TIE - IOC Hunt

Hunt for sightings of MD5, SHA1 and/or SHA256 hashes on endpoints, using McAfee TIE (requires ePO as well). Input: * Hash (default, takes all deferent hashes from context) Output: * All agents that files with "Hash" has been executed on (TIE) * Enrich Agents info from ePO

McAfee Threat Intelligence Exchange · 9 tasks · 1 input · 1 output

Inputs

  • Hash — The Hash to hunt (Could be MD5,SHA1,SHA256). Default is set to all hashes

Outputs

  • McAfee.ePO.Endpoint — Endpoint information for agents has been executed on.

Commands used

epo-find-system tie-file-references

Flowchart

yes yes yes Start Start Is TIE enabled? - Exists Is TIE enabled? Exists List all agents that the hash has been executed on - tie-file-references List all agents that the ... tie-file-references Done Done Did we find any relevant agents? - Exists Did we find any relevant ... Exists Get Agent info from ePO v2 (epo-find-system) - epo-find-system Get Agent info from ePO v... epo-find-system Hunt HASH in TIE Hunt HASH in TIE Enrich in ePO Enrich in ePO Is McAfee ePO v2 enabled? Is McAfee ePO v2 enabled?