id: Malware Investigation - Manual
version: -1
name: Malware Investigation - Manual
deprecated: true
description: |-
  Deprecated. Use 'Malware Investigation & Response Incident handler' instead. (From the 'Malware Investigation And Response Pack')
  Master playbook for investigating suspected malware presence on an endpoint.
  Labels:
   - System: the hostname for the endpoint being investigated
tags:
- Virus
- Malware
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 8b39414f-fe78-4ae6-8ac6-2f13a86f1d22
    type: start
    task:
      id: 8b39414f-fe78-4ae6-8ac6-2f13a86f1d22
      version: -1
      name: start_task
      type: start
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 0
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 81a539cd-6e78-4b61-880c-8c8e2e175748
    type: title
    task:
      id: 81a539cd-6e78-4b61-880c-8c8e2e175748
      version: -1
      name: Initial Triage
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 157
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: ff3af5dc-70b9-4e2a-8b4a-37e3de619553
    type: regular
    task:
      id: ff3af5dc-70b9-4e2a-8b4a-37e3de619553
      version: -1
      name: Get device profile
      description: Retrieve the device profile from IT asset management software to
        consider the asset criticality in the triage process.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: ef3c5802-4fa4-4219-830e-e2aa13721503
    type: regular
    task:
      id: ef3c5802-4fa4-4219-830e-e2aa13721503
      version: -1
      name: Get employee information of the machine's owner
      description: Retrieve employee information of the machine's owner from HR software
        to consider the asset criticality in the triage process.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 30,
          "y": 300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 1f9ec386-92a7-49bc-8e66-748a356ac1fa
    type: regular
    task:
      id: 1f9ec386-92a7-49bc-8e66-748a356ac1fa
      version: -1
      name: Review incident details
      description: |-
        Understand the initial context of the investigation. If any data is missing, collect it and add it to the incident data.
        * system name
        * people involved
        * usernames involved
        * initial severity as reported
        * initial known events and the time of occurrence
        * review the incident with the data collected from the previous tests.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 475
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: e8f50674-3458-4acb-8b0f-e3a6e35344a9
    type: regular
    task:
      id: e8f50674-3458-4acb-8b0f-e3a6e35344a9
      version: -1
      name: Assess severity
      description: Based on the end user affected and other information, assess the severity and
        change it, if needed. 
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "89"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: c7534d44-77d8-48a8-8e97-4ed170468555
    type: regular
    task:
      id: c7534d44-77d8-48a8-8e97-4ed170468555
      version: -1
      name: Notify head of IR team via Slack and Email
      description: Notify relevant stakeholders that we are investigating a suspicious endpoint.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 1175
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: b396740c-364f-45aa-8620-878b3fdb94c4
    type: regular
    task:
      id: b396740c-364f-45aa-8620-878b3fdb94c4
      version: -1
      name: Assign and involve appropriate personnel
      description: Invite the relevant users for investigation - malware and
        network experts as required.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: 257c9d0c-7451-41b5-8dcc-788f14d219f8
    type: title
    task:
      id: 257c9d0c-7451-41b5-8dcc-788f14d219f8
      version: -1
      name: Review monitoring data
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "22"
      - "19"
      - "16"
      - "20"
      - "21"
      - "17"
      - "23"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 1545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "16":
    id: "16"
    taskid: 36798078-47e5-45ab-8a97-ab21a408fd9d
    type: regular
    task:
      id: 36798078-47e5-45ab-8a97-ab21a408fd9d
      version: -1
      name: Search for recent events related to the investigated machine
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "92"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "17":
    id: "17"
    taskid: ce364337-b6a6-4c84-8cab-739f2bce1d3a
    type: condition
    task:
      id: ce364337-b6a6-4c84-8cab-739f2bce1d3a
      version: -1
      name: Is there continuous network capture of the machine?
      description: Is there a continuous network capture of the investigated machine?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "92"
      "yes":
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1360,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "18":
    id: "18"
    taskid: b71db0d8-506b-4c63-88dc-b932e1b06797
    type: regular
    task:
      id: b71db0d8-506b-4c63-88dc-b932e1b06797
      version: -1
      name: Retrieve packet capture for last 24 hours or at most 200MB
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "92"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1610,
          "y": 1870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "19":
    id: "19"
    taskid: 6a05f4ba-e303-4dd8-8173-614ac405cb03
    type: regular
    task:
      id: 6a05f4ba-e303-4dd8-8173-614ac405cb03
      version: -1
      name: Review antivirus logs for the affected systems
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "92"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 890,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "20":
    id: "20"
    taskid: 3b12df3b-6b21-4ef2-8367-ea18df029f35
    type: regular
    task:
      id: 3b12df3b-6b21-4ef2-8367-ea18df029f35
      version: -1
      name: Search UEBA solution for the relevant user's behavior
      description: Search UEBA solution for the relevant user's behavior in the past
        24 hours.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "92"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -450,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "21":
    id: "21"
    taskid: 14e1b624-8c2f-4634-8800-ad8debca322b
    type: regular
    task:
      id: 14e1b624-8c2f-4634-8800-ad8debca322b
      version: -1
      name: Search DNS server logs for investigated machine's activity
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "92"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -910,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "22":
    id: "22"
    taskid: b9fecbb1-1eb9-49d8-831c-f4efc369e8e2
    type: regular
    task:
      id: b9fecbb1-1eb9-49d8-831c-f4efc369e8e2
      version: -1
      name: Search web proxy logs for recent activity from this machine
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "92"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1345,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "23":
    id: "23"
    taskid: c6210378-5eb5-4c3d-8341-39d6cc47236a
    type: regular
    task:
      id: c6210378-5eb5-4c3d-8341-39d6cc47236a
      version: -1
      name: Search firewall logs for blocked traffic from this machine
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "92"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "24":
    id: "24"
    taskid: ae70f6b0-7209-478d-81c7-2c8280ceae04
    type: title
    task:
      id: ae70f6b0-7209-478d-81c7-2c8280ceae04
      version: -1
      name: Collect evidence from the investigated machine
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 2240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "27":
    id: "27"
    taskid: d19990dc-1722-4880-845d-40ed16acc744
    type: regular
    task:
      id: d19990dc-1722-4880-845d-40ed16acc744
      version: -1
      name: Trigger a snapshot / system restore point of affected systems
      description: Create a complete backup of affected systems for recovery and forensics.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 2390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "28":
    id: "28"
    taskid: ebc663ab-0eea-4ae5-81eb-a858bd7aa651
    type: regular
    task:
      id: ebc663ab-0eea-4ae5-81eb-a858bd7aa651
      version: -1
      name: Collect volatile system data
      description: Collect system data like running processes, network connections,
        and files changed. 
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 2760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "29":
    id: "29"
    taskid: 471e4599-6990-454e-8ff3-01a855e0289a
    type: regular
    task:
      id: 471e4599-6990-454e-8ff3-01a855e0289a
      version: -1
      name: Fetch the system's security event log
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -382.5,
          "y": 2760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "30":
    id: "30"
    taskid: b63229fd-f742-4bc6-8ef7-fb87a52136c4
    type: regular
    task:
      id: b63229fd-f742-4bc6-8ef7-fb87a52136c4
      version: -1
      name: Create memory dump of the system
      description: In addition to a full backup, create a memory dump of the system.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
      - "32"
      - "29"
      - "33"
      - "31"
      - "34"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 2580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "31":
    id: "31"
    taskid: 61cdff3c-1422-4faf-8801-e70deee5e67c
    type: regular
    task:
      id: 61cdff3c-1422-4faf-8801-e70deee5e67c
      version: -1
      name: Collect autorun data
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -830,
          "y": 3110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "32":
    id: "32"
    taskid: 8084f1a6-fe26-4633-8ab2-5520e1eba12b
    type: regular
    task:
      id: 8084f1a6-fe26-4633-8ab2-5520e1eba12b
      version: -1
      name: Collect prefetch data
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 559,
          "y": 2940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "33":
    id: "33"
    taskid: 64589fd9-7afc-46cc-8a9d-52e837d5077e
    type: regular
    task:
      id: 64589fd9-7afc-46cc-8a9d-52e837d5077e
      version: -1
      name: Collect browser history
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -582.5,
          "y": 2940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "34":
    id: "34"
    taskid: b9a66bb9-9d7b-4d6f-8c01-41c64488109c
    type: regular
    task:
      id: b9a66bb9-9d7b-4d6f-8c01-41c64488109c
      version: -1
      name: Collect USB device history
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 757.5,
          "y": 3110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "35":
    id: "35"
    taskid: dd777994-1a09-4240-8376-cf29fff6bf53
    type: title
    task:
      id: dd777994-1a09-4240-8376-cf29fff6bf53
      version: -1
      name: Analyze collected evidence
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "93"
      - "94"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 3290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "36":
    id: "36"
    taskid: 4922cf38-a22b-403e-8762-37c601afb928
    type: regular
    task:
      id: 4922cf38-a22b-403e-8762-37c601afb928
      version: -1
      name: Look for suspicious local Windows user accounts and groups
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "95"
      - "47"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 3575
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "37":
    id: "37"
    taskid: 5af97dbe-6575-4b2a-8b98-205008047a89
    type: regular
    task:
      id: 5af97dbe-6575-4b2a-8b98-205008047a89
      version: -1
      name: Look for suspicious autorun entries
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 720,
          "y": 3915
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "38":
    id: "38"
    taskid: ee3e976a-ddce-447c-8a51-adb5518b4ee0
    type: regular
    task:
      id: ee3e976a-ddce-447c-8a51-adb5518b4ee0
      version: -1
      name: Review file reputation for all autorun items
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "39"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 720,
          "y": 4100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "39":
    id: "39"
    taskid: 6c5fbac6-f91d-4abc-860a-310eac3fd71b
    type: regular
    task:
      id: 6c5fbac6-f91d-4abc-860a-310eac3fd71b
      version: -1
      name: Detonate any suspicious autorun items in sandbox
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "96"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 720,
          "y": 4270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "40":
    id: "40"
    taskid: db34b3ad-3999-4acf-8096-5c3eb0ae98f7
    type: regular
    task:
      id: db34b3ad-3999-4acf-8096-5c3eb0ae98f7
      version: -1
      name: Check processes against existing YARA signatures
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "50"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 4790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "41":
    id: "41"
    taskid: 71181b4c-d4d7-468f-848a-d7fb0a7f2cc7
    type: regular
    task:
      id: 71181b4c-d4d7-468f-848a-d7fb0a7f2cc7
      version: -1
      name: Volatility - search for malicious IP addresses
      description: Search for malicious IP addresses in network connection artifacts
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "45"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -240,
          "y": 3745
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "42":
    id: "42"
    taskid: 4036d3b4-3f1c-4611-83e1-0e69ffca5169
    type: regular
    task:
      id: 4036d3b4-3f1c-4611-83e1-0e69ffca5169
      version: -1
      name: Volatility - Check domains in DNS cache against TIP
      description: Check domains in DNS cache against threat intelligence platforms.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "96"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -240,
          "y": 4440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "43":
    id: "43"
    taskid: d2c7636c-933f-4f6a-84e2-52f3c296be29
    type: regular
    task:
      id: d2c7636c-933f-4f6a-84e2-52f3c296be29
      version: -1
      name: Volatility - search for suspicious domains in DNS cache
      description: Search for suspicious domains in DNS cache artifacts.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "42"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -240,
          "y": 4270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "44":
    id: "44"
    taskid: 6665b205-7497-4b6a-893c-645109d6d500
    type: regular
    task:
      id: 6665b205-7497-4b6a-893c-645109d6d500
      version: -1
      name: Volatility - review psxview results
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "41"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -240,
          "y": 3575
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "45":
    id: "45"
    taskid: 82ecf76f-def1-4b11-8b73-99484690428f
    type: regular
    task:
      id: 82ecf76f-def1-4b11-8b73-99484690428f
      version: -1
      name: Volatility - review malfind results
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "46"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -240,
          "y": 3915
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "46":
    id: "46"
    taskid: b050b4fd-cbc9-40b8-8064-4015468b0b01
    type: regular
    task:
      id: b050b4fd-cbc9-40b8-8064-4015468b0b01
      version: -1
      name: Volatility - show list of previously run system commands
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -240,
          "y": 4090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "47":
    id: "47"
    taskid: 4fbfb75a-0a8a-4a97-8358-0b0009733d1d
    type: regular
    task:
      id: 4fbfb75a-0a8a-4a97-8358-0b0009733d1d
      version: -1
      name: Correlate recently created and modified files against TIP
      description: Research current threat intelligence for file activity, and correlate
        recently created and modified files against threat intelligence platform.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "59"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 3745
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "48":
    id: "48"
    taskid: 35291803-ac50-45b9-8af6-24f0b33b3318
    type: regular
    task:
      id: 35291803-ac50-45b9-8af6-24f0b33b3318
      version: -1
      name: Review prefetch data
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "56"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 4270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "49":
    id: "49"
    taskid: bb921d3d-5e52-4c81-8927-d681a630c867
    type: regular
    task:
      id: bb921d3d-5e52-4c81-8927-d681a630c867
      version: -1
      name: Review history of connected USB drives
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 4090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "50":
    id: "50"
    taskid: 877fbae1-4c48-4d48-8816-721664190449
    type: regular
    task:
      id: 877fbae1-4c48-4d48-8816-721664190449
      version: -1
      name: Look for processes without executable image on disk
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "51"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 4970
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "51":
    id: "51"
    taskid: dd74cc90-5dc9-4d88-8c57-79a0112d9639
    type: regular
    task:
      id: dd74cc90-5dc9-4d88-8c57-79a0112d9639
      version: -1
      name: Look for system processes with suspicious execution times
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "52"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 5160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "52":
    id: "52"
    taskid: cee5bf18-f43e-4352-8d45-75ab67439b66
    type: regular
    task:
      id: cee5bf18-f43e-4352-8d45-75ab67439b66
      version: -1
      name: Look for process with short edit distance from known process
      description: |-
        Look for process names with similar names to known processes.
        These may be attempts to fool a human investigator (e.g., scvhost.exe )
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "57"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 5360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "53":
    id: "53"
    taskid: 787e778d-9767-4e62-8632-d305fc0f4928
    type: regular
    task:
      id: 787e778d-9767-4e62-8632-d305fc0f4928
      version: -1
      name: Check process tree and look for suspicious relationships
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "97"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 5735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "54":
    id: "54"
    taskid: ef35ed3e-d934-4fe7-8f29-e3eb1ba39c65
    type: regular
    task:
      id: ef35ed3e-d934-4fe7-8f29-e3eb1ba39c65
      version: -1
      name: Look for traces of network sniffers
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "58"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 6240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "55":
    id: "55"
    taskid: 5aa42e88-5617-444b-8e8c-78f3190bc0e8
    type: regular
    task:
      id: 5aa42e88-5617-444b-8e8c-78f3190bc0e8
      version: -1
      name: Analyze network traffic for malware activity
      description: Analyze the network traffic from/to this system for malware activity
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "54"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 6060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "56":
    id: "56"
    taskid: 459bccb7-3041-41bc-8c82-a59b98ada625
    type: regular
    task:
      id: 459bccb7-3041-41bc-8c82-a59b98ada625
      version: -1
      name: Review shellbag data
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "96"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 4440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "57":
    id: "57"
    taskid: c8f5e2c2-320c-4064-8daf-771ad53b1d79
    type: regular
    task:
      id: c8f5e2c2-320c-4064-8daf-771ad53b1d79
      version: -1
      name: Look up hashes to find trojanized modules
      description: Look up hashes of all running processes and loaded modules to find
        trojanized modules
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "53"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 5550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "58":
    id: "58"
    taskid: 569ff1da-d920-48a6-86b8-e1823b6129a2
    type: regular
    task:
      id: 569ff1da-d920-48a6-86b8-e1823b6129a2
      version: -1
      name: Analyze network traffic for signs of intrusion
      description: Analyze the network traffic from/to this system for signs of intrusion.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "60"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 6430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "59":
    id: "59"
    taskid: 72d9f37f-663d-4a6a-8622-1f56cfce8e1b
    type: regular
    task:
      id: 72d9f37f-663d-4a6a-8622-1f56cfce8e1b
      version: -1
      name: Look for modifications of system files
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "49"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 3925
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "60":
    id: "60"
    taskid: bc465242-756c-44ad-8546-b004ca98190c
    type: title
    task:
      id: bc465242-756c-44ad-8546-b004ca98190c
      version: -1
      name: Data Leak Assessment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "61"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 6630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "61":
    id: "61"
    taskid: 2458ef66-2cdc-4890-88a6-91c367f270fa
    type: regular
    task:
      id: 2458ef66-2cdc-4890-88a6-91c367f270fa
      version: -1
      name: Assess history of C&C communication in network logs
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "62"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 6780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "62":
    id: "62"
    taskid: b29724fe-1dc2-469d-85da-158998cf8406
    type: regular
    task:
      id: b29724fe-1dc2-469d-85da-158998cf8406
      version: -1
      name: Assess the history of local and remote file accesses
      description: Assess the history of local and remote file accesses by the malware.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "63"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 6970
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "63":
    id: "63"
    taskid: 86d9bb9e-cea8-4707-816e-874a263b6ab8
    type: regular
    task:
      id: 86d9bb9e-cea8-4707-816e-874a263b6ab8
      version: -1
      name: Assess unusual activity and data access
      description: Assess unusual activity and data access by compromised user accounts
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "64"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 7155
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "64":
    id: "64"
    taskid: ee0ea26d-63f9-4a4a-80e8-e81a0e3f8ace
    type: condition
    task:
      id: ee0ea26d-63f9-4a4a-80e8-e81a0e3f8ace
      version: -1
      name: Was any sensitive information leaked?
      description: '-'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "66"
      "yes":
      - "65"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 7340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "65":
    id: "65"
    taskid: d8cabc70-1020-4212-8afb-fbb44052c69b
    type: regular
    task:
      id: d8cabc70-1020-4212-8afb-fbb44052c69b
      version: -1
      name: Notify Public Relations (PR) team
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "66"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 400,
          "y": 7510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "66":
    id: "66"
    taskid: 2b290909-b729-46a4-8c09-212bee8f6094
    type: title
    task:
      id: 2b290909-b729-46a4-8c09-212bee8f6094
      version: -1
      name: Respond
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "67"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 7702
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "67":
    id: "67"
    taskid: 9e7d4c09-71b1-48a7-8e81-c6d68f711e77
    type: condition
    task:
      id: 9e7d4c09-71b1-48a7-8e81-c6d68f711e77
      version: -1
      name: Was malware found?
      description: '-'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "68"
      "yes":
      - "69"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 7860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "68":
    id: "68"
    taskid: 9a0c6e9b-e8fb-4623-8204-99fb18b77342
    type: regular
    task:
      id: 9a0c6e9b-e8fb-4623-8204-99fb18b77342
      version: -1
      name: Inform user that no malware was found
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "99"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 330,
          "y": 8030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "69":
    id: "69"
    taskid: 2e0b8f19-ff26-4b74-8b60-400ba0541490
    type: regular
    task:
      id: 2e0b8f19-ff26-4b74-8b60-400ba0541490
      version: -1
      name: Report malware sample to AV vendor
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "70"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 8030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "70":
    id: "70"
    taskid: b2f270d0-9aa0-4419-8726-3e77e3648713
    type: regular
    task:
      id: b2f270d0-9aa0-4419-8726-3e77e3648713
      version: -1
      name: Disable compromised AD account(s)
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "71"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 8205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "71":
    id: "71"
    taskid: 07ff3526-c090-44fc-8ed1-5968703ab1f1
    type: regular
    task:
      id: 07ff3526-c090-44fc-8ed1-5968703ab1f1
      version: -1
      name: Revoke authentication keys stored on the compromised host
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "72"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 8390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "72":
    id: "72"
    taskid: 06089652-2295-4aaa-8832-bf81b8ea9805
    type: regular
    task:
      id: 06089652-2295-4aaa-8832-bf81b8ea9805
      version: -1
      name: Revoke VPN credentials
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "73"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 8580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "73":
    id: "73"
    taskid: 6c344872-4f8a-429e-85bc-5b19cc896675
    type: regular
    task:
      id: 6c344872-4f8a-429e-85bc-5b19cc896675
      version: -1
      name: Instruct the owner to change their passwords
      description: |-
        Instruct the owner to change their passwords for any personal accounts.
        Personal email, social media, LinkedIn profile - these are in the control of the employee and they must be involved to change passwords. IT/Security staff can help to expedite.

        This is not only for the benefit of the employee - there is a real danger to the organization: access to these accounts could allow malicious actors to convincingly impersonate the owner of the device to engage in social engineering against other employees and further attack the organization.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "74"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 8780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "74":
    id: "74"
    taskid: 063654e6-36ff-4f1a-8f64-d2b46828e72a
    type: regular
    task:
      id: 063654e6-36ff-4f1a-8f64-d2b46828e72a
      version: -1
      name: Ban relevant hashes across all systems
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "75"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 8970
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "75":
    id: "75"
    taskid: c220e27d-0def-43b1-8c8e-81f49c17123f
    type: regular
    task:
      id: c220e27d-0def-43b1-8c8e-81f49c17123f
      version: -1
      name: Search for malicious communications from other systems
      description: Search for the same malicious communications from other systems
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "76"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 9160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "76":
    id: "76"
    taskid: b32d3cb5-4029-413b-8b4b-52f415dab2c9
    type: title
    task:
      id: b32d3cb5-4029-413b-8b4b-52f415dab2c9
      version: -1
      name: Remediate and wrap up
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "77"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 9360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "77":
    id: "77"
    taskid: 3f738a4c-9f58-4616-8dcf-eced645d27bd
    type: regular
    task:
      id: 3f738a4c-9f58-4616-8dcf-eced645d27bd
      version: -1
      name: Notify affected user
      description: Notify affected user about the outcome of investigation.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "78"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 9540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "78":
    id: "78"
    taskid: 05fff135-c0f1-4f03-8ee0-46cbc0c0db9d
    type: regular
    task:
      id: 05fff135-c0f1-4f03-8ee0-46cbc0c0db9d
      version: -1
      name: Provide end-user remediation guidance and link to training
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "79"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 9700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "79":
    id: "79"
    taskid: 27b6724e-e6c1-4e2c-8f82-ce90b4d10a8e
    type: condition
    task:
      id: 27b6724e-e6c1-4e2c-8f82-ce90b4d10a8e
      version: -1
      name: Is the identified malware known?
      description: Is the identified malware known? (with automated remediation steps)
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "80"
      "yes":
      - "81"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 9880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "80":
    id: "80"
    taskid: 96d00c65-e637-4b21-8289-0faf6f6d2175
    type: regular
    task:
      id: 96d00c65-e637-4b21-8289-0faf6f6d2175
      version: -1
      name: Document manual remediation steps
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "82"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -420,
          "y": 10055
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "81":
    id: "81"
    taskid: 4aa3a1fd-18e0-41d3-8d60-618a4ce3ee17
    type: regular
    task:
      id: 4aa3a1fd-18e0-41d3-8d60-618a4ce3ee17
      version: -1
      name: Trigger remediation scripts
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "82"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 10055
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "82":
    id: "82"
    taskid: 54e276f9-cbb7-44dc-8853-00a775994162
    type: condition
    task:
      id: 54e276f9-cbb7-44dc-8853-00a775994162
      version: -1
      name: Was remediation successful?
      description: '-'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "83"
      "yes":
      - "84"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 10240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "83":
    id: "83"
    taskid: d18f40f3-bba1-46c5-8835-71dec77bd47d
    type: regular
    task:
      id: d18f40f3-bba1-46c5-8835-71dec77bd47d
      version: -1
      name: Open a ticket for IT to reimage the entire system
      description: Open a ticket for IT to reimage the entire system and restore from
        backup
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "86"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -420,
          "y": 10415
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "84":
    id: "84"
    taskid: c7768e6d-1c42-49a1-8c27-884b6990513a
    type: regular
    task:
      id: c7768e6d-1c42-49a1-8c27-884b6990513a
      version: -1
      name: Remove temporary containment measures
      description: Remove the temporary containment measures that were placed.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "85"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 60,
          "y": 10415
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "85":
    id: "85"
    taskid: 006fc8ba-dfb1-4b86-8487-02c44f90533a
    type: regular
    task:
      id: 006fc8ba-dfb1-4b86-8487-02c44f90533a
      version: -1
      name: Reinstate disabled user accounts with new passwords
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "86"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 60,
          "y": 10590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "86":
    id: "86"
    taskid: b04e8eeb-e625-43db-8bd2-f4121690896a
    type: regular
    task:
      id: b04e8eeb-e625-43db-8bd2-f4121690896a
      version: -1
      name: Deploy generated IoCs in relevant controls
      description: Deploy generated IoCs in relevant controls to prevent future attacks.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "87"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 10770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "87":
    id: "87"
    taskid: f47a10eb-d8db-4be4-852a-3f0ff02d0020
    type: regular
    task:
      id: f47a10eb-d8db-4be4-852a-3f0ff02d0020
      version: -1
      name: Share generated IoCs with partner organizations
      description: '-'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "88"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 10950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "88":
    id: "88"
    taskid: aad7a976-2f78-405a-8fab-ec357b779ebb
    type: regular
    task:
      id: aad7a976-2f78-405a-8fab-ec357b779ebb
      version: -1
      name: Email report to CISO
      description: Email investigation report to CISO
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "98"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 11120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "89":
    id: "89"
    taskid: 78635828-3c6e-42d2-868d-db9d66b7839e
    type: condition
    task:
      id: 78635828-3c6e-42d2-868d-db9d66b7839e
      version: -1
      name: Continue with the investigation or close as false positive?
      description: After analyzing the incident data, the involved users, and the
        device profile, should the investigation continue?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Close as false positive:
      - "90"
      Continue:
      - "91"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "90":
    id: "90"
    taskid: ece0f835-7c6f-4112-8dc5-38d2e9a3e7ac
    type: title
    task:
      id: ece0f835-7c6f-4112-8dc5-38d2e9a3e7ac
      version: -1
      name: False Positive
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "98"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1600,
          "y": 1020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "91":
    id: "91"
    taskid: 411bc5b8-09b5-4697-82b2-6b875ce62998
    type: title
    task:
      id: 411bc5b8-09b5-4697-82b2-6b875ce62998
      version: -1
      name: Continue with the investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 1020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "92":
    id: "92"
    taskid: 53d87877-197c-47fb-8fe9-121d3bfe8273
    type: regular
    task:
      id: 53d87877-197c-47fb-8fe9-121d3bfe8273
      version: -1
      name: Update incident with findings
      description: Update the incident data with the newly collected data from the
        monitoring systems.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -2.5,
          "y": 2060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "93":
    id: "93"
    taskid: 6401f6bb-bf6f-4b22-8d61-e24e0f1b8847
    type: title
    task:
      id: 6401f6bb-bf6f-4b22-8d61-e24e0f1b8847
      version: -1
      name: Memory Dump Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "44"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -240,
          "y": 3430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "94":
    id: "94"
    taskid: 4758a1d0-2c7d-41bf-86cd-d209bfb5ec79
    type: title
    task:
      id: 4758a1d0-2c7d-41bf-86cd-d209bfb5ec79
      version: -1
      name: Device Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "36"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 3430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "95":
    id: "95"
    taskid: 319bf6e3-0a3f-4af1-8e61-95432973fbec
    type: title
    task:
      id: 319bf6e3-0a3f-4af1-8e61-95432973fbec
      version: -1
      name: Autorun Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "37"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 720,
          "y": 3760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "96":
    id: "96"
    taskid: 109ad297-0b52-43a9-861b-c7f0b0fd0a04
    type: title
    task:
      id: 109ad297-0b52-43a9-861b-c7f0b0fd0a04
      version: -1
      name: Processes Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "40"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 4640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "97":
    id: "97"
    taskid: 589abee6-9c1e-4ba4-8491-0e7d3201a305
    type: title
    task:
      id: 589abee6-9c1e-4ba4-8491-0e7d3201a305
      version: -1
      name: Network Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "55"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 5905
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "98":
    id: "98"
    taskid: 9a90315d-f0b2-438a-830f-a58dab6ab708
    type: title
    task:
      id: 9a90315d-f0b2-438a-830f-a58dab6ab708
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1600,
          "y": 11300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "99":
    id: "99"
    taskid: 5d3cd6bc-d5b1-48a8-829d-d30f69fac276
    type: title
    task:
      id: 5d3cd6bc-d5b1-48a8-829d-d30f69fac276
      version: -1
      name: No Malware Found
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "98"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 330,
          "y": 8220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {
      "17_18_yes": 0.52,
      "17_92_No": 0.1,
      "64_65_yes": 0.31,
      "64_66_#default#": 0.38,
      "67_68_no": 0.82,
      "79_80_no": 0.43,
      "79_81_yes": 0.42,
      "82_83_no": 0.43,
      "82_84_yes": 0.5,
      "89_90_Close as false positive": 0.14,
      "89_91_Continue": 0.41
    },
    "paper": {
      "dimensions": {
        "height": 11365,
        "width": 3590,
        "x": -1610,
        "y": 0
      }
    }
  }
inputs: []
outputs: []
fromversion: 5.0.0
tests:
- No tests