id: Search Endpoints By Hash - Generic V2
version: -1
name: Search Endpoints By Hash - Generic V2
description: Hunt using available tools
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 92368958-9a49-4dcc-8db9-b15d29c87e29
    type: start
    task:
      id: 92368958-9a49-4dcc-8db9-b15d29c87e29
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "9"
      - "10"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 410,
          "y": 10
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: b66537ca-cc94-4509-8985-3bb247c163a9
    type: playbook
    task:
      id: b66537ca-cc94-4509-8985-3bb247c163a9
      version: -1
      name: CrowdStrike Falcon - Search Endpoints By Hash
      description: This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook searches across the organization for other endpoints associated with a specific SHA256 hash.
      playbookName: CrowdStrike Falcon - Search Endpoints By Hash
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      FileSha256:
        complex:
          root: inputs.SHA256Hash
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": -10,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 481954b9-682a-4722-8790-1547663edb81
    type: playbook
    task:
      id: 481954b9-682a-4722-8790-1547663edb81
      version: -1
      name: Search Endpoints By Hash - Carbon Black Protection
      description: Hunt for endpoint activity involving hash IOCs, using Carbon Black Protection.
      playbookName: Search Endpoints By Hash - Carbon Black Protection
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      Hash:
        complex:
          root: inputs
          accessor: MD5Hash
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 1130,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: eab5a3b4-3b54-401c-82f9-afbb033b2de3
    type: title
    task:
      id: eab5a3b4-3b54-401c-82f9-afbb033b2de3
      version: -1
      name: MD5 Only
      type: title
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 898,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: b4804466-0b8c-4c96-89e7-3bbed13670ad
    type: title
    task:
      id: b4804466-0b8c-4c96-89e7-3bbed13670ad
      version: -1
      name: MD5 / SHA1 / SHA256
      type: title
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "13"
      - "15"
      - "17"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: d6de96ed-bf55-40bb-887a-3821358bf89c
    type: condition
    task:
      id: d6de96ed-bf55-40bb-887a-3821358bf89c
      version: -1
      name: Is MD5 hash?
      description: Is MD5 hash?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "8"
      - "16"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs
                accessor: MD5Hash
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 898,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 4b3639ac-2625-446f-8f8a-a534ee676494
    type: title
    task:
      id: 4b3639ac-2625-446f-8f8a-a534ee676494
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 410,
          "y": 810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 9a79dca5-a826-494e-8444-87f03331bbe4
    type: playbook
    task:
      id: 9a79dca5-a826-494e-8444-87f03331bbe4
      version: -1
      name: Search Endpoints By Hash - TIE
      description: |-
        Hunt for sightings of MD5, SHA1 and/or SHA256 hashes on endpoints, using McAfee TIE (requires ePO as well).

        Input:
        * Hash (default, takes all deferent hashes from context)

        Output:
        * All agents that files with "Hash" has been executed on (TIE)
        * Enrich Agents info from ePO
      playbookName: Search Endpoints By Hash - TIE
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      Hash:
        simple: ${.=Object.keys(val.inputs).map(function(f) { return val.inputs[f]; }).reduce(function(a, b){ return a.concat(b); }, [])}
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 410,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 96ea4595-3ac2-41be-85f1-9ffe6ac7df6c
    type: playbook
    task:
      id: 96ea4595-3ac2-41be-85f1-9ffe6ac7df6c
      version: -1
      name: Search Endpoints By Hash - Cybereason
      description: Hunt for endpoint activity involving hash, using Cybereason.
      playbookName: Search Endpoints By Hash - Cybereason
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      MD5Hash:
        complex:
          root: inputs.MD5Hash
      SHA1Hash:
        complex:
          root: inputs.SHA1Hash
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": -460,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 54f36ae2-15fa-42cb-8b77-62e48c8e50c4
    type: playbook
    task:
      id: 54f36ae2-15fa-42cb-8b77-62e48c8e50c4
      version: -1
      name: Search Endpoints By Hash - Carbon Black Response V2
      description: Hunt for malicious indicators using Carbon Black
      playbookName: Search Endpoints By Hash - Carbon Black Response V2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      Hash:
        complex:
          root: inputs.MD5Hash
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 720,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 58684e15-2a09-47d2-879c-c374af670aa7
    type: condition
    task:
      id: 58684e15-2a09-47d2-879c-c374af670aa7
      version: -1
      name: Is SHA256 hash?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SHA256Hash
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "11_16_yes": 0.47,
      "11_8_yes": 0.58,
      "17_12_#default#": 0.27
    },
    "paper": {
      "dimensions": {
        "height": 865,
        "width": 1970,
        "x": -460,
        "y": 10
      }
    }
  }
inputs:
- key: MD5Hash
  value:
    complex:
      root: File
      accessor: MD5
  required: false
  description: MD5 Hash
  playbookInputQuery:
- key: SHA1Hash
  value:
    complex:
      root: File
      accessor: SHA1
  required: false
  description: SHA1 Hash
  playbookInputQuery:
- key: SHA256Hash
  value:
    complex:
      root: File
      accessor: SHA256
  required: false
  description: SHA256 Hash
  playbookInputQuery:
outputs:
- contextPath: Endpoint.Hostname
  description: Device hostname
  type: string
- contextPath: Endpoint
  description: The endpoint
  type: unknown
fromversion: 5.0.0
tests:
- No tests