cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

McAfee ESM and ePO TIE Hash Values

I just found something totally ridiculous in the SIEM and figured I'd share it.  I was looking at events in the SIEM from ePO and noticed the sha1 and sha256 file hashes provided from ePO (mainly from TIE) have a 0x in the front of every value because it is a hexadecimal. Unfortunately, normal STIX feeds along with other data sources (like Cisco Firepower) do not normally have a 0x in front of their values, making correlation impossible without customizing the parser to add a 0x in the sha1 and sha256 fields. Further complicating matters.... ePO events show sha values in mixed or lower case.  In feeds like US-CERT, the values imported via the ESM Cyber Threat Feed feature, STIX or TAXII values are provided (without the 0x) and tend to be in upper case.  I just tested attempting to find a TIE hash after converting a known TIE file sha1 hash into upper case and failed to find it in the ESM (because the search is case sensative).
 
This is a big problem because I have several correlation rules looking for hash vales for things like HIDDEN COBRA files, and this effectivly breaks those rules since there is no way in a correlation rule to make things case insensative!

Now we have three issues:
 
  1. Any BackTrace would miss SHA256 and SHA1 values provided by ePO because they would not have a 0x in the SHA256 or SHA1 fields
  2. If TIE were to see something like a defined HIDDEN COBRA hash, it wouldnt cause the correlation rule to alert because the values defined in the watchlist dont have a 0x in them
  3. Other data sources like a Cisco Firepower IPS (which also displays sha256 values but not in the correct field!) would not properly correlate with TIE events because it doesnt have a 0x in the hash value
     
    In order to fix the issue I have to:

    1. Alter the Firepower Parser to place the SHA256 value in the SHA256 field
    2. Alter the FIrepower Parser to append a 0x before the SHA256 value in the SHA256 filed
    3. Alter all of the values in my various SHA256 and SHA1 watchlists to have a 0x before each line item
    4. Convert all of the values in the SHA256 and SHA1 watchlists to lowercase 
    5. Hope that all SHA256 and SHA1 values provided by my data sources (including ePO) are in lowercase
1 Reply
Reliable Contributor kmc
Reliable Contributor
Report Inappropriate Content
Message 2 of 2

Re: McAfee ESM and ePO TIE Hash Values

Hi @jrybicki

Have you got solution parcer to convert it into lower case?

ePO Support Center Plug-in
Check out the new ePO Support Center. Simply access the ePO Software Manager and follow the instructions in the Product Guide for the most commonly used utilities, top known issues announcements, search the knowledgebase for product documentation, and server status and statistics – all from within ePO.