Playbook of the Week: Malware Investigation and Response - the Sequel

[jforsythe]

By Bar Katzir, Product Manager for Cortex, and Sasha Sokolovich, Security Architect for Cortex

Enhancing your security automation and response capabilities across multiple platforms while tending to large amounts of threat investigations is anything but easy. But not doing so requires dependency on many manual processes, increasing incident investigation time and overall risk of malware infections. To prepare for the next inevitable attack, SOC teams must continuously look for ways to improve their post-incident activity processes.

Figure 1: NIST Incident Lifecycle process

You don’t need to do it yourself. Let automation help.

Streamline and automate the malware investigation process with Cortex XSOAR’s Malware Investigation and Response pack. Released in June 2022, the Malware Investigation & Response pack accelerates the investigation process for endpoint malware incidents and alerts by collecting evidence of malicious behaviors, searching telemetry data available through EDRs, and processing malware analysis reports through sandboxes. Incident layouts also include buttons to quickly trigger containment activities.

Customers like you have found immense value in the Malware Investigation and Response Pack, alongside the Deployment Wizard, since its release.

To quote an EMEA Financial Services customer:

“The Malware Investigation and Response pack is by far the easiest use case to deploy.”

Key New Features of the Malware Investigation and Response Content Pack

After working with customers across various sectors and regions on their deployment of the pack, we incorporated their feedback into a new version of the pack to provide more value without compromising investigation speed or scale.

For the new Malware Investigation and Response pack, we focused on the following capabilities:

Account Enrichment

Incorporating the capability to retrieve information about the active user on the endpoint will give the analyst context about the endpoint and possible risks to the organization.

For example, providing insight into the active user’s department— whether they are in finance or engineering— enables the analyst to disable the user's account in the corresponding IDP as needed.

Figure 2: Account Information details in incident view

Firewall Enrichment & Validation (with Threat Hunting Generic playbook)

SIEM and newly added Network Security tools give more context to the threats in your organization. This provides valuable context regarding the severity of the  threat and how wide it has spread within your organization.

Joe Security Sandbox coverage

The new integration with Joe Security sandbox allows analysts to retrieve submitted file information or automatically detonate files that are detected by the deployed EDR. The retrieved information allows the analyst to gain more insights on the alert by using the Sandbox analysis full report or even a quick view of the extracted IOCs, such as MITRE ATT&CK information, from the layout itself.

Figure 3: Joe Security Sandbox Report available to analyst for incident investigation

Figure 4: Joe Security Sandbox Report providing rich analysis and MITRE ATT&CK mapping

Addition of Service Level Agreements (SLAs)

Security investigations are time-sensitive. The longer before the threat is contained, the greater the risk of exposure to the organization. With this enhancement of the pack, you can easily track and monitor Triage, Remediation, and Containment SLAs.

Figure 5: SLAs section within the incident

An SLA Dashboard also allows you to quickly filter your Incident Types based on Severity so you can properly diagnose your SLAs.

Figure 6: SLA Dashboard

Microsoft Defender for Endpoint Rate limit handling

Some advanced hunting queries have limitations. However, the Cortex XSOAR Malware Investigation and Response v2 content pack includes a baked-in rate-limiting support mechanism, which will re-run your queries in the playbooks if you have reached your Incidents API or Advanced Hunting API quota. This ensures your investigation goes unhindered.

Microsoft Defender for Endpoint Advanced Hunting Batch Queries

As the XSOAR R&D team keeps evolving and maintaining current playbooks, it is essential to have flexibility when it comes to customization. This feature allows the customer to add a batch of pre-defined queries as a playbook input. This way, there is no need to detach the playbook for adding your custom Microsoft Defender Advanced Hunting queries.

Assign Analyst to an Incident

Assigning an analyst to an incident based on the less busy user is now available. Moreover, you may define if you would like to assign an on-call analyst using the playbook inputs.

Continuous Innovation in Automation

The Malware Investigation and Response pack accelerates the investigation process for cybersecurity analysts and makes containment activities push-button simple. Although the latest additions add a ton of value for our customers, we are already thinking about what’s next.

---

For more information on the Malware Investigation and Response Pack and other XSOAR packs and playbooks, visit our Cortex XSOAR Developer Docs reference page.

Don’t have Cortex XSOAR? Download our free Community Edition today to test out this playbook and hundreds more automations for common use cases you deal with daily in your security operations or SOC.