
      version: -1
      name: Set Context
      description: '-'
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      append: {}
      key:
        simple: ATDTask
      value:
        complex:
          root: ATD
          filters:
          - - operator: isNotEqualNumber
              left:
                value:
                  simple: ATD.Task.taskId
                iscontext: true
              right:
                value:
                  simple: "-1"
          accessor: Task
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "14":
    id: "14"
    taskid: 6e299488-408a-4b9d-82d0-cb053caf322e
    type: regular
    task:
      id: 6e299488-408a-4b9d-82d0-cb053caf322e
      version: -1
      name: Mcafee ATD Upload File
      description: upload a file/web URL for dynamic analysis by using the provided Analyzer Profile. Only single file/web URL can be submitted at a time.
      script: '|||atd-file-upload'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      analyzeAgain: {}
      dstIp: {}
      entryID:
        complex:
          root: inputs.File
          filters:
          - - operator: match
              left:
                value:
                  simple: inputs.File.Type
                iscontext: true
              right:
                value:
                  simple: .*(?:EXE|SYS|DLL|COM|SCR|CPL|OCX|CGI|DOC|DOTM|DOCX|DOTX|XLS|PPAM|XSLX|PPS|XLSB|PPSX|XLSM|PPSM|PPT|PPTX|PPTM|RTF|SHS|XLTM|SLDM|XLTX|SLDX|XLAM|THMX|DOCM|XAR|JTD|JTDC|PDF|SWF|GZ|7Z|TGZ|MSI|ZIP|LZH|CAB|LZMA|APK|JAR|CLASS|JPEG|PNG|GIF|CMD|ACE|BAT|ARJ|VBS|CHM|XML|LNK|URL|MOF|HTM|OCX|HTML|POTM|EML|POTX|MSG|PS1|VB|REG|VBA|WSC|VBE|WSF|VBS|WSH)\b
              ignorecase: true
            - operator: match
              left:
                value:
                  simple: inputs.File.Info
                iscontext: true
              right:
                value:
                  simple: .*(?:EXE|SYS|DLL|COM|SCR|CPL|OCX|CGI|DOC|DOTM|DOCX|DOTX|XLS|PPAM|XSLX|PPS|XLSB|PPSX|XLSM|PPSM|PPT|PPTX|PPTM|RTF|SHS|XLTM|SLDM|XLTX|SLDX|XLAM|THMX|DOCM|XAR|JTD|JTDC|PDF|SWF|GZ|7Z|TGZ|MSI|ZIP|LZH|CAB|LZMA|APK|JAR|CLASS|JPEG|PNG|GIF|CMD|ACE|BAT|ARJ|VBS|CHM|XML|LNK|URL|MOF|HTM|OCX|HTML|POTM|EML|POTX|MSG|PS1|VB|REG|VBA|WSC|VBE|WSF|VBS|WSH)\b
              ignorecase: true
            - operator: match
              left:
                value:
                  simple: inputs.File.Extension
                iscontext: true
              right:
                value:
                  simple: .*(?:EXE|SYS|DLL|COM|SCR|CPL|OCX|CGI|DOC|DOTM|DOCX|DOTX|XLS|PPAM|XSLX|PPS|XLSB|PPSX|XLSM|PPSM|PPT|PPTX|PPTM|RTF|SHS|XLTM|SLDM|XLTX|SLDX|XLAM|THMX|DOCM|XAR|JTD|JTDC|PDF|SWF|GZ|7Z|TGZ|MSI|ZIP|LZH|CAB|LZMA|APK|JAR|CLASS|JPEG|PNG|GIF|CMD|ACE|BAT|ARJ|VBS|CHM|XML|LNK|URL|MOF|HTM|OCX|HTML|POTM|EML|POTX|MSG|PS1|VB|REG|VBA|WSC|VBE|WSF|VBS|WSH)\b
              ignorecase: true
          accessor: EntryID
      fileName: {}
      filePriorityQ: {}
      messageId: {}
      skipTaskId: {}
      srcIp: {}
      submitType:
        simple: "0"
      url: {}
      vmProfileList: {}
      xMode: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1960,
        "width": 830,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: The file to detonate. File is taken from the context.
- key: Interval
  value:
    simple: "1"
  required: false
  description: Polling frequency - how often the polling command should run (minutes)
- key: Timeout
  value:
    simple: "15"
  required: false
  description: How much time to wait before a timeout occurs (minutes)
outputs:
- contextPath: ATD.Task.taskId
  description: The task ID of the sample uploaded
  type: string
- contextPath: ATD.Task.jobId
  description: The job ID of the sample uploaded
  type: string
- contextPath: ATD.Task.messageId
  description: The message Id relevant to the sample uploaded
  type: string
- contextPath: ATD.Task.srcIp
  description: Source IPv4 address
  type: string
- contextPath: ATD.Task.destIp
  description: Destination IPv4 address
  type: string
- contextPath: ATD.Task.MD5
  description: MD5 of the sample uploaded
  type: string
- contextPath: ATD.Task.SHA1
  description: SHA1 of the sample uploaded
  type: string
- contextPath: ATD.Task.SHA256
  description: SHA256 of the sample uploaded
  type: string
- contextPath: File.Name
  description: Filename (only in case of report type=json)
  type: string
- contextPath: File.Type
  description: File type e.g. "PE" (only in case of report type=json)
  type: string
- contextPath: File.Size
  description: File size (only in case of report type=json)
  type: number
- contextPath: File.MD5
  description: MD5 hash of the file (only in case of report type=json)
  type: string
- contextPath: File.SHA1
  description: SHA1 hash of the file (only in case of report type=json)
  type: string
- contextPath: File.SHA256
  description: SHA256 hash of the file (only in case of report type=json)
  type: string
- contextPath: File.EntryID
  description: The Entry ID of the sample
  type: string
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision
  type: string
- contextPath: File.Malicious.Description
  description: For malicious files, the reason for the vendor to make the decision
  type: string
- contextPath: DBotScore.Indicator
  description: The indicator we tested (only in case of report type=json)
  type: string
- contextPath: DBotScore.Type
  description: The type of the indicator (only in case of report type=json)
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score (only in case of report type=json)
  type: string
- contextPath: DBotScore.Score
  description: The actual score (only in case of report type=json)
  type: number
- contextPath: IP.Address
  description: IP's relevant to the sample
  type: string
- contextPath: InfoFile.EntryID
  description: The EntryID of the report file
  type: string
- contextPath: InfoFile.Extension
  description: The extension of the report file
  type: string
- contextPath: InfoFile.Name
  description: The name of the report file
  type: string
- contextPath: InfoFile.Info
  description: The info of the report file
  type: string
- contextPath: InfoFile.Size
  description: The size of the report file
  type: number
- contextPath: InfoFile.Type
  description: The type of the report file
  type: string
- contextPath: File
  description: File object
  type: unknown
- contextPath: File.Malicious
  description: File Malicious object
  type: unknown
- contextPath: DBotScore
  description: DBotScore object
  type: unknown
- contextPath: InfoFile
  description: Report file object
  type: unknown
tests:
- Test Playbook McAfee ATD
- Detonate File - Generic Test