Search Endpoints By Hash - TIE

Hunt for sightings of MD5, SHA1 and/or SHA256 hashes on endpoints, using McAfee TIE (requires ePO as well). Input: * Hash (default, takes all deferent hashes from context) Output: * All agents that files with "Hash" has been executed on (TIE) * Enrich Agents info from ePO

McAfee Threat Intelligence Exchange · 10 tasks · 1 input · 2 outputs

Inputs

  • Hash — The Hash to hunt (Could be MD5,SHA1,SHA256). Default is set to all hashes

Outputs

  • Endpoint.Hostname — Hostname
  • Endpoint — The endpoint

Commands used

epo-find-system tie-file-references

Flowchart

yes yes yes yes Start Start Is TIE enabled? Is TIE enabled? List all agents that the Hash has been executed on - tie-file-references List all agents that the ... tie-file-references Done Done Did we find any relevant agents? Did we find any relevant ... Hunt HASH in TIE Hunt HASH in TIE Enrich in ePO Enrich in ePO Do we have any files to hunt? Do we have any files to h... Is McAfee ePO v2 enabled? Is McAfee ePO v2 enabled? Get Agent info from ePO v2 - epo-find-system Get Agent info from ePO v2 epo-find-system