id: HAFNIUM - Exchange 0-day exploits version: -1 contentitemexportablefields: contentitemfields: {} name: HAFNIUM - Exchange 0-day exploits description: "This playbook includes the following tasks: Collect indicators to be used in your threat hunting process Retrieve IOCs related to HAFNIUM and the exploited exchange 0-day vulnerabilities Discover IOCs related to the attack Query firewall logs to detect malicious network activity Search endpoint logs for malicious hashes to detect compromised hosts (Available from Cortex XSOAR 5.5.0). Block indicators Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve. Read more about the attack on our Unit42 blog: https://unit42.paloaltonetworks.com/microsoft-exchange-server-vulnerabilities/ Sources: https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/" starttaskid: "0" tasks: "0": id: "0" taskid: 23724197-3ddc-4d4c-86f9-62af787ab59d type: start task: id: 23724197-3ddc-4d4c-86f9-62af787ab59d version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "2" separatecontext: false view: |- { "position": { "x": 470, "y": 70 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "2": id: "2" taskid: c221171d-22b4-4f75-8a38-e4a296c8a8bc type: title task: id: c221171d-22b4-4f75-8a38-e4a296c8a8bc version: -1 name: Collect and Enrich IOCs type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "5" - "6" - "34" separatecontext: false view: |- { "position": { "x": 470, "y": 210 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "5": id: "5" taskid: 0851b947-8882-4c02-8cf1-fcead06eec66 type: regular task: id: 0851b947-8882-4c02-8cf1-fcead06eec66 version: -1 name: Retrieve IOCs from Microsoft blog description: Sends http request. Returns the response as json to collect the indicators from Microsoft blog post scriptName: http type: regular iscommand: false brand: "" nexttasks: '#none#': - "73" scriptarguments: body: {} filename: {} headers: {} insecure: {} method: simple: GET password: {} proxy: {} saveAsFile: {} unsecure: {} url: simple: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/ username: {} reputationcalc: 2 separatecontext: false view: |- { "position": { "x": 470, "y": 370 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "6": id: "6" taskid: 5fb7a03a-0f98-4e84-8757-b2b64d3bbce6 type: regular task: id: 5fb7a03a-0f98-4e84-8757-b2b64d3bbce6 version: -1 name: Retrieve IOCs from Volexity blog description: Sends http request. Returns the response as json to collect the indicators from Volexity blog post scriptName: http type: regular iscommand: false brand: "" nexttasks: '#none#': - "73" scriptarguments: body: {} filename: {} headers: {} insecure: {} method: simple: GET password: {} proxy: {} saveAsFile: {} unsecure: {} url: simple: https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/ username: {} reputationcalc: 2 separatecontext: false view: |- { "position": { "x": 0, "y": 370 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "7": id: "7" taskid: 555f5b82-dd7a-465a-8f88-c83462c87107 type: title task: id: 555f5b82-dd7a-465a-8f88-c83462c87107 version: -1 name: Tag Indicators type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "13" - "12" - "15" separatecontext: false view: |- { "position": { "x": 470, "y": 730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "12": id: "12" taskid: f0b1f95e-9ca5-455f-81b0-5aaa35e6e865 type: regular task: id: f0b1f95e-9ca5-455f-81b0-5aaa35e6e865 version: -1 name: Tag CVE's indicators description: commands.local.cmd.set.indicators script: Builtin|||setIndicators type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "16" scriptarguments: indicatorsValues: complex: root: ExtractedIndicators accessor: CVE transformers: - operator: uniq tags: simple: HAFNIUM, 0Day, ExchangeExploits separatecontext: false view: |- { "position": { "x": 920, "y": 890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "13": id: "13" taskid: 088c8c88-7c98-40fa-802a-fe1f126a7522 type: regular task: id: 088c8c88-7c98-40fa-802a-fe1f126a7522 version: -1 name: Tag IP's indicators description: commands.local.cmd.set.indicators script: Builtin|||setIndicators type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "16" scriptarguments: indicatorsValues: complex: root: ExtractedIndicators accessor: IP transformers: - operator: uniq tags: simple: HAFNIUM, 0Day, ExchangeExploits separatecontext: false view: |- { "position": { "x": 470, "y": 890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "15": id: "15" taskid: 00aeec53-ca51-4fd9-8741-48256ce90c2c type: regular task: id: 00aeec53-ca51-4fd9-8741-48256ce90c2c version: -1 name: Tag file hashes indicators description: commands.local.cmd.set.indicators script: Builtin|||setIndicators type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "16" scriptarguments: indicatorsValues: complex: root: ExtractedIndicators accessor: File transformers: - operator: uniq tags: simple: HAFNIUM, 0Day, ExchangeExploits separatecontext: false view: |- { "position": { "x": 20, "y": 890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "16": id: "16" taskid: 0d74272c-04ef-41a4-84b5-e558e4a36fba type: title task: id: 0d74272c-04ef-41a4-84b5-e558e4a36fba version: -1 name: Hunt IOCs type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "19" - "17" - "18" - "61" - "31" separatecontext: false view: |- { "position": { "x": 470, "y": 1080 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "17": id: "17" taskid: 912e8f4e-0ee2-42bb-88de-b22cccdbb48b type: playbook task: id: 912e8f4e-0ee2-42bb-88de-b22cccdbb48b version: -1 name: Search Endpoint by CVE - Generic description: Hunt for assets with a given CVE using available tools playbookName: Search Endpoint by CVE - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "26" scriptarguments: CVE_ID: complex: root: ExtractedIndicators accessor: CVE transformers: - operator: uniq separatecontext: false loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 790, "y": 1370 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "18": id: "18" taskid: 1fc4b6cb-7580-44cb-86f3-271ae4e6c9df type: playbook task: id: 1fc4b6cb-7580-44cb-86f3-271ae4e6c9df version: -1 name: Search Endpoints By Hash - Generic V2 description: Hunt using available tools playbookName: Search Endpoints By Hash - Generic V2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "26" scriptarguments: MD5Hash: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: "32" transformers: - operator: uniq SHA1Hash: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: "40" transformers: - operator: uniq SHA256Hash: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: "64" transformers: - operator: uniq separatecontext: false loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 150, "y": 1370 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "19": id: "19" taskid: 8c11fd43-d437-4eab-8ed6-5752f9080c74 type: playbook task: id: 8c11fd43-d437-4eab-8ed6-5752f9080c74 version: -1 name: Palo Alto Networks - Hunting And Threat Detection description: "This is a multipurpose playbook used for hunting and threat detection.\ \ The playbook receives inputs based on hashes, IP addresses, or domain names\ \ provided manually or from outputs by other playbooks. \nWith the received\ \ indicators, the playbook leverages data received by PANW products including,\ \ Cortex Data Lake, Autofocus and Pan-OS to search for IP addresses, host\ \ names and users related to the provided indicators.\nThe output provided\ \ by the playbook facilitates pivoting searches for possibly affected IP addresses\ \ or users." playbookName: Palo Alto Networks - Hunting And Threat Detection type: playbook iscommand: false brand: "" nexttasks: '#none#': - "26" scriptarguments: IPAddresses: complex: root: ExtractedIndicators accessor: IP transformers: - operator: uniq MD5: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: "32" transformers: - operator: uniq SHA256: complex: root: ExtractedIndicators.File filters: - - operator: hasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: "64" transformers: - operator: uniq separatecontext: false loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 470, "y": 1230 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "23": id: "23" taskid: 2e8ee0c9-14be-4281-84ba-205f6d06fdda type: regular task: id: 2e8ee0c9-14be-4281-84ba-205f6d06fdda version: -1 name: Investigate further description: | Further investigate the incident (endpoints, the entry point, etc’) type: regular iscommand: false brand: "" nexttasks: '#none#': - "24" separatecontext: false view: |- { "position": { "x": 470, "y": 5035 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "24": id: "24" taskid: 1d312252-568b-479b-87a7-a374268d0594 type: title task: id: 1d312252-568b-479b-87a7-a374268d0594 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 470, "y": 5200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "25": id: "25" taskid: 05318f08-b93b-4eeb-8162-71b9b0bed4d0 type: regular task: id: 05318f08-b93b-4eeb-8162-71b9b0bed4d0 version: -1 name: Search XDR incidents for HAFNIUM activity description: | Search XDR incidents for HAFNIUM scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "64" scriptarguments: query: simple: xdralerts.name:"Uncommon net group execution" or xdralerts.name:"Multiple Discovery Commands" or xdralerts.name:"Exchange process writing aspx files" or xdralerts.name:"Behavioral Threat Detected" or xdralerts.name:"Suspicious Process Creation" or xdralerts.name:"Uncommon remote service start via sc.exe" or xdralerts.name:"Rare SSH Session" or xdralerts.name:"Uncommon ARP cache listing via arp.exe" or xdralerts.name:"Uncommon user management via net.exe" or xdralerts.name:"WmiPrvSe.exe Rare Child Command Line" or xdralerts.name:"Script Connecting to Rare External Host" or xdralerts.name:"Remote process execution using WMI" or xdralerts.name:"64-bit PowerShell spawning a 32-bit PowerShell" or xdralerts.name:"Suspicious PowerShell Command Line" or xdralerts.name:"Dumping Registry hives with passwords" separatecontext: false view: |- { "position": { "x": 1100, "y": 1985 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "26": id: "26" taskid: 99be9722-03ff-4d7f-8b12-96829d11238f type: title task: id: 99be9722-03ff-4d7f-8b12-96829d11238f version: -1 name: 'Remediation ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "35" separatecontext: false view: |- { "position": { "x": 470, "y": 3260 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: 08aa4511-473f-4ead-82d5-bdb7d25ba745 type: title task: id: 08aa4511-473f-4ead-82d5-bdb7d25ba745 version: -1 name: Expanse Issues Search type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "30" separatecontext: false view: |- { "position": { "x": 1470, "y": 1690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "30": id: "30" taskid: 6c41e9e8-a326-44ab-8494-d930b98f249c type: condition task: id: 6c41e9e8-a326-44ab-8494-d930b98f249c version: -1 name: 'Is Expanse enabled? ' description: Checks if the Expanse instance is enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "26" "yes": - "33" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: ExpanseV2 - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: Active ignorecase: true iscontext: true view: |- { "position": { "x": 1470, "y": 1810 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "31": id: "31" taskid: a4658468-e6cc-4151-89b6-a43768122dbd type: title task: id: a4658468-e6cc-4151-89b6-a43768122dbd version: -1 name: Search Activities Related To the 0-Day Exploits type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "32" - "52" - "29" separatecontext: false view: |- { "position": { "x": 1140, "y": 1540 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "32": id: "32" taskid: 7d21b118-b31d-43af-83bc-de2affaa5222 type: title task: id: 7d21b118-b31d-43af-83bc-de2affaa5222 version: -1 name: XDR Related Incidents type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "46" separatecontext: false view: |- { "position": { "x": 890, "y": 1690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "33": id: "33" taskid: 22319772-3a5f-4319-87ea-293150f8c51e type: regular task: id: 22319772-3a5f-4319-87ea-293150f8c51e version: -1 name: Search issues related to Exchange and OWA description: Retrieve issues script: '|||expanse-get-issues' type: regular iscommand: true brand: "" nexttasks: '#none#': - "63" scriptarguments: issue_type: simple: Microsoft OWA Server, Microsoft Exchange Server, Insecure Microsoft Exchange Server separatecontext: false view: |- { "position": { "x": 1730, "y": 1985 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "34": id: "34" taskid: d0b29943-dba8-41e6-8a2d-183fdef37261 type: regular task: id: d0b29943-dba8-41e6-8a2d-183fdef37261 version: -1 name: Retrieve indicators from Azure GitHub description: Sends http request. Returns the response as json. scriptName: http type: regular iscommand: false brand: "" nexttasks: '#none#': - "73" scriptarguments: method: simple: GET url: simple: https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv separatecontext: false view: |- { "position": { "x": 940, "y": 370 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "35": id: "35" taskid: 650c74ff-19bc-45ee-8387-f43a89de29f6 type: condition task: id: 650c74ff-19bc-45ee-8387-f43a89de29f6 version: -1 name: Block indicators automatically? description: Checks whether IOCs associated with the incident can be blocked automatically. type: condition iscommand: false brand: "" nexttasks: '#default#': - "36" "yes": - "74" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.AutoBlockIndicators iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 470, "y": 3490 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "36": id: "36" taskid: 5d7c31c2-5278-4feb-8925-67085c003173 type: regular task: id: 5d7c31c2-5278-4feb-8925-67085c003173 version: -1 name: Manually block indicators description: Manually block the IOCs in the relevant systems. type: regular iscommand: false brand: "" nexttasks: '#none#': - "37" separatecontext: false view: |- { "position": { "x": 210, "y": 3680 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "37": id: "37" taskid: 34307bab-7bbc-4d7b-87db-207786e132f2 type: title task: id: 34307bab-7bbc-4d7b-87db-207786e132f2 version: -1 name: Check Patch Level type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "38" separatecontext: false view: |- { "position": { "x": 470, "y": 3850 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "38": id: "38" taskid: 0da9ab04-aea3-4d68-827e-f4be717d3d33 type: condition task: id: 0da9ab04-aea3-4d68-827e-f4be717d3d33 version: -1 name: Check patch levels of Exchange Server description: "Is the Exchange patched with the March 2021 security updates?\nIf needed, refer to the Microsoft post about the patches: \nhttps://techcommunity.microsoft.com/t5/exchange-team-blog/released-march-2021-exchange-server-security-updates/ba-p/2175901\n " type: condition iscommand: false brand: "" nexttasks: "No": - "40" "Yes": - "39" separatecontext: false view: |- { "position": { "x": 470, "y": 4000 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "39": id: "39" taskid: 36f3308c-e690-4d00-8a3d-374e59a53ef0 type: regular task: id: 36f3308c-e690-4d00-8a3d-374e59a53ef0 version: -1 name: Set Exchange patched flag to true description: Sets Exchange patched flag to true. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "44" scriptarguments: key: simple: ExchangesPatched value: simple: "True" separatecontext: false view: |- { "position": { "x": 210, "y": 4180 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "40": id: "40" taskid: 8b7f376b-5b7d-457a-8c87-71b69591f9e3 type: regular task: id: 8b7f376b-5b7d-457a-8c87-71b69591f9e3 version: -1 name: Set Exchange patched flag to false description: Sets Exchange patched flag to false. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "44" scriptarguments: key: simple: ExchangesPatched value: simple: "False" separatecontext: false view: |- { "position": { "x": 720, "y": 4180 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "41": id: "41" taskid: b50533ab-561a-4f4b-86d3-5a7582aaa4f2 type: condition task: id: b50533ab-561a-4f4b-86d3-5a7582aaa4f2 version: -1 name: Is the Exchange Server patched? description: Checks the user answer if the Exchange Server patched type: condition iscommand: false brand: "" nexttasks: '#default#': - "42" "yes": - "23" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: ExchangesPatched iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 470, "y": 4510 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "42": id: "42" taskid: 9286e773-b14d-430d-8489-b5a0bcc0f36b type: condition task: id: 9286e773-b14d-430d-8489-b5a0bcc0f36b version: -1 name: Is it possible to patch the Exchange Server? description: Check whether it is possible to patch the Exchange Server type: condition iscommand: false brand: "" nexttasks: "No": - "45" "Yes": - "43" separatecontext: false view: |- { "position": { "x": -10, "y": 4690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "43": id: "43" taskid: 0d7d13b7-690d-464f-8e73-66ac2d7e92f4 type: regular task: id: 0d7d13b7-690d-464f-8e73-66ac2d7e92f4 version: -1 name: Install March 2021 Exchange security patches description: |- The March 2021 security patches found here: https://techcommunity.microsoft.com/t5/exchange-team-blog/released-march-2021-exchange-server-security-updates/ba-p/2175901 type: regular iscommand: false brand: "" nexttasks: '#none#': - "23" separatecontext: false view: |- { "position": { "x": 230, "y": 4860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "44": id: "44" taskid: 11fe1ea6-3119-47b4-82fc-9351b7ae858a type: title task: id: 11fe1ea6-3119-47b4-82fc-9351b7ae858a version: -1 name: Mitigation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "41" separatecontext: false view: |- { "position": { "x": 470, "y": 4350 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "45": id: "45" taskid: 2c9da488-1bb4-44e9-8d41-efa87042f141 type: regular task: id: 2c9da488-1bb4-44e9-8d41-efa87042f141 version: -1 name: Interim mitigations description: "Follow the Microsoft blog post about the interim mitigations.\nThe blog post explains how to configure the interim mitigations and their rollback if needed. \nhttps://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/\n\nNotes:\n- These mitigations are not a remediation if your Exchange servers have already been compromised, nor are they full protection against an attack.\n- This should only be used as a temporary mitigation until Exchange servers can be fully patched. \n" type: regular iscommand: false brand: "" nexttasks: '#none#': - "23" separatecontext: false view: |- { "position": { "x": -260, "y": 4860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "46": id: "46" taskid: 83b0f1b8-bbb8-4ec2-812f-9b5d05bcdcf3 type: condition task: id: 83b0f1b8-bbb8-4ec2-812f-9b5d05bcdcf3 version: -1 name: 'Is Cortex XDR enabled? ' description: Checks if the Cortex XDR instance is enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "26" "yes": - "25" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active ignorecase: true - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: Cortex XDR - IR ignorecase: true iscontext: true view: |- { "position": { "x": 890, "y": 1810 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "47": id: "47" taskid: 1ec43324-e0c1-4c72-8875-bd281293fdc0 type: title task: id: 1ec43324-e0c1-4c72-8875-bd281293fdc0 version: -1 name: 'Manually Hunt Windows Event Logs ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "48" separatecontext: false view: |- { "position": { "x": 2210, "y": 2000 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "48": id: "48" taskid: 8a97955f-7d4c-4915-82f6-0538b9481217 type: regular task: id: 8a97955f-7d4c-4915-82f6-0538b9481217 version: -1 name: Nishang PowerShell framework description: | Look for Nishang Invoke-PowerShellTcpOneLine in Windows Event Logging: SecurityEvent | where EventID == 4688 | where Process has_any ("powershell.exe", "PowerShell_ISE.exe") | where CommandLine has "$client = New-Object System.Net.Sockets.TCPClient" Splunk query example: index="*" sourcetype="WinEventLog" source="WinEventLog:Security" EventCode=4104 Message="* Invoke-PowerShellTCP*" index="*" sourcetype="WinEventLog" source="WinEventLog:Security" EventCode=4688 Creator_Process_Name="powershell.exe" System.Net.Sockets.TCPClient type: regular iscommand: false brand: "" nexttasks: '#none#': - "49" separatecontext: false view: |- { "position": { "x": 2210, "y": 2140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "49": id: "49" taskid: fedada54-ba62-4843-881c-eb4c74163ad6 type: regular task: id: fedada54-ba62-4843-881c-eb4c74163ad6 version: -1 name: Powercat detection description: | Look for downloads of PowerCat in cmd and Powershell command line logging in Windows Event Logs: SecurityEvent | where EventID == 4688 | where Process has_any ("cmd.exe", "powershell.exe", "PowerShell_ISE.exe") | where CommandLine has "https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1" Splunk query example: index="*" sourcetype="WinEventLog" source="WinEventLog:Security" EventCode=4104 Message="*powercat*" type: regular iscommand: false brand: "" nexttasks: '#none#': - "50" separatecontext: false view: |- { "position": { "x": 2210, "y": 2320 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "50": id: "50" taskid: 7bed501c-fcdc-4c76-8236-0775fa91f492 type: regular task: id: 7bed501c-fcdc-4c76-8236-0775fa91f492 version: -1 name: UMWorkerProcess.exe in Exchange creating abnormal content description: "Look for Microsoft Exchange Server’s Unified Messaging service\ \ creating non-standard content on disk, which could indicate web shells or\ \ other malicious content, suggesting exploitation of CVE-2021-26858 vulnerability:\n\ \nDeviceFileEvents | where InitiatingProcessFileName == \"UMWorkerProcess.exe\"\ \ | where FileName != \"CacheCleanup.bin\" | where FileName !endswith \".txt\"\ \ | where FileName !endswith \".LOG\" | where FileName !endswith \".cfg\"\ \ | where FileName != \"cleanup.bin\"\n\nSplunk query example:\nindex=* sourcetype=WinEventLog\ \ source=\"WinEventLog:Security\" EventCode=4663 Object_Type=\"File\" (Object_Name=\"\ *.php\" OR Object_Name=\"*.jsp\" OR Object_Name=\"*.js\" OR Object_Name=\"\ *.aspx\" OR Object_Name=\"*.asmx\" OR Object_Name=\"*.cfm\" OR Object_Name=\"\ *.shtml\") (Process_Name=\"*umworkerprocess.exe*\" OR Process_Name=\"*UMService.exe*\"\ ) \n" type: regular iscommand: false brand: "" nexttasks: '#none#': - "51" separatecontext: false view: |- { "position": { "x": 2210, "y": 2500 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "51": id: "51" taskid: af589419-1059-4cd8-85ff-917c122a842e type: regular task: id: af589419-1059-4cd8-85ff-917c122a842e version: -1 name: UMWorkerProcess.exe spawning description: |- Look for Microsoft Exchange Server’s Unified Messaging service spawning abnormal subprocesses, suggesting exploitation of CVE-2021-26857 vulnerability: DeviceProcessEvents | where InitiatingProcessFileName == "UMWorkerProcess.exe" | where FileName != "wermgr.exe" | where FileName != "WerFault.exe" Splunk Query example: index=* sourcetype="WinEventLog" source="WinEventLog:Security" EventCode=4688 (Creator_Process_Name="*umworkerprocess.exe*" OR Creator_Process_Name="*UMService.exe*") NOT New_Process_Name="*UMWorkerProcess.exe*" type: regular iscommand: false brand: "" nexttasks: '#none#': - "57" separatecontext: false view: |- { "position": { "x": 2210, "y": 2680 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "52": id: "52" taskid: 93265b0c-9f91-465d-8d63-42b1808d5586 type: title task: id: 93265b0c-9f91-465d-8d63-42b1808d5586 version: -1 name: Hunt Windows Events type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "59" separatecontext: false view: |- { "position": { "x": 2710, "y": 1690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "53": id: "53" taskid: 28e4eb5b-e158-4e84-8f50-5fcc25a95952 type: regular task: id: 28e4eb5b-e158-4e84-8f50-5fcc25a95952 version: -1 name: Nishang PowerShell event 4104 description: Searches Splunk for events. script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "60" scriptarguments: query: simple: index="*" sourcetype="WinEventLog" source="WinEventLog:Security" EventCode=4104 Message="* Invoke-PowerShellTCP*" update_context: {} separatecontext: false view: |- { "position": { "x": 2710, "y": 2140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "54": id: "54" taskid: 7cb58baa-5d8a-475f-867a-43ecb6269d3b type: regular task: id: 7cb58baa-5d8a-475f-867a-43ecb6269d3b version: -1 name: Powercat detection description: Searches Splunk for events. script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "55" scriptarguments: query: simple: index="*" sourcetype="WinEventLog" source="WinEventLog:Security" EventCode=4104 Message="*powercat*" update_context: {} separatecontext: false view: |- { "position": { "x": 2710, "y": 2500 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "55": id: "55" taskid: ba412446-8bf3-476f-869a-42762c873825 type: regular task: id: ba412446-8bf3-476f-869a-42762c873825 version: -1 name: UMWorkerProcess.exe in Exchange creating abnormal content description: Searches Splunk for events. script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "56" scriptarguments: query: simple: 'index=* sourcetype=WinEventLog source="WinEventLog:Security" EventCode=4663 Object_Type="File" (Object_Name="*.php" OR Object_Name="*.jsp" OR Object_Name="*.js" OR Object_Name="*.aspx" OR Object_Name="*.asmx" OR Object_Name="*.cfm" OR Object_Name="*.shtml") (Process_Name="*umworkerprocess.exe*" OR Process_Name="*UMService.exe*") ' update_context: {} separatecontext: false view: |- { "position": { "x": 2710, "y": 2680 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "56": id: "56" taskid: 19b74702-83fd-415b-8cee-49dfc6578c38 type: regular task: id: 19b74702-83fd-415b-8cee-49dfc6578c38 version: -1 name: UMWorkerProcess.exe spawning description: Searches Splunk for events. script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "58" scriptarguments: query: simple: index=* sourcetype="WinEventLog" source="WinEventLog:Security" EventCode=4688 (Creator_Process_Name="*umworkerprocess.exe*" OR Creator_Process_Name="*UMService.exe*") NOT New_Process_Name="*UMWorkerProcess.exe*" update_context: {} separatecontext: false view: |- { "position": { "x": 2710, "y": 2860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "57": id: "57" taskid: 4b99ee3e-bd3d-4b62-8838-d921c34e190d type: regular task: id: 4b99ee3e-bd3d-4b62-8838-d921c34e190d version: -1 name: IIS authentication bypass vulnerability description: |- Look for Microsoft Exchange Server’s Unified Messaging service spawning abnormal subprocesses, suggesting exploitation of CVE-2021-26857 vulnerability: DeviceProcessEvents | where InitiatingProcessFileName == "UMWorkerProcess.exe" | where FileName != "wermgr.exe" | where FileName != "WerFault.exe" Splunk Query example: index=* sourcetype="WinEventLog" source="WinEventLog:Security" EventCode=4688 (Creator_Process_Name="*umworkerprocess.exe*" OR Creator_Process_Name="*UMService.exe*") NOT New_Process_Name="*UMWorkerProcess.exe*" type: regular iscommand: false brand: "" nexttasks: '#none#': - "26" separatecontext: false view: |- { "position": { "x": 2210, "y": 2860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "58": id: "58" taskid: 400ec611-fe38-44d3-826b-02e9d747859f type: regular task: id: 400ec611-fe38-44d3-826b-02e9d747859f version: -1 name: IIS authentication bypass vulnerability description: Searches Splunk for events. script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "26" scriptarguments: query: simple: |- index=* sourcetype="ms:iis:auto" http_method=POST uri_path="/owa/auth/Current/themes/resources/*" | stats count by src_ip, http_user_agent, uri_path, http_method, uri_query separatecontext: false view: |- { "position": { "x": 2710, "y": 3050 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "59": id: "59" taskid: 806e022a-9d4d-408d-8ac7-8a5e174dafa9 type: condition task: id: 806e022a-9d4d-408d-8ac7-8a5e174dafa9 version: -1 name: Is SIEM Enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' type: condition iscommand: false brand: "" nexttasks: '#default#': - "47" Qradar: - "67" Splunk: - "66" separatecontext: false conditions: - label: Splunk condition: - - operator: isEqualString left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: SplunkPy accessor: state iscontext: true right: value: simple: active ignorecase: true - label: Qradar condition: - - operator: isEqualString left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: QRadar_v2 accessor: state iscontext: true right: value: simple: active ignorecase: true view: |- { "position": { "x": 2710, "y": 1810 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "60": id: "60" taskid: 9ebf3494-6f23-4b77-899f-6ae43b3db35c type: regular task: id: 9ebf3494-6f23-4b77-899f-6ae43b3db35c version: -1 name: Nishang PowerShell event 4688 description: Searches Splunk for events. script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "54" scriptarguments: query: simple: index="*" sourcetype="WinEventLog" source="WinEventLog:Security" EventCode=4688 Creator_Process_Name="powershell.exe" System.Net.Sockets.TCPClient update_context: {} separatecontext: false view: |- { "position": { "x": 2710, "y": 2320 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "61": id: "61" taskid: 8ba9d00f-6a49-4b48-8f4c-f6a2c0bc3959 type: title task: id: 8ba9d00f-6a49-4b48-8f4c-f6a2c0bc3959 version: -1 name: SIEM Indicators Hunting type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "62" - "65" separatecontext: false view: |- { "position": { "x": -110, "y": 1540 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "62": id: "62" taskid: 6700d586-5574-490b-8310-835b5fbb402d type: playbook task: id: 6700d586-5574-490b-8310-835b5fbb402d version: -1 name: Splunk Indicator Hunting description: This playbook queries Splunk for indicators such as file hashes, IP addresses, domains, or urls. It outputs detected users, ip addresses, and hostnames related to the indicators. playbookName: Splunk Indicator Hunting type: playbook iscommand: false brand: "" nexttasks: '#none#': - "26" scriptarguments: IndexName: simple: '*' MD5: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: "32" transformers: - operator: uniq SHA256: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: "64" transformers: - operator: uniq SelectFields: simple: source,timestamp earliest_time: simple: -1d event_limit: simple: "100" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 120, "y": 1690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "63": id: "63" taskid: 2b2f0ced-3b95-4850-88f2-c3d803f14210 type: regular task: id: 2b2f0ced-3b95-4850-88f2-c3d803f14210 version: -1 name: Search for related Expanse incident description: Searches for Expanse related incidents scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "64" scriptarguments: query: simple: type:"Expanse Issue" and name:Insecure Microsoft IIS Web or name:Microsoft Exchange Server or name:Microsoft OWA Server separatecontext: false view: |- { "position": { "x": 1730, "y": 2140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "64": id: "64" taskid: 451c142c-b9b4-4c35-8ab7-3be304c8692e type: regular task: id: 451c142c-b9b4-4c35-8ab7-3be304c8692e version: -1 name: Link related incidents description: Link related Expanse and Cortex XDR incident to HAFNIUM incident, script: Builtin|||linkIncidents type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "26" scriptarguments: linkedIncidentIDs: complex: root: foundIncidents accessor: id separatecontext: false view: |- { "position": { "x": 1420, "y": 2320 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "65": id: "65" taskid: 32533035-a3f1-40e8-856a-3929716ba852 type: playbook task: id: 32533035-a3f1-40e8-856a-3929716ba852 version: -1 name: QRadar Indicator Hunting V2 description: 'The Playbook queries QRadar SIEM for indicators such as file hashes, IP addresses, domains, or urls. ' playbookName: QRadar Indicator Hunting V2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "26" scriptarguments: InternalRange: simple: ${inputs.InternalRange} InvestigationIPFields: simple: sourceip,destinationip InvestigationUserFields: simple: username MD5: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: "32" transformers: - operator: uniq QradarIPfield: simple: sourceip,destinationip SHA256: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: "64" transformers: - operator: uniq TimeFrame: simple: LAST 7 DAYS separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": -330, "y": 1690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "66": id: "66" taskid: 0aac6bf1-07e7-4a18-8c6a-4f3b03f4cf01 type: title task: id: 0aac6bf1-07e7-4a18-8c6a-4f3b03f4cf01 version: -1 name: Hunt Using Splunk type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "53" separatecontext: false view: |- { "position": { "x": 2710, "y": 2000 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "67": id: "67" taskid: 1790a168-6f54-4824-84e3-236a5875576a type: title task: id: 1790a168-6f54-4824-84e3-236a5875576a version: -1 name: Hunt Using Qradar type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "68" separatecontext: false view: |- { "position": { "x": 3280, "y": 2000 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "68": id: "68" taskid: 78c25af9-ce4e-4fc3-80ee-5b3a618f20a6 type: playbook task: id: 78c25af9-ce4e-4fc3-80ee-5b3a618f20a6 version: -1 name: QRadarFullSearch playbookName: QRadarFullSearch type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "69" scriptarguments: interval: simple: "1" query_expression: simple: select * from events WHERE LogSourceTypeName(deviceType) = 'Microsoft Windows Security Event Log' and UTF8(payload) LIKE '%4688%' and UTF8(payload) LIKE '%powershell.exe%' and UTF8(payload) LIKE '%System.Net.Sockets.TCPClient%' Last 7 days range: {} timeout: simple: "600" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 3280, "y": 2140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "69": id: "69" taskid: 77bf00db-c194-408f-8320-550fe23f0bbc type: playbook task: id: 77bf00db-c194-408f-8320-550fe23f0bbc version: -1 name: QRadarFullSearch playbookName: QRadarFullSearch type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "70" scriptarguments: interval: simple: "1" query_expression: simple: select * from events WHERE LogSourceTypeName(deviceType) = 'Microsoft Windows Security Event Log' and UTF8(payload) LIKE '%4104%' and UTF8(payload) LIKE '% Invoke-PowerShellTCP%' Last 7 days range: {} timeout: simple: "600" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 3280, "y": 2320 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "70": id: "70" taskid: d9df6e57-2823-451b-8eba-124b6944e91b type: playbook task: id: d9df6e57-2823-451b-8eba-124b6944e91b version: -1 name: QRadarFullSearch playbookName: QRadarFullSearch type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "71" scriptarguments: interval: simple: "1" query_expression: simple: select * from events WHERE LogSourceTypeName(deviceType) = 'Microsoft Windows Security Event Log' and UTF8(payload) LIKE '%4104%' and UTF8(payload) LIKE '% powercat%' Last 7 days range: {} timeout: simple: "600" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 3280, "y": 2500 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "71": id: "71" taskid: b5541854-af48-45a2-8a12-0833d2723350 type: playbook task: id: b5541854-af48-45a2-8a12-0833d2723350 version: -1 name: QRadarFullSearch description: This playbook runs a QRadar query and return its results to the context. playbookName: QRadarFullSearch type: playbook iscommand: false brand: "" nexttasks: '#none#': - "72" scriptarguments: interval: simple: "1" query_expression: simple: select * from events WHERE LogSourceTypeName(deviceType) = 'Microsoft Windows Security Event Log' and UTF8(payload) LIKE '%4633%' and ( UTF8(payload) LIKE '%.php%' or UTF8(payload) LIKE '%.jsp%' or UTF8(payload) LIKE '%.js%' or UTF8(payload) LIKE '%.aspx%' or UTF8(payload) LIKE '%.asmx%' or UTF8(payload) LIKE '%.cfm%' or UTF8(payload) LIKE '%.shtlm%') AND ( UTF8(payload) LIKE '%umworkerprocess.exe%' or UTF8(payload) LIKE '%UMService.exe%') Last 7 days range: {} timeout: simple: "600" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 3280, "y": 2680 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "72": id: "72" taskid: 22f325df-6b94-47ea-87f0-f8bcecadea52 type: playbook task: id: 22f325df-6b94-47ea-87f0-f8bcecadea52 version: -1 name: QRadarFullSearch description: This playbook runs a QRadar query and return its results to the context. playbookName: QRadarFullSearch type: playbook iscommand: false brand: "" nexttasks: '#none#': - "26" scriptarguments: interval: simple: "1" query_expression: simple: select * from events WHERE LogSourceTypeName(deviceType) = 'Microsoft IIS' and UTF8(payload) LIKE '%POST%' and UTF8(payload) LIKE '%/owa/auth/Current/themes/resources/*%' Last 7 days range: {} timeout: simple: "600" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 3280, "y": 2860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "73": id: "73" taskid: a9793c85-9c17-4636-8ed6-f225729d602a type: regular task: id: a9793c85-9c17-4636-8ed6-f225729d602a version: -1 name: Extract IOCs from blogs description: commands.local.cmd.extract.indicators script: Builtin|||extractIndicators type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "7" scriptarguments: text: complex: root: HttpRequest.Response accessor: Body separatecontext: false view: |- { "position": { "x": 470, "y": 550 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "74": id: "74" taskid: 1356ae2b-c816-426f-8da5-91e1c68ec65b type: playbook task: id: 1356ae2b-c816-426f-8da5-91e1c68ec65b version: -1 name: Block Indicators - Generic v3 playbookName: Block Indicators - Generic v3 type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "37" scriptarguments: AutoBlockIndicators: complex: root: inputs.AutoBlockIndicators AutoCommit: simple: "No" CustomBlockRule: simple: "True" CustomURLCategory: simple: XSOAR Remediation - Malicious URLs IP: complex: root: ExtractedIndicators.IP transformers: - operator: uniq InputEnrichment: simple: "False" MD5: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: "32" ignorecase: true transformers: - operator: uniq RuleDirection: simple: outbound RuleName: simple: XSOAR - Block Indicators playbook - ${incident.id} SHA256: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: "64" ignorecase: true transformers: - operator: uniq URL: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: url ignorecase: true - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" ignorecase: true accessor: Indicator transformers: - operator: uniq UserVerification: complex: root: inputs.UserVerification Username: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: username ignorecase: true - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" accessor: Indicator transformers: - operator: uniq separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 740, "y": 3680 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "30_26_#default#": 0.12, "41_23_yes": 0.21, "41_42_#default#": 0.33, "46_26_#default#": 0.16 }, "paper": { "dimensions": { "height": 5195, "width": 3990, "x": -330, "y": 70 } } } inputs: - key: UserVerification value: simple: "False" required: false description: "Possible values: True/False.\nWhether to provide user verification for blocking IPs. \n\nFalse - No prompt will be displayed to the user.\nTrue - The server will ask the user for blocking verification and will display the blocking list." playbookInputQuery: - key: AutoBlockIndicators value: simple: "True" required: false description: "|- Should the given indicators be automatically blocked, or should the user be given the option to choose? If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block." playbookInputQuery: - key: InternalRange value: complex: root: lists accessor: PrivateIPs transformers: - operator: RegexExtractAll args: error_if_no_match: {} ignore_case: {} multi_line: {} period_matches_newline: {} regex: value: simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2}) unpack_matches: {} - operator: join args: separator: value: simple: ',' required: false description: 'A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).' playbookInputQuery: outputs: [] tests: - No tests (auto formatted) fromversion: 6.5.0