id: Detonate File - Group-IB TDS Polygon version: -1 contentitemexportablefields: contentitemfields: {} name: Detonate File - Group-IB TDS Polygon description: 'Detonate file using Group-IB THF Polygon integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types: 7z, ace, ar, arj, bat, bz2, cab, chm, cmd, com, cpgz, cpl, csv, dat, doc, docm, docx, dot, dotm, dotx, eml, exe, gz, gzip, hta, htm, html, iqy, iso, jar, js, jse, lnk, lz, lzma, lzo, lzh, mcl, mht, msg, msi, msp, odp, ods, odt, ots, ott, pdf, pif, potm, potx, pps, ppsm, ppsx, ppt, pptm, pptx, ps1, pub, py, pyc, r*, rar, reg, rtf, scr, settingcontent-ms, stc, svg, sxc, sxw, tar, taz, .tb2, .tbz, .tbz2, tgz, tlz, txz, tzo, txt, url, uue, vbe, vbs, wsf, xar, xls, xlsb, xlsm, xlsx, xml, xz, z*, zip.' starttaskid: "0" tasks: "0": id: "0" taskid: 9501b3b5-5523-40bd-8af6-ae6a9d6ac607 type: start task: id: 9501b3b5-5523-40bd-8af6-ae6a9d6ac607 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "18" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 560, "y": 20 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "1": id: "1" taskid: fc02e787-ad1e-4381-8e8a-96bd716a9255 type: regular task: id: fc02e787-ad1e-4381-8e8a-96bd716a9255 version: -1 name: polygon-upload-file description: Upload file for analysis script: Group-IB TDS Polygon|||polygon-upload-file type: regular iscommand: true brand: Group-IB TDS Polygon nexttasks: '#none#': - "11" scriptarguments: file_id: complex: root: File filters: - - operator: match left: value: simple: File.Type iscontext: true right: value: simple: .*(?:7Z|ACE|AR|BAT|ARJ|BAT|BZ2|CAB|CHM|CMD|COM|CPGZ|CPL|CSV|DAT|DOC|DOCM|DOCX|DOCT|DOTM|DOTX|EML|EXE|GZ|GZIP|HTA|THM|HTML|IQY|ISO|JAR|JS|JS|JSE|LNK|LZ|LZMA|IZO|IZH|MCL|MHTMSG|MSI|MSP|ODP|ODS|ODT|OTS|OTT|PDF|PIF|POTM|POTX|PPS|PPT|PPTM|PPTX|PS1|PUB|PY|PYC|RAR|REG|RTF|SCR|SETTINGSCONTENT-MS|STC|SVG|SXC|SXW|TAR|TAZ|TB2|TBZ|TBZ2|TGZ|TLZ|TXZ|TZO|TXT|URL|UUE|VBE|VBS|WSF|XAR|XLS|XLSB|XLSM|XLSX|XML|XZ|ZIP)\b ignorecase: true - operator: match left: value: simple: File.Extension iscontext: true right: value: simple: .*(?:7Z|ACE|AR|BAT|ARJ|BAT|BZ2|CAB|CHM|CMD|COM|CPGZ|CPL|CSV|DAT|DOC|DOCM|DOCX|DOCT|DOTM|DOTX|EML|EXE|GZ|GZIP|HTA|THM|HTML|IQY|ISO|JAR|JS|JS|JSE|LNK|LZ|LZMA|IZO|IZH|MCL|MHTMSG|MSI|MSP|ODP|ODS|ODT|OTS|OTT|PDF|PIF|POTM|POTX|PPS|PPT|PPTM|PPTX|PS1|PUB|PY|PYC|RAR|REG|RTF|SCR|SETTINGSCONTENT-MS|STC|SVG|SXC|SXW|TAR|TAZ|TB2|TBZ|TBZ2|TGZ|TLZ|TXZ|TZO|TXT|URL|UUE|VBE|VBS|WSF|XAR|XLS|XLSB|XLSM|XLSX|XML|XZ|ZIP)\b ignorecase: true - - operator: in left: value: simple: File.EntryID iscontext: true right: value: simple: inputs.file_id iscontext: true accessor: EntryID transformers: - operator: uniq language: simple: en password: complex: root: inputs.Password transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1030, "y": 510 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: 3515a2f8-6b03-4061-8125-756cc50294fd type: title task: id: 3515a2f8-6b03-4061-8125-756cc50294fd version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 560, "y": 1730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: 70256af8-c846-4973-86a8-9c3361ee58b3 type: playbook task: id: 70256af8-c846-4973-86a8-9c3361ee58b3 version: -1 name: GenericPolling description: |- Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete. This playbook implements polling by continuously running the command in Step \#2 until the operation completes. The remote action should have the following structure: 1. Initiate the operation. 2. Poll to check if the operation completed. 3. (optional) Get the results of the operation. playbookName: GenericPolling type: playbook iscommand: false brand: "" nexttasks: '#none#': - "14" scriptarguments: Ids: complex: root: Polygon accessor: Analysis.ID transformers: - operator: LastArrayElement Interval: simple: ${inputs.Interval} PollingCommandArgName: simple: tds_analysis_id PollingCommandName: simple: polygon-analysis-info Timeout: simple: ${inputs.Timeout} dt: simple: Polygon.Analysis(val.Status !== 'Finished').ID separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 1030, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "12": id: "12" taskid: d2123158-1ae0-4f5e-87fd-ed63ac94647f type: regular task: id: d2123158-1ae0-4f5e-87fd-ed63ac94647f version: -1 name: polygon-export-report description: Export an archive with THF Polygon report to War Room script: Group-IB TDS Polygon|||polygon-export-report type: regular iscommand: true brand: Group-IB TDS Polygon nexttasks: '#none#': - "19" scriptarguments: tds_analysis_id: complex: root: Polygon accessor: Analysis.ID separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1030, "y": 1040 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: 4a79b7e8-4212-4b47-8078-bfb2dde6e1b4 type: regular task: id: 4a79b7e8-4212-4b47-8078-bfb2dde6e1b4 version: -1 name: polygon-analysis-info description: Get THF Polygon analysis information script: Group-IB TDS Polygon|||polygon-analysis-info type: regular iscommand: true brand: Group-IB TDS Polygon nexttasks: '#none#': - "12" scriptarguments: tds_analysis_id: complex: root: Polygon accessor: Analysis.ID transformers: - operator: LastArrayElement tds_file_id: complex: root: Polygon accessor: Analysis.ID transformers: - operator: LastArrayElement separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1030, "y": 860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "16": id: "16" taskid: 7d9a2924-35c5-4686-8ecb-7de719029f3f type: regular task: id: 7d9a2924-35c5-4686-8ecb-7de719029f3f version: -1 name: polygon-export-pcap description: Network activity dump export script: Group-IB TDS Polygon|||polygon-export-pcap type: regular iscommand: true brand: Group-IB TDS Polygon nexttasks: '#none#': - "4" scriptarguments: tds_analysis_id: complex: root: Polygon accessor: Analysis.ID transformers: - operator: LastArrayElement separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1040, "y": 1550 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "17": id: "17" taskid: 93f7ba3c-51fa-46f0-8b14-fc6609f50f2f type: regular task: id: 93f7ba3c-51fa-46f0-8b14-fc6609f50f2f version: -1 name: polygon-export-video description: Screen activity video export script: Group-IB TDS Polygon|||polygon-export-video type: regular iscommand: true brand: Group-IB TDS Polygon nexttasks: '#none#': - "16" scriptarguments: tds_analysis_id: complex: root: Polygon accessor: Analysis.ID transformers: - operator: LastArrayElement separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1040, "y": 1395 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "18": id: "18" taskid: 6bf891c0-3f7e-4265-8eb9-17931764bff6 type: condition task: id: 6bf891c0-3f7e-4265-8eb9-17931764bff6 version: -1 name: Is THF Polygon integration enabled? description: Check if a given value exists in the context. Will return 'no' for empty arrays. To be used mostly with DQ and selectors. scriptName: Exists type: condition iscommand: false brand: "" nexttasks: '#default#': - "4" "yes": - "21" scriptarguments: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: Group-IB TDS Polygon - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: brand separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 560, "y": 150 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "19": id: "19" taskid: e4ad7e47-59bc-45b2-8408-0d9da0ab7da2 type: condition task: id: e4ad7e47-59bc-45b2-8408-0d9da0ab7da2 version: -1 name: Is file malicious? description: Check if a given value is true. Will return 'no' otherwise scriptName: IsTrue type: condition iscommand: false brand: "" nexttasks: '#default#': - "4" "yes": - "17" scriptarguments: value: complex: root: Polygon accessor: Analysis.Result transformers: - operator: LastArrayElement separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1030, "y": 1220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "21": id: "21" taskid: 1ce58e07-640e-41d0-8e8d-713959491e1c type: condition task: id: 1ce58e07-640e-41d0-8e8d-713959491e1c version: -1 name: Is the file type supported? type: condition iscommand: false brand: "" description: "" nexttasks: '#default#': - "4" "yes": - "1" separatecontext: false conditions: - label: "yes" condition: - - operator: match left: value: complex: root: File accessor: Type iscontext: true right: value: simple: .*(?:7Z|ACE|AR|BAT|ARJ|BAT|BZ2|CAB|CHM|CMD|COM|CPGZ|CPL|CSV|DAT|DOC|DOCM|DOCX|DOCT|DOTM|DOTX|EML|EXE|GZ|GZIP|HTA|THM|HTML|IQY|ISO|JAR|JS|JS|JSE|LNK|LZ|LZMA|IZO|IZH|MCL|MHTMSG|MSI|MSP|ODP|ODS|ODT|OTS|OTT|PDF|PIF|POTM|POTX|PPS|PPT|PPTM|PPTX|PS1|PUB|PY|PYC|RAR|REG|RTF|SCR|SETTINGSCONTENT-MS|STC|SVG|SXC|SXW|TAR|TAZ|TB2|TBZ|TBZ2|TGZ|TLZ|TXZ|TZO|TXT|URL|UUE|VBE|VBS|WSF|XAR|XLS|XLSB|XLSM|XLSX|XML|XZ|ZIP)\b ignorecase: true - operator: match left: value: complex: root: File accessor: Extension iscontext: true right: value: simple: .*(?:7Z|ACE|AR|BAT|ARJ|BAT|BZ2|CAB|CHM|CMD|COM|CPGZ|CPL|CSV|DAT|DOC|DOCM|DOCX|DOCT|DOTM|DOTX|EML|EXE|GZ|GZIP|HTA|THM|HTML|IQY|ISO|JAR|JS|JS|JSE|LNK|LZ|LZMA|IZO|IZH|MCL|MHTMSG|MSI|MSP|ODP|ODS|ODT|OTS|OTT|PDF|PIF|POTM|POTX|PPS|PPT|PPTM|PPTX|PS1|PUB|PY|PYC|RAR|REG|RTF|SCR|SETTINGSCONTENT-MS|STC|SVG|SXC|SXW|TAR|TAZ|TB2|TBZ|TBZ2|TGZ|TLZ|TXZ|TZO|TXT|URL|UUE|VBE|VBS|WSF|XAR|XLS|XLSB|XLSM|XLSX|XML|XZ|ZIP)\b ignorecase: true - - operator: in left: value: complex: root: File accessor: EntryID iscontext: true right: value: simple: inputs.file_id iscontext: true continueonerrortype: "" view: |- { "position": { "x": 820, "y": 330 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 1775, "width": 860, "x": 560, "y": 20 } } } inputs: - key: file_id value: complex: root: File accessor: EntryID required: false description: The File EntryID which will be detonated. playbookInputQuery: - key: Interval value: simple: "1" required: true description: Report requests frequency (minutes) playbookInputQuery: - key: Timeout value: simple: "60" required: true description: Report waiting timeout (minutes) playbookInputQuery: - key: Password value: {} required: false description: Password for the uploaded file. playbookInputQuery: outputs: - contextPath: File.Name description: The full file name (including file extension). type: string - contextPath: File.MD5 description: The MD5 hash of the file. type: string - contextPath: File.SHA1 description: The SHA1 hash of the file. type: string - contextPath: File.SHA256 description: The SHA256 hash of the file. type: string - contextPath: File.Type description: File type. type: string - contextPath: File.Malicious.Vendor description: The vendor that reported the file as malicious. type: string - contextPath: File.Malicious.Description description: A description explaining why the file was determined to be malicious. type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: IP.Address description: IP address. type: string - contextPath: Domain.Name description: The domain name. type: string - contextPath: Domain.DNS description: A list of IP objects resolved by DNS. type: string - contextPath: URL.Data description: The URL. type: string - contextPath: RegistryKey.Path description: The path to the registry key. type: string - contextPath: RegistryKey.Value description: The value at the given RegistryKey. type: string - contextPath: Process.Name description: Process name. type: string - contextPath: Process.PID description: Process PID. type: number - contextPath: Process.CommandLine description: Process command line. type: string - contextPath: Process.Path description: Process path. type: string - contextPath: Process.StartTime description: Process start time. type: date - contextPath: Process.EndTime description: Process end time. type: date - contextPath: Polygon.Analysis.ID description: Analysis ID in THF. type: number - contextPath: Polygon.Analysis.Name description: File name. type: string - contextPath: Polygon.Analysis.Size description: File size. type: number - contextPath: Polygon.Analysis.Started description: Analysis start timestamp. type: date - contextPath: Polygon.Analysis.Analyzed description: Analysis finish timestamp. type: date - contextPath: Polygon.Analysis.MD5 description: Analyzed file MD5 hash. type: string - contextPath: Polygon.Analysis.SHA1 description: Analyzed file SHA1 hash. type: string - contextPath: Polygon.Analysis.SHA256 description: Analyzed file SHA256. type: string - contextPath: Polygon.Analysis.Result description: Analysis verdict. type: string - contextPath: Polygon.Analysis.Status description: The analysis status. type: string - contextPath: Polygon.Analysis.Verdict description: Analysis verdict. type: boolean - contextPath: Polygon.Analysis.Probability description: Verdict probability. type: string - contextPath: Polygon.Analysis.Families description: Malware families. type: string - contextPath: Polygon.Analysis.Score description: Polygon score. type: number - contextPath: Polygon.Analysis.Internet-connection description: Internet availability. type: string - contextPath: Polygon.Analysis.Type description: File type. type: string - contextPath: Polygon.Analysis.DumpExists description: Network activity dump exists. type: boolean - contextPath: Polygon.Analysis.File description: The information about files in analysis. type: unknown - contextPath: Polygon.Analysis.URL description: The information about URL indicators. - contextPath: Polygon.Analysis.IP description: The information about IP indicators. - contextPath: Polygon.Analysis.Domain description: The information about domain indicators. - contextPath: Polygon.Analysis.RegistryKey description: The information about registry keys which were modified during the analysis. - contextPath: Polygon.Analysis.Process description: The information about processes started during the analysis. fromversion: 5.0.0 tests: - No tests