Skip to main content

Cortex XDR - XCloud Token Theft Response

This Playbook is part of the Cloud Incident Response Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.8.0 and later.


Cloud Token Theft Response Playbook#

The Cloud Token Theft Response Playbook provides a structured and comprehensive flow to effectively respond to and mitigate alerts involving the theft of cloud tokens. The playbook supports AWS, GCP, and Azure and executes the following:

Cloud Enrichment:

  • Enriches the involved resources.
  • Enriches the involved identities.
  • Enriches the involved IPs.

Verdict Decision Tree:

  • Determines the appropriate verdict based on the investigation findings.

Early Containment using the Cloud Response - Generic Playbook:

  • Implements early containment measures to prevent further impact.

Cloud Persistence Threat Hunting:

  • Conducts threat hunting activities to identify any cloud persistence techniques.

Enriching and Responding to Hunting Findings:

  • Performs additional enrichment and responds to the findings from threat hunting.

Verdict Handling:

  • Handles false positives identified during the investigation.
  • Handles true positives by initiating appropriate response actions.

Supported Alerts#

Alert NameCSP
Suspicious usage of AWS Lambda’s tokenAWS
Suspicious usage of AWS Lambda’s roleAWS
Suspicious usage of EC2 tokenAWS
Remote usage of an AWS service tokenAWS
Remote usage of an AWS EKS tokenAWS
Suspicious usage of an AWS EKS tokenAWS
Suspicious usage of an AWS ECS tokenAWS
Remote usage of an AWS ECS tokenAWS
Suspicious usage of AWS service tokenAWS
Remote usage of an App engine Service Account tokenGCP
Suspicious usage of App engine Service Account tokenGCP
Remote usage of VM Service Account tokenGCP
Suspicious usage of VM Service Account tokeGCP

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks#

  • IP Enrichment - Generic v2
  • Cloud Threat Hunting - Persistence
  • Cortex XDR - XCloud Token Theft - Set Verdict
  • TIM - Indicator Relationships Analysis
  • Entity Enrichment - Generic v3
  • Cloud Enrichment - Generic
  • Cloud Response - Generic

Integrations#

This playbook does not use any integrations.

Scripts#

  • ParseHTMLIndicators
  • LoadJSON

Commands#

  • xdr-get-cloud-original-alerts
  • xdr-update-incident
  • setIncident
  • closeInvestigation

Playbook Inputs#


NameDescriptionDefault ValueRequired
alert_idThe alert ID.alert.investigationIdOptional
InternalRangeA comma-separated list of internal IP ranges to check IP addresses against. The list should be provided in CIDR notation.Optional
ResolveIPDetermines whether to convert the IP address to a hostname using a DNS query (True/ False).FalseOptional
earlyContainmentWhether to execute early containment.
This action allows you to respond rapidly but have higher probability for false positives.
TrueOptional
VPNIPListThis input can process two types of data:
1. A comma-separated list of internal IPs assigned by the VPN provider using a XSIAM list or an hardcoded array.
2. A link to an IP list which will be processed and extract the IP dynamically which each execution.

For CIDRs, use the InternalRange input.
Optional
autoResourceRemediationWhether to execute the resource remediation automatically.FalseOptional
autoAccessKeyRemediationWhether to execute the access key remediation automatically.FalseOptional
autoUserRemediationWhether to execute the user remediation automatically.FalseOptional
autoBlockIndicatorsWhether to execute the indicators remediation automatically.FalseOptional

Playbook Outputs#


There are no outputs for this playbook.

Playbook Image#


Cortex XDR - XCloud Token Theft Response