{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "SMBs are increasingly targeted by automated ransomware. A negative result over the scoped vulnerable estate confirms that these assets are not currently undergoing a high-speed encryption campaign."
      },
      "name": "AI-Driven Ransomware and Data Extortion",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1041",
        "attack.t1190",
        "attack.t1486",
        "attack.t1566",
        "execution",
        "exfiltration",
        "impact",
        "initial access"
      ],
      "related": [
        {
          "hunt": "lateral-movement-smb-rdp",
          "reason": "This hunt focuses on the vertical path from initial access to ransomware impact; lateral movement is a distinct phase requiring separate authentication and network audit logs.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "This hunt correlates three distinct attack phases across five telemetry surfaces. A single rule might flag mass file modifications but produce false positives for backup software; this hunt requires the presence of vulnerability context, initial access anomalies, and rare process execution to confirm a malicious intrusion.",
      "coverage": [
        {
          "stage": "initial-access-phishing-and-exploitation",
          "steps": [
            "identify-vulnerable-hosts",
            "web-exploitation-signs",
            "auth-anomaly-check"
          ],
          "status": "covered"
        },
        {
          "stage": "execution-of-malicious-code",
          "steps": [
            "rare-writable-processes"
          ],
          "status": "covered"
        },
        {
          "stage": "exfiltration-of-stolen-data",
          "reason": "Requires specialized egress inspection or proxy telemetry not currently listed in the available surfaces.",
          "status": "not_visible",
          "blind_spot": "encrypted-egress"
        },
        {
          "stage": "ransomware-impact",
          "steps": [
            "mass-file-ops"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Phishing and Application Exploitation",
            "slug": "initial-access-phishing-and-exploitation",
            "tactic": "initial-access",
            "techniques": [
              "T1566",
              "T1190"
            ],
            "observables": [
              "Personalized phishing messages",
              "Exploitation of internet-facing vulnerabilities",
              "Exploitation of weak passwords"
            ]
          },
          {
            "name": "Malicious Code Execution",
            "slug": "execution-of-malicious-code",
            "tactic": "execution",
            "observables": [
              "Deployment of malicious code",
              "Autonomous AI agents exploiting passwords and creating personas",
              "Execution of AI-assisted workflows and chatbots"
            ]
          },
          {
            "name": "Data Exfiltration",
            "slug": "exfiltration-of-stolen-data",
            "tactic": "exfiltration",
            "techniques": [
              "T1041"
            ],
            "observables": [
              "Exfiltration over existing C2 channels",
              "Data theft extortion"
            ]
          },
          {
            "name": "Ransomware Encryption",
            "slug": "ransomware-impact",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "Ransomware encryption of files",
              "Data encrypted for impact"
            ]
          }
        ],
        "summary": "Threat actors targeting SMBs, including state-backed and financially motivated groups, are utilizing AI to accelerate attack chains from initial reconnaissance to impact. These campaigns typically involve personalized phishing or vulnerability exploitation followed by the deployment of malicious code, leading to data exfiltration and ransomware encryption."
      },
      "severity": "high",
      "rationale": "Scope the hunt starting with hosts that show high-severity CVEs in hb_vulnerability_finding. Use the results from the first query to populate the scope_hosts parameter if focusing on specific assets.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An automated adversary is exploiting high-severity vulnerabilities or weak credentials to gain initial access, subsequently executing rare processes from writable paths to encrypt files for extortion.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "scoping-parameter",
            "kind": "manual",
            "observed": "2024-10-26"
          },
          "type": "list[host]",
          "default": [],
          "description": "Optional list of hostnames to focus the search; if empty, the whole estate is searched."
        },
        "lookback_days": {
          "from": {
            "ref": "hunt-standard-lookback",
            "kind": "manual",
            "observed": "2024-10-26"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "critical_severity_id": {
          "from": {
            "ref": "vulnerability-threshold",
            "kind": "manual",
            "observed": "2024-10-26"
          },
          "type": "number",
          "default": "4",
          "description": "Minimum severity ID for vulnerability findings (4=High, 5=Critical)."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.welivesecurity.com/en/business-security/quest-simplicity-why-smbs-want-advanced-protection-without-complexity/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.welivesecurity.com/en/business-security/quest-simplicity-why-smbs-want-advanced-protection-without-complexity/",
          "name": "The quest for simplicity: Why SMBs want advanced protection without the complexity"
        }
      ],
      "blind_spots": [
        {
          "id": "unmanaged-assets",
          "risk": "Attacks starting on unmanaged assets remain invisible to endpoint-based process and file monitoring.",
          "question": "Whether unmanaged servers or IoT devices were the entry point.",
          "requires": "comprehensive endpoint agent coverage"
        },
        {
          "id": "encrypted-egress",
          "risk": "Without traffic inspection, data exfiltration over standard web channels is indistinguishable from normal user activity.",
          "stage": "exfiltration-of-stolen-data",
          "question": "Whether sensitive data was exfiltrated via HTTPS to common cloud storage.",
          "requires": "SSL/TLS inspection or network proxy logs"
        }
      ]
    },
    "name": "AI-Driven Ransomware and Data Extortion",
    "description": "This hunt identifies the progression of high-speed ransomware attacks starting from initial access attempts via application exploitation or credential abuse. It scopes the hunt to vulnerable assets, correlates those vulnerabilities with anomalous sign-ins and web traffic, and then pivots to find evidence of malicious execution and bulk file impact. This phased approach is designed to catch automated threats before they complete the encryption phase."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "initial-access-phishing-and-exploitation",
            "steps": [
              "identify-vulnerable-hosts",
              "web-exploitation-signs",
              "auth-anomaly-check"
            ],
            "status": "covered"
          },
          {
            "stage": "execution-of-malicious-code",
            "steps": [
              "rare-writable-processes"
            ],
            "status": "covered"
          },
          {
            "stage": "exfiltration-of-stolen-data",
            "reason": "Requires specialized egress inspection or proxy telemetry not currently listed in the available surfaces.",
            "status": "not_visible",
            "blind_spot": "encrypted-egress"
          },
          {
            "stage": "ransomware-impact",
            "steps": [
              "mass-file-ops"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An automated adversary is exploiting high-severity vulnerabilities or weak credentials to gain initial access, subsequently executing rare processes from writable paths to encrypt files for extortion.",
        "blind_spots": [
          {
            "id": "unmanaged-assets",
            "risk": "Attacks starting on unmanaged assets remain invisible to endpoint-based process and file monitoring.",
            "question": "Whether unmanaged servers or IoT devices were the entry point.",
            "requires": "comprehensive endpoint agent coverage"
          },
          {
            "id": "encrypted-egress",
            "risk": "Without traffic inspection, data exfiltration over standard web channels is indistinguishable from normal user activity.",
            "stage": "exfiltration-of-stolen-data",
            "question": "Whether sensitive data was exfiltrated via HTTPS to common cloud storage.",
            "requires": "SSL/TLS inspection or network proxy logs"
          }
        ],
        "scoping_notes": "Scope the hunt starting with hosts that show high-severity CVEs in hb_vulnerability_finding. Use the results from the first query to populate the scope_hosts parameter if focusing on specific assets.",
        "beyond_detection": "This hunt correlates three distinct attack phases across five telemetry surfaces. A single rule might flag mass file modifications but produce false positives for backup software; this hunt requires the presence of vulnerability context, initial access anomalies, and rare process execution to confirm a malicious intrusion."
      }
    },
    {
      "id": "identify-vulnerable-hosts",
      "type": "query",
      "label": "Identify vulnerable hosts",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_uid, cve_uid, title, affected_package_name, affected_package_version FROM hb_vulnerability_finding WHERE severity_id >= {{critical_severity_id}} AND status != 'suppressed' AND last_seen >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_vulnerability_finding",
        "description": "Locate hosts with high-severity vulnerabilities to establish the probable initial attack surface.",
        "expected_signal": "A list of host identifiers and their vulnerabilities; this establishes where exploitation is most likely to occur."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify vulnerable hosts",
        "reads": [
          "device_uid",
          "cve_uid",
          "title",
          "affected_package_name",
          "affected_package_version",
          "severity_id",
          "status",
          "last_seen"
        ],
        "source": "hb_vulnerability_finding",
        "target": "endpoint",
        "content": "SELECT device_uid, cve_uid, title, affected_package_name, affected_package_version FROM hb_vulnerability_finding WHERE severity_id >= {{critical_severity_id}} AND status != 'suppressed' AND last_seen >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of host identifiers and their vulnerabilities; this establishes where exploitation is most likely to occur.",
        "verified": "dry-run",
        "verified_at": "2026-10-08"
      }
    },
    {
      "id": "web-exploitation-signs",
      "type": "query",
      "label": "Web exploitation attempts",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "web",
        "content": "SELECT device_hostname, url_path, status_code, COUNT(*) as counts, MIN(time) as first_seen FROM hb_http_activity WHERE status_code IN (403, 500) AND (LOWER(url_path) LIKE '%.php%' OR LOWER(url_path) LIKE '%.jsp%' OR LOWER(url_path) LIKE '%.env%' OR LOWER(url_path) LIKE '%.config%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_path, status_code HAVING counts > 5",
        "surface": "hb_http_activity",
        "description": "Detect automated probing by finding high-severity web errors targeting sensitive application files.",
        "expected_signal": "Clusters of 403 or 500 errors targeting PHP, JSP, or configuration files, indicating automated exploitation probes."
      },
      "parents": [
        {
          "id": "identify-vulnerable-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Web exploitation attempts",
        "reads": [
          "device_hostname",
          "url_path",
          "status_code",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_path, status_code, COUNT(*) as counts, MIN(time) as first_seen FROM hb_http_activity WHERE status_code IN (403, 500) AND (LOWER(url_path) LIKE '%.php%' OR LOWER(url_path) LIKE '%.jsp%' OR LOWER(url_path) LIKE '%.env%' OR LOWER(url_path) LIKE '%.config%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_path, status_code HAVING counts > 5",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Clusters of 403 or 500 errors targeting PHP, JSP, or configuration files, indicating automated exploitation probes.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "url_path",
            "status_code"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-10-08"
      }
    },
    {
      "id": "auth-anomaly-check",
      "type": "query",
      "label": "Auth anomaly check",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "identity",
        "content": "SELECT actor_user_name, device_hostname, src_endpoint_ip, COUNT(*) as failures FROM hb_auth_signin WHERE status_id = 2 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, device_hostname, src_endpoint_ip HAVING failures > 20",
        "surface": "hb_auth_signin",
        "description": "Identify high-volume sign-in failures that indicate password exploitation or brute force attempts.",
        "expected_signal": "Specific user accounts or source IPs exhibiting excessive authentication failures consistent with credential stuffing."
      },
      "parents": [
        {
          "id": "identify-vulnerable-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Auth anomaly check",
        "reads": [
          "actor_user_name",
          "device_hostname",
          "src_endpoint_ip",
          "status_id",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, device_hostname, src_endpoint_ip, COUNT(*) as failures FROM hb_auth_signin WHERE status_id = 2 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, device_hostname, src_endpoint_ip HAVING failures > 20",
        "silence": "not_evidence_of_absence",
        "expected": "Specific user accounts or source IPs exhibiting excessive authentication failures consistent with credential stuffing.",
        "verified": "dry-run",
        "verified_at": "2026-10-08"
      }
    },
    {
      "id": "early-stage-triage",
      "type": "analytic",
      "label": "Early-stage triage",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "web"
        ],
        "context": [
          "identify-vulnerable-hosts",
          "web-exploitation-signs",
          "auth-anomaly-check"
        ],
        "objective": "Identify hosts that are both vulnerable and showing signs of active exploitation or credential abuse. Prioritize hosts that appear in the results of identify-vulnerable-hosts AND at least one of web-exploitation-signs or auth-anomaly-check.",
        "description": "Identify vulnerable hosts showing signs of active exploitation.",
        "max_iterations": 4,
        "expected_signal": "A list of hosts exhibiting high-risk indicators for the initial access phase.",
        "success_criteria": "A per-host verdict of malicious | suspicious for initial access, citing matching vulnerability and anomaly data."
      },
      "parents": [
        {
          "id": "web-exploitation-signs",
          "kind": "merge"
        },
        {
          "id": "auth-anomaly-check",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "rare-writable-processes",
      "type": "query",
      "label": "Rare writable processes",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT process_name, process_path, COUNT(DISTINCT device_hostname) as fleet_count, MIN(time) as first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\users\\public\\%' OR LOWER(process_path) LIKE '%\\appdata\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_name, process_path HAVING fleet_count <= 2",
        "surface": "hb_process_activity",
        "description": "Detect malicious code deployment by finding rare binaries running from user-writable directories.",
        "expected_signal": "Processes with low fleet prevalence running from suspicious, user-writable locations."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Rare writable processes",
        "reads": [
          "device_hostname",
          "process_name",
          "process_path",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT process_name, process_path, COUNT(DISTINCT device_hostname) as fleet_count, MIN(time) as first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\users\\public\\%' OR LOWER(process_path) LIKE '%\\appdata\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_name, process_path HAVING fleet_count <= 2",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Processes with low fleet prevalence running from suspicious, user-writable locations.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "process_name",
            "process_path"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-08"
      }
    },
    {
      "id": "mass-file-ops",
      "type": "query",
      "label": "High-speed file impact",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, COUNT(*) as file_touches FROM hb_file_activity WHERE activity_id IN (1, 3, 5) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-1 hours') GROUP BY device_hostname, process_name HAVING file_touches > 1000",
        "surface": "hb_file_activity",
        "description": "Detect ransomware encryption activity by identifying processes with extreme bursts of file touches.",
        "expected_signal": "A single process modifying or renaming over 1,000 files in a single hour, consistent with high-speed encryption."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "High-speed file impact",
        "reads": [
          "device_hostname",
          "process_name",
          "activity_id",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, COUNT(*) as file_touches FROM hb_file_activity WHERE activity_id IN (1, 3, 5) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-1 hours') GROUP BY device_hostname, process_name HAVING file_touches > 1000",
        "silence": "not_evidence_of_absence",
        "expected": "A single process modifying or renaming over 1,000 files in a single hour, consistent with high-speed encryption.",
        "verified": "dry-run",
        "verified_at": "2026-10-08"
      }
    },
    {
      "id": "follow-on-triage",
      "type": "analytic",
      "label": "Follow-on triage",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "web"
        ],
        "context": [
          "early-stage-triage",
          "rare-writable-processes",
          "mass-file-ops"
        ],
        "objective": "Determine if any host identified as suspicious in early-stage-triage is also exhibiting malicious execution and mass file modification consistent with ransomware. Cite the relationship between the vulnerable state, the initial access anomaly, and the follow-on impact.",
        "description": "Correlate early access beachheads with execution and file-level impact evidence.",
        "max_iterations": 6,
        "expected_signal": "A confirmed verdict on ransomware activity citing the full chain from access to impact.",
        "success_criteria": "A definitive verdict for each host citing evidence from at least three surfaces to confirm a full attack chain."
      },
      "parents": [
        {
          "id": "rare-writable-processes",
          "kind": "merge"
        },
        {
          "id": "mass-file-ops",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the follow-on-triage verdict is malicious for at least one host",
        "condition": "the follow-on-triage verdict is malicious for at least one host",
        "blind_spot": "unmanaged-assets",
        "confidence": "high",
        "description": "Direct response based on the agent's findings.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "follow-on-triage"
        }
      ]
    },
    {
      "id": "contain-host",
      "type": "action",
      "label": "Contain host",
      "config": {
        "target": "endpoint",
        "description": "Isolate the compromised endpoint to prevent further data encryption or exfiltration.",
        "instructions": "Isolate the host and collect the binary identified in the rare-writable-processes step.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-deep-dive",
      "type": "task",
      "label": "Analyst deep dive",
      "config": {
        "assignee": "analyst",
        "description": "Perform manual forensic review to confirm the attack vector and assess data loss.",
        "instructions": "Review the full process tree on the compromised host, check for signs of lateral movement via SMB or RDP, and update the vulnerability management plan."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "contain-host"
        }
      ]
    },
    {
      "id": "close-out-hunt",
      "type": "task",
      "label": "Close out hunt",
      "config": {
        "assignee": "analyst",
        "description": "Document the hunt outcome and confirm the current security posture.",
        "instructions": "Log the examined period and confirm whether any indicators of high-speed ransomware were detected."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}