Hosts View - Anomalies Tab

Note: The information in this topic applies to NetWitness Version 11.3 and later.

The Anomalies panel provides a list of image hooks, suspicious threads, kernel hooks, and registry discrepancies running on the host. To access this tab, select a host from the Hosts view and click the Anomalies tab.

Workflow

netwitness_workflowhosts.png

What do you want to do?

User Role I want to ... Show me how
Threat Hunter review hosts with highest risk score*

Analyze Hosts Using the Risk Score
Threat Hunter analyze hosts* Investigating Hosts
Threat Hunter perform adhoc scan*

Scan Hosts
Threat Hunter review host details

Analyze Host Details
Threat Hunter search on snapshot*

Search Files on Host
Threat Hunter analyze processes

Investigating a Process
Threat Hunter review reported anomalies*

Analyze Anomalies
Threat Hunter analyze risky users Analyzing Risky Users

Threat Hunter

analyze events*

Analyzing Events
Threat Hunter download files for deeper analysis* Analyzing Downloaded Files
Threat Hunter perform external lookups* Launch an External Lookup for a File
Threat Hunter change file status or remediate* Changing File Status or Remediate

Threat Hunter

filter files

Filter Host Details
Threat Hunter isolate host from network* Isolating Hosts from Network
Threat Hunter download MFT, system dump, or process dump* Performing Host Forensics

*You can perform this task in the current view.

Related Topics

Quick Look

Below is an example of the Anomalies tab:

anomalies_hosts_view_1344x450.png

1

Agent and Scan Details. You can view the following agent and scan details of the selected host:

Host name - Name of the host. For example, WIN-ABC.

Risk score - Risk score of the host.

Operating System - Operating system on which the agent is running (Linux, Windows, or Mac).

Agent Scan Status - Current status of the scan - Idle, Scanning, Starting Scan, or Stopping Scan. For more information, see Scan Hosts.

Agent Last Seen - Time when the agent last communicated with the Endpoint server.

Agent Version - Version of the agent. For example, 11.3.0.0.

More - Provides options to:

Snapshot Time - Lists scanned time stamps. To view the scan history, you can select the snapshot time from the drop-down menu.
2

Actions in the toolbar:

Change File Status - Provides capabilities to manage suspect and legitimate files and block malicious or infected file to prevent future execution of the file on any host. For more information, see Changing File Status or Remediate.

Analyze Events - Lets you investigate a particular host, IP address, username, filename, or hash to get the entire context of the activity. For more information, see Analyzing Events.

More - Provides options to:

  • Perform external lookups.
  • Download process dump to server.
  • Download files to server, save a local copy, and analyze files for deeper analysis.

Note: You can perform some of the above actions from the right-click context menu.

 
3 Search on Snapshots. Lets you search on all snapshots (file name, file path, and SHA-256 checksum). For more information, see Search Files on Host.
4

Details Panel - Displays the following tabs:
5 Show/Hide Right Panel - Displays the following properties in the right panel:

  • File Details - Displays all properties of the selected process. It is grouped as follows:

    General - General information about the file, such as file name, entropy, size, and format.

    Signature - Provides signatory information.

    Hash - Hash type of the file (MD5, SHA1, and SHA256).

    Time - Time when the file was created, modified, or accessed.

    Location - Location of the file.

    Image Hooks/Kernel Hooks/Suspicious Threads/Registry Discrepancies - Details related to image hooks, kernel hooks, suspicious threads, or registry discrepancies.

  • Local Risk Details - Displays the alerts associated with the local risk score, such as Critical, High, Medium and All.
  • Hosts - Displays the top 100 hosts based on the risk score on which the file is present.
6 Clicking a filename lets you navigate to the Files view for further analysis.
7 Filter Files. You can filter files by selecting the options in the Filters panel and create filters. For more information, see Filter Host Details.
8 Settings Menu. You can set Hosts view preferences by selecting columns from the Settings menu. For more information, see Set Hosts Preference.

Image Hooks

Image hooks found in executable image are displayed in the following columns.

Columns Description
Type

Type of the hook . Possible values are - inline, iat, eat, or exception Handler.
Local Risk Score Risk score of suspicious or malicious activities performed by the file on a specific host.
Global Risk Score Aggregated score of all suspicious and malicious activities performed by the file across all hosts.
Reputation Reputation of a file hash. The statuses are - Malicious, Suspicious, Unknown, Known, Known Good, and Invalid.
Signature Provides signatory information.
Downloaded Indicates the status of the downloaded file - Downloaded, Not Downloaded, and Error.
Hooked Process Process in which hooks are placed.
Hooked Filename Name of the file that was modified by the hook.
Hooked Symbol Symbol in which the hook is performed.

Kernel Hooks

Hooks found on kernel objects are displayed in the following columns.

Category Description
Type Type of kernel object which was modified. Possible values are: objectInitializer,basicObjectPointer, majorFunction, invalidObject, fastIO, notifyRoutine, attachedDevice, device, miniPort, sdt, sysEnter, or type.idt.
Driver name Name of the driver which placed the hooks.
Local Risk Score Risk score of suspicious or malicious activities performed by the file on a specific host.
Global Risk Score Aggregated score of all suspicious and malicious activities performed by the file across all hosts.
Reputation Reputation of a file hash. The statuses are - Malicious, Suspicious, Unknown, Known, Known Good, and Invalid.
Signature Provides signatory information.
Downloaded Indicates the status of the downloaded file - Downloaded, Not Downloaded, and Error.
Object Function Name of the object function hooked into.
Hooked File Name Name of the file that was modified by the hook.

Suspicious Threads

Threads whose service table was hooked are displayed in the following columns.

Category Description
Start Address Start Address - Start address of the thread.
DLL Name Name of the DLL.
Local Risk Score Risk score of suspicious or malicious activities performed by the file on a specific host.
Global Risk Score Aggregated score of all suspicious and malicious activities performed by the file across all hosts.
Reputation Reputation of a file hash. The statuses are - Malicious, Suspicious, Unknown, Known, Known Good, and Invalid.
Process File name and PID of the process in which thread is running.
Downloaded Indicates the status of the downloaded file - Downloaded, Not Downloaded, and Error.
Signature Provides signatory information.
Thread ID ID of the running thread.
Thread Environment Block Address of the thread environment block.

Registry Discrepancies

Configuration settings and options on Microsoft Windows operating systems that are stored are displayed in the following columns.

Category Description
Hive Name of the registry hive when possible, otherwise it displays the hive ID. Possible values are: hkeyClassesRoot, hkeyCurrentUser, hkeyLocalMachine, hkeyUsers, or hkeyPerformanceData.
Reason Type of registry discrepancy. Possible values are: notFound, embeddedNull, accessDenied, parentIsHidden, or dataMismatch.
Registry Path Registry path that is affected. The value is separated by a @ character.
Raw Type Value type found in the low-level parsing.
Raw Data

Value data extracted from the low-level parsing.
API Type Value type from the Win32 registry API.
API Data Value data from the Win32 registry API.