Pivot points 1.0

Pivot points

Last updated 10 Nov 2026
On this page

Give Signal the incident's indicators - a file, a hash, an address, an account - and it tells you whether this host holds any of them, and where.

A pivot point

JSON Pivots in a profile 
"pivots": [
  {"type": "file", "value": "C:\\Users\\Public\\svc.exe", "context": "the implant on WS-CHARLIE"},
  {"type": "hash", "value": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
  {"type": "address", "value": "203.0.113.9", "context": "the staging server"},
  {"type": "domain", "value": "secure-docs-login.top", "context": "the phishing mail"},
  {"type": "account", "value": "CORP\\svc_backup", "context": "used from the staging server"},
  {"type": "registry_key", "value": "HKLM\\SOFTWARE\\Evil", "context": "the implant's configuration"}
]

The context - where the pivot point came from - is optional, but every hit carries it, so give it.

How the search works

Scope reads nothing of its own. It is handed every record the other modules read - shadow copies included - and matches each pivot against what the record names, normalised the way Signal names entities: a path's case, quotes and %SystemRoot%; an account by SID or name; an address in its canonical form.

Then it checks directly what no record may name: a full file path on disk, and a registry key.

Pivot types

Type

Matched against

file

A name: every program and file a record names, in any folder. A full path: the whole path, also checked on disk. * matches any characters (*\temp\*.ps1) - slower, and warned about.

file_present

Only the disk now: a full path, no wildcard. An IoC sweep of the current state - a file that was there and is gone is not found.

sha256, sha1, md5, hash

The hashes Signal computes: running processes' executables, the programs of auto-starts, services and tasks, programs with connections, downloads still on disk; and Sysmon's process creations. hash is typed by its length.

account

A SID, or DOMAIN\name exactly, or name in any domain.

address

Every address a record names.

domain

Every host name a record names, and its subdomains.

url

Part of the URLs of downloads, visits, BITS jobs, extension updates, web requests.

service

A service's key name.

task

A task's path, or its name in any folder.

command

Part of a command line, an auto-start command or a PowerShell script (4 characters at least).

registry_key

The auto-start entries' keys (the key or below); also checked directly, except HKCU\....

remote_id

The remote access tools' own IDs, this host's and its peers'.

extension

A browser extension's ID.

The result

Each pivot found is one SCOPE-PIVOT-HIT signal (critical): its occurrences are every record and direct check that holds it. The Scope module's pivots table has one row per pivot: found or "no - not in what this run read", where, what its direct check found, and which kinds of record were searched.

Try it yourself

  1. Make a pivot of your own

    Write a profile with one pivot: {"type": "file", "value": "notepad.exe", "context": "lab"}.

  2. Open Notepad

    Leave it running.

  3. Run with the profile

    signal live -all -profile lab.json -o .\

  4. Read the hit

    Find SCOPE-PIVOT-HIT: which records held notepad.exe? The running process, Prefetch, perhaps a process creation if auditing is on.

Next

Baselines and suppressions: tell Signal what your organisation runs on purpose.