id: Possible External RDP Brute-Force - Set Verdict
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Possible External RDP Brute-Force - Set Verdict
description: "This playbook creating an array called \"Suspicious Elements\", which is used to count potential security threats. The following elements can be added to the array:\n\n- \"IP Reputation\" - DBot Score is 2-3 \n- \"Source geolocation\" - RDP Connection made from rare geo-location \n-  Related to campaign - IP address is related to campaign, based on TIM module\n-  Hunting results - the hunt for indicators related to the source IP and the related campaign returned results\n-  XDR Alert search - XDR Alerts that related to the same username and endpoint, and to the MITRE tactics that comes after \"Credential Access\", were found.\n- Risky User - one or more risky users are involved in the incident, as identified by the Cortex Core - IR integration's ITDR module.\n- Risky Host - one or more risky hosts are involved in the incident, as identified by the Cortex Core - IR integration's ITDR module.\n\nThe array will then be outputted and its size will be compared to a final threshold. If the size is greater than or equal to the threshold, the investigation's final verdict will be deemed a \"True Positive.\""
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 446f9247-e57a-430f-8aeb-02d0e5f53cae
    type: start
    task:
      id: 446f9247-e57a-430f-8aeb-02d0e5f53cae
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
      - "4"
      - "1"
      - "2"
      - "10"
      - "12"
      - "13"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 56055fa9-a5d2-4c5a-8f16-fa9f84262480
    type: condition
    task:
      id: 56055fa9-a5d2-4c5a-8f16-fa9f84262480
      version: -1
      name: Related to specific campaign?
      description: Check if a related campaign exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.RelatedCampaign
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 30,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: f92cdec9-e639-463f-8b27-90e97920209e
    type: condition
    task:
      id: f92cdec9-e639-463f-8b27-90e97920209e
      version: -1
      name: Has Hunting Results?
      description: Check if hunting results exist.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.HuntResults
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: d82ac18e-cec4-486a-8fca-9e877d3a1e37
    type: condition
    task:
      id: d82ac18e-cec4-486a-8fca-9e877d3a1e37
      version: -1
      name: Has related alerts?
      description: Check if XDR related alerts exist.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.RelatedAlerts
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 880,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: d3816b97-2a2f-4539-83ee-af6592faad20
    type: condition
    task:
      id: d3816b97-2a2f-4539-83ee-af6592faad20
      version: -1
      name: Connection from unusual country?
      description: Check if the connection was made from an unusual country.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.UnusualGeoLocation
            iscontext: true
          right:
            value:
              simple: "false"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1300,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 5408731d-6b13-46de-8490-f196f1890360
    type: regular
    task:
      id: 5408731d-6b13-46de-8490-f196f1890360
      version: -1
      name: Set unusual country
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: Unusual Country
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1300,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Source Geolocation
      output:
        simple: Connection from unusual country
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: bc3eca1f-c99b-4630-884d-9e573739a061
    type: regular
    task:
      id: bc3eca1f-c99b-4630-884d-9e573739a061
      version: -1
      name: Set related alerts
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: Related Alerts
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 880,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Alert Search Results
      output:
        complex:
          root: inputs.RelatedAlerts
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 0e017a52-2083-4c77-8f32-542c271a1761
    type: regular
    task:
      id: 0e017a52-2083-4c77-8f32-542c271a1761
      version: -1
      name: Set hunting results
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: Hunting Results
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Hunt Results Count
      output:
        simple: Has campaign hunt results
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 0cfadcf4-e302-4714-8cdf-c22fe1640354
    type: regular
    task:
      id: 0cfadcf4-e302-4714-8cdf-c22fe1640354
      version: -1
      name: Set campaign
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: Related Campaign
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 30,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Part of Campaign
      output:
        complex:
          root: inputs.RelatedCampaign
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: d18b4c9c-408b-4155-8a49-c07e400508b3
    type: title
    task:
      id: d18b4c9c-408b-4155-8a49-c07e400508b3
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 8e87df54-e1ee-4dcb-8911-0da0077e8b65
    type: condition
    task:
      id: 8e87df54-e1ee-4dcb-8911-0da0077e8b65
      version: -1
      name: IP Reputation is suspicious?
      description: Check if the IP reputation is suspicious or higher.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: inputs.IpReputation
            iscontext: true
          right:
            value:
              simple: "2"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -390,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 2820bf44-fc60-4781-84ef-fe725a1b3628
    type: regular
    task:
      id: 2820bf44-fc60-4781-84ef-fe725a1b3628
      version: -1
      name: Set IP Reputation
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: IP Reputation
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -390,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 16c9bbda-5247-47c2-81d5-2909757ab287
    type: condition
    task:
      id: 16c9bbda-5247-47c2-81d5-2909757ab287
      version: -1
      name: Risky user involved?
      description: Checks if a risky user is involved in the incident.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.RiskyUser
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -800,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 03fb3ebe-d5d6-4695-81d2-5ceab496655b
    type: condition
    task:
      id: 03fb3ebe-d5d6-4695-81d2-5ceab496655b
      version: -1
      name: Risky host involved?
      description: Checks if a risky user is involved in the incident.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.RiskyHost
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1210,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: f480c89c-1647-44ec-8e9e-d1af77bcb52e
    type: regular
    task:
      id: f480c89c-1647-44ec-8e9e-d1af77bcb52e
      version: -1
      name: Add risky user to suspicious elements
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: Risky User
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -800,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 93f3be3f-29e0-499f-8cc3-ac8fb5e8fa06
    type: regular
    task:
      id: 93f3be3f-29e0-499f-8cc3-ac8fb5e8fa06
      version: -1
      name: Add risky host to suspicious elements
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Suspicious_Elements
      value:
        simple: Risky Host
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1210,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "10_9_#default#": 0.28,
      "3_9_#default#": 0.19,
      "4_9_#default#": 0.2
    },
    "paper": {
      "dimensions": {
        "height": 535,
        "width": 2890,
        "x": -1210,
        "y": 50
      }
    }
  }
inputs:
- key: RelatedAlerts
  value: {}
  required: false
  description: Number of XDR alerts that are related to the same user or endpoint.
  playbookInputQuery:
- key: RelatedCampaign
  value: {}
  required: false
  description: Campaign related to the external IP.
  playbookInputQuery:
- key: HuntResults
  value: {}
  required: false
  description: Determine whether hunting results exist. The input value should be true or false.
  playbookInputQuery:
- key: UnusualGeoLocation
  value: {}
  required: false
  description: ' determine whether the RDP connection has made RDP Connection made from rare geo-location. the input value should be true or false.'
  playbookInputQuery:
- key: IpReputation
  value: {}
  required: false
  description: The external IP reputation.
  playbookInputQuery:
- key: RiskyUser
  value:
    complex:
      root: Core.RiskyUser
      filters:
      - - operator: isEqualString
          left:
            value:
              simple: Core.RiskyUser.risk_level
            iscontext: true
          right:
            value:
              simple: MED
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              simple: Core.RiskyUser.risk_level
            iscontext: true
          right:
            value:
              simple: HIGH
          ignorecase: true
      accessor: id
  required: false
  description: Usernames of users that were found as risky by Cortex Core IR.
  playbookInputQuery:
- key: RiskyHost
  value:
    complex:
      root: Core.RiskyHost
      filters:
      - - operator: isEqualString
          left:
            value:
              simple: Core.RiskyHost.risk_level
            iscontext: true
          right:
            value:
              simple: MED
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              simple: Core.RiskyHost.risk_level
            iscontext: true
          right:
            value:
              simple: HIGH
          ignorecase: true
      accessor: id
  required: false
  description: Hostnames that were found as risky by Cortex Core IR.
  playbookInputQuery:
outputs:
- contextPath: Suspicious_Elements
  description: Array that contains all the suspicious elements.
  type: unknown
tests:
- No tests (auto formatted)
marketplaces:
- marketplacev2
- platform
fromversion: 6.8.0
system: true


supportedModules:
- agentix
- cloud
- cloud_posture
- cloud_runtime_security
- edr
- xsiam