id: Remote PsExec with LOLBIN command execution alert
version: -1
name: Remote PsExec with LOLBIN command execution alert
description: "The \"Remote PsExec-like LOLBIN Command Execution\" playbook is designed to address and respond to alerts indicating suspicious activities related to remote PsExec-like LOLBIN command execution from an unsigned non-standard source. \nThe playbook aims to efficiently:\n\n- Check if the execution is blocked. If not will terminate the process (Manually by default).\n- Enrich any entities and indicators from the alert and find any related campaigns.\n- Perform command analysis to provide insights and verdict for the executed command.\n- Perform further endpoint investigation using XDR.\n- Checks for any malicious verdict found to raise the severity of the alert.\n- Perform Automatic/Manual remediation response by blocking any malicious indicators found.\n\nThe playbook is designed to run as a sub-playbook in ‘Cortex XDR Incident Handling - v3 & Cortex XDR Alerts Handling’.\nIt depends on the data from the parent playbooks and can not be used as a standalone version."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f123daa4-a999-4747-84df-d8d1ca3b6fcd
    type: start
    task:
      id: f123daa4-a999-4747-84df-d8d1ca3b6fcd
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 736269a0-79d7-4b4c-8acd-acbfa32952d5
    type: title
    task:
      id: 736269a0-79d7-4b4c-8acd-acbfa32952d5
      version: -1
      name: Enrichment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "38"
      - "40"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 60eed42f-939e-49a4-838e-36146b780d18
    type: condition
    task:
      id: 60eed42f-939e-49a4-838e-36146b780d18
      version: -1
      name: Is it blocked?
      description: Check if the command execution was blocked.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "Yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: containsString
          left:
            value:
              complex:
                root: alert
                accessor: action
                transformers:
                - operator: uniq
            iscontext: true
          right:
            value:
              simple: Prevented
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: d2fb1cef-fe7a-4bbf-8f01-1d8a7cefc32b
    type: condition
    task:
      id: d2fb1cef-fe7a-4bbf-8f01-1d8a7cefc32b
      version: -1
      name: Should auto terminate process?
      description: Check if auto remediation is set to True.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "1"
      "yes":
      - "41"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoRemediation
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 770,
          "y": -280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: f3f9974c-9fde-4505-86e3-9cdb784d53b2
    type: playbook
    task:
      id: f3f9974c-9fde-4505-86e3-9cdb784d53b2
      version: -1
      name: Command-Line Analysis
      description: "This playbook takes a command line from the alert and performs the following actions:\n- Checks for base64 string and decodes if exists\n- Extracts and enriches indicators from the command line\n- Checks specific arguments for malicious usage \n\nAt the end of the playbook, it sets a possible verdict for the command line, based on the finding:\n1. Indicators found in the command line\n2. Found AMSI techniques\n3. Found suspicious parameters\n4. Usage of malicious tools\n5. Indication of network activity\n6. Indication of suspicious LOLBIN execution\n\nNote: In case you are wishing to run this playbook with a list of command lines, set this playbook to be running in a loop. To do so, navigate to the 'Loop'  and check \"For Each Input\"."
      playbookName: Command-Line Analysis
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "37"
    scriptarguments:
      Commandline:
        complex:
          root: alert
          accessor: targetprocesscmd
          transformers:
          - operator: uniq
      StringSimilarityThreshold:
        simple: "0.5"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 180,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: c46d7663-a26c-43a4-8256-081df3a9e92a
    type: regular
    task:
      id: c46d7663-a26c-43a4-8256-081df3a9e92a
      version: -1
      name: Raise incident severity
      description: commands.local.cmd.set.incident
      script: Builtin|||setAlert
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      severity:
        simple: High
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 1200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 30d51313-90b0-4191-813d-cd41bba866de
    type: title
    task:
      id: 30d51313-90b0-4191-813d-cd41bba866de
      version: -1
      name: Remediation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 3f4a0d5a-cf7d-4b48-806b-762e2d81fb42
    type: condition
    task:
      id: 3f4a0d5a-cf7d-4b48-806b-762e2d81fb42
      version: -1
      name: Should auto block indicators?
      description: Check if auto remediation is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "36"
      "yes":
      - "28"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoRemediation
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 1500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 149f64f6-f6a8-4a72-8ab1-7f90e642b778
    type: title
    task:
      id: 149f64f6-f6a8-4a72-8ab1-7f90e642b778
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: ec109fc1-abef-4b6a-80e8-9c0021c97731
    type: title
    task:
      id: ec109fc1-abef-4b6a-80e8-9c0021c97731
      version: -1
      name: Investigation & Analysis
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "13"
      - "42"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: 28ac1eb1-0de2-4c79-8238-504f5a28a1aa
    type: playbook
    task:
      id: 28ac1eb1-0de2-4c79-8238-504f5a28a1aa
      version: -1
      name: Block Indicators - Generic v3
      description: |+
        This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks:

        - Block URL - Generic v2
        - Block Account - Generic v2
        - Block IP - Generic v3
        - Block File - Generic v2
        - Block Email - Generic v2
        - Block Domain - Generic v2

      playbookName: Block Indicators - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      AutoBlockIndicators:
        simple: "True"
      AutoCommit:
        simple: "No"
      CustomBlockRule:
        simple: "True"
      CustomURLCategory:
        simple: XSOAR Remediation - Malicious URLs
      IP:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: ip
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      InputEnrichment:
        simple: "False"
      RuleDirection:
        simple: outbound
      RuleName:
        simple: XSOAR - Block Indicators playbook - ${incident.id}
      URL:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: url
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      UserVerification:
        simple: "True"
      Username:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: username
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 680,
          "y": 1670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 78f3d476-e332-48b8-8dd5-669a3a8ec36e
    type: condition
    task:
      id: 78f3d476-e332-48b8-8dd5-669a3a8ec36e
      version: -1
      name: Found additional alerts or suspicious command line?
      description: Check if any malicious verdict is found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "22"
      Malicious:
      - "15"
    separatecontext: false
    conditions:
    - label: Malicious
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: CommandlineVerdict
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 19e960f5-0b99-40b7-82ae-6ff603dc2b03
    type: playbook
    task:
      id: 19e960f5-0b99-40b7-82ae-6ff603dc2b03
      version: -1
      name: Threat Hunting - Generic
      description: "This playbook enables threat hunting for IOCs in your enterprise. It currently supports the following integrations: \n- Splunk\n- Qradar\n- Pan-os \n- Cortex data lake \n- Autofocus\n- Microsoft 365 Defender"
      playbookName: Threat Hunting - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      IPAddress:
        complex:
          root: ExtractedIndicators
          accessor: IP
          transformers:
          - operator: uniq
      MD5:
        complex:
          root: File
          accessor: MD5
          transformers:
          - operator: uniq
      QRadarTimeFrame:
        simple: LAST 7 DAYS
      SHA1:
        complex:
          root: File
          accessor: SHA1
          transformers:
          - operator: uniq
      SHA256:
        complex:
          root: File
          accessor: SHA256
          transformers:
          - operator: uniq
      SplunkEarliestTime:
        simple: -7d@d
      SplunkLatestTime:
        simple: now
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 730,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 19081ef3-2615-4e32-8b77-f1c36dbea137
    type: regular
    task:
      id: 19081ef3-2615-4e32-8b77-f1c36dbea137
      version: -1
      name: Terminate suspicious process
      description: Initiate a new endpoint script execution of shell commands.
      script: '|||core-run-script-execute-commands'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      commands:
        complex:
          root: alert
          accessor: initiatorpid
          transformers:
          - operator: ConcatFormat
            args:
              ctx_data: {}
              ctx_inc: {}
              ctx_inputs: {}
              keep_symbol_to_null: {}
              prefix:
                value:
                  simple: 'taskkill /F /PID '
              suffix: {}
              variable_markers: {}
      endpoint_ids:
        simple: ${Core.Endpoint.endpoint_id}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 770,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: ad7cad0d-f975-43b7-8149-584e8104bdc1
    type: regular
    task:
      id: ad7cad0d-f975-43b7-8149-584e8104bdc1
      version: -1
      name: Waiting for manual remediation
      description: |
        Containment and Eradication:

        1. Identify all affected systems and user accounts that were involved in the incident.
        2. Disable or suspend compromised accounts and reset passwords where necessary.
        3. Thoroughly investigate the extent of the compromise across the network.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1110,
          "y": 1670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 4ba2e064-ac6c-4024-8637-5f4fe58998d3
    type: regular
    task:
      id: 4ba2e064-ac6c-4024-8637-5f4fe58998d3
      version: -1
      name: Set Command-Line Verdict to Layout
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      commandline:
        complex:
          root: commandline
          accessor: original
      commandlineverdict:
        simple: ${CommandlineVerdict}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 180,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: 4314c7ec-ffad-4498-82f4-cd9cc9c3c1c7
    type: playbook
    task:
      id: 4314c7ec-ffad-4498-82f4-cd9cc9c3c1c7
      version: -1
      name: Enrichment for Verdict
      description: This playbook checks prior alert closing reasons and performs enrichment and prevalence checks on different IOC types. It then  returns the information needed to establish the alert's verdict.
      playbookName: Enrichment for Verdict
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      CloseReason:
        simple: Resolved - False Positive,Resolved - Duplicate Incident,Resolved - Known Issue
      CommandLine:
        simple: ${alert.cgocmd}
      Domain:
        complex:
          root: alert
          accessor: domainname
      FileSHA256:
        complex:
          root: alert
          accessor: initiatorsha256
      IP:
        complex:
          root: alert
          accessor: hostip
      URL:
        complex:
          root: alert
          accessor: url
      UseReputationCommand:
        simple: "True"
      User:
        complex:
          root: alert
          accessor: username
      query:
        simple: (initiatorsha256:${inputs.FileSHA256} or hostip:${inputs.IP}) and sourceBrand:"${alert.sourceBrand}" and name:"${alert.name}"
      threshold:
        simple: "2"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 180,
          "y": 380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: e7a95b47-b732-4ede-88bb-693bf96d273d
    type: playbook
    task:
      id: e7a95b47-b732-4ede-88bb-693bf96d273d
      version: -1
      name: Get entity alerts by MITRE tactics
      description: |-
        This playbook searches XDR alerts related to specific entities , on a given timeframe, based on MITRE tactics.
        Note: The playbook's inputs enable manipulating the execution flow. Read the input descriptions for details.
      playbookName: Get entity alerts by MITRE tactics
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      EntityID:
        complex:
          root: inputs.EndpointIDs
          transformers:
          - operator: uniq
      EntityType:
        simple: IP
      HuntCnCTechniques:
        simple: "False"
      HuntCollectionTechniques:
        simple: "True"
      HuntCredentialAccessTechniques:
        simple: "False"
      HuntDefenseEvasionTechniques:
        simple: "False"
      HuntDiscoveryTechniques:
        simple: "False"
      HuntExecutionTechniques:
        simple: "False"
      HuntImpactTechniques:
        simple: "False"
      HuntInitialAccessTechniques:
        simple: "False"
      HuntLateralMovementTechniques:
        simple: "False"
      HuntPersistenceTechniques:
        simple: "False"
      HuntPrivilegeEscalationTechniques:
        simple: "True"
      HuntReconnaissanceTechniques:
        simple: "False"
      RunAll:
        simple: "False"
      timeRange:
        simple: 6 hours
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 730,
          "y": 380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 8ece8239-b854-4e28-86d8-e832d08e09e3
    type: regular
    task:
      id: 8ece8239-b854-4e28-86d8-e832d08e09e3
      version: -1
      name: Get endpoint ID
      description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set (start by counting from 0).
      script: '|||core-get-endpoints'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    scriptarguments:
      ip_list:
        complex:
          root: alert
          accessor: hostip
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 770,
          "y": -110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: c136bf29-105d-4456-8efd-25ac39c064d6
    type: regular
    task:
      id: c136bf29-105d-4456-8efd-25ac39c064d6
      version: -1
      name: Extract source IP address indicator
      description: commands.local.cmd.extract.indicators
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "33"
    scriptarguments:
      text:
        simple: ${alert.details}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 730,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "10_1_Yes": 0.29,
      "17_28_yes": 0.52,
      "17_36_#default#": 0.57,
      "29_15_Malicious": 0.54,
      "29_22_#default#": 0.18
    },
    "paper": {
      "dimensions": {
        "height": 2525,
        "width": 1310,
        "x": 180,
        "y": -620
      }
    }
  }
inputs:
- key: alerts_ids
  value:
    simple: ${alert.id}
  required: false
  description: The ID's of the relevant alerts
  playbookInputQuery:
- key: AutoRemediation
  value:
    simple: "false"
  required: false
  description: Whether remediation will be run automatically or manually. If set to "True" - remediation will be automatic.
  playbookInputQuery:
- key: LOLBASFeedLimit
  value:
    simple: "100"
  required: false
  description: LOLBAS Feed results limit
  playbookInputQuery:
- key: EndpointIDs
  value:
    simple: ${alert.hostip}
  required: false
  description: The IDs of the victim endpoint
  playbookInputQuery:
outputs: []
tests:
- No tests
fromversion: 6.10.0
marketplaces:
- marketplacev2
- platform


supportedModules:
- agentix
- cloud
- cloud_posture
- cloud_runtime_security
- edr
- xsiam