Search Endpoints By Hash - Generic V2

Hunt using available tools

Common Playbooks · 11 tasks · 3 inputs · 2 outputs

Details

IDSearch Endpoints By Hash - Generic V2
From Version5.0.0
Tasks11

README

Hunt using available tools

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Search Endpoints By Hash - TIE
  • CrowdStrike Falcon - Search Endpoints By Hash
  • Search Endpoints By Hash - Cybereason
  • Search Endpoints By Hash - Carbon Black Response V2
  • Search Endpoints By Hash - Carbon Black Protection

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name Description Default Value Required
MD5Hash MD5 Hash File.MD5 Optional
SHA1Hash SHA1 Hash File.SHA1 Optional
SHA256Hash SHA256 Hash File.SHA256 Optional

Playbook Outputs

Path Description Type
Endpoint.Hostname Device hostname string
Endpoint The endpoint unknown

Playbook Image

Search Endpoints By Hash - Generic V2

Inputs

  • MD5Hash — MD5 Hash
  • SHA1Hash — SHA1 Hash
  • SHA256Hash — SHA256 Hash

Outputs

  • Endpoint.Hostname — Device hostname
  • Endpoint — The endpoint

Flowchart

yes yes yes Start Start CrowdStrike Falcon - Search Endpoints By Hash - CrowdStrike Falcon - Search Endpoints By Hash CrowdStrike Falcon - Sear... CrowdStrike Falcon - Search E... Search Endpoints By Hash - Carbon Black Protection - Search Endpoints By Hash - Carbon Black Protection Search Endpoints By Hash ... Search Endpoints By Hash - Ca... MD5 Only MD5 Only MD5 / SHA1 / SHA256 MD5 / SHA1 / SHA256 Is MD5 hash? Is MD5 hash? Done Done Search Endpoints By Hash - TIE - Search Endpoints By Hash - TIE Search Endpoints By Hash ... Search Endpoints By Hash - TIE Search Endpoints By Hash - Cybereason - Search Endpoints By Hash - Cybereason Search Endpoints By Hash ... Search Endpoints By Hash - Cy... Search Endpoints By Hash - Carbon Black Response V2 - Search Endpoints By Hash - Carbon Black Response V2 Search Endpoints By Hash ... Search Endpoints By Hash - Ca... Is SHA256 hash? Is SHA256 hash?

Source

playbook-Search_Endpoints_By_Hash_-_Generic_V2.yml
Download History Raw 
id: Search Endpoints By Hash - Generic V2
version: -1
name: Search Endpoints By Hash - Generic V2
description: Hunt using available tools
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 92368958-9a49-4dcc-8db9-b15d29c87e29
    type: start
    task:
      id: 92368958-9a49-4dcc-8db9-b15d29c87e29
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "9"
      - "10"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 410,
          "y": 10
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: b66537ca-cc94-4509-8985-3bb247c163a9
    type: playbook
    task:
      id: b66537ca-cc94-4509-8985-3bb247c163a9
      version: -1
      name: CrowdStrike Falcon - Search Endpoints By Hash
      description: This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook searches across the organization for other endpoints associated with a specific SHA256 hash.
      playbookName: CrowdStrike Falcon - Search Endpoints By Hash
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      FileSha256:
        complex:
          root: inputs.SHA256Hash
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": -10,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 481954b9-682a-4722-8790-1547663edb81
    type: playbook
    task:
      id: 481954b9-682a-4722-8790-1547663edb81
      version: -1
      name: Search Endpoints By Hash - Carbon Black Protection
      description: Hunt for endpoint activity involving hash IOCs, using Carbon Black Protection.
      playbookName: Search Endpoints By Hash - Carbon Black Protection
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      Hash:
        complex:
          root: inputs
          accessor: MD5Hash
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 1130,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: eab5a3b4-3b54-401c-82f9-afbb033b2de3
    type: title
    task:
      id: eab5a3b4-3b54-401c-82f9-afbb033b2de3
      version: -1
      name: MD5 Only
      type: title
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 898,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: b4804466-0b8c-4c96-89e7-3bbed13670ad
    type: title
    task:
      id: b4804466-0b8c-4c96-89e7-3bbed13670ad
      version: -1
      name: MD5 / SHA1 / SHA256
      type: title
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "13"
      - "15"
      - "17"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: d6de96ed-bf55-40bb-887a-3821358bf89c
    type: condition
    task:
      id: d6de96ed-bf55-40bb-887a-3821358bf89c
      version: -1
      name: Is MD5 hash?
      description: Is MD5 hash?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "8"
      - "16"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs
                accessor: MD5Hash
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 898,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 4b3639ac-2625-446f-8f8a-a534ee676494
    type: title
    task:
      id: 4b3639ac-2625-446f-8f8a-a534ee676494
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 410,
          "y": 810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 9a79dca5-a826-494e-8444-87f03331bbe4
    type: playbook
    task:
      id: 9a79dca5-a826-494e-8444-87f03331bbe4
      version: -1
      name: Search Endpoints By Hash - TIE
      description: |-
        Hunt for sightings of MD5, SHA1 and/or SHA256 hashes on endpoints, using McAfee TIE (requires ePO as well).

        Input:
        * Hash (default, takes all deferent hashes from context)

        Output:
        * All agents that files with "Hash" has been executed on (TIE)
        * Enrich Agents info from ePO
      playbookName: Search Endpoints By Hash - TIE
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      Hash:
        simple: ${.=Object.keys(val.inputs).map(function(f) { return val.inputs[f]; }).reduce(function(a, b){ return a.concat(b); }, [])}
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 410,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 96ea4595-3ac2-41be-85f1-9ffe6ac7df6c
    type: playbook
    task:
      id: 96ea4595-3ac2-41be-85f1-9ffe6ac7df6c
      version: -1
      name: Search Endpoints By Hash - Cybereason
      description: Hunt for endpoint activity involving hash, using Cybereason.
      playbookName: Search Endpoints By Hash - Cybereason
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      MD5Hash:
        complex:
          root: inputs.MD5Hash
      SHA1Hash:
        complex:
          root: inputs.SHA1Hash
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": -460,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 54f36ae2-15fa-42cb-8b77-62e48c8e50c4
    type: playbook
    task:
      id: 54f36ae2-15fa-42cb-8b77-62e48c8e50c4
      version: -1
      name: Search Endpoints By Hash - Carbon Black Response V2
      description: Hunt for malicious indicators using Carbon Black
      playbookName: Search Endpoints By Hash - Carbon Black Response V2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      Hash:
        complex:
          root: inputs.MD5Hash
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 720,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 58684e15-2a09-47d2-879c-c374af670aa7
    type: condition
    task:
      id: 58684e15-2a09-47d2-879c-c374af670aa7
      version: -1
      name: Is SHA256 hash?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SHA256Hash
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "11_16_yes": 0.47,
      "11_8_yes": 0.58,
      "17_12_#default#": 0.27
    },
    "paper": {
      "dimensions": {
        "height": 865,
        "width": 1970,
        "x": -460,
        "y": 10
      }
    }
  }
inputs:
- key: MD5Hash
  value:
    complex:
      root: File
      accessor: MD5
  required: false
  description: MD5 Hash
  playbookInputQuery:
- key: SHA1Hash
  value:
    complex:
      root: File
      accessor: SHA1
  required: false
  description: SHA1 Hash
  playbookInputQuery:
- key: SHA256Hash
  value:
    complex:
      root: File
      accessor: SHA256
  required: false
  description: SHA256 Hash
  playbookInputQuery:
outputs:
- contextPath: Endpoint.Hostname
  description: Device hostname
  type: string
- contextPath: Endpoint
  description: The endpoint
  type: unknown
fromversion: 5.0.0
tests:
- No tests