Malware Core

This is a wrapper to allow or block hash lists from Cortex XDR, MSDE or CrowdStrike.

This script allows removing specified files using Cortex XDR, CrowdStrike and Microsoft Defender (Advanced Threat Protection).

Malicious Behavior

Host Name

Parent Process ID

Threat Actor

Infected hosts found in the investigation

Quarantined

The user involved

Terminated Action

Deprecated. Use 'Malware Investigation & Response Incident handler' instead. (From the 'Malware Investigation And Response Pack')
Master playbook for investigating suspected malware presence on an endpoint.
Labels:

• System: the hostname for the endpoint being investigated

Deprecated. Use 'Malware Investigation & Response Incident handler' instead. (From the 'Malware Investigation And Response Pack')
This playbook is triggered by a malware incident from an 'Endpoint' type integration. The playbook performs enrichment, detonation, and hunting within the organization, and remediation on the malware.
Used sub-playbooks:

• Endpoint Enrichment - Generic v2.1
• Retrieve File from Endpoint - Generic
• Detonate File - Generic
• File Enrichment - Generic v2
• Calculate Severity - Generic v2
• Isolate Endpoint - Generic
• Block Indicators - Generic v2

Deprecated. Use 'Malware Investigation & Response Incident handler' instead. (From the 'Malware Investigation And Response Pack')

This playbook provides a framework for handling malware investigation through all essential steps. The playbook consists of 7 stages. Each stage contains the relevant playbook or tasks.
This playbook auto extracts indicators from incidents using indicator extraction rules of the malware incident type.
To use Illusive integration in the Forensics - Generic playbook, note that you will be able to set the forensic timeline by editing the Forensics - Generic playbook inputs.

This is a wrapper to allow or block hash lists from Cortex XDR, MSDE or CrowdStrike.

This script allows removing specified files using Cortex XDR, CrowdStrike and Microsoft Defender (Advanced Threat Protection).

Terminated Action

Parent Process ID

Quarantined

Threat Actor

Malicious Behavior

Deprecated. Use 'Malware Investigation & Response Alert handler' instead. (From the 'Malware Investigation And Response Pack')
This playbook is triggered by a malware alert from an 'Endpoint' type integration. The playbook performs enrichment, detonation, and hunting within the organization, and remediation on the malware.
Used sub-playbooks:

• Endpoint Enrichment - Generic v2.1
• Retrieve File from Endpoint - Generic
• Detonate File - Generic
• File Enrichment - Generic v2
• Calculate Severity - Generic v2
• Isolate Endpoint - Generic
• Block Indicators - Generic v2

Deprecated. Use 'Malware Investigation & Response Alert handler' instead. (From the 'Malware Investigation And Response Pack')
Master playbook for investigating suspected malware presence on an endpoint.
Labels:

• System: the hostname for the endpoint being investigated

Deprecated. Use 'Malware Investigation & Response Alert handler' instead. (From the 'Malware Investigation And Response Pack')

This playbook provides a framework for handling malware investigation through all essential steps. The playbook consists of 7 stages. Each stage contains the relevant playbook or tasks.
This playbook auto extracts indicators from alerts using indicator extraction rules of the malware alert type.
To use Illusive integration in the Forensics - Generic playbook, note that you will be able to set the forensic timeline by editing the Forensics - Generic playbook inputs.