id: Hunt Extracted Hashes
version: -1
name: Hunt Extracted Hashes
description: Deprecated. Use the Hunt Extracted Hashes V2 playbook instead. This playbook extracts IOCs from the incident details and attached\
  \ files using regular expressions and then hunts for hashes on endpoints in the organization\
  \ using available tools.\nThe playbook supports multiple types of attachments. For\
  \ the full supported attachments list, refer to \"Extract Indicators From\
  \ File - Generic v2\".
starttaskid: '0'
hidden: true
tasks:
  '0':
    id: '0'
    taskid: 59fc9f42-bf21-4997-8070-602f898371be
    type: start
    task:
      id: 59fc9f42-bf21-4997-8070-602f898371be
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 265,\n    \"y\": 50\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '1':
    id: '1'
    taskid: f13441e2-ffef-4378-8c79-279d95b0c563
    type: playbook
    task:
      id: f13441e2-ffef-4378-8c79-279d95b0c563
      version: -1
      name: Extract Indicators From File - Generic v2
      description: "Extracts indicators from a file.\nSupported file types:\n- PDF\n\
        - TXT\n- HTM, HTML\n- DOC, DOCX\n- PPT\n- PPTX\n- RTF\n- XLS\n- XLSX\n- XML"
      playbookName: Extract Indicators From File - Generic v2
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '4'
    scriptarguments:
      File:
        complex:
          root: inputs.File
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
    view: "{\n  \"position\": {\n    \"x\": 50,\n    \"y\": 340\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '2':
    id: '2'
    taskid: bed696d2-fd98-445d-8c7b-cc9b329ca469
    type: title
    task:
      id: bed696d2-fd98-445d-8c7b-cc9b329ca469
      version: -1
      name: Extract Indicator
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '1'
      - '3'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 265,\n    \"y\": 195\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '3':
    id: '3'
    taskid: dc06ffdb-b63c-4d90-89da-cd056cdaaf7e
    type: regular
    task:
      id: dc06ffdb-b63c-4d90-89da-cd056cdaaf7e
      version: -1
      name: Extract indicators from incident details
      description: Extract all indicators according to server indicator configuration.
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '4'
    scriptarguments:
      entryID: {}
      filePath: {}
      investigationID: {}
      text:
        complex:
          root: incident
    reputationcalc: 2
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 480,\n    \"y\": 340\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '4':
    id: '4'
    taskid: 97b12b55-7e66-40d2-83d4-3a5bc75b194b
    type: title
    task:
      id: 97b12b55-7e66-40d2-83d4-3a5bc75b194b
      version: -1
      name: Hunt
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '5'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 265,\n    \"y\": 515\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '5':
    id: '5'
    taskid: dcb432fe-6ac4-4bff-83d9-e64fb94664d2
    type: playbook
    task:
      id: dcb432fe-6ac4-4bff-83d9-e64fb94664d2
      version: -1
      name: Search Endpoints By Hash - Generic
      description: Hunt using available tools
      playbookName: Search Endpoints By Hash - Generic
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '6'
    scriptarguments:
      MD5Hash:
        complex:
          root: File
          accessor: MD5
      SHA1Hash:
        complex:
          root: File
          accessor: SHA1
      SHA256Hash:
        complex:
          root: File
          accessor: SHA256
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
    view: "{\n  \"position\": {\n    \"x\": 265,\n    \"y\": 670\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '6':
    id: '6'
    taskid: 7fb78c72-bf88-460c-8bf0-c0eeab0f5ecc
    type: title
    task:
      id: 7fb78c72-bf88-460c-8bf0-c0eeab0f5ecc
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 265,\n    \"y\": 860\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
view: "{\n  \"linkLabelsPosition\": {},\n  \"paper\": {\n    \"dimensions\": {\n \
  \     \"height\": 875,\n      \"width\": 810,\n      \"x\": 50,\n      \"y\": 50\n\
  \    }\n  }\n}"
inputs:
- key: File
  value:
    complex:
      root: File
  required: false
  description: The file from which to extract indicators.
outputs: []
fromversion: 5.0.0
tests:
  - No test
deprecated: true