{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "AI-assisted attacks compress weeks of work into hours, making manual triage ineffective; automated hunts for behavioral loops are necessary to catch the intrusion before root systems are compromised." }, "name": "AI-Agentic Escalation and Infrastructure Hijacking", "type": "investigation", "labels": [ "hunt", "attack.t1555", "attack.t1578", "attack.t1078", "attack.t0016", "attack.t0010", "attack.t0043" ], "series": { "slug": "an-ai-assisted-cyber-attack-inside-a-unit-42-investigation", "index": 2, "title": "An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation", "total": 2 }, "related": [ { "hunt": "web-service-breach-and-mapping", "reason": "The initial infiltration and internal mapping stage precedes the credential escalation and pipeline hijacking found here.", "relation": "follows" }, { "hunt": "automated-service-infiltration-data-harvesting", "relation": "follows" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple rule for failed logins misses the automated adaptation of an AI agent. This hunt correlates rapid auth shifts with downstream infrastructure changes and AI resource usage, providing the full context of an agentic loop.", "coverage": [ { "stage": "secrets-manager-takeover", "steps": [ "secrets-access-shifts" ], "status": "covered" }, { "stage": "cicd-pipeline-exploitation", "steps": [ "pipeline-tamper-check" ], "status": "covered" }, { "stage": "ai-infrastructure-hijacking", "steps": [ "ai-endpoint-usage-burst" ], "status": "covered" }, { "stage": "web-service-breach-and-mapping", "reason": "Belongs to another part of the 'An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation' series.", "status": "out_of_scope" }, { "stage": "repository-secrets-harvesting", "reason": "Belongs to another part of the 'An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Public Web Service Breach and Automated Recon", "slug": "web-service-breach-and-mapping", "tactic": "initial-access", "techniques": [ "T1190", "T1046", "T0000", "T0002" ], "observables": [ "Publicly accessible web service breach", "Automated recon agent mapping internal microservices", "Service discovery tool execution", "Bursty API requests", "Structured Markdown files for inter-agent communication" ] }, { "name": "Enterprise Repository Secrets Harvesting", "slug": "repository-secrets-harvesting", "tactic": "credential-access", "techniques": [ "T1552.001", "T0014" ], "observables": [ "Code scraping across enterprise repositories", "Extraction of hard-coded tokens and service passwords", "Presence of Python caches and paired asset folders", "Markdown files containing harvested metadata" ] }, { "name": "Secrets Manager Privilege Escalation", "slug": "secrets-manager-takeover", "tactic": "privilege-escalation", "techniques": [ "T1555", "T0016" ], "observables": [ "Infiltration of secrets management system using stolen tokens", "Harvesting of master administrative credentials", "Parallel authentications from single identities", "Rapid 401/200 HTTP state shifts during access attempts" ] }, { "name": "DevOps Pipeline Hijacking", "slug": "cicd-pipeline-exploitation", "tactic": "persistence", "techniques": [ "T1578", "T0010" ], "observables": [ "Unauthorized CI/CD build triggers", "Execution of custom workflows in code applications", "Attempts to modify Terraform configurations", "Exfiltration of cloud access keys via pipeline actions" ] }, { "name": "AI Infrastructure Post-Compromise Abuse", "slug": "ai-infrastructure-hijacking", "tactic": "impact", "techniques": [ "T1078", "T0043" ], "observables": [ "LLM calls to multiple frontier AI agents in parallel", "Invocation of cloud AI models via stolen API keys", "Bursty model usage from unexpected identities", "AI endpoints used as post-compromise orchestration infrastructure" ] } ], "summary": "An attacker used autonomous AI agents to compress weeks of intrusion tradecraft into a 10-hour campaign, breaching a web service to map the internal network and harvest secrets. The agents then escalated privileges through a secrets manager to hijack CI/CD pipelines and repurpose enterprise AI infrastructure for post-compromise operations." }, "severity": "high", "rationale": "Focus on infrastructure hosting containerized web services and identities with administrative access to cloud control planes and CI/CD systems.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An automated AI agent loop is conducting high-speed privilege escalation via secrets managers, tampering with CI/CD configurations, and hijacking cloud AI endpoints for external orchestration.", "parameters": { "scope_hosts": { "from": { "ref": "Analyst-populated from scoping result.", "kind": "manual", "observed": "2026-09-02" }, "type": "list[host]", "default": [], "description": "Hosts identified in the scoping step; leave empty to run fleet-wide." }, "ai_endpoints": { "from": { "ref": "https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/", "kind": "article", "observed": "2026-09-02" }, "type": "list[domain]", "default": [ "api.openai.com", "anthropic.com", "bedrock.us-east-1.amazonaws.com", "sagemaker.us-east-1.amazonaws.com", "api.cohere.ai" ], "description": "Enterprise AI service endpoints for burst detection." }, "lookback_days": { "from": { "ref": "Standard hunt window", "kind": "manual", "observed": "2026-09-02" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "docker_package_pattern": { "from": { "ref": "Article mentions Docker as a primary product in the attack chain.", "kind": "manual", "observed": "2026-09-02" }, "type": "string", "default": "%docker%", "description": "Package name pattern to identify Docker-related infrastructure." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/", "name": "Unit 42 \u2014 An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation" } ], "blind_spots": [ { "id": "no-http-payload-visibility", "risk": "We can see the burst of traffic but cannot distinguish between a malicious agent's plan and a legitimate large-scale AI-assisted refactor.", "stage": "ai-infrastructure-hijacking", "question": "What specifically were the agents prompting the AI endpoints to do?", "requires": "API gateway request body logging or deep packet inspection" }, { "id": "ephemeral-runner-memory", "risk": "File activity may miss in-memory script execution or environment variable scraping if the runner is ephemeral and lacks a resident agent.", "stage": "cicd-pipeline-exploitation", "question": "Did the agent execute scripts purely in memory on the CI/CD runner?", "requires": "Endpoint telemetry on CI/CD runner nodes" } ] }, "name": "AI-Agentic Escalation and Infrastructure Hijacking", "description": "This hunt identifies the high-speed execution characteristic of agentic AI attacks, which compress weeks of manual red-teaming into hours. It targets the transition from failed to successful access (401 to 200 state shifts) against sensitive endpoints, followed by unauthorized modifications to Terraform configurations and bursty usage of enterprise AI services. By correlating these behaviors across authentication and file surfaces, we detect the methodical orchestration of an autonomous intruder." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "an-ai-assisted-cyber-attack-inside-a-unit-42-investigation", "index": 2, "title": "An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation", "total": 2 }, "coverage": [ { "stage": "secrets-manager-takeover", "steps": [ "secrets-access-shifts" ], "status": "covered" }, { "stage": "cicd-pipeline-exploitation", "steps": [ "pipeline-tamper-check" ], "status": "covered" }, { "stage": "ai-infrastructure-hijacking", "steps": [ "ai-endpoint-usage-burst" ], "status": "covered" }, { "stage": "web-service-breach-and-mapping", "reason": "Belongs to another part of the 'An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation' series.", "status": "out_of_scope" }, { "stage": "repository-secrets-harvesting", "reason": "Belongs to another part of the 'An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation' series.", "status": "out_of_scope" } ], "rationale": "An automated AI agent loop is conducting high-speed privilege escalation via secrets managers, tampering with CI/CD configurations, and hijacking cloud AI endpoints for external orchestration.", "blind_spots": [ { "id": "no-http-payload-visibility", "risk": "We can see the burst of traffic but cannot distinguish between a malicious agent's plan and a legitimate large-scale AI-assisted refactor.", "stage": "ai-infrastructure-hijacking", "question": "What specifically were the agents prompting the AI endpoints to do?", "requires": "API gateway request body logging or deep packet inspection" }, { "id": "ephemeral-runner-memory", "risk": "File activity may miss in-memory script execution or environment variable scraping if the runner is ephemeral and lacks a resident agent.", "stage": "cicd-pipeline-exploitation", "question": "Did the agent execute scripts purely in memory on the CI/CD runner?", "requires": "Endpoint telemetry on CI/CD runner nodes" } ], "scoping_notes": "Focus on infrastructure hosting containerized web services and identities with administrative access to cloud control planes and CI/CD systems.", "beyond_detection": "A simple rule for failed logins misses the automated adaptation of an AI agent. This hunt correlates rapid auth shifts with downstream infrastructure changes and AI resource usage, providing the full context of an agentic loop." } }, { "id": "docker-host-scoping", "type": "query", "label": "Identify Docker-enabled infrastructure", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE LOWER(package_name) LIKE '{{docker_package_pattern}}'", "surface": "hb_software_inventory", "description": "Find hosts running Docker, as the initial breach targeted containerized web services used to tunnel into the network.", "expected_signal": "A list of hostnames providing the attack surface. Silence indicates no Docker software was found in inventory." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify Docker-enabled infrastructure", "reads": [ "device_hostname", "package_name" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE LOWER(package_name) LIKE '{{docker_package_pattern}}'", "silence": "not_evidence_of_absence", "expected": "A list of hostnames providing the attack surface. Silence indicates no Docker software was found in inventory.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "secrets-access-shifts", "type": "query", "label": "Rapid HTTP auth state shifts", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "web", "content": "SELECT device_hostname, src_endpoint_ip, actor_user_name, url_hostname, COUNT(CASE WHEN status_code = 401 THEN 1 END) AS unauthorized_count, COUNT(CASE WHEN status_code = 200 THEN 1 END) AS authorized_count, MIN(time) AS first_event, MAX(time) AS last_event FROM hb_http_activity WHERE status_code IN (200, 401) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, src_endpoint_ip, actor_user_name, url_hostname HAVING unauthorized_count > 0 AND authorized_count > 0 AND (julianday(MAX(time)) - julianday(MIN(time))) * 1440 <= 15", "surface": "hb_http_activity", "description": "Detect automated agents successfully brute-forcing or harvesting secrets by looking for a transition from 401 to 200 within a tight 15-minute window.", "expected_signal": "A source IP or user showing multiple failures followed by success on a sensitive API. This is the primary indicator of an automated loop." }, "parents": [ { "id": "docker-host-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Rapid HTTP auth state shifts", "reads": [ "device_hostname", "src_endpoint_ip", "actor_user_name", "url_hostname", "status_code", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, src_endpoint_ip, actor_user_name, url_hostname, COUNT(CASE WHEN status_code = 401 THEN 1 END) AS unauthorized_count, COUNT(CASE WHEN status_code = 200 THEN 1 END) AS authorized_count, MIN(time) AS first_event, MAX(time) AS last_event FROM hb_http_activity WHERE status_code IN (200, 401) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, src_endpoint_ip, actor_user_name, url_hostname HAVING unauthorized_count > 0 AND authorized_count > 0 AND (julianday(MAX(time)) - julianday(MIN(time))) * 1440 <= 15", "silence": "not_evidence_of_absence", "expected": "A source IP or user showing multiple failures followed by success on a sensitive API. This is the primary indicator of an automated loop.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "pipeline-tamper-check", "type": "query", "label": "DevOps configuration tampering", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, actor_user_name, file_path, file_name, time FROM hb_file_activity WHERE (LOWER(file_name) LIKE '%.tf' OR LOWER(file_path) LIKE '%workflows%') AND activity_id IN (1, 3, 5) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Identify attempts to plant backdoors or exfiltrate credentials via modifications to Terraform files or CI/CD workflow configurations.", "expected_signal": "Write or modification events on infrastructure-as-code files, particularly from service accounts or in coordination with auth shifts." }, "parents": [ { "id": "docker-host-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "DevOps configuration tampering", "reads": [ "device_hostname", "actor_user_name", "file_path", "file_name", "time", "activity_id" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, actor_user_name, file_path, file_name, time FROM hb_file_activity WHERE (LOWER(file_name) LIKE '%.tf' OR LOWER(file_path) LIKE '%workflows%') AND activity_id IN (1, 3, 5) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Write or modification events on infrastructure-as-code files, particularly from service accounts or in coordination with auth shifts.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "ai-endpoint-usage-burst", "type": "query", "label": "Bursty AI endpoint usage", "config": { "dsl": "sqlite", "role": "baseline", "source": "web", "content": "SELECT device_hostname, url_hostname, COUNT(*) AS request_count, MIN(time) AS first_seen FROM hb_http_activity WHERE instr(',' || '{{ai_endpoints}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_hostname HAVING request_count >= 50", "surface": "hb_http_activity", "description": "Detect AI-endpoint hijacking by finding high-volume, rare usage of frontier AI models from internal hosts.", "expected_signal": "Bursty traffic to AI providers from a specific host. A baseline count helps distinguish normal usage from hijack-driven orchestration." }, "parents": [ { "id": "docker-host-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Bursty AI endpoint usage", "reads": [ "device_hostname", "url_hostname", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, url_hostname, COUNT(*) AS request_count, MIN(time) AS first_seen FROM hb_http_activity WHERE instr(',' || '{{ai_endpoints}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_hostname HAVING request_count >= 50", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Bursty traffic to AI providers from a specific host. A baseline count helps distinguish normal usage from hijack-driven orchestration.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "url_hostname" ], "rare_below": 2 }, "verified_at": "2026-09-20" } }, { "id": "triage-agent", "type": "analytic", "label": "Weigh agentic intrusion evidence", "config": { "cite": "required", "tools": [ "endpoint", "web" ], "context": [ "docker-host-scoping", "secrets-access-shifts", "pipeline-tamper-check", "ai-endpoint-usage-burst" ], "objective": "Decide whether the identified telemetry suggests an AI-orchestrated intrusion based on temporal correlation and behavioral shifts.", "description": "Determine if the auth shifts, file edits, and bursty AI requests indicate a coordinated autonomous agent breach.", "max_iterations": 6, "expected_signal": "A verdict citing specific hosts and identities involved in the automated loop.", "success_criteria": "A per-host verdict of malicious, suspicious, or benign citing row evidence." }, "parents": [ { "id": "secrets-access-shifts", "kind": "merge" }, { "id": "pipeline-tamper-check", "kind": "merge" }, { "id": "ai-endpoint-usage-burst", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on agentic threat", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-agent verdict is malicious for any host or identity", "condition": "the triage-agent verdict is malicious for any host or identity", "blind_spot": "no-http-payload-visibility", "confidence": "high", "description": "Execute containment if the agent confirms malicious behavior.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-agent" } ] }, { "id": "revoke-and-isolate", "type": "action", "label": "Revoke identity and isolate resources", "config": { "target": "endpoint", "description": "Halt the automated agent loop by severing its access and infrastructure.", "instructions": "Revoke the affected identity tokens and isolate any associated cloud resources or CI/CD runners identified in the triage.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "terraform-state-review", "type": "task", "label": "Terraform and CI/CD audit", "config": { "assignee": "analyst", "description": "Verify the integrity of DevOps configurations to ensure no persistent backdoors remain.", "instructions": "Review all Terraform commits and CI/CD workflow changes in the window. Verify if branch protection was bypassed or if keys were exfiltrated." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "revoke-and-isolate" } ] }, { "id": "close-out", "type": "task", "label": "Hunt close-out", "config": { "assignee": "analyst", "description": "Record findings and document any gaps in visibility identified during the hunt.", "instructions": "Record the identities and IPs involved. If burst thresholds were too low for normal development activity, adjust them for future runs." }, "parents": [ { "id": "terraform-state-review" } ] } ] }