--- analysis: A simple rule for failed logins misses the automated adaptation of an AI agent. This hunt correlates rapid auth shifts with downstream infrastructure changes and AI resource usage, providing the full context of an agentic loop. blind_spots: - id: no-http-payload-visibility question: What specifically were the agents prompting the AI endpoints to do? requires: API gateway request body logging or deep packet inspection risk: We can see the burst of traffic but cannot distinguish between a malicious agent's plan and a legitimate large-scale AI-assisted refactor. stage: ai-infrastructure-hijacking - id: ephemeral-runner-memory question: Did the agent execute scripts purely in memory on the CI/CD runner? requires: Endpoint telemetry on CI/CD runner nodes risk: File activity may miss in-memory script execution or environment variable scraping if the runner is ephemeral and lacks a resident agent. stage: cicd-pipeline-exploitation coverage: - stage: secrets-manager-takeover status: covered steps: - secrets-access-shifts - stage: cicd-pipeline-exploitation status: covered steps: - pipeline-tamper-check - stage: ai-infrastructure-hijacking status: covered steps: - ai-endpoint-usage-burst - reason: 'Belongs to another part of the ''An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation'' series.' stage: web-service-breach-and-mapping status: out_of_scope - reason: 'Belongs to another part of the ''An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation'' series.' stage: repository-secrets-harvesting status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: AI-assisted attacks compress weeks of work into hours, making manual triage ineffective; automated hunts for behavioral loops are necessary to catch the intrusion before root systems are compromised. methodology: model-assisted trigger: intel-report hypothesis: An automated AI agent loop is conducting high-speed privilege escalation via secrets managers, tampering with CI/CD configurations, and hijacking cloud AI endpoints for external orchestration. labels: - hunt - attack.t1555 - attack.t1578 - attack.t1078 - attack.t0016 - attack.t0010 - attack.t0043 name: AI-Agentic Escalation and Infrastructure Hijacking parameters: ai_endpoints: default: - api.openai.com - anthropic.com - bedrock.us-east-1.amazonaws.com - sagemaker.us-east-1.amazonaws.com - api.cohere.ai description: Enterprise AI service endpoints for burst detection. from: kind: article observed: '2026-09-02' ref: https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/ type: list[domain] docker_package_pattern: default: '%docker%' description: Package name pattern to identify Docker-related infrastructure. from: kind: manual observed: '2026-09-02' ref: Article mentions Docker as a primary product in the attack chain. type: string lookback_days: default: '14' description: Days of history to examine. from: kind: manual observed: '2026-09-02' ref: Standard hunt window type: number scope_hosts: default: [] description: Hosts identified in the scoping step; leave empty to run fleet-wide. from: kind: manual observed: '2026-09-02' ref: Analyst-populated from scoping result. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/ gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: Focus on infrastructure hosting containerized web services and identities with administrative access to cloud control planes and CI/CD systems. references: - name: "Unit 42 \u2014 An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation" url: https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/ related: - hunt: web-service-breach-and-mapping reason: The initial infiltration and internal mapping stage precedes the credential escalation and pipeline hijacking found here. relation: follows - hunt: automated-service-infiltration-data-harvesting relation: follows scenario: stages: - name: Public Web Service Breach and Automated Recon observables: - Publicly accessible web service breach - Automated recon agent mapping internal microservices - Service discovery tool execution - Bursty API requests - Structured Markdown files for inter-agent communication slug: web-service-breach-and-mapping tactic: initial-access techniques: - T1190 - T1046 - T0000 - T0002 - name: Enterprise Repository Secrets Harvesting observables: - Code scraping across enterprise repositories - Extraction of hard-coded tokens and service passwords - Presence of Python caches and paired asset folders - Markdown files containing harvested metadata slug: repository-secrets-harvesting tactic: credential-access techniques: - T1552.001 - T0014 - name: Secrets Manager Privilege Escalation observables: - Infiltration of secrets management system using stolen tokens - Harvesting of master administrative credentials - Parallel authentications from single identities - Rapid 401/200 HTTP state shifts during access attempts slug: secrets-manager-takeover tactic: privilege-escalation techniques: - T1555 - T0016 - name: DevOps Pipeline Hijacking observables: - Unauthorized CI/CD build triggers - Execution of custom workflows in code applications - Attempts to modify Terraform configurations - Exfiltration of cloud access keys via pipeline actions slug: cicd-pipeline-exploitation tactic: persistence techniques: - T1578 - T0010 - name: AI Infrastructure Post-Compromise Abuse observables: - LLM calls to multiple frontier AI agents in parallel - Invocation of cloud AI models via stolen API keys - Bursty model usage from unexpected identities - AI endpoints used as post-compromise orchestration infrastructure slug: ai-infrastructure-hijacking tactic: impact techniques: - T1078 - T0043 summary: An attacker used autonomous AI agents to compress weeks of intrusion tradecraft into a 10-hour campaign, breaching a web service to map the internal network and harvest secrets. The agents then escalated privileges through a secrets manager to hijack CI/CD pipelines and repurpose enterprise AI infrastructure for post-compromise operations. series: index: 2 slug: an-ai-assisted-cyber-attack-inside-a-unit-42-investigation title: 'An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation' total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # AI-Agentic Escalation and Infrastructure Hijacking This hunt identifies the high-speed execution characteristic of agentic AI attacks, which compress weeks of manual red-teaming into hours. It targets the transition from failed to successful access (401 to 200 state shifts) against sensitive endpoints, followed by unauthorized modifications to Terraform configurations and bursty usage of enterprise AI services. By correlating these behaviors across authentication and file surfaces, we detect the methodical orchestration of an autonomous intruder. ## docker-host-scoping Find hosts running Docker, as the initial breach targeted containerized web services used to tunnel into the network. ```sqlite target=endpoint role=scoping params=(docker_package_pattern=docker_package_pattern) ~~~yaml expected: A list of hostnames providing the attack surface. Silence indicates no Docker software was found in inventory. reads: - device_hostname - package_name silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-09-20' ~~~ SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE LOWER(package_name) LIKE '{{docker_package_pattern}}' ``` ## parallel-activity-check parallel: - → secrets-access-shifts - → pipeline-tamper-check - → ai-endpoint-usage-burst join: → triage-agent ## secrets-access-shifts Detect automated agents successfully brute-forcing or harvesting secrets by looking for a transition from 401 to 200 within a tight 15-minute window. ```sqlite target=web role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: A source IP or user showing multiple failures followed by success on a sensitive API. This is the primary indicator of an automated loop. reads: - device_hostname - src_endpoint_ip - actor_user_name - url_hostname - status_code - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, src_endpoint_ip, actor_user_name, url_hostname, COUNT(CASE WHEN status_code = 401 THEN 1 END) AS unauthorized_count, COUNT(CASE WHEN status_code = 200 THEN 1 END) AS authorized_count, MIN(time) AS first_event, MAX(time) AS last_event FROM hb_http_activity WHERE status_code IN (200, 401) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, src_endpoint_ip, actor_user_name, url_hostname HAVING unauthorized_count > 0 AND authorized_count > 0 AND (julianday(MAX(time)) - julianday(MIN(time))) * 1440 <= 15 ``` ## pipeline-tamper-check Identify attempts to plant backdoors or exfiltrate credentials via modifications to Terraform files or CI/CD workflow configurations. ```sqlite target=endpoint role=triage params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Write or modification events on infrastructure-as-code files, particularly from service accounts or in coordination with auth shifts. reads: - device_hostname - actor_user_name - file_path - file_name - time - activity_id silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, actor_user_name, file_path, file_name, time FROM hb_file_activity WHERE (LOWER(file_name) LIKE '%.tf' OR LOWER(file_path) LIKE '%workflows%') AND activity_id IN (1, 3, 5) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## ai-endpoint-usage-burst Detect AI-endpoint hijacking by finding high-volume, rare usage of frontier AI models from internal hosts. ```sqlite target=web role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts, ai_endpoints=ai_endpoints) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Bursty traffic to AI providers from a specific host. A baseline count helps distinguish normal usage from hijack-driven orchestration. prevalence: by: device_hostname key: - url_hostname rare_below: 2 reads: - device_hostname - url_hostname - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, url_hostname, COUNT(*) AS request_count, MIN(time) AS first_seen FROM hb_http_activity WHERE instr(',' || '{{ai_endpoints}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_hostname HAVING request_count >= 50 ``` ## triage-agent ```agent target=hunter cite: required context: - docker-host-scoping - secrets-access-shifts - pipeline-tamper-check - ai-endpoint-usage-burst max_iterations: 6 objective: Decide whether the identified telemetry suggests an AI-orchestrated intrusion based on temporal correlation and behavioral shifts. success_criteria: A per-host verdict of malicious, suspicious, or benign citing row evidence. tools: - endpoint - web ``` ## route-on-verdict if~: "the triage-agent verdict is malicious for any host or identity" (confidence: high, judge=hunter) then: → revoke-and-isolate indeterminate: → terraform-state-review unavailable: → terraform-state-review (blind_spot: no-http-payload-visibility) else: → terraform-state-review ## revoke-and-isolate ```action target=endpoint ~~~yaml approval: required ~~~ Revoke the affected identity tokens and isolate any associated cloud resources or CI/CD runners identified in the triage. ``` → terraform-state-review ## terraform-state-review ```manual target=analyst Review all Terraform commits and CI/CD workflow changes in the window. Verify if branch protection was bypassed or if keys were exfiltrated. ``` → close-out ## close-out ```manual target=analyst Record the identities and IPs involved. If burst thresholds were too low for normal development activity, adjust them for future runs. ``` → end