Cisco Orbital - Incident Response - Disable Local User Account

This incident response workflow consumes one or more users (user or process_username) and attempts to disable the local account on endpoints running windows, mac or linux

This workflow is intended for use in a playbook during the containment stage.

Upon execution, the analyst receives notification (prompt task) to select whether the attempt to disable local account should be executed on the endpoints involved in the incident or on all endpoints for which users exist in the local account database.

The workflow will also attempt to confirm whether the Disable request was successful.

Targets

This workflow requires Cisco Orbital integrated in Cisco XDR (Module) and active on Endpoints

Workflow Steps

Structure :

• Create Task Prompt and wait for Analyst answer

• For Each User (user or process_username)

  • If prompt answer = "Endpoints Involved in the Incident Only" :

    • Extract target endpoints from incident, store hostnames in "Host Table" with type "none" and Format "Host List"
    • With "Host list", Check via Orbital Query if user exists on endpoints (user account monitoring)
    • If Query Failed with error "no result for job" : Update workflow output (no endpoint connected) and workflow completed
    • If Query Success : Update host table with result for each endpoint connected (type = "Exists" or "Not Exists"")
    • For Each host in "Host Table" - Disable Account
      • If "Exists" : Request to disable account via Orbital Script (windows : powershell Disable-LocalUser, Linux : Usermod -L, Mac : pwpolicy -u)
        • If Script status success True : Update workflow output (Request sent)
        • If Script status success False : Update workflow output (Orbital Error)
      • If "Not Exists" : Update workflow output (User does not exist)
      • If "None" (endpoint not connected) : Update workflow output (Endpoint not connected)
    • For Each Hostname in "Host Table" - Confirm Account Disabled
      • If "Exists" : Check via Orbital Script user account status (windows : powershell Get-LocalUser, Linux : passwd -S, Mac : pwpolicy -getpolicy -u)
        • If user account disable (match regex) : Update workflow output (confirmed)

  • If Prompt answer = "All endpoints for which users exist in the local account database"

    • Search on All Endpoints via Orbital Query to find where user exists on endpoints (user account monitoring)
    • If Query Failed with error "no result for job" : Update workflow output (no endpoint connected) and workflow completed
    • If Query success :
      • For Each result, get row count
        If row count > 0 : Add hostname to host table
    • If row in host table = 0
      • Update workflow output (No Endpoint found)
    • If row in host table > 0
      • For Each host in "Host Table" - Disable Account
        • Request to disable account via Orbital Script (windows : powershell Disable-LocalUser, Linux : Usermod -L, Mac : pwpolicy -u)
          • If Script status success True : Update workflow output (request sent)
          • If Script status success False : Update workflow output (Orbital Error)
      • For Each Hostname in "Host Table" - Confirm Account Disabled
        • Check via Orbital Script user account status (windows : powershell Get-LocalUser, Linux : passwd -S, Mac : pwpolicy -getpolicy -u)
          • If user account disable (match regex) : Update workflow output (confirmed)