%GoCortexIO Snippets

Cortex XDR

| 20 minutes to implement | ~3 min read

#Scenario

Thwart data exfiltration and rogue communication from unauthorised modifications to the local routing table designed to bypass network security controls.

markdown
> Make sure you're comfortable with the results in your own environment before using this more widely.

# Snippet - Intercept and neutralise outbound malicious traffic

> Note, this Snippet is compatible on Windows Endpoints only. 

## Scenario: You receive targeted Intel (network IOC's) or need to respond to an active threat by safely redirecting unauthorised external connections to an internal sinkhole.

Be aware that this script supports a `IP Array` that you can define under `blackhole_list`

Simply use XDR/XSIAM `Action Centre` and use `Run Endpoint Script`, use the Python below and update for your intended targets.
python
# Make sure you're comfortable with the results in your own environment before using this more widely.
import subprocess
import sys

def add_persistent_null_route(ip_addresses, subnet_mask="255.255.255.255", gateway="0.0.0.0"):
    """
    Iterates through a list of IP addresses and adds a persistent null route for each.
    """
    
    if isinstance(ip_addresses, str):
        ip_addresses = [ip_addresses]

    print(f"Starting batch route process for {len(ip_addresses)} targets...\n")

    for ip in ip_addresses:
        ip = ip.strip()
        command = [
            "route", "/p", "ADD", 
            ip, 
            "MASK", subnet_mask, 
            gateway
        ]

        try:
            result = subprocess.run(
                command, 
                check=True, 
                capture_output=True, 
                text=True
            )
            print(f"[SUCCESS] Route added for: {ip}")
            
        except subprocess.CalledProcessError as e:
            print(f"[ERROR] Failed to add {ip}. (Check Admin privileges)")
            print(f"Details: {e.stderr.strip()}")
            # Continue to the next IP instead of exiting immediately
            continue
            
        except Exception as e:
            print(f"[ERROR] An unexpected error occurred for {ip}: {e}")

# --- Main execution ---
if __name__ == "__main__":
    # You can now provide an array of target IPs
    blackhole_list = [
        "10.0.0.2",
        "172.16.1.2",
        "192.168.1.2"
    ]
    
    add_persistent_null_route(blackhole_list)
markdown
> Make sure you're comfortable with the results in your own environment before using this more widely.

# Need to rollback or undo your changes?

## Use the following script to remove the static routes we setup above and return the hosts to "normal"

Be sure to update the `rollback_list` array before running.
python
# Make sure you're comfortable with the results in your own environment before using this more widely.
import subprocess
import sys

def remove_persistent_null_routes(ip_addresses):
    """
    Iterates through a list of IP addresses and removes their persistent routes.
    
    Note: Windows only needs the target IP address to delete a route.
    """
    # If a single IP string is passed, convert it to a list
    if isinstance(ip_addresses, str):
        ip_addresses = [ip_addresses]

    print(f"Starting batch route removal for {len(ip_addresses)} targets...\n")

    for ip in ip_addresses:
        ip = ip.strip()
        
        # Command to delete a route: route DELETE [destination]
        command = [
            "route",
            "DELETE",
            ip
        ]

        try:
            result = subprocess.run(
                command, 
                check=True, 
                capture_output=True, 
                text=True
            )
            print(f"[SUCCESS] Route removed for: {ip}")
            if result.stdout:
                print(f"   Details: {result.stdout.strip()}")
            
        except subprocess.CalledProcessError as e:
            print(f"[ERROR] Failed to remove route for {ip}. (Check Admin privileges or if route exists)")
            print(f"Details: {e.stderr.strip() if e.stderr else 'Route may not exist.'}")
            continue
            
        except Exception as e:
            print(f"[ERROR] An unexpected error occurred for {ip}: {e}")

# --- Main execution ---
if __name__ == "__main__":
    # Put the same array here to reverse the changes
    rollback_list = [
        "1.1.1.1",
        "8.8.8.8",
        "123.123.123.123"
    ]
    
    remove_persistent_null_routes(rollback_list)
#agent#detection#playbook