--- analysis: Detecting the SOAP call alone is noisy. This hunt is required to correlate administrative server activity with rare process-level baseline execution to find the specific, unauthorized document access that follows key theft. blind_spots: - id: no-endpoint-telemetry question: Was SharpRMS run on a non-enrolled device? requires: universal endpoint coverage risk: The SLC key allows for offline decryption. If the attacker moves the stolen documents and key to a personal or unmanaged machine, process telemetry will not see the decryption impact. stage: offline-unauthorized-decryption - id: file-magic-bytes-visibility question: Which files were identified as RMS-protected through byte-level scanning? requires: deep file inspection or EDR file-header logging risk: We cannot see the attacker sweeping shares for the D0-CF-11-E0 magic bytes via standard file activity logs, making the recon stage a blind spot. stage: recon-rms-protected-content coverage: - stage: initial-access-exploitation status: covered steps: - soap-export-activity - stage: rms-configuration-discovery status: covered steps: - discovery-activity - stage: slc-private-key-extraction status: covered steps: - assess-extraction - blind_spot: file-magic-bytes-visibility reason: Identifying OLE magic bytes or internal stream names requires deep file inspection not present in hb_file_activity. stage: recon-rms-protected-content status: not_visible - stage: offline-unauthorized-decryption status: covered steps: - unauthorized-decryption-activity - confirm-impact guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: The AD RMS SLC private key is the master root for all protected documents in a deployment. Because it cannot be rotated and remains valid for 255 years, its compromise is a permanent failure of data confidentiality. methodology: model-assisted trigger: intel-report hypothesis: An intruder has extracted the AD RMS Server Licensor Certificate (SLC) private key through a Trusted Publishing Domain export and is using it to decrypt protected documents offline. labels: - hunt - attack.t1003.001 - attack.t1082 - attack.t1083 - attack.t1190 - attack.t1005 name: AD RMS Master Key Extraction and Offline Decryption parameters: lookback_days: default: '14' description: Days of history to examine. type: number rms_admin_paths: default: - /wmcs/admin/server.asmx - /wmcs/admin/trustpolicy.asmx description: AD RMS admin SOAP endpoints used for TPD export. type: list[path] scope_hosts: default: [] description: Specific hosts identified in the scoping step to narrow the hunt. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.huntress.com/blog/ad-rms-slc-encryption-key gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Scope first to AD RMS servers using the software inventory. Use the resulting hostnames to populate the scope_hosts parameter, which narrows the HTTP and process searches to the most relevant infrastructure. references: - name: "Huntress \u2014 AD RMS SLC Encryption Key" url: https://www.huntress.com/blog/ad-rms-slc-encryption-key related: - hunt: ad-rms-client-side-bypass reason: This hunt focuses on root key theft and global decryption, whereas client-side bypasses focus on individual document policy stripping by authorized users. relation: out-of-scope-alternative scenario: stages: - name: Exploitation of AD RMS Service observables: - SOAP calls to VESUVIO admin endpoints - 'Targeting AD RMS Service Group identities: tony.soprano' slug: initial-access-exploitation tactic: initial-access techniques: - T1190 - name: AD RMS Key and Database Discovery observables: - SharpRMS tool execution - Querying keyprotection admin operation - 'Response containing IsServicePrivateKeySoftwareBased: true' - DatabaseConnectionString targeting data source=BARONE slug: rms-configuration-discovery tactic: discovery techniques: - T1082 - name: SLC Private Key Extraction via TPD Export observables: - Authenticated SOAP call to Trusted Publishing Domain (TPD) export endpoint - Extraction of 1172-byte SLC private key material - Integrated Security=SSPI authentication to SQL server BARONE slug: slc-private-key-extraction tactic: credential-access techniques: - T1003.001 - name: Identification of RMS Protected Documents observables: - Searching for files starting with OLE magic bytes D0-CF-11-E0-A1-B1-1A-E1 - Identifying OLE streams named Primary and EncryptedPackage - Targeting files like BOARD_MINUTES_2026.docx slug: recon-rms-protected-content tactic: discovery techniques: - T1083 - name: Offline Document Decryption observables: - Use of SharpRMS for offline decryption using extracted SLC key - Accessing protected .docx files by non-authorized users like paulie.gualtieri slug: offline-unauthorized-decryption tactic: collection techniques: - T1005 summary: An attacker with AD RMS Service Group membership identifies protected assets and extracts the long-lived, unrotatable Server Licensor Certificate (SLC) private key via a Trusted Publishing Domain (TPD) export operation. This key acts as a master key for the entire deployment, allowing for permanent offline decryption of every document ever protected by the cluster, even after the infrastructure is rebuilt. severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # AD RMS Master Key Extraction and Offline Decryption This hunt identifies the extraction of the AD RMS root key (SLC) and subsequent unauthorized document decryption. The Server Licensor Certificate is a long-lived root of trust that allows for the permanent, offline decryption of any document protected by that cluster. The flow identifies AD RMS servers, detects administrative discovery and SOAP-based TPD export calls, and then baselines rare decryption-related process activity to identify unauthorized data access across the fleet. ## identify-rms-servers Find hosts with AD RMS software installed to narrow the search for administrative activity. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of hostnames running AD RMS components. Silence means no AD RMS installations were found in the current inventory. reads: - package_name - vendor_name - device_hostname silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-09-20' ~~~ SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%rights management%' OR LOWER(vendor_name) LIKE '%microsoft%rms%') ``` ## early-stage-parallel parallel: - → soap-export-activity - → discovery-activity join: → assess-extraction ## soap-export-activity Detect successful HTTP requests to the AD RMS Trusted Publishing Domain export endpoints. ```sqlite target=web role=triage params=(lookback_days=lookback_days, scope_hosts=scope_hosts, rms_admin_paths=rms_admin_paths) ~~~yaml expected: Successful 200 OK responses to AD RMS admin paths. Silence proves no successful TPD exports were observed in this window. reads: - url_path - device_hostname - actor_user_name - status_code - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, url_path, actor_user_name, src_endpoint_ip, time FROM hb_http_activity WHERE (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND instr(',' || '{{rms_admin_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0 AND (status_code = 200 OR status_code = '200') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## discovery-activity Identify process execution related to SharpRMS or the keyprotection command used to verify if the key is software-based. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Command lines explicitly referencing AD RMS discovery tools or operations. Silence suggests no such discovery tools were launched on the managed estate. reads: - process_cmd_line - user_name - device_hostname - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND (LOWER(process_cmd_line) LIKE '%sharperms%' OR LOWER(process_cmd_line) LIKE '%keyprotection%') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## assess-extraction ```agent target=hunter cite: required context: - soap-export-activity - discovery-activity max_iterations: 4 objective: Determine if the SOAP activity and discovery command lines together indicate a successful SLC key extraction by a Service Group member. success_criteria: A per-host verdict of malicious, suspicious, or benign citing the relevant rows. tools: - endpoint - web ``` ## unauthorized-decryption-activity Baseline rare decryption activity across the fleet to identify the impact of the stolen SLC key. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Process command lines indicating offline decryption on hosts where the user is not a service administrator. Silence confirms no unauthorized decryption tools were detected. prevalence: by: device_hostname key: - process_cmd_line rare_below: 3 reads: - process_cmd_line - device_hostname - user_name - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT process_cmd_line, device_hostname, user_name, MIN(time) AS first_seen, COUNT(*) AS execution_count FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%--decrypt%' OR LOWER(process_cmd_line) LIKE '%--slc%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_cmd_line, device_hostname, user_name HAVING COUNT(DISTINCT device_hostname) <= 3 ``` ## confirm-impact ```agent target=hunter cite: required context: - assess-extraction - unauthorized-decryption-activity max_iterations: 4 objective: Verify if the rare decryption events correlate with the previously identified stolen key extraction to confirm a data breach. success_criteria: A final malicious verdict for any host where a stolen key was used for decryption. tools: - endpoint - web ``` ## route-on-impact if~: "the confirm-impact verdict is malicious for at least one host involving stolen SLC keys" (confidence: high, judge=hunter) then: → isolate-beachhead indeterminate: → document-exposure unavailable: → document-exposure (blind_spot: no-endpoint-telemetry) else: → close-out ## isolate-beachhead ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host where decryption was observed and disable the AD RMS Service Group account. Since the SLC key is unrotatable, notify the data protection team that all previously protected content must be considered exposed. ``` → document-exposure ## document-exposure ```manual target=analyst Review hb_file_activity for the host and time window identified. Look for access to .docx or .xlsx files by the process identified in unauthorized-decryption-activity. Identify which sensitive shares were swept for OLE magic bytes. ``` → close-out ## close-out ```manual target=analyst Record the results of the hunt. If no activity was found, document that the HTTP and process telemetry confirmed the integrity of the AD RMS root key for this window. ``` → end