CrowdStrike Falcon - Search Endpoints By Hash

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook searches across the organization for other endpoints associated with a specific SHA256/MD5/SHA1 hash.

CrowdStrike Falcon · 19 tasks · 4 inputs · 10 outputs

Inputs

  • FileSha256 — The SHA256 file hash to search for.
  • HostId — The ID of the host that originated the detection.
  • SHA1 — The SHA1 file hash to search for.
  • MD5 — The MD5 file hash to search for.

Outputs

  • Endpoint — Additional hosts that have the hash present.
  • CrowdStrike.IOC.DeviceCount — The number of devices the IOC ran on.
  • Endpoint.Hostname — The endpoint's hostname.
  • CrowdStrike.IOC.Type — The type of the IOC.
  • Endpoint.IPAddress — The endpoint's IP address or list of IP addresses.
  • CrowdStrike.IOC.Value — The string representation of the indicator.
  • Endpoint.OS — The endpoint operation system.
  • Endpoint.Status — The endpoint status.
  • Endpoint.IsIsolated — The endpoint isolation status.
  • CrowdStrike.DeviceID — Device IDs an indicator ran on.

Commands used

cs-falcon-device-count-ioc cs-falcon-device-ran-on endpoint

Flowchart

no yes yes yes yes yes yes no no Start Start Get device ID list by SHA1 - cs-falcon-device-ran-on Get device ID list by SHA1 cs-falcon-device-ran-on Count devices in the environment by SHA256 - cs-falcon-device-count-ioc Count devices in the envi... cs-falcon-device-count-ioc Done Done Should enrich the returned results? Should enrich the returne... Enrich endpoint details for non original host - endpoint Enrich endpoint details f... endpoint Is CrowdStrike Falcon enabled? - IsIntegrationAvailable Is CrowdStrike Falcon ena... IsIntegrationAvailable SHA256 SHA256 SHA1 SHA1 MD5 MD5 Count devices in the environment by SHA1 - cs-falcon-device-count-ioc Count devices in the envi... cs-falcon-device-count-ioc Count devices in the environment by MD5 - cs-falcon-device-count-ioc Count devices in the envi... cs-falcon-device-count-ioc Is there any MD5? Is there any MD5? Is there any SHA1? Is there any SHA1? Is there any SHA256? Is there any SHA256? Get device id list by MD5 - cs-falcon-device-ran-on Get device id list by MD5 cs-falcon-device-ran-on Get device id list by SHA256 - cs-falcon-device-ran-on Get device id list by SHA256 cs-falcon-device-ran-on Should enrich the returned results? Should enrich the returne... Should enrich the returned results? Should enrich the returne...