FireEye HX - Execution Flow Indicators Hunting

This playbook queries FireEye Endpoint Security (HX) for execution flow indicators, including processes name, registry keys, registry values, and applications. Note that multiple search values should be separated by commas only (without spaces or any special characters).

FireEye HX · 26 tasks · 8 inputs · 19 outputs

Inputs

  • Application — Single or multiple application names or codes to search for within FireEye HX logs. By default, the 'contains' clause is used. Separate multiple search values by commas only (without spaces or any special characters).
  • ProcessName — A single or multiple process names to search for within FireEye HX logs. By default, the 'contains' clause is used. Separate multiple search values by commas only (without spaces or any special characters).
  • RegistryKey — A single or multiple registry keys to search for within FireEye HX logs. Separate multiple search values by commas only (without spaces or any special characters).
  • RegistryValue — A single or multiple registry values to search for within FireEye HX logs. By default, the 'contains' clause is used. Separate multiple search values by commas only (without spaces or any special characters).
  • hostSetName — The name of host set to be searched.
  • exhaustive — Whether a search is exhaustive or quick. Possible values are: yes, no. Default is yes.
  • interval_in_seconds — The interval in seconds between each poll. Default is 60.
  • limit — Limits the results count (once the limit is reached, the search is stopped).

Outputs

  • FireEyeHX.HuntingResults — Email message objects and fields that were retrieved from FireEye HX.
  • FireEyeHX.HuntingResults.Timestamp - Event — The timestamp of the event.
  • FireEyeHX.HuntingResults.Timestamp - Accessed — The last accessed time.
  • FireEyeHX.HuntingResults.Timestamp - Modified — The time when the entry was last modified.
  • FireEyeHX.HuntingResults.File Name — The name of the file.
  • FireEyeHX.HuntingResults.File Full Path — The full path of the file.
  • FireEyeHX.HuntingResults.DNS Hostname — The name of the DNS host.
  • FireEyeHX.HuntingResults.URL — The event URL.
  • FireEyeHX.HuntingResults.Username — The event username.
  • FireEyeHX.HuntingResults.File MD5 Hash — The MD5 hash of the file.
  • FireEyeHX.HuntingResults.Port — The Port.
  • FireEyeHX.HuntingResults.Process ID — The ID of the process.
  • FireEyeHX.HuntingResults.Local IP Address — The local IP Address.
  • FireEyeHX.HuntingResults.Local Port — The local Port.
  • FireEyeHX.HuntingResults.Remote Port — The remote port.
  • FireEyeHX.HuntingResults.IP Address — The IP address.
  • FireEyeHX.HuntingResults.Process Name — The process name.
  • FireEyeHX.HuntingResults.type — The type of the event.
  • FireEyeHX.HuntingResults.id — The ID of the result.

Commands used

fireeye-hx-search

Flowchart

yes yes yes yes yes yes yes yes yes Start Start Application Indicators Application Indicators Done Done Is FireEye HX enabled? - IsIntegrationAvailable Is FireEye HX enabled? IsIntegrationAvailable Any applications to hunt for? Any applications to hunt ... FireEye HX Query - Applications - fireeye-hx-search FireEye HX Query - Applic... fireeye-hx-search Process Name Indicators Process Name Indicators Any process names to hunt for? Any process names to hunt... FireEye HX Query - Parent Process Name - fireeye-hx-search FireEye HX Query - Parent... fireeye-hx-search FireEye HX Query - Process Name - fireeye-hx-search FireEye HX Query - Proces... fireeye-hx-search Application Hunting Done Application Hunting Done Process Name Hunting Done Process Name Hunting Done Save Matching Results - Applications - SetAndHandleEmpty Save Matching Results - A... SetAndHandleEmpty Save Matching Results - Process Name - SetAndHandleEmpty Save Matching Results - P... SetAndHandleEmpty Remove Duplications From Matching Results - SetAndHandleEmpty Remove Duplications From ... SetAndHandleEmpty Save Matching Results - Parent Process name - SetAndHandleEmpty Save Matching Results - P... SetAndHandleEmpty FireEye HX Query - Registry Value - fireeye-hx-search FireEye HX Query - Regist... fireeye-hx-search Registry Value Indicators Registry Value Indicators Registry Key Indicators Registry Key Indicators Any registry values to hunt for? Any registry values to hu... Save Matching Results - Registry Value - SetAndHandleEmpty Save Matching Results - R... SetAndHandleEmpty Registry Value Hunting Done Registry Value Hunting Done Any registry keys to hunt for? Any registry keys to hunt... FireEye HX Query - Registry Key - fireeye-hx-search FireEye HX Query - Regist... fireeye-hx-search Save Matching Results - Registry Key - SetAndHandleEmpty Save Matching Results - R... SetAndHandleEmpty Registry Key Hunting Done Registry Key Hunting Done