Hosts View - Autoruns Tab

[#1]

Hosts View - Autoruns TabHosts View - Autoruns Tab

Note: The information in this topic applies to NetWitness Version 11.1 and later.

The Autoruns panel provides a list of autoruns, services, tasks, and cron jobs running on the host. To access this tab, select a host from the Hosts view and click the Autoruns tab.

Workflow

What do you want to do?

User Role	I want to ...	Show me how
Threat Hunter	review hosts with highest risk score*	Analyze Hosts Using the Risk Score
Threat Hunter	analyze hosts*	Investigating Hosts
Threat Hunter	perform adhoc scan*	Scan Hosts
Threat Hunter	review host details	Analyze Host Details
Threat Hunter	search on snapshot*	Search Files on Host
Threat Hunter	analyze processes	Investigating a Process
Threat Hunter	review reported anomalies	Analyze Anomalies
Threat Hunter	analyze risky users	Analyzing Risky Users
Threat Hunter	analyze events*	Analyzing Events
Threat Hunter	download files for deeper analysis*	Analyzing Downloaded Files
Threat Hunter	perform external lookups*	Launch an External Lookup for a File
Threat Hunter	change file status or remediate*	Changing File Status or Remediate
Threat Hunter	filter files	Filter Host Details
Threat Hunter	isolate host from network*	Isolating Hosts from Network
Threat Hunter	download MFT, system dump, or process dump*	Performing Host Forensics

*You can perform this task in the current view.

Related Topics

• Focusing on Endpoint Analysis
• Investigating Hosts
• Analyzing Downloaded Files
• Changing File Status or Remediate
• Analyzing Events
• Performing Host Forensics
• Isolating Hosts from Network

Quick Look

Below is an example of the Autoruns tab:

1	Agent and Scan Details. You can view the following agent and scan details of the selected host: Host name - Name of the host. For example, WIN-ABC. Risk score - Risk score of the host. Operating System - Operating system on which the agent is running (Linux, Windows, or Mac). Agent Scan Status - Current status of the scan - Idle, Scanning, Starting Scan, or Stopping Scan. For more information, see Scan Hosts. Agent Last Seen - Time when the agent last communicated with the Endpoint server. Agent Version - Version of the agent. For example, 11.3.0.0. More - Provides options to: Start a scan for the selected hosts. For more information, see Scan Hosts. Extracts host attributes and endpoint data to a JSON file of the selected snapshot. For more information, see Export Host Attributes. Isolation host from the network. For more information, see Isolating Hosts from Network. Download MFT to the server. For more information, see Performing Host Forensics. Download System Dump to the server. For more information, see System and Process Memory Dump. Perform remediation actions using the Remote Shell option. For more information, see Performing Host Forensics. Snapshot Time - Lists scanned time stamps. To view the scan history, you can select the snapshot time from the drop-down menu.
2	Actions in the toolbar: Change File Status - Provides capabilities to manage suspect and legitimate files and block malicious or infected file to prevent future execution of the file on any host. For more information, see Changing File Status or Remediate. Analyze Events - Lets you investigate a particular host, IP address, username, filename, or hash to get the entire context of the activity. For more information, see Analyzing Events. More Actions - Provides options to: Perform external lookups. Download process dump to server. Download files to server, save a local copy, and analyze files for deeper analysis. Note: You can perform some of the above actions from the right-click context menu.
3	Search on Snapshots. Lets you search on all snapshots (file name, file path, and SHA-256 checksum). For more information, see Search Files on Host.
4	Details Panel - Displays the following tabs: Autoruns - Files that are executed at start-up. Services - Files that are running as a service for the selected host. Tasks/Cron jobs - Files that are configured to run as scheduled tasks along with the trigger.
5	Show/Hide Right Panel - Displays the following properties in the right panel: Details - Displays all properties of the selected process. It is grouped as follows: General - General information about the file, such as file name, entropy, size, and format. Signature - Provides signatory information. Hash - Hash type of the file (MD5, SHA1, and SHA256). Time - Time when the file was created, modified, or accessed. Location - Location of the file. Autoruns/Services/Tasks - Details related to autrouns, services, or tasks. Local Risk Details - Displays the alerts associated with the local risk score, such as Critical, High, Medium and All. Hosts -Displays the top 100 hosts based on the risk score on which the file is present.
6	Clicking a filename lets you navigate to the Files view for further analysis.
7	Filter Files. You can filter files by selecting the options in the Filters panel and create filters. For more information, see Filter Host Details.
8	Settings Menu. You can set Hosts view preferences by selecting columns from the Settings menu. For more information, see Set Hosts Preference.

Previous Page	Next Page