{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Social media scam ads are a multi-billion dollar problem targeting user credentials and local systems; identifying the transition from social feeds to external execution provides a high-value signal for preventing financial and data loss."
      },
      "name": "Ad-Driven Phishing and Malware Delivery",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1566.002",
        "attack.t1190",
        "attack.t1204.002",
        "attack.t1566.003",
        "credential access",
        "execution",
        "initial access"
      ],
      "related": [
        {
          "hunt": "browser-extension-malware-persistence",
          "reason": "Scam ads can also trick users into installing malicious browser extensions, which requires hb_software_inventory inspection.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A static rule for social media traffic is too noisy. This hunt uses a gated evaluation to contextually filter referrals and only alerts when rare binaries or suspicious form submissions occur on the same host.",
      "coverage": [
        {
          "stage": "initial-access-fraudulent-ads",
          "steps": [
            "lead-ad-traffic",
            "evaluate-lead"
          ],
          "status": "covered"
        },
        {
          "stage": "execution-fraudulent-software-install",
          "steps": [
            "rare-browser-spawned-processes"
          ],
          "status": "covered"
        },
        {
          "stage": "credential-access-phishing-harvesting",
          "steps": [
            "suspicious-form-submissions"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Initial Access via Scam Ads",
            "slug": "initial-access-fraudulent-ads",
            "tactic": "initial-access",
            "techniques": [
              "T1566",
              "T1190"
            ],
            "observables": [
              "Ad impressions on social media platforms (Meta, Instagram, Facebook)",
              "Sensational news headlines or clickbait used as lures",
              "Deepfaked celebrity endorsements for investment scams",
              "Traffic to domains mimicking legitimate brands or customer support",
              "Browser exploitation attempts via malicious ad scripts"
            ]
          },
          {
            "name": "User Execution of Malicious Installers",
            "slug": "execution-fraudulent-software-install",
            "tactic": "execution",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "User prompted to download software to fix 'computer infection'",
              "Execution of unknown or suspicious installers downloaded from browser",
              "AppX deployment or MsiInstaller events from browser-initiated downloads",
              "Installation of remote access software via social engineering pressure"
            ]
          },
          {
            "name": "Credential and Financial Information Harvesting",
            "slug": "credential-access-phishing-harvesting",
            "tactic": "credential-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "HTTP POST requests to fraudulent e-commerce sites or phishing pages",
              "User input into web forms for 'prize giveaways' or questionnaires",
              "Collection of card details, passwords, and personal identifiers (name, address, phone)",
              "Call-back numbers on ads routing to fraudulent support centers"
            ]
          }
        ],
        "summary": "Adversaries leverage fraudulent social media advertisements and search results to redirect users to phishing sites or deliver malware. The campaign uses social engineering tactics like fake security alerts and celebrity endorsements to trick victims into downloading malicious installers or submitting sensitive financial credentials to spoofed e-commerce domains."
      },
      "severity": "medium",
      "rationale": "Focus on endpoints where social media sites are accessed. Corporate proxies may mask the referrer, so prioritize hosts with local EDR agents providing unproxied process and HTTP events.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is using fraudulent social media advertisements to lure users into phishing sites or trick them into installing remote access tools, identified by browser-originating traffic from social platforms followed by rare process execution.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "hunt-standard",
            "kind": "manual",
            "observed": "2024-01-01"
          },
          "type": "list[host]",
          "default": [],
          "description": "Optional list of hosts to narrow the investigation; empty means the whole estate."
        },
        "browser_names": {
          "from": {
            "ref": "hunt-standard",
            "kind": "manual",
            "observed": "2024-01-01"
          },
          "type": "list[string]",
          "default": [
            "chrome.exe",
            "msedge.exe",
            "firefox.exe",
            "brave.exe",
            "safari.exe"
          ],
          "description": "Common browser executable names to monitor as parent processes."
        },
        "lookback_days": {
          "from": {
            "ref": "hunt-standard",
            "kind": "manual",
            "observed": "2024-01-01"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "sensitive_paths": {
          "from": {
            "ref": "hunt-standard",
            "kind": "manual",
            "observed": "2024-01-01"
          },
          "type": "list[path]",
          "default": [
            "/login",
            "/signin",
            "/auth",
            "/verify",
            "/bank",
            "/checkout",
            "/submit"
          ],
          "description": "URL path segments often used in phishing or harvesting forms."
        },
        "social_referrers": {
          "from": {
            "ref": "eset-research",
            "kind": "article",
            "observed": "2026-10-20"
          },
          "type": "list[domain]",
          "default": [
            "l.facebook.com",
            "t.co",
            "linkedin.com",
            "instagram.com",
            "tiktok.com",
            "fb.com"
          ],
          "description": "Referrer domains for social media platforms used as ad delivery vehicles."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.welivesecurity.com/en/social-media/is-ad-scam-how-tell-before-click/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.welivesecurity.com/en/social-media/is-ad-scam-how-tell-before-click/",
          "name": "ESET Research \u2014 Is the ad a scam? How to tell before you click"
        }
      ],
      "blind_spots": [
        {
          "id": "no-tls-decryption",
          "risk": "Encrypted network traffic prevents seeing the specific path or form data, leaving only the domain as evidence.",
          "stage": "initial-access-fraudulent-ads",
          "question": "whether the URL path or body for specific 'giveaway' lures was visible",
          "requires": "TLS inspection at the gateway or browser-level logging"
        },
        {
          "id": "telephony-blind-spot",
          "risk": "Phone-based social engineering is invisible to IT endpoint and network telemetry.",
          "stage": "initial-access-fraudulent-ads",
          "question": "whether a user called a phone number listed in a scam ad",
          "requires": "Telephony logs or external reporting"
        }
      ]
    },
    "name": "Ad-Driven Phishing and Malware Delivery",
    "description": "This hunt targets the complete lifecycle of a scam-ad intrusion. It begins by identifying users clicking through from social media platforms to external sites. The flow uses a gated design to first evaluate these leads before performing more resource-intensive queries for rare browser-spawned processes and credential harvesting activity. This allows the hunt to distinguish between legitimate social media browsing and the specific 'click-to-execution' pattern characteristic of malvertising and deepfaked celebrity investment scams."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "initial-access-fraudulent-ads",
            "steps": [
              "lead-ad-traffic",
              "evaluate-lead"
            ],
            "status": "covered"
          },
          {
            "stage": "execution-fraudulent-software-install",
            "steps": [
              "rare-browser-spawned-processes"
            ],
            "status": "covered"
          },
          {
            "stage": "credential-access-phishing-harvesting",
            "steps": [
              "suspicious-form-submissions"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary is using fraudulent social media advertisements to lure users into phishing sites or trick them into installing remote access tools, identified by browser-originating traffic from social platforms followed by rare process execution.",
        "blind_spots": [
          {
            "id": "no-tls-decryption",
            "risk": "Encrypted network traffic prevents seeing the specific path or form data, leaving only the domain as evidence.",
            "stage": "initial-access-fraudulent-ads",
            "question": "whether the URL path or body for specific 'giveaway' lures was visible",
            "requires": "TLS inspection at the gateway or browser-level logging"
          },
          {
            "id": "telephony-blind-spot",
            "risk": "Phone-based social engineering is invisible to IT endpoint and network telemetry.",
            "stage": "initial-access-fraudulent-ads",
            "question": "whether a user called a phone number listed in a scam ad",
            "requires": "Telephony logs or external reporting"
          }
        ],
        "scoping_notes": "Focus on endpoints where social media sites are accessed. Corporate proxies may mask the referrer, so prioritize hosts with local EDR agents providing unproxied process and HTTP events.",
        "beyond_detection": "A static rule for social media traffic is too noisy. This hunt uses a gated evaluation to contextually filter referrals and only alerts when rare binaries or suspicious form submissions occur on the same host."
      }
    },
    {
      "id": "lead-ad-traffic",
      "type": "query",
      "label": "External traffic from social media referrers",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, referrer, user_agent, time FROM hb_http_activity WHERE (instr(',' || '{{social_referrers}}' || ',', ',' || LOWER(referrer) || ',') > 0) AND (instr(',' || '{{social_referrers}}' || ',', ',' || LOWER(url_hostname) || ',') = 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Identify potential ad-click leads by finding HTTP requests where the referrer is a known social media domain and the target is an external site.",
        "expected_signal": "A list of hosts that followed a link from a social platform to an external domain. Silence suggests no such transitions occurred."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "External traffic from social media referrers",
        "reads": [
          "device_hostname",
          "url_hostname",
          "url_path",
          "referrer",
          "user_agent",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, referrer, user_agent, time FROM hb_http_activity WHERE (instr(',' || '{{social_referrers}}' || ',', ',' || LOWER(referrer) || ',') > 0) AND (instr(',' || '{{social_referrers}}' || ',', ',' || LOWER(url_hostname) || ',') = 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hosts that followed a link from a social platform to an external domain. Silence suggests no such transitions occurred.",
        "verified": "dry-run",
        "verified_at": "2026-10-21"
      }
    },
    {
      "id": "evaluate-lead",
      "type": "analytic",
      "label": "Evaluate the referral lead",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "web"
        ],
        "context": [
          "lead-ad-traffic"
        ],
        "objective": "Review the external domains reached from social media. Flag those that appear to be typosquats, investment sites, or tech support lures.",
        "description": "An agent determines if the ad-click leads warrant deeper inspection of process activity and POST submissions.",
        "max_iterations": 3,
        "expected_signal": "A summary of high-risk leads citing specific hosts and destination domains.",
        "success_criteria": "A per-host verdict on whether the referral looks like a scam ad interaction."
      },
      "parents": [
        {
          "id": "lead-ad-traffic"
        }
      ]
    },
    {
      "id": "gate-decision",
      "type": "checkpoint",
      "label": "Gate to fan-out",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the evaluate-lead verdict identifies at least one suspicious host or destination",
        "condition": "the evaluate-lead verdict identifies at least one suspicious host or destination",
        "blind_spot": "no-tls-decryption",
        "confidence": "high",
        "description": "Avoid expensive parallel queries if the initial ad-click evaluation finds no suspicious activity.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "evaluate-lead"
        }
      ]
    },
    {
      "id": "rare-browser-spawned-processes",
      "type": "query",
      "label": "Rare browser-spawned processes",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE (instr(',' || '{{browser_names}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0) AND (instr(LOWER(process_name), 'setup') > 0 OR instr(LOWER(process_name), 'install') > 0 OR instr(LOWER(process_cmd_line), 'anydesk') > 0 OR instr(LOWER(process_cmd_line), 'teamviewer') > 0 OR instr(LOWER(process_cmd_line), 'rustdesk') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY path HAVING hosts <= 3 ORDER BY hosts, runs",
        "surface": "hb_process_activity",
        "description": "Search for installers or remote access tools spawned directly from browser processes, stacked by prevalence to find unique host activity.",
        "expected_signal": "Browsers spawning binaries that are not widespread across the fleet. Rare installers suggest user-initiated execution from a scam site."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare browser-spawned processes",
        "reads": [
          "device_hostname",
          "process_path",
          "process_name",
          "process_cmd_line",
          "parent_process_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE (instr(',' || '{{browser_names}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0) AND (instr(LOWER(process_name), 'setup') > 0 OR instr(LOWER(process_name), 'install') > 0 OR instr(LOWER(process_cmd_line), 'anydesk') > 0 OR instr(LOWER(process_cmd_line), 'teamviewer') > 0 OR instr(LOWER(process_cmd_line), 'rustdesk') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY path HAVING hosts <= 3 ORDER BY hosts, runs",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Browsers spawning binaries that are not widespread across the fleet. Rare installers suggest user-initiated execution from a scam site.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "path"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-21"
      }
    },
    {
      "id": "suspicious-form-submissions",
      "type": "query",
      "label": "Suspicious web form submissions",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, http_method, request_body_len, referrer, time FROM hb_http_activity WHERE http_method = 'POST' AND (instr(',' || '{{sensitive_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Identify potential credential harvesting by finding POST requests to sensitive paths on the same hosts involved in ad clicks.",
        "expected_signal": "POST requests to login or verification paths on domains reached via social referrals. Silence means no harvesting submissions were recorded."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Suspicious web form submissions",
        "reads": [
          "device_hostname",
          "url_hostname",
          "url_path",
          "http_method",
          "request_body_len",
          "referrer",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, http_method, request_body_len, referrer, time FROM hb_http_activity WHERE http_method = 'POST' AND (instr(',' || '{{sensitive_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "POST requests to login or verification paths on domains reached via social referrals. Silence means no harvesting submissions were recorded.",
        "verified": "dry-run",
        "verified_at": "2026-10-21"
      }
    },
    {
      "id": "triage-full-chain",
      "type": "analytic",
      "label": "Weigh full intrusion evidence",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "web"
        ],
        "context": [
          "evaluate-lead",
          "rare-browser-spawned-processes",
          "suspicious-form-submissions"
        ],
        "objective": "Determine if any host showing suspicious ad referrals subsequently executed a rare binary or submitted data to a sensitive web path.",
        "description": "An agent correlates the initial referral context with follow-on execution and harvesting to reach a final verdict.",
        "max_iterations": 6,
        "expected_signal": "A malicious verdict for any host showing a 'referral -> execution' or 'referral -> submission' chain.",
        "success_criteria": "A verdict of malicious, suspicious, or benign per host, citing the chain of rows."
      },
      "parents": [
        {
          "id": "rare-browser-spawned-processes",
          "kind": "merge"
        },
        {
          "id": "suspicious-form-submissions",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-triage",
      "type": "checkpoint",
      "label": "Route on triage verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage-full-chain verdict is malicious for at least one host",
        "condition": "the triage-full-chain verdict is malicious for at least one host",
        "confidence": "high",
        "description": "Isolate hosts with confirmed malicious execution and route others for review.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-full-chain"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate compromised host",
      "config": {
        "target": "endpoint",
        "description": "Prevent further malware activity or credential misuse by severing the host's network connectivity.",
        "instructions": "Isolate the host immediately. Terminate the browser and any identified installer processes.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-triage",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst review and reporting",
      "config": {
        "assignee": "analyst",
        "description": "An analyst reviews findings to confirm the scam type and preserve evidence for bank reimbursement claims.",
        "instructions": "Review the cited browser activity and processes. If form submissions were detected, prompt the user for password changes and bank notification. Preserve the ad URL and domain for platform reporting."
      },
      "parents": [
        {
          "id": "route-on-triage",
          "branch": "default"
        },
        {
          "id": "route-on-triage",
          "branch": "on_unavailable"
        },
        {
          "id": "route-on-triage",
          "branch": "on_refutes"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Finalize the hunt and record coverage results.",
        "instructions": "Log the findings. Update the software inventory if any new unauthorized tools were found."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "default"
        },
        {
          "id": "gate-decision",
          "branch": "on_unavailable"
        },
        {
          "id": "gate-decision",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-review"
        }
      ]
    }
  ]
}