{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Backup servers are high-value targets for persistence and data theft. A confirmed persistent implant on these servers represents an immediate risk of data exfiltration or ransomware deployment." }, "name": "AhsayCBS Persistence and Python Implant", "type": "investigation", "labels": [ "hunt", "attack.t1053.005", "attack.t1547.001", "attack.t1059.006", "attack.t1620", "attack.t1480.001", "attack.t1071.001", "command and control", "credential access", "defense evasion", "execution", "impact", "initial access", "persistence" ], "series": { "slug": "inside-an-ahsaycbs-intrusion-hidden-webshells-a-cryptominer-and-a-c2-implant", "index": 2, "title": "Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "total": 3 }, "related": [ { "hunt": "ahsay-webshell-exploitation", "reason": "Initial exploitation and the presence of webshells are handled in a separate hunt focused on web server directories.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple detection rule for the 'kvm' task may exist, but this hunt correlates persistence (task/registry) with the execution of a custom implant and its C2 network traffic across two distinct phases. This multi-surface context is necessary to distinguish an intrusion from remnants of an un-remediated compromise.", "coverage": [ { "stage": "persistence-scheduled-task", "steps": [ "scheduled-task-persistence" ], "status": "covered" }, { "stage": "persistence-registry-run", "steps": [ "registry-run-persistence" ], "status": "covered" }, { "stage": "execution-python-implant", "steps": [ "python-implant-activity" ], "status": "covered" }, { "stage": "command-and-control-https", "steps": [ "c2-communications" ], "status": "covered" }, { "stage": "exploitation-ahsay-rce", "reason": "Belongs to another part of the 'Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant' series.", "status": "out_of_scope" }, { "stage": "persistence-webshells", "reason": "Belongs to another part of the 'Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant' series.", "status": "out_of_scope" }, { "stage": "defense-evasion-impair-protection", "reason": "Belongs to another part of the 'Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant' series.", "status": "out_of_scope" }, { "stage": "credential-access-veeam", "reason": "Belongs to another part of the 'Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant' series.", "status": "out_of_scope" }, { "stage": "persistence-remote-access-tools", "reason": "Belongs to another part of the 'Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant' series.", "status": "out_of_scope" }, { "stage": "c2-tunneling", "reason": "Belongs to another part of the 'Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant' series.", "status": "out_of_scope" }, { "stage": "impact-resource-hijacking", "reason": "Belongs to another part of the 'Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "AhsayCBS Remote Code Execution", "slug": "exploitation-ahsay-rce", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "POST request to /rps/api/json/UpdateReceivers.do" ] }, { "name": "JSP Webshell Deployment", "slug": "persistence-webshells", "tactic": "persistence", "techniques": [ "T1505.003", "T1027.003" ], "observables": [ "AhsayCBS.jsp", "nsmind.jsp", "a2b59a4bb296604b.jsp", "status_*.jsp", "st_*.jsp", "Hardcoded key parameter p with hex characters followed by P", "Payload hidden in PNG pixel data" ] }, { "name": "Defender Security Evasion", "slug": "defense-evasion-impair-protection", "tactic": "defense-evasion", "techniques": [ "T1562.001" ], "observables": [ "Defender exclusions for system paths", "Defender exclusions for .exe and .dll extensions", "Defender exclusion for AhsayCBS service process" ] }, { "name": "Cryptominer Task Persistence", "slug": "persistence-scheduled-task", "tactic": "persistence", "techniques": [ "T1053.005" ], "observables": [ "Scheduled task named kvm", "Task running every minute as SYSTEM", "Task XML with backdated start time" ] }, { "name": "Registry Run Key Persistence", "slug": "persistence-registry-run", "tactic": "persistence", "techniques": [ "T1547.001" ], "observables": [ "Registry Run key for main.py" ] }, { "name": "Python Reflective Implant Execution", "slug": "execution-python-implant", "tactic": "execution", "techniques": [ "T1059.006", "T1620", "T1480.001" ], "observables": [ "main.py script", "Embedded Python distribution", "Reflective x64 DLL loader", "Marker file named with SHA-256 of MachineGuid" ] }, { "name": "Veeam Credential Harvesting", "slug": "credential-access-veeam", "tactic": "credential-access", "techniques": [ "T1555" ], "observables": [ "Commands matching NetExec Veeam module for stored credentials" ] }, { "name": "Remote Access Software", "slug": "persistence-remote-access-tools", "tactic": "persistence", "techniques": [ "T1219" ], "observables": [ "AnyDesk installation", "Atera installation", "Splashtop installation" ] }, { "name": "Protocol Tunneling", "slug": "c2-tunneling", "tactic": "command-and-control", "techniques": [ "T1572" ], "observables": [ "chisel executable", "gost executable", "wust*a.exe and wust*b.exe in .st* folders" ] }, { "name": "HTTPS Implant C2", "slug": "command-and-control-https", "tactic": "command-and-control", "techniques": [ "T1071.001" ], "observables": [ "creepexplosiondarknight.com", "hxxps://creepexplosiondarknight.com/d" ] }, { "name": "XMRig Resource Hijacking", "slug": "impact-resource-hijacking", "tactic": "impact", "techniques": [ "T1496.001" ], "observables": [ "kvm-agent.exe", "pool.supportxmr.com:443", "pool-fr.supportxmr.com:443", "104.243.43.115:443" ] } ], "summary": "Threat actors exploited unauthenticated RCE and auth bypass flaws in AhsayCBS backup servers to deploy multiple JSP webshell families and persistent implants. The intrusion involved defense evasion via Defender exclusions, a custom Python reflective loader communicating with creepexplosiondarknight[.]com, and the use of tunneling tools (Chisel, Gost) alongside XMRig cryptominers and Veeam credential harvesting." }, "severity": "high", "rationale": "Focus on servers running Ahsay backup software first. Use the software inventory to identify targets, then broaden the search to look for the 'kvm' task across all servers if the initial results are sparse.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has maintained access to an exploited backup server using a scheduled task for a miner and a Registry Run key for a custom Python implant that communicates with known C2 infrastructure.", "parameters": { "c2_domains": { "from": { "ref": "huntress-ahsay-post", "kind": "article", "observed": "2026-11-09" }, "type": "list[domain]", "default": [ "creepexplosiondarknight.com", "updatereceivers.do" ], "description": "C2 domains observed in Python implant and exploit communications." }, "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2026-11-09" }, "type": "list[host]", "default": [], "description": "Optional: List of known AhsayCBS server hostnames to narrow the hunt." }, "lookback_days": { "from": { "ref": "standard-retention", "kind": "manual", "observed": "2026-11-09" }, "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/ahsaycbs-webshells", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/ahsaycbs-webshells", "name": "Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant" } ], "blind_spots": [ { "id": "no-process-visibility", "risk": "A host without EDR coverage will contribute no process rows, potentially missing an active implant.", "stage": "execution-python-implant", "question": "Was the Python implant executed without a corresponding process start event?", "requires": "EDR process logging on all backup servers" }, { "id": "machine-guid-hash-marker", "risk": "The marker file name is unique per host; while we hunt for it, the lack of a known list of hashes makes detection dependent on finding the activity rather than the file itself.", "stage": "execution-python-implant", "question": "Can we identify the marker file without knowing the MachineGuid in advance?", "requires": "hb_file_activity" } ] }, "name": "AhsayCBS Persistence and Python Implant", "description": "This hunt identifies OS-level persistence and post-exploitation activity following an AhsayCBS intrusion. It targets the 'kvm' scheduled task and the 'main.py' Python implant. The hunt follows a phased approach: first identifying the persistence mechanisms established during the 'patience' phase of the attack, then corroborating these with behavioral evidence of active implant execution and network C2 traffic. This ensures that persistence evidence is weighed against active malicious communication before containment is recommended." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "inside-an-ahsaycbs-intrusion-hidden-webshells-a-cryptominer-and-a-c2-implant", "index": 2, "title": "Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant", "total": 3 }, "coverage": [ { "stage": "persistence-scheduled-task", "steps": [ "scheduled-task-persistence" ], "status": "covered" }, { "stage": "persistence-registry-run", "steps": [ "registry-run-persistence" ], "status": "covered" }, { "stage": "execution-python-implant", "steps": [ "python-implant-activity" ], "status": "covered" }, { "stage": "command-and-control-https", "steps": [ "c2-communications" ], "status": "covered" }, { "stage": "exploitation-ahsay-rce", "reason": "Belongs to another part of the 'Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant' series.", "status": "out_of_scope" }, { "stage": "persistence-webshells", "reason": "Belongs to another part of the 'Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant' series.", "status": "out_of_scope" }, { "stage": "defense-evasion-impair-protection", "reason": "Belongs to another part of the 'Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant' series.", "status": "out_of_scope" }, { "stage": "credential-access-veeam", "reason": "Belongs to another part of the 'Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant' series.", "status": "out_of_scope" }, { "stage": "persistence-remote-access-tools", "reason": "Belongs to another part of the 'Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant' series.", "status": "out_of_scope" }, { "stage": "c2-tunneling", "reason": "Belongs to another part of the 'Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant' series.", "status": "out_of_scope" }, { "stage": "impact-resource-hijacking", "reason": "Belongs to another part of the 'Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant' series.", "status": "out_of_scope" } ], "rationale": "An intruder has maintained access to an exploited backup server using a scheduled task for a miner and a Registry Run key for a custom Python implant that communicates with known C2 infrastructure.", "blind_spots": [ { "id": "no-process-visibility", "risk": "A host without EDR coverage will contribute no process rows, potentially missing an active implant.", "stage": "execution-python-implant", "question": "Was the Python implant executed without a corresponding process start event?", "requires": "EDR process logging on all backup servers" }, { "id": "machine-guid-hash-marker", "risk": "The marker file name is unique per host; while we hunt for it, the lack of a known list of hashes makes detection dependent on finding the activity rather than the file itself.", "stage": "execution-python-implant", "question": "Can we identify the marker file without knowing the MachineGuid in advance?", "requires": "hb_file_activity" } ], "scoping_notes": "Focus on servers running Ahsay backup software first. Use the software inventory to identify targets, then broaden the search to look for the 'kvm' task across all servers if the initial results are sparse.", "beyond_detection": "A simple detection rule for the 'kvm' task may exist, but this hunt correlates persistence (task/registry) with the execution of a custom implant and its C2 network traffic across two distinct phases. This multi-surface context is necessary to distinguish an intrusion from remnants of an un-remediated compromise." } }, { "id": "scope-ahsay-hosts", "type": "query", "label": "Identify hosts with Ahsay software", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%ahsay%'", "surface": "hb_software_inventory", "description": "Identify potential target hosts by finding those with Ahsay software installed.", "expected_signal": "A list of hosts currently running Ahsay backup software. Silence indicates no such software is managed in inventory." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify hosts with Ahsay software", "reads": [ "package_name", "device_hostname" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%ahsay%'", "silence": "not_evidence_of_absence", "expected": "A list of hosts currently running Ahsay backup software. Silence indicates no such software is managed in inventory.", "verified": "dry-run", "verified_at": "2026-11-10" } }, { "id": "scheduled-task-persistence", "type": "query", "label": "Search for the kvm cryptominer task", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, job_name, job_cmd_line, job_user_name, time FROM hb_scheduled_job WHERE (LOWER(job_name) = 'kvm' OR LOWER(job_cmd_line) LIKE '%kvm-agent%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_scheduled_job", "description": "Find the scheduled task named 'kvm' used to relaunch the miner every minute.", "expected_signal": "A task named kvm or a command line running kvm-agent.exe, often as SYSTEM." }, "parents": [ { "id": "scope-ahsay-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Search for the kvm cryptominer task", "reads": [ "job_name", "job_cmd_line", "device_hostname", "job_user_name", "time" ], "source": "hb_scheduled_job", "target": "endpoint", "content": "SELECT device_hostname, job_name, job_cmd_line, job_user_name, time FROM hb_scheduled_job WHERE (LOWER(job_name) = 'kvm' OR LOWER(job_cmd_line) LIKE '%kvm-agent%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A task named kvm or a command line running kvm-agent.exe, often as SYSTEM.", "verified": "dry-run", "verified_at": "2026-11-10" } }, { "id": "registry-run-persistence", "type": "query", "label": "Search for Registry Run persistence", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_data, time FROM hb_registry_activity WHERE (LOWER(reg_target) LIKE '%\\\\currentversion\\\\run%' OR LOWER(reg_target) LIKE '%\\\\currentversion\\\\runonce%') AND LOWER(reg_value_data) LIKE '%python.exe%main.py%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_registry_activity", "description": "Identify the Run key established for the Python implant script.", "expected_signal": "A registry value pointing to a Python interpreter launching main.py." }, "parents": [ { "id": "scope-ahsay-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Search for Registry Run persistence", "reads": [ "reg_target", "reg_value_data", "device_hostname", "time" ], "source": "hb_registry_activity", "target": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_data, time FROM hb_registry_activity WHERE (LOWER(reg_target) LIKE '%\\\\currentversion\\\\run%' OR LOWER(reg_target) LIKE '%\\\\currentversion\\\\runonce%') AND LOWER(reg_value_data) LIKE '%python.exe%main.py%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A registry value pointing to a Python interpreter launching main.py.", "verified": "dry-run", "verified_at": "2026-11-10" } }, { "id": "evaluate-persistence", "type": "analytic", "label": "Evaluate persistence evidence", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "scheduled-task-persistence", "registry-run-persistence" ], "objective": "Identify hosts where the 'kvm' task or 'main.py' run key exists. Mark these as high-interest for activity analysis.", "description": "Assess the persistence artifacts discovered to prioritize follow-on hunting.", "max_iterations": 3, "expected_signal": "A verdict on whether persistence has been established on any hosts.", "success_criteria": "A list of hosts with confirmed persistence artifacts." }, "parents": [ { "id": "scheduled-task-persistence", "kind": "merge" }, { "id": "registry-run-persistence", "kind": "merge" } ] }, { "id": "python-implant-activity", "type": "query", "label": "Rare Python script execution", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_cmd_line) AS cmd, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%python.exe%main.py%' OR LOWER(process_cmd_line) LIKE '%\\\\main.py%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY cmd HAVING hosts <= 3", "surface": "hb_process_activity", "description": "Identify rare invocations of 'main.py' or Python from unusual paths to isolate the implant execution.", "expected_signal": "Rare command lines involving main.py, specifically those not residing in Program Files." }, "parents": [ { "id": "evaluate-persistence" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare Python script execution", "reads": [ "process_cmd_line", "device_hostname", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_cmd_line) AS cmd, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%python.exe%main.py%' OR LOWER(process_cmd_line) LIKE '%\\\\main.py%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY cmd HAVING hosts <= 3", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Rare command lines involving main.py, specifically those not residing in Program Files.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "cmd" ], "rare_below": 3 }, "verified_at": "2026-11-10" } }, { "id": "c2-communications", "type": "query", "label": "DNS activity for known C2", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) as count, MIN(time) as first_seen FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname", "surface": "hb_dns_activity", "description": "Identify network resolutions to the specific C2 domains identified in the research.", "expected_signal": "Any resolution of creepexplosiondarknight.com by a host already identified with persistence artifacts." }, "parents": [ { "id": "evaluate-persistence" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "DNS activity for known C2", "reads": [ "query_hostname", "device_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) as count, MIN(time) as first_seen FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname", "silence": "not_evidence_of_absence", "expected": "Any resolution of creepexplosiondarknight.com by a host already identified with persistence artifacts.", "verified": "dry-run", "verified_at": "2026-11-10" } }, { "id": "final-triage", "type": "analytic", "label": "Final triage of compromise", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "evaluate-persistence", "python-implant-activity", "c2-communications" ], "objective": "Determine which hosts are compromised by correlating the earlier persistence findings with active process execution and C2 communications.", "description": "Correlate all phases of the intrusion to produce a definitive verdict.", "max_iterations": 5, "expected_signal": "High-confidence verdict for compromised hosts.", "success_criteria": "A per-host verdict of malicious | suspicious | benign, citing persistence rows and activity rows." }, "parents": [ { "id": "python-implant-activity", "kind": "merge" }, { "id": "c2-communications", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the final-triage verdict is malicious for at least one host", "condition": "the final-triage verdict is malicious for at least one host", "blind_spot": "no-process-visibility", "confidence": "high", "description": "Decide the next step based on the final triage verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "final-triage" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Sever the implant's C2 and prevent further actions by the intruder.", "instructions": "Isolate the host from the network. Gather the 'main.py' script and identify the marker file (named with the SHA-256 of the MachineGuid) before remediation.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review", "config": { "assignee": "analyst", "description": "Manual verification of agent citations and artifact collection.", "instructions": "Review the cited rows for the 'kvm' task and Python execution. Verify that the Python script is not part of a legitimate administrative tool." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Document findings and identify any gaps in visibility.", "instructions": "Document the identified artifacts and whether any were deleted (self-deletion). Finalize the hunt report." }, "parents": [ { "id": "analyst-review" } ] } ] }