Malware Core

This script allows removing specified files using Cortex XDR, CrowdStrike and Microsoft Defender (Advanced Threat Protection).

This is a wrapper to allow or block hash lists from Cortex XDR, MSDE or CrowdStrike.

Infected hosts found in the investigation

Host Name

Threat Actor

The user involved

Quarantined

Malicious Behavior

Terminated Action

Parent Process ID

Deprecated. Use 'Malware Investigation & Response Incident handler' instead. (From the 'Malware Investigation And Response Pack')
Master playbook for investigating suspected malware presence on an endpoint.
Labels:

• System: the hostname for the endpoint being investigated

Deprecated. Use 'Malware Investigation & Response Incident handler' instead. (From the 'Malware Investigation And Response Pack')
This playbook is triggered by a malware incident from an 'Endpoint' type integration. The playbook performs enrichment, detonation, and hunting within the organization, and remediation on the malware.
Used sub-playbooks:

• Endpoint Enrichment - Generic v2.1
• Retrieve File from Endpoint - Generic
• Detonate File - Generic
• File Enrichment - Generic v2
• Calculate Severity - Generic v2
• Isolate Endpoint - Generic
• Block Indicators - Generic v2

Deprecated. Use 'Malware Investigation & Response Incident handler' instead. (From the 'Malware Investigation And Response Pack')

This playbook provides a framework for handling malware investigation through all essential steps. The playbook consists of 7 stages. Each stage contains the relevant playbook or tasks.
This playbook auto extracts indicators from incidents using indicator extraction rules of the malware incident type.
To use Illusive integration in the Forensics - Generic playbook, note that you will be able to set the forensic timeline by editing the Forensics - Generic playbook inputs.

This script allows removing specified files using Cortex XDR, CrowdStrike and Microsoft Defender (Advanced Threat Protection).

This is a wrapper to allow or block hash lists from Cortex XDR, MSDE or CrowdStrike.

Threat Actor

Terminated Action

Parent Process ID

Malicious Behavior

Quarantined

Deprecated. Use 'Malware Investigation & Response Alert handler' instead. (From the 'Malware Investigation And Response Pack')
Master playbook for investigating suspected malware presence on an endpoint.
Labels:

• System: the hostname for the endpoint being investigated

Deprecated. Use 'Malware Investigation & Response Alert handler' instead. (From the 'Malware Investigation And Response Pack')
This playbook is triggered by a malware alert from an 'Endpoint' type integration. The playbook performs enrichment, detonation, and hunting within the organization, and remediation on the malware.
Used sub-playbooks:

• Endpoint Enrichment - Generic v2.1
• Retrieve File from Endpoint - Generic
• Detonate File - Generic
• File Enrichment - Generic v2
• Calculate Severity - Generic v2
• Isolate Endpoint - Generic
• Block Indicators - Generic v2

Deprecated. Use 'Malware Investigation & Response Alert handler' instead. (From the 'Malware Investigation And Response Pack')

This playbook provides a framework for handling malware investigation through all essential steps. The playbook consists of 7 stages. Each stage contains the relevant playbook or tasks.
This playbook auto extracts indicators from alerts using indicator extraction rules of the malware alert type.
To use Illusive integration in the Forensics - Generic playbook, note that you will be able to set the forensic timeline by editing the Forensics - Generic playbook inputs.