Command-Line Analysis
Common Playbooks Pack.#
This Playbook is part of theSupported versions
Supported Cortex XSOAR versions: 6.0.0 and later.
This playbook takes the command line from the alert and performs the following actions:
- Checks for base64 string and decodes if exists
- Extracts and enriches indicators from the command line
- Checks specific arguments for malicious usage
At the end of the playbook, it sets a possible verdict for the command line, based on the finding:
- Indicators found in the command line
- Found AMSI techniques
- Found suspicious parameters
- Usage of malicious tools
- Indication of network activity
#
DependenciesThis playbook uses the following sub-playbooks, integrations, and scripts.
#
Sub-playbooksThis playbook does not use any sub-playbooks.
#
IntegrationsThis playbook does not use any integrations.
#
Scripts- MatchRegexV2
- Base64Decode
- Set
#
Commands- enrichIndicators
- extractIndicators
#
Playbook InputsName | Description | Default Value | Required |
---|---|---|---|
Commandline | The command line. | Required |
#
Playbook OutputsPath | Description | Type |
---|---|---|
MatchRegex | The regex found in the command line | unknown |
Indicators | Indicators extracted from the command line | unknown |
commandline | The command line | unknown |
CommandlineVerdict | The command line verdict | unknown |