{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Adversaries are actively weaponizing trusted software like ScreenConnect and AI assistants, which are often excluded from aggressive detection; a negative result over the estate is essential to ensure trust is not being abused."
      },
      "name": "Abuse of Trusted RMM and AI Agent Software",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1195",
        "attack.t1574.002",
        "attack.t1572",
        "attack.t1190",
        "command and control",
        "credential access",
        "execution",
        "initial access",
        "persistence"
      ],
      "series": {
        "slug": "when-trust-becomes-the-payload-inside-the-threats-etc-quarterly-report",
        "index": 2,
        "title": "When trust becomes the payload: Inside the threats, etc quarterly report",
        "total": 2
      },
      "related": [
        {
          "hunt": "initial-access-aitm-phishing",
          "reason": "Phishing-based initial access is handled by a separate identity-focused hunt.",
          "relation": "out-of-scope-alternative"
        },
        {
          "hunt": "saas-identity-consent-loophole-abuse",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "This hunt uses a phased flow to pivot from module sideloading and RMM child processes into high-frequency command analysis; no single detection rule can baseline normal developer AI assistant behavior against automated abuse.",
      "coverage": [
        {
          "stage": "execution-msi-dll-sideloading",
          "steps": [
            "sideloading-check"
          ],
          "status": "covered"
        },
        {
          "stage": "persistence-rmm-abuse",
          "steps": [
            "rmm-child-check"
          ],
          "status": "covered"
        },
        {
          "stage": "c2-proxy-tunneling",
          "steps": [
            "tunneling-check"
          ],
          "status": "covered"
        },
        {
          "stage": "execution-ai-agent-automation",
          "steps": [
            "ai-velocity-check"
          ],
          "status": "covered"
        },
        {
          "stage": "initial-access-aitm-phishing",
          "reason": "Belongs to another part of the 'When trust becomes the payload: Inside the threats, etc quarterly report' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "identity-consent-mfa-bypass",
          "reason": "Belongs to another part of the 'When trust becomes the payload: Inside the threats, etc quarterly report' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Adversary-in-the-Middle Phishing",
            "slug": "initial-access-aitm-phishing",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "Adversary-in-the-Middle (AiTM) phishing kits",
              "Credential theft targeting cloud/SaaS tenants"
            ]
          },
          {
            "name": "Consent Loophole and Rapid Login",
            "slug": "identity-consent-mfa-bypass",
            "tactic": "credential-access",
            "techniques": [
              "T1190",
              "T1555"
            ],
            "observables": [
              "Abuse of first-party application consent",
              "8-minute delay between infostealer infection and login",
              "Bypassing MFA hurdles via session theft"
            ]
          },
          {
            "name": "Signed MSI and DLL Sideloading",
            "slug": "execution-msi-dll-sideloading",
            "tactic": "execution",
            "techniques": [
              "T1574.002"
            ],
            "observables": [
              "Microsoft Software Installer (MSI) delivery",
              "Dynamic link library (DLL) sideloading",
              "16-second execution window from lure to sideload"
            ]
          },
          {
            "name": "RMM Persistence via ScreenConnect",
            "slug": "persistence-rmm-abuse",
            "tactic": "persistence",
            "techniques": [
              "T1195"
            ],
            "observables": [
              "ScreenConnect",
              "Signed remote monitoring and management (RMM) agents",
              "Interactive access on endpoints"
            ]
          },
          {
            "name": "Network Proxy Tunneling",
            "slug": "c2-proxy-tunneling",
            "tactic": "command-and-control",
            "techniques": [
              "T1572"
            ],
            "observables": [
              "Proxy tunneling",
              "Memory tampering outcomes"
            ]
          },
          {
            "name": "AI Agent-Driven Attack Actions",
            "slug": "execution-ai-agent-automation",
            "tactic": "execution",
            "techniques": [
              "T1195"
            ],
            "observables": [
              "AI coding assistants",
              "17,600 reconstructed actions over four days",
              "High-frequency automated activity from AI application processes"
            ]
          }
        ],
        "summary": "Adversaries are weaponizing trust across the enterprise stack by abusing legitimate tools like ScreenConnect, AI coding assistants, and Microsoft first-party clients. Intrusions leverage AiTM phishing to bypass MFA and deploy signed payloads via DLL sideloading, often achieving full compromise from infection to cloud login in just eight minutes."
      },
      "severity": "medium",
      "rationale": "Target developer workstations and IT servers first. Ensure the lookback covers the 4-day automation window mentioned in the research.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "Adversaries are weaponizing trusted remote management tools and AI assistants to execute code via MSI sideloading and high-frequency automated commands, bypassing traditional detection by operating within signed processes.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Optional list of hosts to focus on; leave empty for fleet-wide."
        },
        "shell_names": {
          "from": {
            "ref": "shell-list",
            "kind": "manual",
            "observed": "2024-05-20"
          },
          "type": "list[string]",
          "default": [
            "cmd.exe",
            "powershell.exe",
            "pwsh.exe",
            "bash",
            "sh"
          ],
          "description": "Common shell processes to find as children of RMM."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "ai_process_names": {
          "from": {
            "ref": "elastic-security-labs",
            "kind": "article",
            "observed": "2026-11-04"
          },
          "type": "list[string]",
          "default": [
            "cursor.exe",
            "github-copilot-agent.exe",
            "windsurf.exe",
            "code.exe"
          ],
          "description": "Common AI assistant process names."
        },
        "rmm_process_names": {
          "from": {
            "ref": "common-rmm-list",
            "kind": "manual",
            "observed": "2024-05-20"
          },
          "type": "list[string]",
          "default": [
            "screenconnect.exe",
            "screenconnect.client.exe",
            "anydesk.exe"
          ],
          "description": "Process names for RMM software to monitor."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.elastic.co/security-labs/reports/threats-etc-report-november-2026-trouble-with-trust",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.elastic.co/security-labs/reports/threats-etc-report-november-2026-trouble-with-trust",
          "name": "Elastic Security Labs \u2014 November 2026 threats, etc Report"
        }
      ],
      "blind_spots": [
        {
          "id": "no-agent-telemetry",
          "risk": "Attackers may target unmanaged hosts where module loads are not visible.",
          "stage": "execution-msi-dll-sideloading",
          "question": "Are we seeing sideloading on hosts that do not report telemetry?",
          "requires": "an endpoint agent on every host"
        },
        {
          "id": "ai-traffic-encryption",
          "risk": "Network connection counts can identify outliers, but the actual payload content is invisible without decryption.",
          "stage": "c2-proxy-tunneling",
          "question": "Is the protocol tunneling hidden within standard encrypted AI traffic?",
          "requires": "TLS inspection or proxy logs"
        }
      ]
    },
    "name": "Abuse of Trusted RMM and AI Agent Software",
    "description": "This hunt examines the weaponization of legitimate, signed software in the enterprise stack. It follows a phased flow: first identifying hosts with ScreenConnect or AI assistants, then searching for rapid MSI sideloading and suspicious RMM child processes. Finally, it correlates this with high-frequency automated actions and protocol tunneling to distinguish between administrative use and adversary abuse."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "when-trust-becomes-the-payload-inside-the-threats-etc-quarterly-report",
          "index": 2,
          "title": "When trust becomes the payload: Inside the threats, etc quarterly report",
          "total": 2
        },
        "coverage": [
          {
            "stage": "execution-msi-dll-sideloading",
            "steps": [
              "sideloading-check"
            ],
            "status": "covered"
          },
          {
            "stage": "persistence-rmm-abuse",
            "steps": [
              "rmm-child-check"
            ],
            "status": "covered"
          },
          {
            "stage": "c2-proxy-tunneling",
            "steps": [
              "tunneling-check"
            ],
            "status": "covered"
          },
          {
            "stage": "execution-ai-agent-automation",
            "steps": [
              "ai-velocity-check"
            ],
            "status": "covered"
          },
          {
            "stage": "initial-access-aitm-phishing",
            "reason": "Belongs to another part of the 'When trust becomes the payload: Inside the threats, etc quarterly report' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "identity-consent-mfa-bypass",
            "reason": "Belongs to another part of the 'When trust becomes the payload: Inside the threats, etc quarterly report' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "Adversaries are weaponizing trusted remote management tools and AI assistants to execute code via MSI sideloading and high-frequency automated commands, bypassing traditional detection by operating within signed processes.",
        "blind_spots": [
          {
            "id": "no-agent-telemetry",
            "risk": "Attackers may target unmanaged hosts where module loads are not visible.",
            "stage": "execution-msi-dll-sideloading",
            "question": "Are we seeing sideloading on hosts that do not report telemetry?",
            "requires": "an endpoint agent on every host"
          },
          {
            "id": "ai-traffic-encryption",
            "risk": "Network connection counts can identify outliers, but the actual payload content is invisible without decryption.",
            "stage": "c2-proxy-tunneling",
            "question": "Is the protocol tunneling hidden within standard encrypted AI traffic?",
            "requires": "TLS inspection or proxy logs"
          }
        ],
        "scoping_notes": "Target developer workstations and IT servers first. Ensure the lookback covers the 4-day automation window mentioned in the research.",
        "beyond_detection": "This hunt uses a phased flow to pivot from module sideloading and RMM child processes into high-frequency command analysis; no single detection rule can baseline normal developer AI assistant behavior against automated abuse."
      }
    },
    {
      "id": "identify-trusted-hosts",
      "type": "query",
      "label": "Identify hosts with RMM or AI software",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT device_hostname FROM hb_process_activity WHERE (instr(',' || '{{ai_process_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{rmm_process_names}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Find the subset of the estate where trusted software (RMM or AI) has actually run in the window to scope the hunt.",
        "expected_signal": "A list of hostnames. Silence means no such software is active in the environment."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify hosts with RMM or AI software",
        "reads": [
          "device_hostname",
          "process_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT DISTINCT device_hostname FROM hb_process_activity WHERE (instr(',' || '{{ai_process_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{rmm_process_names}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames. Silence means no such software is active in the environment.",
        "verified": "dry-run",
        "verified_at": "2026-11-05"
      }
    },
    {
      "id": "sideloading-check",
      "type": "query",
      "label": "MSIexec loading modules from user-writable paths",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, module_path, time FROM hb_module_activity WHERE LOWER(process_name) LIKE '%msiexec.exe' AND (LOWER(module_path) LIKE '%\\users\\public\\%' OR LOWER(module_path) LIKE '%\\appdata\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_module_activity",
        "description": "Identify potential DLL sideloading matching the report's MSI-delivery pattern.",
        "expected_signal": "MSIexec loading a module from a user profile is the core observable for the 16-second attack window described in the report."
      },
      "parents": [
        {
          "id": "identify-trusted-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "MSIexec loading modules from user-writable paths",
        "reads": [
          "device_hostname",
          "module_path",
          "process_name",
          "time"
        ],
        "source": "hb_module_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, module_path, time FROM hb_module_activity WHERE LOWER(process_name) LIKE '%msiexec.exe' AND (LOWER(module_path) LIKE '%\\users\\public\\%' OR LOWER(module_path) LIKE '%\\appdata\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "MSIexec loading a module from a user profile is the core observable for the 16-second attack window described in the report.",
        "verified": "dry-run",
        "verified_at": "2026-11-05"
      }
    },
    {
      "id": "rmm-child-check",
      "type": "query",
      "label": "Shell spawns from trusted RMM tools",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, parent_process_name, process_name, process_cmd_line, time FROM hb_process_activity WHERE instr(',' || '{{rmm_process_names}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 AND instr(',' || '{{shell_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Identify when an attacker or technician spawns a shell from an RMM tool.",
        "expected_signal": "A shell spawned by RMM indicates a technician (or attacker) is running commands; this provides the persistence context."
      },
      "parents": [
        {
          "id": "identify-trusted-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Shell spawns from trusted RMM tools",
        "reads": [
          "device_hostname",
          "parent_process_name",
          "process_cmd_line",
          "process_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, parent_process_name, process_name, process_cmd_line, time FROM hb_process_activity WHERE instr(',' || '{{rmm_process_names}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 AND instr(',' || '{{shell_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A shell spawned by RMM indicates a technician (or attacker) is running commands; this provides the persistence context.",
        "verified": "dry-run",
        "verified_at": "2026-11-05"
      }
    },
    {
      "id": "early-triage-agent",
      "type": "analytic",
      "label": "Early-stage read",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "sideloading-check",
          "rmm-child-check"
        ],
        "objective": "Identify hosts where signed software is performing unexpected execution or spawning shells.",
        "description": "Summarize whether the observed module loads or RMM shells indicate suspicious initial behavior.",
        "max_iterations": 3,
        "expected_signal": "A verdict on which hosts show anomalous trust abuse.",
        "success_criteria": "A list of hosts with suspicious early-stage activity."
      },
      "parents": [
        {
          "id": "sideloading-check",
          "kind": "merge"
        },
        {
          "id": "rmm-child-check",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "ai-velocity-check",
      "type": "query",
      "label": "High-velocity AI assistant command activity",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, COUNT(*) as action_count, MIN(time) as first_action, MAX(time) as last_action FROM hb_process_activity WHERE instr(',' || '{{ai_process_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name HAVING action_count > 1000",
        "surface": "hb_process_activity",
        "description": "Detect the 17,600-action pattern by counting unique commands from AI processes with a high threshold.",
        "expected_signal": "High counts (e.g., >1000 commands) suggest automated abuse of an AI coding agent rather than normal developer work."
      },
      "parents": [
        {
          "id": "early-triage-agent"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "High-velocity AI assistant command activity",
        "reads": [
          "device_hostname",
          "process_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, COUNT(*) as action_count, MIN(time) as first_action, MAX(time) as last_action FROM hb_process_activity WHERE instr(',' || '{{ai_process_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name HAVING action_count > 1000",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "new_this_window"
        },
        "expected": "High counts (e.g., >1000 commands) suggest automated abuse of an AI coding agent rather than normal developer work.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "process_name"
          ],
          "rare_below": 2
        },
        "verified_at": "2026-11-05"
      }
    },
    {
      "id": "tunneling-check",
      "type": "query",
      "label": "Outbound tunneling from trusted processes",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "network",
        "content": "SELECT dst_endpoint_ip, COUNT(DISTINCT device_hostname) as host_count FROM hb_network_connection WHERE (instr(',' || '{{ai_process_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{rmm_process_names}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_ip HAVING host_count <= 2",
        "surface": "hb_network_connection",
        "description": "Identify protocol tunneling by finding rare outbound destinations from RMM or AI tools.",
        "expected_signal": "Outbound traffic to rare IP addresses from trusted apps is an indicator of C2 tunneling."
      },
      "parents": [
        {
          "id": "early-triage-agent"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Outbound tunneling from trusted processes",
        "reads": [
          "device_hostname",
          "dst_endpoint_ip",
          "process_name",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT dst_endpoint_ip, COUNT(DISTINCT device_hostname) as host_count FROM hb_network_connection WHERE (instr(',' || '{{ai_process_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{rmm_process_names}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_ip HAVING host_count <= 2",
        "silence": "not_evidence_of_absence",
        "expected": "Outbound traffic to rare IP addresses from trusted apps is an indicator of C2 tunneling.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "dst_endpoint_ip"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-11-05"
      }
    },
    {
      "id": "comprehensive-triage-agent",
      "type": "analytic",
      "label": "Comprehensive triage",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "early-triage-agent",
          "ai-velocity-check",
          "tunneling-check"
        ],
        "objective": "Confirm whether the sequence of trust abuse, high-velocity automation, and protocol tunneling constitutes a malicious intrusion.",
        "description": "Integrate early-stage evidence with follow-on automated command patterns and tunneling.",
        "max_iterations": 6,
        "expected_signal": "A full-chain verdict for each host.",
        "success_criteria": "A detailed intrusion verdict per host."
      },
      "parents": [
        {
          "id": "ai-velocity-check",
          "kind": "merge"
        },
        {
          "id": "tunneling-check",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "verdict-decision",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the comprehensive-triage-agent verdict is malicious for at least one host",
        "condition": "the comprehensive-triage-agent verdict is malicious for at least one host",
        "blind_spot": "no-agent-telemetry",
        "confidence": "high",
        "description": "Direct the workflow based on the agent's confidence.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "comprehensive-triage-agent"
        }
      ]
    },
    {
      "id": "contain-host",
      "type": "action",
      "label": "Isolate host",
      "config": {
        "target": "endpoint",
        "description": "Halt automated attacker activity.",
        "instructions": "Isolate the host via EDR to sever C2 and halt automated commands.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "verdict-decision",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-validation",
      "type": "task",
      "label": "Analyst validation",
      "config": {
        "assignee": "analyst",
        "description": "Verify the findings to ensure legitimate developer activity was not misidentified.",
        "instructions": "Review the command lists from ai-velocity-check. Confirm if they match known development workflows or automated credential theft."
      },
      "parents": [
        {
          "id": "verdict-decision",
          "branch": "default"
        },
        {
          "id": "verdict-decision",
          "branch": "on_unavailable"
        },
        {
          "id": "verdict-decision",
          "branch": "on_refutes"
        },
        {
          "id": "contain-host"
        }
      ]
    },
    {
      "id": "close-hunt",
      "type": "task",
      "label": "Close hunt",
      "config": {
        "assignee": "analyst",
        "description": "Record examined evidence and visibility gaps.",
        "instructions": "Document findings and identify any trusted applications that require tuning in the baseline."
      },
      "parents": [
        {
          "id": "analyst-validation"
        }
      ]
    }
  ]
}