playbook-RegPathReputationBasicLists_test.yml

id: RegPathReputationBasicLists_test
version: 17
name: RegPathReputationBasicLists_test
description: Test the script - RegPathReputationBasicLists
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: e14bd4ba-8857-476d-82cc-bfc6292b685b
    type: start
    task:
      id: e14bd4ba-8857-476d-82cc-bfc6292b685b
      version: -1
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 8f267e88-5bdd-4f72-8aa5-1dfeeb25d3dc
    type: regular
    task:
      id: 8f267e88-5bdd-4f72-8aa5-1dfeeb25d3dc
      version: -1
      name: RegPathReputationBasicLists
      description: Check the given registry path against a small blacklist (score
        3), whitelist (score 1), and suspicious list (score 2). If the key matches
        neither, returns an answer of 0.
      scriptName: RegPathReputationBasicLists
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      input:
        simple: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: 1293a5c5-dc94-41cd-8792-bcfd200a37a2
    type: condition
    task:
      id: 1293a5c5-dc94-41cd-8792-bcfd200a37a2
      version: -1
      name: Verify Context Output
      description: "Takes the comments of a given entry ID and stores them in the
        incident context, under a provided context key. \nFor accessing the last executed
        task's comments, provide ${lastCompletedTaskEntries.[0]} as the value for
        the entryId input parameter."
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: RegistryKey.Path
            iscontext: true
          right:
            value:
              simple: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
          ignorecase: true
      - - operator: isEqualString
          left:
            value:
              simple: RegistryKey.Score
            iscontext: true
          right:
            value:
              simple: "2"
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: c6fe777c-5762-48e1-8b2f-d05270e64695
    type: regular
    task:
      id: c6fe777c-5762-48e1-8b2f-d05270e64695
      version: -1
      name: Delete Context
      description: Delete field from context
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      all:
        simple: "yes"
      index: {}
      key: {}
      keysToKeep: {}
      subplaybook: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: 539c595a-5fae-41d9-8ac3-6c28a512c331
    type: regular
    task:
      id: 539c595a-5fae-41d9-8ac3-6c28a512c331
      version: -1
      name: Untitled Task
      description: Prints an error entry with a given message
      scriptName: PrintErrorEntry
      type: regular
      iscommand: false
      brand: ""
    scriptarguments:
      message:
        simple: Failed Validation
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 260,
          "y": 760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: a23f34cd-6045-4012-80f0-38e2e50864a9
    type: regular
    task:
      id: a23f34cd-6045-4012-80f0-38e2e50864a9
      version: -1
      name: Verify Contents Output is a number as used by the Server
      description: Script to test RegPathReputationBasicList and see the proper Contents
        output is returned
      scriptName: TestRegPathReputation
      type: regular
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -180,
          "y": 770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 815,
        "width": 820,
        "x": -180,
        "y": 50
      }
    }
  }
inputs: []
outputs: []