id: USTA Account Takeover Prevention Employee Credential Incident
version: -1
fromversion: 6.10.0
name: USTA Account Takeover Prevention Employee Credential Incident
description: ' This playbook automates the detection and response process when compromised employee credentials are identified via USTA platform.'
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: c51a6743-d257-4e9c-966a-630163668797
    type: start
    task:
      id: c51a6743-d257-4e9c-966a-630163668797
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 695,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 64836d9e-7b26-4836-86dc-f9f98caad2e8
    type: condition
    task:
      id: 64836d9e-7b26-4836-86dc-f9f98caad2e8
      version: -1
      name: Check if the credentials are valid
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.ustaaccounttakeoverpreventionusername
            iscontext: true
          right:
            value: {}
        - operator: isNotEmpty
          left:
            value:
              simple: incident.ustaaccounttakeoverpreventionpassword
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: e8add26b-4b2b-4f6c-a28c-d93d06c675c1
    type: regular
    task:
      id: e8add26b-4b2b-4f6c-a28c-d93d06c675c1
      version: -1
      name: Perform a password reset and escalate
      type: regular
      iscommand: false
      description: ""
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 77518aa7-8c48-4ded-88e0-24c23ada2b01
    type: title
    task:
      id: 77518aa7-8c48-4ded-88e0-24c23ada2b01
      version: -1
      name: END
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 695,
          "y": 735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: f73c381e-e847-4f8a-8697-d17375d755b1
    type: condition
    task:
      id: f73c381e-e847-4f8a-8697-d17375d755b1
      version: -1
      name: Check if the password meets the minimum length
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: StringLength.Result
            iscontext: true
          right:
            value:
              simple: inputs.MinimumPasswordLength
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: fd6629e5-f4d2-4a97-8da6-e768a2bdf76f
    type: regular
    task:
      id: fd6629e5-f4d2-4a97-8da6-e768a2bdf76f
      version: -1
      name: Check incident password length
      description: Returns the length of  the string passed as the argument
      scriptName: StringLength
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      str:
        simple: ${incident.ustaaccounttakeoverpreventionpassword}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: ce226298-21af-4263-b5fa-76c6c17c3500
    type: title
    task:
      id: ce226298-21af-4263-b5fa-76c6c17c3500
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 2f489ffe-b050-4c7f-9a96-dbfe443c18da
    type: title
    task:
      id: 2f489ffe-b050-4c7f-9a96-dbfe443c18da
      version: -1
      name: END
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 17509d9f-7beb-4de1-be0f-8db3b68586be
    type: condition
    task:
      id: 17509d9f-7beb-4de1-be0f-8db3b68586be
      version: -1
      name: Is Corporate Credential ?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isTrue
          left:
            value:
              simple: incident.ustaaccounttakeoverpreventioniscorporate
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 695,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 012392e5-46b7-44d1-9ef5-c4765577edcb
    type: title
    task:
      id: 012392e5-46b7-44d1-9ef5-c4765577edcb
      version: -1
      name: END
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 910,
          "y": 385
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1085,
        "width": 1240,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: MinimumPasswordLength
  value:
    simple: "5"
  required: true
  description: Minimum compromised credential's password length required for Playbook to work
  playbookInputQuery:
outputs: []
quiet: true
tests:
- No tests (auto formatted)