TIE - IOC Hunt

Hunt for sightings of MD5, SHA1 and/or SHA256 hashes on endpoints, using McAfee TIE (requires ePO as well). Input: * Hash (default, takes all deferent hashes from context) Output: * All agents that files with "Hash" has been executed on (TIE) * Enrich Agents info from ePO

McAfee Threat Intelligence Exchange · 9 tasks · 1 input · 1 output

Details

ID	`TIE - IOC Hunt`
From Version	5.0.0
Tasks	9

README

Hunt for sightings of MD5, SHA1 and/or SHA256 hashes on endpoints, using McAfee TIE (requires ePO as well).

Input:

Hash (default, takes all deferent hashes from context)

Output:

All agents that files with “Hash” has been executed on (TIE)
Enrich Agents info from ePO

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

McAfeeTIEV2
McAfee-TIE

Scripts

Exists

Commands

epo-find-system
tie-file-references

Playbook Inputs

Name	Description	Default Value	Required
Hash	The Hash to hunt (Could be MD5,SHA1,SHA256). Default is set to all hashes	${.=val.File.map(function(f) {return [f.MD5, f.SHA1, f.SHA256];}).reduce(function(a, b){return a.concat(b);}, []).filter(function (val1) {return val1;})}	Optional

Playbook Outputs

Path	Description	Type
McAfee.ePO.Endpoint	Endpoint information for agents has been executed on.	unknown

Playbook Image

TIE - IOC Hunt

Inputs

Hash — The Hash to hunt (Could be MD5,SHA1,SHA256). Default is set to all hashes

Outputs

McAfee.ePO.Endpoint — Endpoint information for agents has been executed on.

Commands used

epo-find-system tie-file-references

Flowchart

Source

playbook-TIE_-_IOC_Hunt.yml

Download History Raw

id: TIE - IOC Hunt
version: -1
name: TIE - IOC Hunt
description: |-
  Hunt for sightings of MD5, SHA1 and/or SHA256 hashes on endpoints, using McAfee TIE (requires ePO as well).

  Input:
  * Hash (default, takes all deferent hashes from context)

  Output:
  * All agents that files with "Hash" has been executed on (TIE)
  * Enrich Agents info from ePO
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: b79d975a-a6dc-4a66-8515-c8f4177b0a40
    type: start
    task:
      id: b79d975a-a6dc-4a66-8515-c8f4177b0a40
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 1bf80041-9e03-4daf-861c-a709df537687
    type: condition
    task:
      id: 1bf80041-9e03-4daf-861c-a709df537687
      version: -1
      name: Is TIE enabled?
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
      description: Is the McAfee TIE integration installed and configured?
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "3"
    scriptarguments:
      value:
        simple: ${modules(val.brand=="McAfee Threat Intelligence Exchange")}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: c906e63c-45c5-4540-8f42-b74db1943725
    type: regular
    task:
      id: c906e63c-45c5-4540-8f42-b74db1943725
      version: -1
      name: List all agents that the hash has been executed on
      description: Retrieves the set of systems which have referenced (typically executed) the specified hashes.
      script: '|||tie-file-references'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      file:
        complex:
          root: inputs.Hash
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 430,
          "y": 519
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: c283821d-46ac-4b77-8728-9bc136f0c729
    type: title
    task:
      id: c283821d-46ac-4b77-8728-9bc136f0c729
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1492
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: adfc3709-ca91-4ac0-8c2b-179c44d30403
    type: condition
    task:
      id: adfc3709-ca91-4ac0-8c2b-179c44d30403
      version: -1
      name: Did we find any relevant agents?
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
      description: condition
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "8"
    scriptarguments:
      value:
        simple: ${File.References.AgentGuid}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 430,
          "y": 703
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 5d9d7475-757f-4b4a-81a7-8ad317b5a714
    type: regular
    task:
      id: 5d9d7475-757f-4b4a-81a7-8ad317b5a714
      version: -1
      name: Get Agent info from ePO v2 (epo-find-system)
      description: Finds systems in the McAfee ePO system tree.
      script: '|||epo-find-system'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      searchText:
        complex:
          root: McAfee.TIE.FilesReferences.References
          accessor: AgentGuid
      verbose:
        simple: "false"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 430,
          "y": 1300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: a08baee9-a402-4bc8-8cae-77c4c144d889
    type: title
    task:
      id: a08baee9-a402-4bc8-8cae-77c4c144d889
      version: -1
      name: Hunt HASH in TIE
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 1df1aefe-fce4-4fb8-80e0-3fbef311f772
    type: title
    task:
      id: 1df1aefe-fce4-4fb8-80e0-3fbef311f772
      version: -1
      name: Enrich in ePO
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 430,
          "y": 926
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: a01b200f-cc8b-4f6c-8fbd-b8c568201ad4
    type: condition
    task:
      id: a01b200f-cc8b-4f6c-8fbd-b8c568201ad4
      version: -1
      name: Is McAfee ePO v2 enabled?
      type: condition
      iscommand: false
      brand: ""
      description: Is the McAfee ePO v2 integration installed and configured?
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: McAfee ePO v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 430,
          "y": 1090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "1_4_#default#": 0.1,
      "5_4_#default#": 0.28,
      "5_8_yes": 0.58,
      "9_4_#default#": 0.44,
      "9_6_yes": 0.59
    },
    "paper": {
      "dimensions": {
        "height": 1507,
        "width": 647.5,
        "x": 162.5,
        "y": 50
      }
    }
  }
inputs:
- key: Hash
  value:
    simple: ${.=val.File.map(function(f) {return [f.MD5, f.SHA1, f.SHA256];}).reduce(function(a,
      b){return a.concat(b);}, []).filter(function (val1) {return val1;})}
  required: false
  description: |-
    The Hash to hunt (Could be MD5,SHA1,SHA256).
    Default is set to all hashes
  playbookInputQuery:
outputs:
- contextPath: McAfee.ePO.Endpoint
  description: Endpoint information for agents has been executed on.
  type: unknown
tests:
- search_endpoints_by_hash_-_tie_-_test
- McAfee-TIE Test
fromversion: 5.0.0