About asset tags

domain_controller

The logic depends on the data provided by the Endpoint Detection and Response (EDR) system. For example, in Crowdstrike we look for (1) an event with the simple name OsVersionInfoand (2) if the raw data indicates that the product type is 2.

exchange_server

Hunters is looking for exchange processes running from %\\program files%\\microsoft\\exchange server%. EDR agents where such a process is observed are automatically tagged as exchange servers.

aad_connect_server

Hunters looks for records where the device_platform is WINDOWS and the lowered_target_process_path contains the path to azureadconnect.exe.

device_platform = 'WINDOWS' AND lowered_target_process_path LIKE 
'%\\windows\\system32\\certsrv.exe'

ad_certificate_services_server

Hunters looks for records where the device_platform is WINDOWS and the lowered_target_process_path contains the path to certsrv.exe.

WHERE device_platform = 'WINDOWS'
  AND lowered_target_process_path LIKE '%\\windows\\system32\\certsrv.exe'

adfs_server

Hunters looks for records in which:

• The device_platform is WINDOWS

• The lowered_target_process_path contains the path to microsoft.identityserver.servicehost.exe within the windows\adfs directory, which is specified as the default directory for the Active Directory Federation Service (ADFS).

WHERE device_platform = 'WINDOWS' 
-- windows\\adfs is the default directory of the active directory federation service
 AND lowered_target_process_path LIKE  '%\\windows\\adfs\\microsoft.identityserver.servicehost.exe'

adfs_service_user

This tag will be applied to records in which:

• The device_platform is WINDOWS

• The lowered_target_process_path  contains the path to microsoft.identityserver.servicehost.exe within the windows\adfs directory, which is specified as the default directory for the Active Directory Federation Service (ADFS).

• It excludes records associated with local service accounts by checking that the target_process_windows_user_sid  does not start with s-1-5-21

WHERE device_platform = 'WINDOWS' 
-- windows\\adfs is the default directory of the active directory federation service
AND lowered_target_process_path LIKE  '%\\windows\\adfs\\microsoft.identityserver.servicehost.exe'
-- exclude local service accounts
AND LOWER(target_process_windows_user_sid) LIKE 's-1-5-21%'

citrix_delivery_controller_server

This tag will be applied to Windows devices related to specific Citrix processes.

WHERE device_platform = 'WINDOWS' AND
      lowered_target_process_name IN ('citrix.adidentity.exe', 'citrix.analytics.exe', 'brokerservice.exe',
      'citrix.configurationlogging.exe', 'citrix.configuration.exe', 'citrix.delegatedadmin.exe',
      'citrix.envtest.exe', 'citrix.host.exe', 'citrix.machinecreation.exe', 'citrix.monitor.exe',
      'citrix.storefront.exe')

domain_controller_user

This tag will be applied to users who logged into assets that are tagged as domain controllers and are not:

• Built-in accounts

• Local accounts

• Logon types that don't really signify this is a user with relevant privileges to log into a DC: Network, Unlock, CachedUnlock

linux_server

Currently applicable for Crowdstrike and Sentinel only.
This tag will be applied to Linux devices with serveras product type description.

WHERE PLATFORM_NAME = 'linux' AND PRODUCT_TYPE_DESC = 'server'

vmware_vcenter_server

WHERE device_platform = 'WINDOWS' AND
      -- appears in multiple different paths, but all are under program files\vmware
      lowered_target_process_path LIKE '%\\program files\\vmware\\%' AND
      lowered_target_process_name = 'vpxd.exe'

windows_server

Different logic per EDR.
In CS for example, we look for PLATFORM_NAME=`windows` AND PRODUCT_TYPE_DESC=`server` and also look for a specific event called OsVersionInfo and tag asset where raw:ProductName::VARCHAR LIKE `%windows server%`

okta_ad_service_account

This tag will be added to assets in which event_type matches any of the values specified below.

event_type IN ('system.agent.ad.read_ldap',
               'system.agent.ad.invoke_dir',
               'system.agent.ad.read_topology',
               'system.agent.ad.write_ldap')

okta_admin

event_type = 'user.session.access_admin_app' AND
outcome_result = 'SUCCESS'

gsuite_admin

This tag will be added to assets whose ID_APPLICATION_NAME is admin and whose actor_email is not empty.

WHERE ID_APPLICATION_NAME = 'admin'
 -- some events are not by specific user (thresholds reached, etc.)
   AND actor_email IS NOT NULL

Origin

Hunters OOTB

User

Setup

Not required

Manually under Knowledge Center> Tags or using API

Visibility

Under the asset/attribute name

Under the Enrichment section

Retroactive application

Not relevant

Not applied retroactively