mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
21 lines
944 B
YAML
21 lines
944 B
YAML
name: ActiveDirectory Reset password
|
|
id: fc0edc96-ff2b-48b0-9f6f-63da6783fd63
|
|
version: 2
|
|
creation_date: '2021-12-08'
|
|
modification_date: '2026-05-19'
|
|
author: Philip Royer, Splunk
|
|
type: Response
|
|
description: This playbook resets the password of a potentially compromised user account. First, an analyst is prompted to evaluate the situation and choose whether to reset the account. If they approve, a strong password is generated and the password is reset.
|
|
playbook: activedirectory_reset_password
|
|
how_to_implement: This playbook works on artifacts with artifact:*.cef.compromisedUserName which can be created as shown in the playbook "recorded_future_handle_leaked_credentials" - The prompt is hard-coded to use "admin" as the user, so change it to the correct user or role
|
|
references: []
|
|
app_list:
|
|
- AD LDAP
|
|
platform_tags: []
|
|
playbook_type: Automation
|
|
vpe_type: Classic
|
|
playbook_fields:
|
|
- compromisedUserName
|
|
product:
|
|
- Splunk SOAR
|