id: CrowdStrike Falcon Intelligence Sandbox Detonate and Analyze File version: -1 fromversion: 6.5.0 name: CrowdStrike Falcon Intelligence Sandbox Detonate and Analyze File description: This playbook uploads, detonates, and analyzes files for the CrowdStrike Falcon Intelligence Sandbox. starttaskid: "0" tasks: "0": id: "0" taskid: d6740543-d7a7-44f8-82c0-9b63ba206946 type: start task: id: d6740543-d7a7-44f8-82c0-9b63ba206946 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "3" separatecontext: false view: |- { "position": { "x": 490, "y": 260 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: 20d4c83c-1366-4524-82a4-42a305852e17 type: condition task: id: 20d4c83c-1366-4524-82a4-42a305852e17 version: -1 name: Is CrowdStrike Falcon Intelligence Sandbox enabled? description: Returns 'yes' if the Falcon Intelligence Sandbox integration is available. scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: "no": - "10" "yes": - "7" scriptarguments: brandname: simple: CrowdStrike Falcon X results: - brandInstances separatecontext: false view: |- { "position": { "x": 490, "y": 400 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: 5612d5cb-af92-4478-84c8-216b2c947b9f type: condition task: id: 5612d5cb-af92-4478-84c8-216b2c947b9f version: -1 name: Is file type supported? description: Checks if the file type is supported. type: condition iscommand: false brand: "" nexttasks: '#default#': - "10" "yes": - "11" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: File filters: - - operator: match left: value: simple: File.Type iscontext: true right: value: simple: .*(?:EXE|DLL|COM|SCR|CPL|DOC|DOCX|XLS|XSLX|PPS|PPSX|PPT|PPTX|RTF|PDF|ETC|PUB|SCT|INK|CHM|HTA|WSF|JS|VBS|VBE|SWF|PL|PS1|PSD1|PSM1|SVG|PY|ELF|EML|MSG)\b ignorecase: true - operator: match left: value: simple: File.Extension iscontext: true right: value: simple: .*(?:EXE|DLL|COM|SCR|CPL|DOC|DOCX|XLS|XSLX|PPS|PPSX|PPT|PPTX|RTF|PDF|ETC|PUB|SCT|INK|CHM|HTA|WSF|JS|VBS|VBE|SWF|PL|PS1|PSD1|PSM1|SVG|PY|ELF|EML|MSG)\b ignorecase: true - operator: match left: value: simple: File.Info iscontext: true right: value: simple: .*(?:EXE|DLL|COM|SCR|CPL|DOC|DOCX|XLS|XSLX|PPS|PPSX|PPT|PPTX|RTF|PDF|ETC|PUB|SCT|INK|CHM|HTA|WSF|JS|VBS|VBE|SWF|PL|PS1|PSD1|PSM1|SVG|PY|ELF|EML|MSG)\b ignorecase: true accessor: EntryID iscontext: true ignorecase: true view: |- { "position": { "x": 700, "y": 1120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: 14ec2393-6dc2-464b-874b-ecff72eaf913 type: regular task: id: 14ec2393-6dc2-464b-874b-ecff72eaf913 version: -1 name: Set File to context description: Sets the file object into context. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "5" scriptarguments: key: simple: File value: complex: root: inputs.File separatecontext: false view: |- { "position": { "x": 700, "y": 940 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: 4c6b9421-a1bd-4b04-8b88-0a4d418e2fd4 type: condition task: id: 4c6b9421-a1bd-4b04-8b88-0a4d418e2fd4 version: -1 name: Is there a File to Detonate? description: Checks that there is a file in the playbook input. type: condition iscommand: false brand: "" nexttasks: '#default#': - "10" "yes": - "6" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.File iscontext: true right: value: {} view: |- { "position": { "x": 700, "y": 600 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: d840af25-45ab-4b77-8eef-be41022df556 type: regular task: id: d840af25-45ab-4b77-8eef-be41022df556 version: -1 name: CrowdStrike Falcon Intelligence Sandbox upload and detonate description: Submits a sample SHA256 hash for sandbox analysis. script: '|||cs-fx-submit-uploaded-file' type: regular iscommand: true brand: "" nexttasks: '#none#': - "10" scriptarguments: environment_id: simple: ${inputs.AlertOS} extended_data: simple: "true" polling: simple: "true" sha256: simple: ${File.SHA256} separatecontext: false view: |- { "position": { "x": 780, "y": 1530 } } note: false evidencedata: description: simple: Falcon Intelligence Sandbox report customfields: {} timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "10": id: "10" taskid: bb0060f5-6110-463f-8023-ac1f336e6b48 type: title task: id: bb0060f5-6110-463f-8023-ac1f336e6b48 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 490, "y": 1700 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: 2d0ba109-c75b-497f-809f-cbb54c1d230d type: regular task: id: 2d0ba109-c75b-497f-809f-cbb54c1d230d version: -1 name: Submit Uploaded file description: Uploads a file for sandbox analysis. script: '|||cs-fx-upload-file' type: regular iscommand: true brand: "" nexttasks: '#none#': - "8" scriptarguments: action_script: simple: ${inputs.ActionScript} command_line: simple: ${inputs.CommandLine} document_password: simple: ${inputs.DocumentPassword} network_setting: simple: ${inputs.NetworkSettings} environment_id: simple: ${inputs.EnvironmentID} extended_data: simple: "true" file: simple: ${File.EntryID} file_name: simple: example submit_file: simple: "no" submit_name: simple: ${inputs.SubmitName} system_date: simple: ${inputs.SystemDate} system_time: simple: ${inputs.SystemTime} separatecontext: false view: |- { "position": { "x": 780, "y": 1380 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 1505, "width": 670, "x": 490, "y": 260 } } } inputs: - key: File value: {} required: false description: The details of the file to detonate. playbookInputQuery: - key: AlertOS value: complex: root: ${incident accessor: deviceosname} transformers: - operator: MapValuesTransformer args: input_values: value: simple: Windows,Linux,Android mapped_values: value: simple: '160: Windows 10 (64-bit),300: Linux Ubuntu 16.04,300: Linux Ubuntu 16.04' required: false description: |- The operating system for which the alert was raised. accepted values are Windows, Linux, Android playbookInputQuery: null - key: NetworkSettings value: simple: "default" required: false description: | Specifies the sandbox network configuration used for analysis. Possible values are: - default: Fully operating network (default behavior if not specified). - tor: Route network traffic via TOR. - simulated: Simulate network traffic. - offline: Disable all network traffic. playbookInputQuery: null - key: EnvironmentID value: simple: '''160: Windows 10 (64-bit)''' required: false description: Sandbox environment used for analysis. playbookInputQuery: null - key: ActionScript value: {} required: false description: Runtime script for sandbox analysis. playbookInputQuery: null - key: CommandLine value: {} required: false description: 'Command line script passed to the submitted file at runtime. Max length: 2048 characters.' playbookInputQuery: null - key: DocumentPassword value: {} required: false description: 'Auto-filled for Adobe or Office files that prompt for a password. Max length: 32 characters.' playbookInputQuery: null - key: SubmitName value: {} required: false description: Name of the malware sample that’s used for file type detection. and analysis. playbookInputQuery: null - key: SystemDate value: {} required: false description: Set a custom date for the sandbox environment in the format yyyy-MM-dd. playbookInputQuery: null - key: SystemTime value: {} required: false description: Sets a custom time for the sandbox environment in the format HH:mm. playbookInputQuery: null outputs: - contextPath: csfalconx.resource.tags description: The analysis tags. - contextPath: csfalconx.resource.sha256 description: The SHA256 hash of the scanned file. - contextPath: csfalconx.resource.file_name description: 'The name of the uploaded file. ' - contextPath: csfalconx.resource.sandbox description: The Falcon Intelligence Sandbox findings. type: unknown - contextPath: csfalconx.resource.intel description: The Falcon Intelligence Sandbox intelligence results. type: unknown tests: - No tests