Audit and Remediation: Hash Searches are Not Returning Information About a Known Hash

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

When searching for a Hash on a machine where it is known to exist, a query returns nothing

Environment

• Carbon Black Cloud Console: All Supported Versions
• Carbon Black Cloud Sensor: 3.7.x and Below

Cause

• This can happen because the current version of osquery's hash table is cap sensitive
• While the powershell command Get-FileHash returns the hash in all caps

Resolution

• LIKE can be used instead of = in the query
• The hash search can be encapsulated with lower(HASH)