TIE - IOC Hunt

Hunt for sightings of MD5, SHA1 and/or SHA256 hashes on endpoints, using McAfee TIE (requires ePO as well). Input: * Hash (default, takes all deferent hashes from context) Output: * All agents that files with "Hash" has been executed on (TIE) * Enrich Agents info from ePO

Pack

McAfee-TIE

Tasks

9

Inputs

• Hash — The Hash to hunt (Could be MD5,SHA1,SHA256). Default is set to all hashes

Outputs

• McAfee.ePO.Endpoint — Endpoint information for agents has been executed on.

Commands used

• epo-find-system
• tie-file-references