Pivoting on Indicators: Turning One Artefact Into the Whole Picture

An investigation usually starts with one artefact — a file hash from an alert, a domain from a proxy log, an address from a firewall deny. Pivoting is moving from that artefact to related ones, and doing it well is the difference between remediating one host and understanding a campaign.

The pivots that work

From a hash to the file's characteristics: the network destinations it contacts, the files it writes, the registry keys it sets. Those become new indicators to search the estate for. Also to other samples sharing code or configuration, which links this incident to a known family.

From a domain to the addresses it has resolved to over time, through passive DNS. Historical resolution is the useful part — the current address may be a hosting provider's, while a resolution from three months ago points at the actor's own infrastructure.

From an address to the other domains that have resolved to it. If an address hosts five domains and one is known malicious, the others warrant attention.

From registration data — a registrant email or organization, a name server, a registration date — to other domains sharing them. Privacy protection limits this and patterns persist: actors reuse registrars, hosting providers and naming conventions.

From a certificate to everything sharing it or its fingerprint, and from certificate transparency logs to other names the same actor requested certificates for — the same source used defensively under subdomain enumeration.

From infrastructure characteristics — a distinctive response, a specific service banner, a particular TLS configuration — searched across internet-wide scan data to find other hosts configured identically. This finds infrastructure that shares no address or domain with what you started from, and it is the most powerful pivot available.

Where it goes wrong

Shared infrastructure. The largest trap. A domain resolving to a large hosting provider's address shares it with thousands of unrelated sites, and pivoting from that address produces a list with no investigative value. Check whether an address is dedicated before pivoting from it, and treat content delivery and cloud addresses as dead ends.

Stale data. Passive DNS and scan data are historical, so a relationship that existed six months ago may say nothing about now — and may say a great deal, depending on the question. Always note the date of an observation.

Confirmation bias. Pivoting produces a graph, and a graph is persuasive. It is easy to assemble a network of loosely connected artefacts and conclude they are one campaign. The discipline is to ask what evidence would disconfirm the link, which is the analytic technique under the intelligence cycle.

Attribution overreach. Shared infrastructure, shared tooling and deliberately planted false flags all mislead. Attribution is rarely necessary for defensive action — knowing the technique matters more than knowing the actor.

Operational security while investigating

Pivoting touches third-party services, and some of those touches are visible to the adversary.

Submitting a file to a public analysis service makes it and its hash public, so an attacker monitoring for their own samples learns they have been detected. Resolving a domain or connecting to infrastructure from your own network tells them who is looking. Even a certificate transparency query is safe while a direct connection is not.

So prefer passive sources, use infrastructure not attributable to your organization when active checking is necessary, and be deliberate about what you submit. For a targeted intrusion, the decision to upload a sample is one to make consciously rather than reflexively.

Knowing when to stop

Pivoting expands indefinitely, and an investigation with no stopping rule becomes a research project.

Stop when the graph stops answering the question. If the objective is scoping an incident, you are looking for indicators to search the estate for — and once you have them, further expansion serves curiosity rather than response.

Convert findings into action: indicators to block and hunt for, and behavioural detections built from what the samples do, which outlive the indicators by a wide margin. That output, fed into your SIEM and into hunting hypotheses as under threat hunting, is what makes the exercise worth the hours.

Exam angles

Know pivoting as moving from one indicator to related ones — hash to network artefacts, domain to historical resolutions, address to co-hosted domains, certificate to related infrastructure, and configuration fingerprints across scan data. Recognize shared hosting and stale observations as the main sources of false relationships, and confirmation bias and attribution overreach as the analytic risks. Know that active checking can alert the adversary, making passive sources preferable.