H3AD-SEC H3AD-HUNT PIVEX
PIVEX
Pivot Across Every Artifact
v10.0 · 36 ARTIFACTS
36 artifacts168+ pivots
Select an artifact or click any node.
FROMTOPURPOSE
NETIPDomain / FQDNresolves_to — Passive DNS pivot
NETIPSSL Certificatepresents — Cert infra clustering
NETIPNet Sessioncommunicates_with — Session pivot
NETDomainIP / FQDN / URLresolves_to / parent_of / hosts
NETDomainSSL Certificateuses — Cert-based infra link
NETURLFiledelivers — Payload download chain
NETURLHTTP Requestrequested_via — Request trace
NETNet SessionIP / Domainoriginates_from / queries
NETSSL CertificateDomain / IPissued_to / used_by
NETJA3IP / Domainobserved_on / connects_to
NETUser AgentURL / Net Sessionaccesses / part_of
NETDNS QueryDomain / IP / Hostqueries / resolves_to / originates_from
NETNetwork TrafficIP / Net Sessioninvolves / part_of — Traffic scope
NETASNIP / Domaincontains / resolves_to — Infra attribution
NETPortIP / Host / Serviceopen_on / exposes — Service fingerprint
EPTHashFileidentifies — File artifact lookup
EPTHashURL / IP / Domaindownloaded_from / hosted_on / associated_with
EPTHashProcessexecuted_by — Execution chain
EPTFileHash / Processhas_hash / executed_by
EPTFileHost / Userexists_on / owned_by
EPTFile PathFilepoints_to — On-disk lookup
EPTCommand LineProcessexecuted_by — LOLBin / cmdline trace
EPTEvent IDProcess / Hostobserved_on / part_of — Event context
EPTProcessCommand Lineexecuted_with — LOLBin analysis
EPTProcessRegistrymodifies — Persistence write
EPTProcessSched. Task / Startup Itemcreates — Persistence chain
EPTProcessProcessspawned_by / spawns — Tree walk
EPTProcessFile / User / Hostruns / executed_as / runs_on
EPTShareHost / File / Userexists_on / contains / accessed_by
EPTHostProcess / File / Userruns / stores / used_by
EPTHostNet Sessiongenerates — Session scope
EPTVuln IDHostaffects — Affected asset scope
EPTServiceProcess / Host / Fileruns_as / runs_on / loads — Service chain
EPTMutexProcess / Host / Hashcreated_by / observed_on / associated_with
EPTNamed PipeProcess / Hostcreated_by / observed_on — IPC pivot
EPTDLLProcess / Host / Hashloaded_by / observed_on / has_hash
EPTProcessNet Session / IPcommunicates_with — Network beacon pivot
IDNUserHost / Processlogs_into / executes
IDNUserIP / Cloud Resourceoriginates_from / accesses
IDNRDP SessionHost / Userconnects_to / initiated_by
IDNIdentityUserrepresents — Cloud identity map
EMLEmailAttachment / URLcontains — Phishing chain
EMLEmailDomainoriginates_from — Sender pivot
EMLAttachmentHashhas_hash — Payload hash
CLDCloud ResourceIdentity / IPowned_by / exposed_via
ARTIFACT TYPEPRIMARY SOURCES
IP AddressFirewall · SIEM · NetFlow · Proxy · Shodan · AbuseIPDB
DomainPassive DNS · Proxy logs · DNS server logs · RiskIQ · SecurityTrails
FQDNDNS logs · Sysmon Event 22 · EDR · Proxy
URLProxy logs · Email Gateway · Browser history · EDR · Zeek
DNS QueryDNS logs · Sysmon Event 22 · EDR · Network tap
HTTP RequestProxy · Zeek · Suricata · Firewall · Network sensor
SSL Cert / SSL CertificateCensys · Shodan · crt.sh · JARM · Passive DNS
JA3 HashNetwork sensor · Zeek · Suricata · PCAP
User AgentProxy · Zeek · Firewall logs · SIEM
Net TrafficNetFlow · PCAP · Zeek · Suricata · Firewall
Net SessionNetFlow · Firewall · Proxy · Zeek · EDR
ASNWHOIS · BGP tables · Shodan · RIPEstat · ipinfo.io
PortShodan · Censys · Masscan · Nmap · Firewall logs
File HashEDR · AV · Sandbox · MalwareBazaar · VirusTotal
FileEDR · Sandbox · AV · MalwareBazaar · File system audit
File PathEDR · Sysmon Event 11 · MFT · USN Journal · KAPE
ProcessEDR · Sysmon Event 1 · WinEvent 4688 · Process Monitor
Command LineEDR · Sysmon Event 1 · WinEvent 4688 · PowerShell ScriptBlock
Registry KeySysmon 12-14 · EDR · WinEvent 4657 · Autoruns · reg.exe
Scheduled TaskWinEvent 4698 · Task Scheduler logs · EDR · Autoruns
Startup ItemAutoruns · EDR · Sysmon · Registry audit · WinEvent 4688
HostEDR · SIEM · AD · CMDB · Vuln Scanner
Network ShareWinEvent 5140/5145 · EDR · Sysmon · AD
Event IDWindows Event Log · SIEM · Splunk · Elastic
Vuln ID (CVE)NVD · CISA KEV · Tenable · Qualys · Shodan
ServiceEDR · Sysmon Event 4 · WinEvent 7045 · SC.exe · Autoruns
MutexEDR · Sysmon Event 17/18 · Sandbox · Process Monitor
Named PipeEDR · Sysmon Event 17/18 · Process Monitor · PipeView
DLLEDR · Sysmon Event 7 · PE analysis · VirusTotal · Sandbox
UserAD logs · IAM · Okta · SIEM · UEBA
IdentityAzure AD · AWS IAM · GCP SA · Okta · CloudTrail
RDP SessionWinEvent 4624/4778/4779 · EDR · NetFlow · Security Onion
EmailEmail Gateway · O365 Message Trace · Proofpoint · Mimecast
AttachmentEmail Gateway · Sandbox · AV · EDR · O365 ATP
Cloud ResourceCloudTrail · Azure Monitor · GCP Audit · GuardDuty
NETWORK (14)
ENDPOINT (16)
IDENTITY (3)
EMAIL (2)
CLOUD (1)
Click chip or node → centers artifact, highlights next pivots · Click highlighted node → extends path · Breadcrumb tracks traversal