Hunt Extracted Hashes Deprecated Hidden

Deprecated. Use the Hunt Extracted Hashes V2 playbook instead. This playbook extracts IOCs from the incident details and attached\ \ files using regular expressions and then hunts for hashes on endpoints in the organization\ \ using available tools.\nThe playbook supports multiple types of attachments. For\ \ the full supported attachments list, refer to \"Extract Indicators From\ \ File - Generic v2\".

Deprecated Content (Deprecated) · 7 tasks · 1 input · 0 outputs

Details

ID	`Hunt Extracted Hashes`
From Version	5.0.0
Tasks	7

README

Deprecated. Use the Hunt Extracted Hashes V2 instead. This playbook extracts IOCs from the incident details and attached files using regular expressions and then hunts for hashes on endpoints in the organization using available tools.
The playbook supports multiple types of attachments. For the full supported attachments list, refer to “Extract Indicators From File - Generic v2”.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Search Endpoints By Hash - Generic
Extract Indicators From File - Generic v2

Integrations

Builtin

Scripts

This playbook does not use any scripts.

Commands

extractIndicators

Playbook Inputs

Name	Description	Default Value	Required
File	The file from which to extract indicators.	File	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Hunt_Extracted_Hashes

Inputs

File — The file from which to extract indicators.

Commands used

extractIndicators

Flowchart

Source

playbook-Hunt_Extracted_Hashes.yml

Download History Raw

id: Hunt Extracted Hashes
version: -1
name: Hunt Extracted Hashes
description: Deprecated. Use the Hunt Extracted Hashes V2 playbook instead. This playbook extracts IOCs from the incident details and attached\
  \ files using regular expressions and then hunts for hashes on endpoints in the organization\
  \ using available tools.\nThe playbook supports multiple types of attachments. For\
  \ the full supported attachments list, refer to \"Extract Indicators From\
  \ File - Generic v2\".
starttaskid: '0'
hidden: true
tasks:
  '0':
    id: '0'
    taskid: 59fc9f42-bf21-4997-8070-602f898371be
    type: start
    task:
      id: 59fc9f42-bf21-4997-8070-602f898371be
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 265,\n    \"y\": 50\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '1':
    id: '1'
    taskid: f13441e2-ffef-4378-8c79-279d95b0c563
    type: playbook
    task:
      id: f13441e2-ffef-4378-8c79-279d95b0c563
      version: -1
      name: Extract Indicators From File - Generic v2
      description: "Extracts indicators from a file.\nSupported file types:\n- PDF\n\
        - TXT\n- HTM, HTML\n- DOC, DOCX\n- PPT\n- PPTX\n- RTF\n- XLS\n- XLSX\n- XML"
      playbookName: Extract Indicators From File - Generic v2
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '4'
    scriptarguments:
      File:
        complex:
          root: inputs.File
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
    view: "{\n  \"position\": {\n    \"x\": 50,\n    \"y\": 340\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '2':
    id: '2'
    taskid: bed696d2-fd98-445d-8c7b-cc9b329ca469
    type: title
    task:
      id: bed696d2-fd98-445d-8c7b-cc9b329ca469
      version: -1
      name: Extract Indicator
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '1'
      - '3'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 265,\n    \"y\": 195\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '3':
    id: '3'
    taskid: dc06ffdb-b63c-4d90-89da-cd056cdaaf7e
    type: regular
    task:
      id: dc06ffdb-b63c-4d90-89da-cd056cdaaf7e
      version: -1
      name: Extract indicators from incident details
      description: Extract all indicators according to server indicator configuration.
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '4'
    scriptarguments:
      entryID: {}
      filePath: {}
      investigationID: {}
      text:
        complex:
          root: incident
    reputationcalc: 2
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 480,\n    \"y\": 340\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '4':
    id: '4'
    taskid: 97b12b55-7e66-40d2-83d4-3a5bc75b194b
    type: title
    task:
      id: 97b12b55-7e66-40d2-83d4-3a5bc75b194b
      version: -1
      name: Hunt
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '5'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 265,\n    \"y\": 515\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '5':
    id: '5'
    taskid: dcb432fe-6ac4-4bff-83d9-e64fb94664d2
    type: playbook
    task:
      id: dcb432fe-6ac4-4bff-83d9-e64fb94664d2
      version: -1
      name: Search Endpoints By Hash - Generic
      description: Hunt using available tools
      playbookName: Search Endpoints By Hash - Generic
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '6'
    scriptarguments:
      MD5Hash:
        complex:
          root: File
          accessor: MD5
      SHA1Hash:
        complex:
          root: File
          accessor: SHA1
      SHA256Hash:
        complex:
          root: File
          accessor: SHA256
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
    view: "{\n  \"position\": {\n    \"x\": 265,\n    \"y\": 670\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '6':
    id: '6'
    taskid: 7fb78c72-bf88-460c-8bf0-c0eeab0f5ecc
    type: title
    task:
      id: 7fb78c72-bf88-460c-8bf0-c0eeab0f5ecc
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 265,\n    \"y\": 860\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
view: "{\n  \"linkLabelsPosition\": {},\n  \"paper\": {\n    \"dimensions\": {\n \
  \     \"height\": 875,\n      \"width\": 810,\n      \"x\": 50,\n      \"y\": 50\n\
  \    }\n  }\n}"
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: The file from which to extract indicators.
outputs: []
fromversion: 5.0.0
tests:
  - No test
deprecated: true