id: search_endpoints_by_hash_-_tie version: -1 contentitemexportablefields: contentitemfields: {} name: Search Endpoints By Hash - TIE description: |- Hunt for sightings of MD5, SHA1 and/or SHA256 hashes on endpoints, using McAfee TIE (requires ePO as well). Input: * Hash (default, takes all deferent hashes from context) Output: * All agents that files with "Hash" has been executed on (TIE) * Enrich Agents info from ePO starttaskid: "0" tasks: "0": id: "0" taskid: 80386f11-23d2-4ca7-8e8a-efc6c7d8b797 type: start task: id: 80386f11-23d2-4ca7-8e8a-efc6c7d8b797 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "7" separatecontext: false view: |- { "position": { "x": 162.5, "y": 50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "1": id: "1" taskid: f96c54b2-b8fa-48b8-8a56-56555a749c10 type: condition task: id: f96c54b2-b8fa-48b8-8a56-56555a749c10 version: -1 name: Is TIE enabled? description: Is TIE enabled? type: condition iscommand: false brand: "" nexttasks: '#default#': - "4" "yes": - "9" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: McAfee Threat Intelligence Exchange - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: brand iscontext: true view: |- { "position": { "x": 162.5, "y": 340 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: 26ba9604-ced2-4c35-8e13-075d3ed04042 type: regular task: id: 26ba9604-ced2-4c35-8e13-075d3ed04042 version: -1 name: List all agents that the Hash has been executed on description: Retrieves the set of systems which have referenced (typically executed) the specified hashes. script: '|||tie-file-references' type: regular iscommand: true brand: "" nexttasks: '#none#': - "5" scriptarguments: file: complex: root: inputs.Hash separatecontext: false view: |- { "position": { "x": 430, "y": 757 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: b000dc4b-e71b-43dc-87d3-da7fbeae2d91 type: title task: id: b000dc4b-e71b-43dc-87d3-da7fbeae2d91 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 162.5, "y": 1693 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: c7e628c9-cb07-408a-8667-8f4bb2c6d944 type: condition task: id: c7e628c9-cb07-408a-8667-8f4bb2c6d944 version: -1 name: Did we find any relevant agents? description: Did we get any Agent GUIDS? type: condition iscommand: false brand: "" nexttasks: '#default#': - "4" "yes": - "8" scriptarguments: value: complex: root: File accessor: References.AgentGuid separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: File accessor: References.AgentGuid iscontext: true view: |- { "position": { "x": 430, "y": 920 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: ef3c7391-412b-4976-8fc4-f66cbe2607c4 type: title task: id: ef3c7391-412b-4976-8fc4-f66cbe2607c4 version: -1 name: Hunt HASH in TIE type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "1" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 162.5, "y": 195 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: 4795a873-58e7-4312-83ae-bd7e29d8e8f1 type: title task: id: 4795a873-58e7-4312-83ae-bd7e29d8e8f1 version: -1 name: Enrich in ePO type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "10" separatecontext: false view: |- { "position": { "x": 740, "y": 1170 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: c8baebe6-606d-4e83-88ab-09ac98b1be34 type: condition task: id: c8baebe6-606d-4e83-88ab-09ac98b1be34 version: -1 name: Do we have any files to hunt? description: Do we have any files to hunt? type: condition iscommand: false brand: "" nexttasks: '#default#': - "4" "yes": - "3" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: inputs.Hash iscontext: true view: |- { "position": { "x": 430, "y": 507 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "10": id: "10" taskid: 0719d6b3-9f7c-42ee-887a-afef3d4bd02f type: condition task: id: 0719d6b3-9f7c-42ee-887a-afef3d4bd02f version: -1 name: Is McAfee ePO v2 enabled? description: Is McAfee ePO v2 enabled? type: condition iscommand: false brand: "" nexttasks: '#default#': - "4" "yes": - "11" scriptarguments: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: epo - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: McAfee ePO v2 - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: brand iscontext: true view: |- { "position": { "x": 430, "y": 1290 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: 225bf1fd-60fa-451b-8637-f7b036af6945 type: regular task: id: 225bf1fd-60fa-451b-8637-f7b036af6945 version: -1 name: Get Agent info from ePO v2 description: Finds systems in the McAfee ePO system tree. script: McAfee ePO v2|||epo-find-system type: regular iscommand: true brand: McAfee ePO v2 nexttasks: '#none#': - "4" scriptarguments: searchText: complex: root: McAfee.TIE.FilesReferences.References accessor: AgentGuid separatecontext: false view: |- { "position": { "x": 430, "y": 1500 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false system: true view: |- { "linkLabelsPosition": { "10_11_yes": 0.48, "1_4_#default#": 0.1, "5_4_#default#": 0.24, "5_8_yes": 0.59, "9_4_#default#": 0.19 }, "paper": { "dimensions": { "height": 1708, "width": 647.5, "x": 162.5, "y": 50 } } } inputs: - key: Hash value: simple: ${.=val.File.map(function(f) {return [f.MD5, f.SHA1, f.SHA256];}).reduce(function(a, b){return a.concat(b);}, []).filter(function (val1) {return val1;})} required: false description: |- The Hash to hunt (Could be MD5,SHA1,SHA256). Default is set to all hashes playbookInputQuery: outputs: - contextPath: Endpoint.Hostname description: Hostname type: string - contextPath: Endpoint description: The endpoint type: unknown tests: - search_endpoints_by_hash_-_tie_-_test - McAfee-TIE Test fromversion: 5.0.0