{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Adversaries using automation and AI to manage thousands of stolen sessions represents a significant escalation in capability. Identifying these hubs neutralizes large-scale phishing backends."
      },
      "name": "Adversary Operational Workflow and AI Automation",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1090.003",
        "attack.t1176",
        "attack.t1566"
      ],
      "related": [
        {
          "hunt": "evilginx-infrastructure-detection",
          "reason": "This hunt focuses on the adversary operating machine, not the phishing landing pages themselves.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A single alert on Make.com or AI tools is prone to noise. This hunt identifies the cluster of research, automation, and session management characterizing an adversary operating machine.",
      "coverage": [
        {
          "stage": "phishing-research-and-ai-generation",
          "steps": [
            "ai-research-dns"
          ],
          "status": "covered"
        },
        {
          "stage": "automation-infrastructure-setup",
          "steps": [
            "automation-infra-dns"
          ],
          "status": "covered"
        },
        {
          "stage": "identity-persistence-via-session-refresh",
          "steps": [
            "identity-session-maintenance"
          ],
          "status": "covered"
        },
        {
          "stage": "host-persistence-and-tool-usage",
          "steps": [
            "scope-security-tools",
            "adversary-tool-usage"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "AI-Assisted Phishing and Target Research",
            "slug": "phishing-research-and-ai-generation",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "censys.io",
              "toolbaz.com",
              "docsbot.ai",
              "explo.ai",
              "translate.google.com",
              "search for Evilginx instances",
              "csv generator ai",
              "free ai no signup"
            ]
          },
          {
            "name": "Workflow Automation and Bot Communication",
            "slug": "automation-infrastructure-setup",
            "tactic": "command-and-control",
            "techniques": [
              "T1090.003"
            ],
            "observables": [
              "make.com",
              "api.telegram.org",
              "Telegram Bot APIs",
              "webhook configuration",
              "AS 12651980 CANADA INC"
            ]
          },
          {
            "name": "Identity Access and Session Maintenance",
            "slug": "identity-persistence-via-session-refresh",
            "tactic": "persistence",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "session token refreshing",
              "access to 2471 unique identities",
              "malicious mail rule creation"
            ]
          },
          {
            "name": "Endpoint Persistence and Software Discovery",
            "slug": "host-persistence-and-tool-usage",
            "tactic": "persistence",
            "techniques": [
              "T1176"
            ],
            "observables": [
              "Malwarebytes Browser Guard extension",
              "autoruns.exe",
              "unique machine name",
              "Bitdefender search"
            ]
          }
        ],
        "summary": "A threat actor accidentally installed a security agent on their own operating host, revealing a workflow that utilizes AI tools like Make.com and Toolbaz to automate phishing and message crafting. The adversary searched for Evilginx instances via Censys and maintained access to thousands of compromised identities through session token refreshes from infrastructure hosted on the VIRTUO AS."
      },
      "severity": "high",
      "rationale": "Focus first on systems with multiple security products (Malwarebytes, Bitdefender) as adversaries often use them for testing evasion. The identity sign-in query is fleet-wide to identify the source IP.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is operating a jump box characterized by the installation of multiple security products for research, the use of AI for phishing content generation, and high-volume session maintenance across many compromised identities.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Optional list of hostnames to narrow the search; leave empty for fleet-wide."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "automation_domains": {
          "from": {
            "ref": "https://www.huntress.com/blog/rare-look-inside-attacker-operation",
            "kind": "article",
            "observed": "2024-09-09"
          },
          "type": "list[domain]",
          "default": [
            "make.com",
            "api.telegram.org"
          ],
          "description": "Workflow automation and bot communication domains."
        },
        "ai_research_domains": {
          "from": {
            "ref": "https://www.huntress.com/blog/rare-look-inside-attacker-operation",
            "kind": "article",
            "observed": "2024-09-09"
          },
          "type": "list[domain]",
          "default": [
            "toolbaz.com",
            "docsbot.ai",
            "explo.ai",
            "translate.google.com",
            "censys.io"
          ],
          "description": "AI writing assistants and phishing research domains used by the adversary."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.huntress.com/blog/rare-look-inside-attacker-operation",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.huntress.com/blog/rare-look-inside-attacker-operation",
          "name": "Huntress Blog \u2014 Rare Look Inside Attacker Operation"
        }
      ],
      "blind_spots": [
        {
          "id": "nat-correlation-gap",
          "risk": "A sign-in anomaly identifies a network location but cannot pin it to a device without additional correlation data.",
          "stage": "identity-persistence-via-session-refresh",
          "question": "Which specific device belongs to the IP performing high-volume sign-ins?",
          "requires": "VPN or DHCP logs correlating src_endpoint_ip to internal hostnames"
        },
        {
          "id": "dns-visibility-limitation",
          "risk": "Standard DNS logging misses lookups if the adversary uses custom DNS-over-HTTPS providers.",
          "stage": "phishing-research-and-ai-generation",
          "question": "Is the adversary using DoH to hide AI research activity?",
          "requires": "Endpoint process-to-network correlation with SNI capture"
        }
      ]
    },
    "name": "Adversary Operational Workflow and AI Automation",
    "description": "This hunt identifies the operating patterns of a professional threat actor who integrates workflow automation and AI into their phishing operations. It follows the adversary's lifecycle from initial software evaluation and research to the backend management of thousands of stolen user sessions. By clustering competitor security software installation with AI writing assistant usage and high-volume authentication attempts from a single source, the hunt pinpoints the attacker's primary infrastructure."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "phishing-research-and-ai-generation",
            "steps": [
              "ai-research-dns"
            ],
            "status": "covered"
          },
          {
            "stage": "automation-infrastructure-setup",
            "steps": [
              "automation-infra-dns"
            ],
            "status": "covered"
          },
          {
            "stage": "identity-persistence-via-session-refresh",
            "steps": [
              "identity-session-maintenance"
            ],
            "status": "covered"
          },
          {
            "stage": "host-persistence-and-tool-usage",
            "steps": [
              "scope-security-tools",
              "adversary-tool-usage"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary is operating a jump box characterized by the installation of multiple security products for research, the use of AI for phishing content generation, and high-volume session maintenance across many compromised identities.",
        "blind_spots": [
          {
            "id": "nat-correlation-gap",
            "risk": "A sign-in anomaly identifies a network location but cannot pin it to a device without additional correlation data.",
            "stage": "identity-persistence-via-session-refresh",
            "question": "Which specific device belongs to the IP performing high-volume sign-ins?",
            "requires": "VPN or DHCP logs correlating src_endpoint_ip to internal hostnames"
          },
          {
            "id": "dns-visibility-limitation",
            "risk": "Standard DNS logging misses lookups if the adversary uses custom DNS-over-HTTPS providers.",
            "stage": "phishing-research-and-ai-generation",
            "question": "Is the adversary using DoH to hide AI research activity?",
            "requires": "Endpoint process-to-network correlation with SNI capture"
          }
        ],
        "scoping_notes": "Focus first on systems with multiple security products (Malwarebytes, Bitdefender) as adversaries often use them for testing evasion. The identity sign-in query is fleet-wide to identify the source IP.",
        "beyond_detection": "A single alert on Make.com or AI tools is prone to noise. This hunt identifies the cluster of research, automation, and session management characterizing an adversary operating machine."
      }
    },
    {
      "id": "scope-security-tools",
      "type": "query",
      "label": "Identify hosts with overlapping security tools",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, COUNT(DISTINCT package_name) as tool_count FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%malwarebytes%' OR LOWER(package_name) LIKE '%bitdefender%' OR LOWER(package_name) LIKE '%huntress%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname HAVING tool_count > 1",
        "surface": "hb_software_inventory",
        "description": "Find systems where multiple security agents are installed, indicating an adversary evaluating competitor defenses.",
        "expected_signal": "Hosts with more than one security product installed; standard assets usually run exactly one."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify hosts with overlapping security tools",
        "reads": [
          "device_hostname",
          "package_name"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT device_hostname, COUNT(DISTINCT package_name) as tool_count FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%malwarebytes%' OR LOWER(package_name) LIKE '%bitdefender%' OR LOWER(package_name) LIKE '%huntress%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname HAVING tool_count > 1",
        "silence": "not_evidence_of_absence",
        "expected": "Hosts with more than one security product installed; standard assets usually run exactly one.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "ai-research-dns",
      "type": "query",
      "label": "DNS queries for AI writing and research",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT device_hostname, query_hostname, COUNT(*) AS lookup_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE instr(',' || '{{ai_research_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, query_hostname",
        "surface": "hb_dns_activity",
        "description": "Identify hosts resolving domains for AI-driven text generation and vulnerability research.",
        "expected_signal": "Rare resolutions for AI writing assistants or Censys. This establishes the phishing research phase."
      },
      "parents": [
        {
          "id": "scope-security-tools"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "DNS queries for AI writing and research",
        "reads": [
          "device_hostname",
          "query_hostname",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, query_hostname, COUNT(*) AS lookup_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE instr(',' || '{{ai_research_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, query_hostname",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Rare resolutions for AI writing assistants or Censys. This establishes the phishing research phase.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "query_hostname"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "automation-infra-dns",
      "type": "query",
      "label": "Automation infrastructure lookups",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_hostname, query_hostname, COUNT(*) AS lookup_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE instr(',' || '{{automation_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, query_hostname",
        "surface": "hb_dns_activity",
        "description": "Identify traffic to automation platforms and bot APIs used for command and control.",
        "expected_signal": "Hosts resolving Make.com or Telegram API establishing automated infrastructure presence."
      },
      "parents": [
        {
          "id": "scope-security-tools"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Automation infrastructure lookups",
        "reads": [
          "device_hostname",
          "query_hostname",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, query_hostname, COUNT(*) AS lookup_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE instr(',' || '{{automation_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, query_hostname",
        "silence": "not_evidence_of_absence",
        "expected": "Hosts resolving Make.com or Telegram API establishing automated infrastructure presence.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "early-stage-triage",
      "type": "analytic",
      "label": "Triage early research and automation",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "network"
        ],
        "context": [
          "scope-security-tools",
          "ai-research-dns",
          "automation-infra-dns"
        ],
        "objective": "Identify hosts displaying clustered activity of security software evaluation, AI research, and automation. Distinguish between an external attacker VPS (public IP, no agent presence) and a compromised internal host (private IP, agent present in software inventory).",
        "description": "Determine if any host shows a cluster of AI research and automation setup activity.",
        "max_iterations": 3,
        "expected_signal": "A list of hosts meeting the adversary jump box research profile.",
        "success_criteria": "A verdict for each host specifying if the pattern matches an adversary operating host."
      },
      "parents": [
        {
          "id": "ai-research-dns",
          "kind": "merge"
        },
        {
          "id": "automation-infra-dns",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "identity-session-maintenance",
      "type": "query",
      "label": "High-volume identity access from single IP",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "identity",
        "content": "SELECT src_endpoint_ip, COUNT(DISTINCT actor_user_name) AS unique_identities, COUNT(*) AS auth_events, MIN(time) AS first_seen FROM hb_auth_signin WHERE time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip HAVING unique_identities > 5 ORDER BY unique_identities DESC",
        "surface": "hb_auth_signin",
        "description": "Identify source IPs maintaining access to many unique identities.",
        "expected_signal": "A single IP address managing sessions for a disproportionate number of users."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "High-volume identity access from single IP",
        "reads": [
          "src_endpoint_ip",
          "actor_user_name",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT src_endpoint_ip, COUNT(DISTINCT actor_user_name) AS unique_identities, COUNT(*) AS auth_events, MIN(time) AS first_seen FROM hb_auth_signin WHERE time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip HAVING unique_identities > 5 ORDER BY unique_identities DESC",
        "silence": "not_evidence_of_absence",
        "expected": "A single IP address managing sessions for a disproportionate number of users.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "ip-to-device-correlation",
      "type": "query",
      "label": "Correlate IP to internal hostname",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "network",
        "content": "SELECT DISTINCT src_endpoint_ip, device_hostname FROM hb_network_connection WHERE state_kind = 'log' AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_network_connection",
        "description": "Map source IPs from the authentication logs back to internal hostnames using network events.",
        "expected_signal": "Rows mapping suspicious IPs to specific internal devices."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Correlate IP to internal hostname",
        "reads": [
          "src_endpoint_ip",
          "device_hostname",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT DISTINCT src_endpoint_ip, device_hostname FROM hb_network_connection WHERE state_kind = 'log' AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Rows mapping suspicious IPs to specific internal devices.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "adversary-tool-usage",
      "type": "query",
      "label": "Execution of research and persistence tools",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%autoruns%' OR LOWER(process_name) LIKE '%rclone%' OR LOWER(process_name) LIKE '%anydesk%' OR LOWER(process_cmd_line) LIKE '%evilginx%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "surface": "hb_process_activity",
        "description": "Identify execution of tools like Autoruns, rclone, or AnyDesk on candidate hosts.",
        "expected_signal": "Process execution rows showing attacker tools on a host identified in previous phases."
      },
      "parents": [
        {
          "id": "identity-session-maintenance",
          "kind": "merge"
        },
        {
          "id": "ip-to-device-correlation",
          "kind": "merge"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Execution of research and persistence tools",
        "reads": [
          "device_hostname",
          "process_name",
          "process_cmd_line",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%autoruns%' OR LOWER(process_name) LIKE '%rclone%' OR LOWER(process_name) LIKE '%anydesk%' OR LOWER(process_cmd_line) LIKE '%evilginx%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "silence": "not_evidence_of_absence",
        "expected": "Process execution rows showing attacker tools on a host identified in previous phases.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "final-operational-triage",
      "type": "analytic",
      "label": "Final operational verdict",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "network"
        ],
        "context": [
          "early-stage-triage",
          "identity-session-maintenance",
          "ip-to-device-correlation",
          "adversary-tool-usage"
        ],
        "objective": "Determine if a host or IP is functioning as an adversary jump box by correlating AI research, automation DNS, high-volume identity access, and specific tool execution.",
        "description": "Synthesize early indicators with high-volume session maintenance and tool usage.",
        "max_iterations": 6,
        "expected_signal": "A high-confidence determination of malicious operational activity.",
        "success_criteria": "A final verdict of malicious per host/IP, citing evidence across all phases."
      },
      "parents": [
        {
          "id": "adversary-tool-usage"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on final verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the final-operational-triage verdict is malicious for at least one host or source IP",
        "condition": "the final-operational-triage verdict is malicious for at least one host or source IP",
        "blind_spot": "nat-correlation-gap",
        "confidence": "high",
        "description": "Direct the hunt outcome based on the severity of clustered activity.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "final-operational-triage"
        }
      ]
    },
    {
      "id": "contain-and-revoke",
      "type": "action",
      "label": "Contain host and revoke sessions",
      "config": {
        "target": "endpoint",
        "description": "Sever the adversary access to the endpoint and the managed identities.",
        "instructions": "Isolate the suspect jump box via EDR. Revoke all active sessions and refresh MFA for every identity identified in the session maintenance step.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-audit",
      "type": "task",
      "label": "Remediation audit and mail rule review",
      "config": {
        "assignee": "analyst",
        "description": "Confirm effective containment and audit for persistent malicious rules.",
        "instructions": "Verify host isolation. Manually audit compromised identities for mail-forwarding or hiding rules created to sustain access."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "contain-and-revoke"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Finalize the hunt and document results.",
        "instructions": "Record identified adversary infrastructure. Update AI and automation domain parameters if new indicators were discovered."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-audit"
        }
      ]
    }
  ]
}