author: Patrick Bareiss, Splunk
automation:
  actions:
  - file reputation
  - hunt file
  - get file
  - block hash
  - disable user
  - logoff user
  - shutdown system
  - create ticket
  is_note_required: false
  playbooks:
  - playook: malware_hunt_and_contain
    scm: community
  role: null
  sla: null
  sla_type: minutes
date: '2020-08-05'
description: Uses any presented filehash artifact sent to phantom and conducts a reputation
  check, hunts for additional systems, blocks file hash with <=10 positive detections
  and creates a ticket for follow up.  Any hashes found with >10 positive hits, automatically
  blockes the hashes, disables user accounts, logs off the user, shuts down the system
  and finally creates a urgent ticket.
id: 1d7b437a-5114-4b94-a585-04c3362ba08f
name: Malware Hunt and Contain
references:
- https://github.com/phantomcyber/playbooks/blob/4.9/malware_hunt_and_contain.json
- https://github.com/phantomcyber/playbooks/blob/4.9/malware_hunt_and_contain.py
- https://github.com/phantomcyber/playbooks/blob/4.9/malware_hunt_and_contain.png
tags:
  nist: RS.RP
  product:
  - Splunk Phantom
type: response
version: 2
workflow: "1. Gets file reputation for every hash presented and filters hashes with\
  \ >10 OR <=10 and >5 for positive hits\n2. Get the files that match and hunt the\
  \ file hashes and return the system(s)/user(s) that have these files present\n3.\
  \ If >10 then block hash, disable users, logoff user, shutdown system and create\
  \ a ticket\n4. IF <=10 but >5 block hash, and create a ticket\nTicket template:\n\
  \  Virus Detected on # devices\n  Hashes submitted with detections: (list hashes)\n\
  \  File was found on # of devices (list devices)\n  This impacts at least # users:\
  \ (list users)\n  # of hashes were submitted for blocking: (list hashes)\n  # of\
  \ users were forced to logoff: (list users)\n  # of user accounts were disabled:\
  \ (list users)\n  # of systems were shutdown: (list systems)\n"
