word.exe
payload.exe
wmiexec.exe
/sensitive/file
evil.com
explorer.exe
cmd.exe
word.exe talking to non-whitelisted domain
word.exe spawning child process
wmiexec from non standard grandparent process
Process with network access creates file, executes child from it
Risk: 50
Risk: 100
Risk: 75
Risk: 80
Asset Lens
Risk Node
name: 'word with child process'
score: 100
name: 'word network'
score: 80
name: 'wmiexec grandparent'
score: 75
score: 400
Through the lens of an asset, view the scope of risks within that lens
name: 'file created and then executed'
score: 50
name: 'unique parent process pair'
score: 20
Lense score is sum of all scoped nodes' risk scores, where overlapping risks on a node give a % bonus
chrome.exe
mal.doc
mallory-win7
name: 'Commonly Targeted App Read Browser Created File'
score: 10
name: 'Browser Created File'
score: 5
Sorted list of lenses
By Colin
