{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Autonomous agents compress attack timelines from weeks to hours; early detection of their internal footprint prevents catastrophic data loss and encryption."
      },
      "name": "Agentic Swarm Traversal and C2 Coordination",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1133",
        "attack.t1071.004",
        "attack.t1486",
        "attack.t1566",
        "command and control",
        "impact",
        "initial access",
        "persistence"
      ],
      "series": {
        "slug": "one-breach-please-and-make-no-mistakes",
        "index": 2,
        "title": "One breach, please, and make no mistakes",
        "total": 2
      },
      "related": [
        {
          "hunt": "agentic-initial-access-phishing",
          "reason": "This hunt targets post-compromise traversal, while entry via spoofed identities is handled separately.",
          "relation": "out-of-scope-alternative"
        },
        {
          "hunt": "autonomous-perimeter-probing-identity-abuse",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A single rule might fire on a GPO change, but it cannot correlate it with an hourly DNS burst and a sudden file-touch burst on the same host to distinguish a swarm from an administrator.",
      "coverage": [
        {
          "stage": "persistence-and-traversal",
          "steps": [
            "ad-gpo-persistence-lead"
          ],
          "status": "covered"
        },
        {
          "stage": "c2-dns-beaconing",
          "steps": [
            "dns-coordination-beaconing"
          ],
          "status": "covered"
        },
        {
          "stage": "exfiltration-and-impact",
          "steps": [
            "mass-file-system-impact"
          ],
          "status": "covered"
        },
        {
          "stage": "exploit-public-facing-app",
          "reason": "Belongs to another part of the 'One breach, please, and make no mistakes' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "identity-access-phishing",
          "reason": "Belongs to another part of the 'One breach, please, and make no mistakes' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Exploitation of Public-Facing Applications",
            "slug": "exploit-public-facing-app",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "High volume of SQL injection attempts",
              "Requests from Python, curl, or wget user agents",
              "Spike in WAF alerts",
              "Automated traffic hitting unpatched vulnerabilities"
            ]
          },
          {
            "name": "Identity Access and Phishing",
            "slug": "identity-access-phishing",
            "tactic": "initial-access",
            "techniques": [
              "T1566",
              "T1133"
            ],
            "observables": [
              "Phishing invoices sent at volume",
              "HR onboarding requests for fabricated identities",
              "MFA prompt-bombing (push/SMS fatigue)",
              "VPN access attempts with valid credentials"
            ]
          },
          {
            "name": "Internal Persistence and Traversal",
            "slug": "persistence-and-traversal",
            "tactic": "persistence",
            "techniques": [
              "T1133"
            ],
            "observables": [
              "Malicious Group Policy Object (GPO) deployment",
              "Active Directory modifications",
              "Spike in east-west network traffic",
              "Rapid rotation of stolen credentials",
              "Worm-like traversal through internal segments"
            ]
          },
          {
            "name": "Application Layer C2",
            "slug": "c2-dns-beaconing",
            "tactic": "command-and-control",
            "techniques": [
              "T1071"
            ],
            "observables": [
              "DNS beaconing for command-and-control",
              "Anomalous DNS query volume",
              "Traffic to external infrastructure used for agent coordination"
            ]
          },
          {
            "name": "Data Exfiltration and Impact",
            "slug": "exfiltration-and-impact",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "Theft of AI model weights",
              "Theft of customer data",
              "Encryption of local and remote drives",
              "Spam and package stuffing on public repositories (e.g., RubyGems)"
            ]
          }
        ],
        "summary": "Autonomous AI agent swarms automate and compress the attack lifecycle into hours, utilizing high-volume automated probing, phishing, and vulnerability exploitation. Once inside, the agents adapt in real-time to traverse the network via Active Directory and DNS-based command-and-control to exfiltrate AI model weights or encrypt data."
      },
      "severity": "high",
      "rationale": "Focus the lookback and scope on domain controllers and high-value servers hosting proprietary data or AI models as identified in the article.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An autonomous agent swarm is maintaining persistence through Active Directory GPO modifications while coordinating data theft via high-volume DNS beaconing and rapid file encryption.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Limit analysis to specific domain controllers or sensitive file servers."
        },
        "lookback_days": {
          "type": "number",
          "default": "7",
          "description": "Days of historical telemetry to examine."
        },
        "min_dns_hourly": {
          "type": "number",
          "default": "1000",
          "description": "Hourly threshold for DNS queries to a single domain to flag as coordination."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://blog.talosintelligence.com/one-breach-please-and-make-no-mistakes/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://blog.talosintelligence.com/one-breach-please-and-make-no-mistakes/",
          "name": "Talos \u2014 One breach, please, and make no mistakes"
        }
      ],
      "blind_spots": [
        {
          "id": "limited-endpoint-telemetry",
          "risk": "A swarm could target a server segment without endpoint logging, leaving only AD audit logs visible.",
          "owner": "Infrastructure Team",
          "stage": "exfiltration-and-impact",
          "question": "whether a process on an unmanaged host is encrypting files",
          "requires": "EDR coverage on 100% of servers",
          "remediation": "Audit EDR deployment across sensitive database and model tiers."
        },
        {
          "id": "dns-over-https-coordination",
          "risk": "Agents using DoH bypass the hb_dns_activity surface, making the coordination layer invisible to this hunt.",
          "owner": "Network Security Team",
          "stage": "c2-dns-beaconing",
          "question": "whether coordination traffic is hidden in HTTPS streams",
          "requires": "TLS inspection of DoH traffic",
          "remediation": "Enforce local DNS resolvers and block external DoH endpoints."
        }
      ]
    },
    "name": "Agentic Swarm Traversal and C2 Coordination",
    "description": "This hunt identifies the footprint of an AI-driven swarm that use automation to traverse networks at machine speed. It looks for the early noisy signs of agentic activity: unauthorized Active Directory policy modifications, followed by a parallel check for anomalous DNS coordination traffic and mass file system interactions typical of data exfiltration or encryption for impact."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "one-breach-please-and-make-no-mistakes",
          "index": 2,
          "title": "One breach, please, and make no mistakes",
          "total": 2
        },
        "coverage": [
          {
            "stage": "persistence-and-traversal",
            "steps": [
              "ad-gpo-persistence-lead"
            ],
            "status": "covered"
          },
          {
            "stage": "c2-dns-beaconing",
            "steps": [
              "dns-coordination-beaconing"
            ],
            "status": "covered"
          },
          {
            "stage": "exfiltration-and-impact",
            "steps": [
              "mass-file-system-impact"
            ],
            "status": "covered"
          },
          {
            "stage": "exploit-public-facing-app",
            "reason": "Belongs to another part of the 'One breach, please, and make no mistakes' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "identity-access-phishing",
            "reason": "Belongs to another part of the 'One breach, please, and make no mistakes' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An autonomous agent swarm is maintaining persistence through Active Directory GPO modifications while coordinating data theft via high-volume DNS beaconing and rapid file encryption.",
        "blind_spots": [
          {
            "id": "limited-endpoint-telemetry",
            "risk": "A swarm could target a server segment without endpoint logging, leaving only AD audit logs visible.",
            "owner": "Infrastructure Team",
            "stage": "exfiltration-and-impact",
            "question": "whether a process on an unmanaged host is encrypting files",
            "requires": "EDR coverage on 100% of servers",
            "remediation": "Audit EDR deployment across sensitive database and model tiers."
          },
          {
            "id": "dns-over-https-coordination",
            "risk": "Agents using DoH bypass the hb_dns_activity surface, making the coordination layer invisible to this hunt.",
            "owner": "Network Security Team",
            "stage": "c2-dns-beaconing",
            "question": "whether coordination traffic is hidden in HTTPS streams",
            "requires": "TLS inspection of DoH traffic",
            "remediation": "Enforce local DNS resolvers and block external DoH endpoints."
          }
        ],
        "scoping_notes": "Focus the lookback and scope on domain controllers and high-value servers hosting proprietary data or AI models as identified in the article.",
        "beyond_detection": "A single rule might fire on a GPO change, but it cannot correlate it with an hourly DNS burst and a sudden file-touch burst on the same host to distinguish a swarm from an administrator."
      }
    },
    {
      "id": "ad-gpo-persistence-lead",
      "type": "query",
      "label": "Suspicious GPO and AD Entity Modifications",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, entity_name, actor_user_name, actor_user_uid, attribute_name, attribute_value, time FROM hb_entity_management WHERE activity_id IN (1, 3) AND (LOWER(entity_name) LIKE '%\\cn=policies%' OR LOWER(entity_name) LIKE '%\\cn=gpo%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_entity_management",
        "description": "Identify unauthorized modifications to Group Policy Objects or sensitive AD containers that indicate an agent swarm establishing persistent internal traversal.",
        "expected_signal": "Rows indicating creation or update of GPO attributes by unexpected service accounts or newly seen administrative principals. Silence suggests no active AD-level persistence was attempted."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Suspicious GPO and AD Entity Modifications",
        "reads": [
          "device_hostname",
          "entity_name",
          "actor_user_name",
          "actor_user_uid",
          "attribute_name",
          "attribute_value",
          "time"
        ],
        "source": "hb_entity_management",
        "target": "endpoint",
        "content": "SELECT device_hostname, entity_name, actor_user_name, actor_user_uid, attribute_name, attribute_value, time FROM hb_entity_management WHERE activity_id IN (1, 3) AND (LOWER(entity_name) LIKE '%\\cn=policies%' OR LOWER(entity_name) LIKE '%\\cn=gpo%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Rows indicating creation or update of GPO attributes by unexpected service accounts or newly seen administrative principals. Silence suggests no active AD-level persistence was attempted.",
        "verified": "dry-run",
        "verified_at": "2026-10-08"
      }
    },
    {
      "id": "dns-coordination-beaconing",
      "type": "query",
      "label": "Anomalous DNS Query Volume",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT device_hostname, query_hostname, COUNT(*) as query_count, strftime('%Y-%m-%d %H', time) as burst_hour FROM hb_dns_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname, burst_hour HAVING query_count > {{min_dns_hourly}}",
        "surface": "hb_dns_activity",
        "description": "Detect high-frequency DNS query bursts that indicate agent coordination or C2 heartbeats using DNS as an transport.",
        "expected_signal": "A single host querying the same domain over 1000 times in an hour. Low volume suggest the swarm is dormant or using stealthier protocols."
      },
      "parents": [
        {
          "id": "ad-gpo-persistence-lead"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Anomalous DNS Query Volume",
        "reads": [
          "device_hostname",
          "query_hostname",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, query_hostname, COUNT(*) as query_count, strftime('%Y-%m-%d %H', time) as burst_hour FROM hb_dns_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname, burst_hour HAVING query_count > {{min_dns_hourly}}",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "new_this_window"
        },
        "expected": "A single host querying the same domain over 1000 times in an hour. Low volume suggest the swarm is dormant or using stealthier protocols.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "query_hostname"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-08"
      }
    },
    {
      "id": "mass-file-system-impact",
      "type": "query",
      "label": "High-Density File Activity Bursts",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, COUNT(DISTINCT file_path) as unique_files_touched, strftime('%Y-%m-%d %H', time) as burst_hour FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id IN (1, 3, 4) AND LOWER(process_name) NOT LIKE '%backup%' AND LOWER(process_name) NOT LIKE '%msmpeng%' AND LOWER(process_name) NOT LIKE '%search%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, burst_hour HAVING unique_files_touched > 500",
        "surface": "hb_file_activity",
        "description": "Identify processes interacting with an unusually large number of distinct files in a short window, suggesting exfiltration or encryption.",
        "expected_signal": "A process touching 500+ unique files in an hour. Excludes common system processes to minimize noise."
      },
      "parents": [
        {
          "id": "ad-gpo-persistence-lead"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "High-Density File Activity Bursts",
        "reads": [
          "device_hostname",
          "process_name",
          "file_path",
          "time",
          "activity_id"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, COUNT(DISTINCT file_path) as unique_files_touched, strftime('%Y-%m-%d %H', time) as burst_hour FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id IN (1, 3, 4) AND LOWER(process_name) NOT LIKE '%backup%' AND LOWER(process_name) NOT LIKE '%msmpeng%' AND LOWER(process_name) NOT LIKE '%search%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, burst_hour HAVING unique_files_touched > 500",
        "silence": "not_evidence_of_absence",
        "expected": "A process touching 500+ unique files in an hour. Excludes common system processes to minimize noise.",
        "verified": "dry-run",
        "verified_at": "2026-10-08"
      }
    },
    {
      "id": "agent-triage-swarm",
      "type": "analytic",
      "label": "Weigh Coordinated Swarm Evidence",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint"
        ],
        "context": [
          "ad-gpo-persistence-lead",
          "dns-coordination-beaconing",
          "mass-file-system-impact"
        ],
        "objective": "Determine if the evidence indicates a coordinated agent swarm. Prioritize hosts where at least two of the three telemetry leads overlap in time, as isolated GPO changes or high-density file touches can occur during normal administration.",
        "description": "Synthesize AD modifications, DNS coordination patterns, and high-density file activity to confirm an autonomous intrusion.",
        "max_iterations": 6,
        "expected_signal": "A detailed verdict citing temporal overlaps between telemetry surfaces.",
        "success_criteria": "Verdicts citing rows where AD modifications correlate with DNS or file bursts on the same host or for the same user account."
      },
      "parents": [
        {
          "id": "dns-coordination-beaconing",
          "kind": "merge"
        },
        {
          "id": "mass-file-system-impact",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "decision-on-verdict",
      "type": "checkpoint",
      "label": "Route on Swarm Verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the agent triage indicates a high-confidence coordinated intrusion involving AD persistence and anomalous volume on a single host",
        "condition": "the agent triage indicates a high-confidence coordinated intrusion involving AD persistence and anomalous volume on a single host",
        "blind_spot": "limited-endpoint-telemetry",
        "confidence": "high",
        "description": "Direct the hunt to immediate isolation or manual review.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "agent-triage-swarm"
        }
      ]
    },
    {
      "id": "isolate-compromised-host",
      "type": "action",
      "label": "Isolate Compromised Host",
      "config": {
        "target": "endpoint",
        "description": "Halt the traversal of the agent swarm by isolating the beachhead device.",
        "instructions": "Isolate the device_hostname identified in the malicious verdict. Request explicit approval before isolating any domain controller.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "decision-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "manual-analyst-review",
      "type": "task",
      "label": "Manual Analyst Review",
      "config": {
        "assignee": "analyst",
        "description": "Verify the coordinated findings and investigate the scope of the actor's session.",
        "instructions": "Review the cited DNS coordination domains and file bursts. Pivot to hb_auth_signin using the actor_user_name from the AD modifications to check for other compromised sessions."
      },
      "parents": [
        {
          "id": "decision-on-verdict",
          "branch": "default"
        },
        {
          "id": "decision-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-compromised-host"
        }
      ]
    },
    {
      "id": "close-out-negative",
      "type": "task",
      "label": "Close Out and Document",
      "config": {
        "assignee": "analyst",
        "description": "Document the hunt results and tune thresholds.",
        "instructions": "Record the findings. If no activity was found, update the thresholds in the parameters if the hunt produced excessive noise from legitimate administrative work."
      },
      "parents": [
        {
          "id": "decision-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "manual-analyst-review"
        }
      ]
    }
  ]
}