Search Endpoints By Hash - Carbon Black Protection

Hunt for endpoint activity involving hash IOCs, using Carbon Black Protection.

Carbon Black Enterprise Protection · 9 tasks · 1 input · 2 outputs

Inputs

  • Hash — The MD5 Hash to hunt for

Outputs

  • Endpoint.Hostname — The device hostname
  • Endpoint — The endpoint

Commands used

cbp-computer-get

Flowchart

yes yes yes start_task start_task Search hashes in the file catalog - CBPCatalogFindHash Search hashes in the file... CBPCatalogFindHash Check if the hashes are included in any rules - CBPFindRule Check if the hashes are i... CBPFindRule Is Carbon Black Protection enabled? Is Carbon Black Protectio... Done Done Do we have files to hunt? Do we have files to hunt? Get hostname and workgroup - cbp-computer-get Get hostname and workgroup cbp-computer-get Get hostname - Set Get hostname Set Any endpoints found? - Exists Any endpoints found? Exists