Stairwell Inception

This Integration is part of the Stairwell Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.5.0 and later.

Use the Stairwell Inception integration to enrich data in XSOAR using Stairwell's knowledge and perform automated variant discovery.

Not a customer and interested in signing up? You can request access here.

Generate required API key#

Follow these steps for a self-deployed configuration.

Access the Inception web UI and generate a API/CLI token here.
Copy your API token for the integration configuration usage.

Configure Stairwell Inception in Cortex#

Parameter	Required
API Key	True
Use system proxy settings	False
Trust any certificate (not secure)	False

Commands#

You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

inception-file-enrichment#

Enrich files using file hash (MD5, SHA1, SHA256) with Stairwell's knowledge.

Base Command#

inception-file-enrichment

Input#

Argument Name	Description	Required
fileHash	File hash (MD5, SHA1, SHA256) to lookup.	Required

Context Output#

Path	Type	Description
Inception.File_Details	Dict	Raw JSON output from API

Command Example#

!inception-file-enrichment fileHash=9fe1ac46f0cdebf03156a6232d771c14559f8daf

Context Example#

{
 "inception": {
  "file_details": {
   "type": "file",
   "id": "e7762f90024c5366807c7c145d3456f0ac3be086c0ec3557427d3c2c10a2052d",
   "links": {
    "self": "/api/v3/files/e7762f90024c5366807c7c145d3456f0ac3be086c0ec3557427d3c2c10a2052d"
   },
   "data": {
    "attributes": {
     "md5": "00ddbafe247c891eed36bd74f66f936b",
     "sha1": "9fe1ac46f0cdebf03156a6232d771c14559f8daf",
     "sha256": "e7762f90024c5366807c7c145d3456f0ac3be086c0ec3557427d3c2c10a2052d",
     "size": 118024,
     "creation_date": 1653722032,
     "last_analysis_results": {
      "ClamAV": {
       "category": "undetected",
       "engine_name": "ClamAV",
       "result": "undetected"
      },
      "Engine2": {
       "category": "malicious",
       "engine_name": "Engine2",
       "result": "Trojan/Win.Hermeticwiper"
      }
     },
     "last_analysis_stats": {
      "harmless": 1,
      "malicious": 1
     },
     "names": [
      "C:\\GimmeCreds.dll"
     ],
     "meaningful_name": "C:\\GimmeCreds.dll",
     "type_description": "EXE",
     "crowdsourced_yara_results": [{
       "rule_name": "wiper_HermeticWiper"
      },
      {
       "rule_name": "MAL_HERMETIC_WIPER"
      }
     ],
     "inception": {
      "environments": [{
       "environment_id": {
        "id": "AAAAAA-BBBBBB-CCCCCC-DDDDDDD"
       }
      }],
      "assets": [{
       "asset_id": {
        "id": "DDDDDD-CCCCCC-BBBBBB-AAAAAAA"
       },
       "name": "WORKGROUP\\IDABEAR"
      }]
     },
     "magic": "EXE",
     "imphash": "fe4a2284122da348258c83ef437fbd7b",
     "ssdeep": "1536:WBOoa7Nn54urilmw9BgjKu1sPPxaS4NOyqC:WBOoa7P4xlPwV16PkS4NVqC"
    }
   }
  }
 }
}

Human Readable Output#

Stairwell Inception#
MD5: 00ddbafe247c891eed36bd74f66f936b SHA256: e7762f90024c5366807c7c145d3456f0ac3be086c0ec3557427d3c2c10a2052d Seen Assets: 1 Matching YARA Intel: wiper_HermeticWiper,MAL_HERMETIC_WIPER
AV Scanning Results#
Engine Name Result
ClamAV undetected
Engine2 Trojan/Win.Hermeticwiper

Engine Name	Result
ClamAV	undetected
Engine2	Trojan/Win.Hermeticwiper

inception-variant-discovery#

Hunt for variants using a SHA256 across all files you have access to, including your environments and Stairwell's malware feeds.

Base Command#

inception-variant-discovery

Input#

Argument Name	Description	Required
sha256	SHA256 of file to hunt for variants on.	Required

Context Output#

Path	Type	Description
Inception.Variants	Dict	Raw JSON output from API

Command Example#

!inception-variant-discovery sha256=30e27357b7b773b226d4ee638e17b19b954226d197b0781822859269a5c22b4d

Context Example#

{
 "inception": {
  "variants": {
   "name": "variants/30e27357b7b773b226d4ee638e17b19b954226d197b0781822859269a5c22b4d",
   "variants": [{
     "similarity": 1,
     "sha256": "e1a00d8923bac6f863c262236f15eb60d80571f8b31e7220c4b2912fae7e9a14"
    },
    {
     "similarity": 0.9875,
     "sha256": "d2a00d8923bac6f863c262236f15eb60d80571f8b31e7220c4b2912fae7e9a12"
    }
   ],
   "variant_count": 2,
   "original_object": "30e27357b7b773b226d4ee638e17b19b954226d197b0781822859269a5c22b4d"
  }
 }
}

Human Readable Output#

File Variants Discovered#
sha256 similarity
e1a00d8923bac6f863c262236f15eb60d80571f8b31e7220c4b2912fae7e9a14 1
d2a00d8923bac6f863c262236f15eb60d80571f8b31e7220c4b2912fae7e9a12 0.9875

sha256	similarity
e1a00d8923bac6f863c262236f15eb60d80571f8b31e7220c4b2912fae7e9a14	1
d2a00d8923bac6f863c262236f15eb60d80571f8b31e7220c4b2912fae7e9a12	0.9875