Search Endpoints By Hash - TIE

Hunt for sightings of MD5, SHA1 and/or SHA256 hashes on endpoints, using McAfee TIE (requires ePO as well). Input: * Hash (default, takes all deferent hashes from context) Output: * All agents that files with "Hash" has been executed on (TIE) * Enrich Agents info from ePO

Pack

McAfee-TIE

Tasks

10

Inputs

• Hash — The Hash to hunt (Could be MD5,SHA1,SHA256). Default is set to all hashes

Outputs

• Endpoint.Hostname — Hostname
• Endpoint — The endpoint

Commands used

• epo-find-system
• tie-file-references