CrowdStrike Rapid IOC Hunting Deprecated Hidden

Deprecated. Use "CrowdStrike Rapid IOC Hunting v2" playbook instead. Hunt for endpoint activity involving hash and domain IOCs, using Crowdstrike Falcon Host.\nAlso use AnalystEmail label to determine where to send an email alert if something is found.

Deprecated Content (Deprecated) · 17 tasks · 0 inputs · 0 outputs

Commands used

cs-device-ran-on cs-device-search

Flowchart

yes yes yes yes yes yes Start Start Are there domains to hunt? - Exists Are there domains to hunt? Exists Are there MD5s to hunt? - Exists Are there MD5s to hunt? Exists Are there SHA1s to hunt? - Exists Are there SHA1s to hunt? Exists Are there SHA256s to hunt? - Exists Are there SHA256s to hunt? Exists Hunt for devices accessing bad domains - cs-device-ran-on Hunt for devices accessin... cs-device-ran-on Hunt for devices running MD5 - cs-device-ran-on Hunt for devices running MD5 cs-device-ran-on Hunt for devices accessing SHA1 - cs-device-ran-on Hunt for devices accessin... cs-device-ran-on Hunt for devices accessing SHA256 - cs-device-ran-on Hunt for devices accessin... cs-device-ran-on Get device details and email Get device details and email Get device details - cs-device-search Get device details cs-device-search Notify analyst to review information - SendEmail Notify analyst to review ... SendEmail Analyst - review information Analyst - review information Found any devices? - Exists Found any devices? Exists Done Done Is FalconHost enabled? - Exists Is FalconHost enabled? Exists Hunt for indicators Hunt for indicators