Search Endpoints By Hash - Carbon Black Protection

Hunt for endpoint activity involving hash IOCs, using Carbon Black Protection.

Carbon Black Enterprise Protection · 9 tasks · 1 input · 2 outputs

Details

IDsearch_endpoints_by_hash_-_carbon_black_protection
From Version5.0.0
Tasks9

README

Hunts for endpoint activity involving hash IOCs, using Carbon Black Protection.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • carbonblackprotection

Scripts

  • CBPCatalogFindHash
  • Exists
  • CBPFindRule
  • Set

Commands

  • cbp-computer-get

Playbook Inputs

Name Description Default Value Source Required
Hash The MD5 file Hash to hunt for. MD5 File Optional

Playbook Outputs

Path Description Type
Endpoint.Hostname The device hostname. string
Endpoint The endpoint. unknown

Playbook Image

Search_Endpoints_By_Hash_Carbon_Black_Protection

Inputs

  • Hash — The MD5 Hash to hunt for

Outputs

  • Endpoint.Hostname — The device hostname
  • Endpoint — The endpoint

Commands used

cbp-computer-get

Flowchart

yes yes yes start_task start_task Search hashes in the file catalog - CBPCatalogFindHash Search hashes in the file... CBPCatalogFindHash Check if the hashes are included in any rules - CBPFindRule Check if the hashes are i... CBPFindRule Is Carbon Black Protection enabled? Is Carbon Black Protectio... Done Done Do we have files to hunt? Do we have files to hunt? Get hostname and workgroup - cbp-computer-get Get hostname and workgroup cbp-computer-get Get hostname - Set Get hostname Set Any endpoints found? - Exists Any endpoints found? Exists

Source

playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Protection.yml
Download History Raw 
id: search_endpoints_by_hash_-_carbon_black_protection
fromversion: 5.0.0
system: true
version: -1
name: Search Endpoints By Hash - Carbon Black Protection
description: Hunt for endpoint activity involving hash IOCs, using Carbon Black Protection.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 9b42ebf8-2133-4457-83ed-1d281ed7887f
    type: start
    task:
      id: 9b42ebf8-2133-4457-83ed-1d281ed7887f
      version: -1
      name: start_task
      description: ""
      type: start
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
  "8":
    id: "8"
    taskid: 0891cd8c-8331-42ee-80d8-ec78652b7ad2
    type: regular
    task:
      id: 0891cd8c-8331-42ee-80d8-ec78652b7ad2
      version: -1
      name: Search hashes in the file catalog
      description: Searching The file catalog for the hashes
      scriptName: CBPCatalogFindHash
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      extend-context:
        simple: ComputerId=computerId
      md5:
        complex:
          root: inputs.Hash
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -471,
          "y": 608
        }
      }
  "9":
    id: "9"
    taskid: 255f2625-68d4-4475-81a2-663da89a39d6
    type: regular
    task:
      id: 255f2625-68d4-4475-81a2-663da89a39d6
      version: -1
      name: Check if the hashes are included in any rules
      description: If the hashes have been approved or blocked in the past, they will be in existing rules. It is useful to see whether the hash was in some block list or allow list or a person marked them as such, possibly with a comment explaining their reasons.
      scriptName: CBPFindRule
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      extend-context:
        simple: ComputerId=computerId
      hash:
        complex:
          root: inputs.Hash
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -471,
          "y": 774
        }
      }
  "10":
    id: "10"
    taskid: 02afb0d8-e0fd-424d-83c6-44a15204351f
    type: condition
    task:
      id: 02afb0d8-e0fd-424d-83c6-44a15204351f
      version: -1
      name: Is Carbon Black Protection enabled?
      description: Is Carbon Black Protection enabled?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "12"
    scriptarguments:
      value:
        simple: ${modules(val.brand == 'carbonblackprotection' && val.state == 'active')}
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: string.isEqual
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: carbonblackprotection
                - - operator: string.isEqual
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
  "11":
    id: "11"
    taskid: e5069a6c-2c37-4f0d-8a7b-571fdd1aa9ac
    type: title
    task:
      id: e5069a6c-2c37-4f0d-8a7b-571fdd1aa9ac
      version: -1
      name: Done
      description: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1594
        }
      }
  "12":
    id: "12"
    taskid: 57f5bcda-24a1-4387-8566-94fa8eed1155
    type: condition
    task:
      id: 57f5bcda-24a1-4387-8566-94fa8eed1155
      version: -1
      name: Do we have files to hunt?
      description: Do we have files to hunt?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "8"
    scriptarguments:
      value:
        simple: ${File.MD5}
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: inputs.Hash
            iscontext: true
    view: |-
      {
        "position": {
          "x": -179,
          "y": 364
        }
      }
  "13":
    id: "13"
    taskid: 0174e70d-e14f-47cc-8c65-0b36c142ae52
    type: regular
    task:
      id: 0174e70d-e14f-47cc-8c65-0b36c142ae52
      version: -1
      name: Get hostname and workgroup
      description: Get hostname and workgroup
      script: carbonblackprotection|||cbp-computer-get
      type: regular
      iscommand: true
      brand: carbonblackprotection
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      extend-context: {}
      headers: {}
      id:
        complex:
          root: ComputerId
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -693,
          "y": 1272
        }
      }
  "14":
    id: "14"
    taskid: accc2606-97d8-45e7-8382-8fa3a8799240
    type: regular
    task:
      id: accc2606-97d8-45e7-8382-8fa3a8799240
      version: -1
      name: Get hostname
      description: Get hostname
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      append: {}
      key:
        simple: Endpoint.Hostname
      value:
        complex:
          root: Endpoint
          accessor: Hostname
          transformers:
          - operator: string.replaceMatch
            args:
              regex:
                value:
                  simple: .*\\(.*)
              replaceWith:
                value:
                  simple: $1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -693,
          "y": 1426
        }
      }
  "15":
    id: "15"
    taskid: cecaea78-7661-4243-8f10-3f1a4aa38668
    type: condition
    task:
      id: cecaea78-7661-4243-8f10-3f1a4aa38668
      version: -1
      name: Any endpoints found?
      description: Any endpoints found?
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "13"
    scriptarguments:
      extend-context: {}
      value:
        complex:
          root: ComputerId
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -471,
          "y": 936
        }
      }
view: |-
  {
    "linkLabelsPosition": {
      "10_11_#default#": 0.15,
      "10_12_yes": 0.67,
      "12_11_#default#": 0.1,
      "12_8_yes": 0.39,
      "15_11_#default#": 0.14,
      "15_13_yes": 0.59
    },
    "paper": {
      "dimensions": {
        "height": 1609,
        "width": 1123,
        "x": -693,
        "y": 50
      }
    }
  }
inputs:
- key: Hash
  value:
    complex:
      root: File
      accessor: MD5
  required: false
  description: The MD5 Hash to hunt for
outputs:
- contextPath: Endpoint.Hostname
  description: The device hostname
  type: string
- contextPath: Endpoint
  description: The endpoint
  type: unknown
tests:
- no test