{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "AI-generated phishing scales rapidly and is often missed by traditional signature-based mail filters; detecting the behavioral execution and subsequent C2 is critical for stopping intrusions early." }, "name": "AI-Crafted Phishing and Multi-Hop Proxies", "type": "investigation", "labels": [ "hunt", "attack.t1566", "attack.t1090.003" ], "related": [ { "hunt": "scheduled-task-persistence-user-writable-paths", "reason": "Phishing payloads often use scheduled tasks for persistence, which requires a separate investigation of hb_scheduled_job.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple rule might catch a Tor connection, but this hunt correlates delivery sentiment keywords, process parentage with directory prefix awareness, and network prevalence using an agent to weigh the intent and context of the entire chain.", "coverage": [ { "stage": "ai-generated-phishing-delivery", "steps": [ "phishing-dns-corroboration" ], "status": "covered" }, { "stage": "phishing-payload-execution", "steps": [ "lead-process-spawns" ], "status": "covered" }, { "stage": "obfuscated-multi-hop-c2", "steps": [ "multi-hop-prevalence" ], "status": "covered" } ], "scenario": { "stages": [ { "name": "AI-Generated Phishing Delivery", "slug": "ai-generated-phishing-delivery", "tactic": "initial-access", "techniques": [ "T1566" ], "observables": [ "high-sentiment email content", "well-formatted malicious emails", "suspicious sender domains", "malicious URLs", "domain abuse levels", "urgent or emotive language" ] }, { "name": "Phishing Payload Execution", "slug": "phishing-payload-execution", "tactic": "execution", "techniques": [ "T1566" ], "observables": [ "process spawned from email clients (e.g., outlook.exe)", "process spawned from browsers (e.g., chrome.exe)", "execution of files from temp directories", "downloads of executable payloads from high-reputation domains" ] }, { "name": "Obfuscated Multi-Hop C2", "slug": "obfuscated-multi-hop-c2", "tactic": "command-and-control", "techniques": [ "T1090.003" ], "observables": [ "onion routing traffic", "Tor exit node connections", ".onion domain resolutions", "operational relay box (ORB) network nodes", "multi-hop VPS proxy chains", "traffic to compromised IoT devices" ] } ], "summary": "This campaign involves the delivery of highly tailored, AI-generated phishing emails designed to bypass traditional filters by leveraging natural language and emotional triggers. Successful initial access via these messages leads to the execution of malicious payloads that utilize multi-hop proxy networks and onion routing to obfuscate command-and-control traffic." }, "severity": "medium", "rationale": "Start with general user workstations; prioritize those in departments like HR or Finance which are frequent targets for high-sentiment phishing.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is using AI-generated phishing to deliver payloads that establish command-and-control via multi-hop proxy networks, disguising traffic through Tor or private relay nodes.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual" }, "type": "list[host]", "default": [], "description": "Optional list of hosts from the lead step to scope expensive network queries." }, "lookback_days": { "from": { "ref": "standard-retention", "kind": "manual", "observed": "2026-06-30" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "scope_processes": { "from": { "ref": "lead-step-pivot", "kind": "manual" }, "type": "list[string]", "default": [], "description": "Specific process names discovered in the lead step to filter network and DNS activity." }, "phishing_domains": { "from": { "ref": "red-canary-phishing-blog", "kind": "article", "observed": "2026-06-30" }, "type": "list[domain]", "default": [ "login-verify-ai.com", "account-security-update.net", "secure-mail-gateway.io" ], "description": "Known domains from AI-phishing campaigns; refresh before running." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://redcanary.com/blog/threat-detection/phishing-ai-agent/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://redcanary.com/blog/threat-detection/phishing-ai-agent/", "name": "Red Canary \u2014 Train, triage, repeat: The AI agent changing how we fight phishing" } ], "blind_spots": [ { "id": "missing-process-telemetry", "risk": "A host without EDR will not report the process spawns that trigger this gated hunt.", "stage": "phishing-payload-execution", "question": "whether the execution occurred on hosts with missing EDR coverage", "requires": "hb_process_activity with parent information" }, { "id": "missing-network-logs", "risk": "Tor bridges and private ORBs operating on port 443 are harder to distinguish from standard web traffic and may be missed by the rare-port prevalence query.", "stage": "obfuscated-multi-hop-c2", "question": "whether traffic was sent over common ports like 443 via a bridge", "requires": "hb_network_connection egress logs" } ] }, "name": "AI-Crafted Phishing and Multi-Hop Proxies", "description": "This hunt follows a gated flow to identify the lifecycle of an AI-assisted phishing attack. It begins with a lead query focused on suspicious child processes spawned from common email and browser parents in user-writable directories. If an agent confirms these executions as suspicious, the hunt opens a fan-out investigation into network and DNS telemetry. This second stage searches for multi-hop proxy connections\u2014specifically Tor entry points and rare outbound ports\u2014and matches DNS queries against domains with patterns typical of automated phishing campaigns, specifically filtered to the suspect processes identified in the lead. The final triage correlates delivery, execution, and C2 to confirm a multi-stage intrusion." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "coverage": [ { "stage": "ai-generated-phishing-delivery", "steps": [ "phishing-dns-corroboration" ], "status": "covered" }, { "stage": "phishing-payload-execution", "steps": [ "lead-process-spawns" ], "status": "covered" }, { "stage": "obfuscated-multi-hop-c2", "steps": [ "multi-hop-prevalence" ], "status": "covered" } ], "rationale": "An adversary is using AI-generated phishing to deliver payloads that establish command-and-control via multi-hop proxy networks, disguising traffic through Tor or private relay nodes.", "blind_spots": [ { "id": "missing-process-telemetry", "risk": "A host without EDR will not report the process spawns that trigger this gated hunt.", "stage": "phishing-payload-execution", "question": "whether the execution occurred on hosts with missing EDR coverage", "requires": "hb_process_activity with parent information" }, { "id": "missing-network-logs", "risk": "Tor bridges and private ORBs operating on port 443 are harder to distinguish from standard web traffic and may be missed by the rare-port prevalence query.", "stage": "obfuscated-multi-hop-c2", "question": "whether traffic was sent over common ports like 443 via a bridge", "requires": "hb_network_connection egress logs" } ], "scoping_notes": "Start with general user workstations; prioritize those in departments like HR or Finance which are frequent targets for high-sentiment phishing.", "beyond_detection": "A simple rule might catch a Tor connection, but this hunt correlates delivery sentiment keywords, process parentage with directory prefix awareness, and network prevalence using an agent to weigh the intent and context of the entire chain." } }, { "id": "lead-process-spawns", "type": "query", "label": "Suspicious processes from phishing vectors", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%\\outlook.exe' OR LOWER(parent_process_name) LIKE '%\\chrome.exe' OR LOWER(parent_process_name) LIKE '%\\msedge.exe' OR LOWER(parent_process_name) LIKE '%\\firefox.exe' OR LOWER(parent_process_name) LIKE '%\\thunderbird.exe') AND (LOWER(process_path) LIKE '%\\appdata\\%' OR LOWER(process_path) LIKE '%\\users\\public\\%' OR LOWER(process_path) LIKE '%\\programdata\\%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify potential phishing payload execution by finding unusual child processes spawned by email clients or web browsers.", "expected_signal": "A list of processes executed from temporary or public paths by browsers or mail clients. Absence suggests no direct execution from these vectors occurred." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Suspicious processes from phishing vectors", "reads": [ "device_hostname", "process_name", "process_path", "process_cmd_line", "parent_process_name", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%\\outlook.exe' OR LOWER(parent_process_name) LIKE '%\\chrome.exe' OR LOWER(parent_process_name) LIKE '%\\msedge.exe' OR LOWER(parent_process_name) LIKE '%\\firefox.exe' OR LOWER(parent_process_name) LIKE '%\\thunderbird.exe') AND (LOWER(process_path) LIKE '%\\appdata\\%' OR LOWER(process_path) LIKE '%\\users\\public\\%' OR LOWER(process_path) LIKE '%\\programdata\\%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A list of processes executed from temporary or public paths by browsers or mail clients. Absence suggests no direct execution from these vectors occurred.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "assess-lead", "type": "analytic", "label": "Assess lead execution", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "lead-process-spawns" ], "objective": "Determine if the child process spawned from a mail client or browser represents a suspicious execution or a potential downloader, citing command line arguments and paths.", "description": "Decide if the processes found in the lead query indicate high-sentiment phishing activity or a legitimate automated download.", "max_iterations": 3, "expected_signal": "A per-host verdict of suspicious or benign based on the process metadata.", "success_criteria": "A verdict of suspicious | benign per host." }, "parents": [ { "id": "lead-process-spawns" } ] }, { "id": "gate-on-lead", "type": "checkpoint", "label": "Gate on lead suspicion", "config": { "fuzzy": true, "judge": "hunter", "question": "the assessment identifies at least one process execution as suspicious or high-risk", "condition": "the assessment identifies at least one process execution as suspicious or high-risk", "blind_spot": "missing-process-telemetry", "confidence": "high", "description": "Move to the expensive network and DNS queries only for hosts showing suspicious lead activity.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "assess-lead" } ] }, { "id": "multi-hop-prevalence", "type": "query", "label": "Rare multi-hop and Tor connection ports", "config": { "dsl": "sqlite", "role": "baseline", "source": "network", "content": "SELECT device_hostname, dst_endpoint_port, process_name, dst_endpoint_ip, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_network_connection WHERE (dst_endpoint_port IN (9001, 9050, 9150) OR dst_endpoint_port > 1024) AND direction = 'outbound' AND LOWER(process_name) NOT LIKE '%\\chrome.exe' AND LOWER(process_name) NOT LIKE '%\\msedge.exe' AND LOWER(process_name) NOT LIKE '%\\firefox.exe' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY dst_endpoint_port HAVING host_count < 5 ORDER BY host_count ASC", "surface": "hb_network_connection", "description": "Find outbound connections to Tor entry points or rare high-ports that indicate multi-hop proxy or ORB use, excluding common browser noise.", "expected_signal": "Connections to ports associated with Tor or rare destination ports that are unique to a few hosts. Exclusion of browsers prevents web noise from polluting the prevalence count." }, "parents": [ { "id": "gate-on-lead", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare multi-hop and Tor connection ports", "reads": [ "device_hostname", "dst_endpoint_port", "process_name", "dst_endpoint_ip", "direction", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, dst_endpoint_port, process_name, dst_endpoint_ip, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_network_connection WHERE (dst_endpoint_port IN (9001, 9050, 9150) OR dst_endpoint_port > 1024) AND direction = 'outbound' AND LOWER(process_name) NOT LIKE '%\\chrome.exe' AND LOWER(process_name) NOT LIKE '%\\msedge.exe' AND LOWER(process_name) NOT LIKE '%\\firefox.exe' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY dst_endpoint_port HAVING host_count < 5 ORDER BY host_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Connections to ports associated with Tor or rare destination ports that are unique to a few hosts. Exclusion of browsers prevents web noise from polluting the prevalence count.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "dst_endpoint_port" ], "rare_below": 5 }, "verified_at": "2026-09-20" } }, { "id": "phishing-dns-corroboration", "type": "query", "label": "Phishing domain and sentiment matches", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE (instr(',' || '{{phishing_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%verify-ai%' OR LOWER(query_hostname) LIKE '%secure-login%') AND ('{{scope_processes}}' = '' OR instr(',' || '{{scope_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_dns_activity", "description": "Correlate the suspicious execution with DNS lookups for known phishing domains, filtered to the specific processes found in the lead.", "expected_signal": "DNS queries for phishing infrastructure or domains containing urgent sentiment from the suspect processes. Filtering by process_name ensures the network activity is linked to the lead execution." }, "parents": [ { "id": "gate-on-lead", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Phishing domain and sentiment matches", "reads": [ "device_hostname", "query_hostname", "process_name", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE (instr(',' || '{{phishing_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%verify-ai%' OR LOWER(query_hostname) LIKE '%secure-login%') AND ('{{scope_processes}}' = '' OR instr(',' || '{{scope_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "DNS queries for phishing infrastructure or domains containing urgent sentiment from the suspect processes. Filtering by process_name ensures the network activity is linked to the lead execution.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "final-triage", "type": "analytic", "label": "Triage full attack chain", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "assess-lead", "multi-hop-prevalence", "phishing-dns-corroboration" ], "objective": "Correlate the suspicious execution chain with outbound traffic to confirm a multi-stage intrusion involving AI-crafted delivery and multi-hop C2.", "description": "Synthesize the execution evidence with network and DNS patterns to confirm a phishing-led intrusion.", "max_iterations": 5, "expected_signal": "A final verdict of malicious or benign per host.", "success_criteria": "A verdict citing specific process IDs, network ports, and DNS domains." }, "parents": [ { "id": "multi-hop-prevalence", "kind": "merge" }, { "id": "phishing-dns-corroboration", "kind": "merge" } ] }, { "id": "route-final", "type": "checkpoint", "label": "Route on final triage", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict identifies a confirmed malicious execution followed by multi-hop proxy beaconing", "condition": "the triage verdict identifies a confirmed malicious execution followed by multi-hop proxy beaconing", "blind_spot": "missing-network-logs", "confidence": "high", "description": "Initiate containment for malicious findings or route for manual review.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "final-triage" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Stop C2 traffic and prevent lateral movement from the compromised host.", "instructions": "Isolate the host immediately via the EDR agent and revoke any active sessions for the user identified in the lead query.", "action_approval": "required" }, "parents": [ { "id": "route-final", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review", "config": { "assignee": "analyst", "description": "Review findings to confirm AI-generated patterns and refine the detection engine.", "instructions": "Manually verify the process chain and network connections. Examine the suspected phishing domain for AI-typical sentiment patterns (over-professional language or high urgency) and document any new C2 indicators." }, "parents": [ { "id": "gate-on-lead", "branch": "default" }, { "id": "gate-on-lead", "branch": "on_unavailable" }, { "id": "route-final", "branch": "default" }, { "id": "route-final", "branch": "on_unavailable" }, { "id": "route-final", "branch": "on_refutes" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Document findings and finalize the hunt.", "instructions": "Add newly discovered C2 domains to the watch list and document any novel persistence mechanisms identified during investigation." }, "parents": [ { "id": "gate-on-lead", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }