Search Endpoints By Hash - TIE

Hunt for sightings of MD5, SHA1 and/or SHA256 hashes on endpoints, using McAfee TIE (requires ePO as well). Input: * Hash (default, takes all deferent hashes from context) Output: * All agents that files with "Hash" has been executed on (TIE) * Enrich Agents info from ePO

McAfee Threat Intelligence Exchange · 10 tasks · 1 input · 2 outputs

Details

IDsearch_endpoints_by_hash_-_tie
From Version5.0.0
Tasks10

README

Hunt for sightings of MD5, SHA1 and/or SHA256 hashes on endpoints, using McAfee TIE (requires ePO as well).

Input:

  • Hash (default, takes all deferent hashes from context)

Output:

  • All agents that files with “Hash” has been executed on (TIE)
  • Enrich Agents info from ePO

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • McAfee ePO v2
  • McAfeeTIEV2
  • McAfee-TIE

Scripts

This playbook does not use any scripts.

Commands

  • epo-find-system
  • tie-file-references

Playbook Inputs

Name Description Default Value Required
Hash The Hash to hunt (Could be MD5,SHA1,SHA256).
Default is set to all hashes		 ${.=val.File.map(function(f) {return [f.MD5, f.SHA1, f.SHA256];}).reduce(function(a, b){return a.concat(b);}, []).filter(function (val1) {return val1;})} Optional

Playbook Outputs

Path Description Type
Endpoint.Hostname Hostname string
Endpoint The endpoint unknown

Playbook Image

Search Endpoints By Hash - TIE

Inputs

  • Hash — The Hash to hunt (Could be MD5,SHA1,SHA256). Default is set to all hashes

Outputs

  • Endpoint.Hostname — Hostname
  • Endpoint — The endpoint

Commands used

epo-find-system tie-file-references

Flowchart

yes yes yes yes Start Start Is TIE enabled? Is TIE enabled? List all agents that the Hash has been executed on - tie-file-references List all agents that the ... tie-file-references Done Done Did we find any relevant agents? Did we find any relevant ... Hunt HASH in TIE Hunt HASH in TIE Enrich in ePO Enrich in ePO Do we have any files to hunt? Do we have any files to h... Is McAfee ePO v2 enabled? Is McAfee ePO v2 enabled? Get Agent info from ePO v2 - epo-find-system Get Agent info from ePO v2 epo-find-system

Source

playbook-Search_Endpoints_By_Hash_-_TIE.yml
Download History Raw 
id: search_endpoints_by_hash_-_tie
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Search Endpoints By Hash - TIE
description: |-
  Hunt for sightings of MD5, SHA1 and/or SHA256 hashes on endpoints, using McAfee TIE (requires ePO as well).

  Input:
  * Hash (default, takes all deferent hashes from context)

  Output:
  * All agents that files with "Hash" has been executed on (TIE)
  * Enrich Agents info from ePO
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 80386f11-23d2-4ca7-8e8a-efc6c7d8b797
    type: start
    task:
      id: 80386f11-23d2-4ca7-8e8a-efc6c7d8b797
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: f96c54b2-b8fa-48b8-8a56-56555a749c10
    type: condition
    task:
      id: f96c54b2-b8fa-48b8-8a56-56555a749c10
      version: -1
      name: Is TIE enabled?
      description: Is TIE enabled?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: McAfee Threat Intelligence Exchange
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 26ba9604-ced2-4c35-8e13-075d3ed04042
    type: regular
    task:
      id: 26ba9604-ced2-4c35-8e13-075d3ed04042
      version: -1
      name: List all agents that the Hash has been executed on
      description: Retrieves the set of systems which have referenced (typically executed) the specified hashes.
      script: '|||tie-file-references'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      file:
        complex:
          root: inputs.Hash
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 430,
          "y": 757
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: b000dc4b-e71b-43dc-87d3-da7fbeae2d91
    type: title
    task:
      id: b000dc4b-e71b-43dc-87d3-da7fbeae2d91
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1693
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: c7e628c9-cb07-408a-8667-8f4bb2c6d944
    type: condition
    task:
      id: c7e628c9-cb07-408a-8667-8f4bb2c6d944
      version: -1
      name: Did we find any relevant agents?
      description: Did we get any Agent GUIDS?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "8"
    scriptarguments:
      value:
        complex:
          root: File
          accessor: References.AgentGuid
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: References.AgentGuid
            iscontext: true
    view: |-
      {
        "position": {
          "x": 430,
          "y": 920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: ef3c7391-412b-4976-8fc4-f66cbe2607c4
    type: title
    task:
      id: ef3c7391-412b-4976-8fc4-f66cbe2607c4
      version: -1
      name: Hunt HASH in TIE
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 4795a873-58e7-4312-83ae-bd7e29d8e8f1
    type: title
    task:
      id: 4795a873-58e7-4312-83ae-bd7e29d8e8f1
      version: -1
      name: Enrich in ePO
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 740,
          "y": 1170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: c8baebe6-606d-4e83-88ab-09ac98b1be34
    type: condition
    task:
      id: c8baebe6-606d-4e83-88ab-09ac98b1be34
      version: -1
      name: Do we have any files to hunt?
      description: Do we have any files to hunt?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.Hash
            iscontext: true
    view: |-
      {
        "position": {
          "x": 430,
          "y": 507
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 0719d6b3-9f7c-42ee-887a-afef3d4bd02f
    type: condition
    task:
      id: 0719d6b3-9f7c-42ee-887a-afef3d4bd02f
      version: -1
      name: Is McAfee ePO v2 enabled?
      description: Is McAfee ePO v2 enabled?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "11"
    scriptarguments:
      value:
        complex:
          root: modules
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: modules.brand
                iscontext: true
              right:
                value:
                  simple: epo
          - - operator: isEqualString
              left:
                value:
                  simple: modules.state
                iscontext: true
              right:
                value:
                  simple: active
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: McAfee ePO v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 430,
          "y": 1290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 225bf1fd-60fa-451b-8637-f7b036af6945
    type: regular
    task:
      id: 225bf1fd-60fa-451b-8637-f7b036af6945
      version: -1
      name: Get Agent info from ePO v2
      description: Finds systems in the McAfee ePO system tree.
      script: McAfee ePO v2|||epo-find-system
      type: regular
      iscommand: true
      brand: McAfee ePO v2
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      searchText:
        complex:
          root: McAfee.TIE.FilesReferences.References
          accessor: AgentGuid
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 430,
          "y": 1500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "10_11_yes": 0.48,
      "1_4_#default#": 0.1,
      "5_4_#default#": 0.24,
      "5_8_yes": 0.59,
      "9_4_#default#": 0.19
    },
    "paper": {
      "dimensions": {
        "height": 1708,
        "width": 647.5,
        "x": 162.5,
        "y": 50
      }
    }
  }
inputs:
- key: Hash
  value:
    simple: ${.=val.File.map(function(f) {return [f.MD5, f.SHA1, f.SHA256];}).reduce(function(a, b){return a.concat(b);}, []).filter(function (val1) {return val1;})}
  required: false
  description: |-
    The Hash to hunt (Could be MD5,SHA1,SHA256).
    Default is set to all hashes
  playbookInputQuery:
outputs:
- contextPath: Endpoint.Hostname
  description: Hostname
  type: string
- contextPath: Endpoint
  description: The endpoint
  type: unknown
tests:
- search_endpoints_by_hash_-_tie_-_test
- McAfee-TIE Test
fromversion: 5.0.0