Hunting

Collect data to support threat hunting.

Hunting enables investigators to search for specific data across a large number of hosts. Hunt collections provide more details about where something occurred. Hunting examples include finding which endpoints executed a piece of malware, which users accessed a particular file, or which endpoints were accessed by a specific user.

Create a hunt

Select hunt collections when you want to search for a specific activity across a large number of hosts. Hunt Collections gather more details about where something occurred. For example, use a hunt to find which endpoints executed a piece of malware, which users accessed a particular file, or which endpoints a specific user authenticated to.

When adding a new hunt collection, you can select from various artifact types for Windows, macOS and Linux.

1. In the New Hunt Collection wizard, in the Hunt Collection Name, enter a name that will be easy to find in the collections table.
2. Select the Platform, Windows, macOS or Linux.
3. Select one of the time range options:

   • One Time Collection: Run the hunt collection only once.
   • Repeat Collection Every: Run the hunt collection every x hours set.
   • Schedule: Range of days during the week and time frame.
4. In Description , enter information that is relevant to the collection you are creating.
5. In Maximum Concurrent Endpoints, enter the maximum number of endpoints that will run the searches at the same time within the time range specified. The default is 200 endpoints.
6. On the Configuration page, refer to Configure Collection for information about each artifact.

Note

You can save hunts in an incomplete state and edit them later. After a hunt has run, you cannot edit it. Instead, you can duplicate the hunt with the same configuration.

Hunt results

The hunt results page consolidates information collected by the Cortex XDR agent enabling you to investigate and take action on your endpoints.

Review process execution search results

The Process Execution table displays a normalized table containing an overview of all of the different process execution artifacts collected from the endpoints. Investigate the following detailed fields:

The grouping button () shows the number of affected endpoints grouped by executable name. This enables you to perform hunting via frequency analysis (referred to as stacking) and provides a birds eye view of potential malware files that require further analysis.

Field	Description
Context	Contextual details relating to the executed process such as files opened, command line arguments, or process run count.
Executable Name	Name of the executable.
Executable Path	Path of the executable.
Hostname	Name of the host on which the process resided.
MDS	MDS value of the executable file, if available on the file system.
SHA1	SHA1 value of the executable file, if available on the file system.
SHA256	SHA256 value of the executable file, if available on the file system.
Timestamp	Timestamp associated with the executable file or process execution.
Type	Type of process artifact.
User	User name associated with the execution artifact.
Verdict	WildFire verdict for the following process execution artifacts. Prefetch Recentfilecache Shimcache UserAssist If there is a WildFire verdict, the relevant Verdict is displayed. Unknown Benign Malware Grayware Also, a link to the WildFire analysis report is available for review.

Review file access

The File Access table displays a normalized table containing an overview of all of the different file access artifacts collected from the endpoints. Investigate the following detailed fields:

Field	Description
Hostname	Name of the host on where the file access artifact resided.
Path	Path of the accessed file or folder.
Timestamp	Timestamp associated with the accessed file or folder.
Type	Type of file access artifact.
User	User name of who accessed the file or folder, if available.

Review persistence search results

The Persistence table displays a normalized table containing an overview of all of the application persistence artifacts collected from the endpoints. Investigate the following detailed fields:

The grouping button () shows the number of affected endpoints grouped by file path. This enables you to perform hunting via frequency analysis (referred to as stacking) and provides a birds eye view of potential malware files that require further analysis.

Field	Description
Command	Command to be executed.
Endpoint ID	Unique identifier of the endpoint on which the persistence mechanism resides.
File Path	Path of a secondary executable (often a dll) associated with this persistence mechanism.
File SHA256	SHA256 value of the file.
Hostname	Name of the host on which the persistence mechanism resides.
Image Path	Path of the executable associated with this persistence mechanism.
Name	Name associated with persistence mechanism, if available.
Registry Path	Path of the registry value.
Timestamp	Timestamp associated with the persistence mechanism.
Type	Type of persistence mechanism.
User	User account associated with persistence mechanism.
User SID	User account associated with persistence mechanism.
Verdict	WildFire verdict for the following persistence artifacts. Drivers Registry Scheduled Tasks Services Startup Folder If there is a WildFire verdict, the relevant Verdict is displayed. Unknown Benign Malware Grayware Also, a link to the WildFire analysis report is available for review.

Review network data search results

The Network table displays an overview of the different types of network artifacts collected on the endpoints. Investigate the following detailed fields:

Field	Description
Hostname	Name of the host on which the network activity occurred.
Interface	Type of network interface.
IP Address	IP address associated with network activity.
Resolution	Network data type associated with the IP address.
Type	Type of network artifact.

Review remote access search results

The Remote Access table displays a normalized table containing an overview of all of the remote access artifacts collected from the endpoints. Investigate the following detailed fields:

Field	Description
Connection ID	Unique Identifier associated with the particular remote access connection found in this row.
Connection Type	Type of remote access connection.
Duration	Duration of remote access connection.
Endpoint ID	A unique ID assigned by Cortex XDR that identifies the endpoint.
Hostname	Name of the host on which the remote access occurred.
Message	Description of activity related to this remote access collection.
Source Host	Origination host of remote access connection.
Timestamp	Date and time of the remote access activity.
Type	Type of remote access artifact.
User	User account associated with remote access connection.

Review archive history search results

The Archive History table displays an overview of the different types of archive processes that were executed on an endpoint. Investigate the following detailed fields:

Field	Description
Hostname	Name of the host on which the archive history was found.
Timestamp	Timestamp associated with archive history file.
Type	Type of archive history artifact. 7-Zip Folder History WinRAR ArcHistory
Path	Path of archive history file.
User	User account associated with archive history file.

Linux

The collection results for the Core Linux artifacts include information about each artifact.

Artifact	Result Details
Auditd Rules	Auditd Rules artifact in Linux forensics refers to the log data collected by the Linux Audit Daemon, a core component of security auditing. It records a detailed, chronological trail of system events based on a set of pre-configured rules.
Authorized Keys	Shows the public keys that are permitted to log in as a specific user via SSH. Attackers can add their own keys to this file to gain persistent access to a system.
Environment Variables	Lists environment variables for a given context (for example: a user's shell or a specific process). These variables define the execution environment and can contain important paths, configurations, or sensitive data.
File Listing	Shows information about the timeline of file system activity.
Files & Processes	Lists files opened by processes. This is crucial for mapping processes to the files and network sockets they are interacting with, which can reveal hidden activities, loaded libraries, or active network connections.
Firewall Rules	Lists control network traffic. Analyzing these rules is crucial for understanding the network security posture and identifying potentially malicious or overly permissive configurations.
System-Wide Configuration	Shows key-value pairs parsed from various configuration files in the /etc directory, for example: /etc/resolv.conf for DNS settings. This artifact helps understand the system's network and operational configuration.
Kernel Modules	Lists kernel modules on the system, their state, and the associated file path. Malicious actors may use custom kernel modules (rootkits) to hide their presence or gain privileged access.
Known Hosts	Lists the files that store the public keys of SSH servers a user has connected to. This helps to verify the server's identity and prevent man-in-the-middle attacks by alerting the user if the server's key changes.
Mounted Filesystems	Lists all mounted file systems, their sources (devices), types, and unique identifiers. This is useful for discovering connected storage and network shares, and understanding the file system layout.
Network Connections	Shows the lists of active network connections and listening ports. Essential for identifying unauthorized network communications, malware command and control (C2) channels, or unexpected listening services.
Running Processes	Shows a detailed snapshot of running processes on the system. This includes process identifiers, user context, executable path, parent-child relationships, state, and performance metrics. It is a cornerstone artifact for live system analysis.
System Information	Provides fundamental hardware and system information, including manufacturer, model, UUID, and memory details. This helps to identify and profile the system.
Systemd Service	Lists the system daemons or services (for example, from systemd). Analyzing these is key to understanding what long-running processes are configured on the system and to spot malicious or unnecessary services.
User Login & Session History	Shows records of user login sessions from the last command, showing who logged in, from where, and for how long. This is essential for auditing user access and investigating unauthorized logins.

Hunt status

Hunts consist of searches across multiple endpoints and those searches can take time to return results from all of the targeted endpoints. To view the status of all of the searches contained within a hunt, go to Investigation & Response → Forensics. From the investigations table, click the investigation link. From the Collections tab, select Hunt and from the Status column of the hunt, click Actions. This launches a new browser tab displaying the Actions table. Within the Actions table, you can scroll or use the filters to see the status of any search within a hunt across any of the targeted endpoints.

Using this information, you can identify the successful and failed searches and take the necessary action.

Field	Description
Endpoint name	Agent hostname.
Endpoint ID	Agent unique ID.
Action ID	A unique identifier for the agent action.
Name	Name of search.
Status	Shows one of the following statuses of the search: Pending In progress Completed successfully Failed Timeout
Artifact category	Name of category for the search. Example: Process execution
Artifact	Artifact targeted by this search. Example: Amcache
Results	Number of results received for the search.
Last updated	Latest time results were received for this action.
Parameters	The string that describes the search parameters. Example: C:\Users* File Name Regex: *.exe
Creation time	Timestamp when the search was created.