Sophos Endpoint

Discussions How can I search for a MD5 Hash with Sophos EndPoint

Sophos Endpoint requires membership for participation - click to join

Thread Info

State Suggested Answer
Replies 5 replies
Answers 1 answer
Subscribers 14 subscribers
Views 1672 views
Users 0 members are here

Options

Suggested

How can I search for a MD5 Hash with Sophos EndPoint

Hans_Dampf 2 months ago

I have a hash like: 6ea2c9276c122222222222f9ae2 i want to search on the clients for this hash. is there a posibility to search with Sophos EP?

Added Tags
[edited by: GlennSen at 10:38 AM (GMT -7) on 3 Jul 2024]

Parents

0 Maxim-Sophos 2 months ago

You can do it if you have Intercept X Advanced w/XDR, but not with just Intercept X endpoint without XDR.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel
0 Hans_Dampf 2 months ago in reply to Maxim-Sophos

OK is there any documentation on how to search for it if you have XDR.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Maxim-Sophos 2 months ago in reply to Hans_Dampf

I believe it requires a Live Discover query of the endpoints themselves. Unfortunately I'm not an expert in Live Discover queries (or SQL). It looks like the table you want to query is called hash: https://osquery.io/schema/5.4.0#hash

You may have better luck in the XDR forum with finding help on writing the query.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 Maxim-Sophos 2 months ago in reply to Hans_Dampf

I believe it requires a Live Discover query of the endpoints themselves. Unfortunately I'm not an expert in Live Discover queries (or SQL). It looks like the table you want to query is called hash: https://osquery.io/schema/5.4.0#hash

You may have better luck in the XDR forum with finding help on writing the query.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data