liveBook · Manning

Humio

As explained in Cyber Threat Hunting

A log-management and observability platform for collecting, storing, searching, and analyzing machine-generated event data.

Humio is a central event repository for storing and searching machine-generated data at scale. In threat hunting, it provides the fast event searches needed to turn suspicious activity hypotheses into clues. CrowdStrike acquired Humio and renamed it Falcon LogScale. section 3.1.4

A productive investigation starts with a behavior, not a command to memorize. Search Sysmon process-creation events for a Microsoft Word parent process and a PowerShell child process, then broaden the condition to include CMD or pivot to file-creation events for PowerShell scripts. Inspect the returned fields—timestamps, host, event ID, image, command line, and parent command line—to reconstruct what happened. section 3.1.4

Listing 3.1 Search for Word spawning PowerShell in Sysmon events using Humio
sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" AND
_raw.EventID=1 AND
(_raw.ParentCommandLine=/winword.exe/i) AND (_raw.CommandLine=/powershell/i)

This query finds process-creation events where Word launches PowerShell. Its AND conditions narrow a large event store to a suspicious parent-child process relationship. section 3.1.4

After identifying a suspicious file or process, use free-text searches and time-ordered fields to pivot through related events. Searching for www.ps1, winword.exe, or www.txt reveals a sequence in which Word opens a document, launches cscript, and leads to PowerShell and CMD activity. The resulting timeline supports an investigation narrative rather than treating each alert as isolated. section 3.1.4

Humio queries in this workflow commonly use:

  • Field filters to select a source type, event ID, host, address, byte count, or command-line value. section 3.1.4 section 7.3
  • Regular-expression conditions for case-insensitive process names, filenames, and extracted values. section 3.1.4 section 7.3
  • Grouping and sorting to rank destination addresses or combinations of destination address and TLS cipher list by event count. section 7.3
Listing 7.42 IP addresses with 162.125 communicating with 10.0.0.18 with 845 bytes
@sourcetype=stream:tcp 10.0.0.18 AND 162.125 AND bytes=845
| regex("\"ssl_client_cipher_list\":\[(?<ciphers>(.*?))\]")
| groupBy(["dest_ip", "ciphers"])
| sort(_count, order=desc, limit=10)

This query filters TCP events by source, destination range, and byte count; extracts TLS cipher lists; then groups and ranks matching destinations for beaconing analysis. section 7.3

Investigating suspicious Office activity

Start with Word spawning PowerShell. If a matching event shows Word created www.ps1, search for that filename to find PowerShell executing it and inspect its parent command line. Search for the related www.txt script to expose subsequent CMD and rundll32 launches, then arrange the timestamps as a threat-execution timeline. section 3.1.4

How Cyber Threat Hunting covers it

How deep it goes
Demonstrates practical filters, regular expressions, grouping, sorting, and investigation pivots without detailing platform administration or query-language internals.
Examples
Uses Word launching PowerShell, www.ps1 and www.txt pivots, DLL execution, and Dropbox-address connection searches.
What it assumes
Assumes Sysmon events are collected and forwarded, while emphasizing search logic over memorizing commands.
What you can do after
Apply it via Humio searches to filter, correlate, rank, and timeline events during threat-hunting investigations.
How it connects
Connects Sysmon, threat hunting, process creation, PowerShell, CMD, rundll32, beaconing, TLS cipher lists, Splunk, and Elasticsearch.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.