{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The active exploitation of zero-day vulnerabilities in ubiquitous office software (Outlook and Chrome) presents an immediate threat to corporate credentials. This hunt identifies post-compromise activity that specifically bypasses static signature-based controls." }, "name": "AI-Enhanced Client Exploitation and Automated Credential Theft", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1555", "attack.t1059", "attack.t1071", "command and control", "credential access", "execution", "initial access" ], "related": [ { "hunt": "lateral-movement-after-client-compromise", "reason": "Once credentials are stolen by VOLTA/NIK, lateral movement using those credentials is the logical next stage.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "This hunt does not rely on static file signatures, which are easily rotated. It pivots from application failure modes (memory violation crashes) to fleet-wide prevalence and automated credential-store access, providing a contextual view of the attack chain that a single detection rule cannot replicate.", "coverage": [ { "stage": "vulnerability-exploitation-outlook-chrome", "steps": [ "scoping-vulnerable-inventory", "client-application-crashes" ], "status": "covered" }, { "stage": "malware-implant-execution", "steps": [ "rare-binaries-and-known-hashes" ], "status": "covered" }, { "stage": "automated-credential-theft", "steps": [ "credential-access-activity" ], "status": "covered" }, { "stage": "ai-enabled-command-and-control", "reason": "The AI-driven logic of the C2 occurs within the compromised session or on the attacker's infrastructure; standard network telemetry can see the connection but not the integrated AI analysis.", "status": "not_visible" } ], "scenario": { "stages": [ { "name": "Zero-day client exploitation", "slug": "vulnerability-exploitation-outlook-chrome", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "CVE-2026-124194", "CVE-2026-125350", "crafted HTML page targeting Chrome XML component", "Spoofing within Microsoft Office Outlook" ] }, { "name": "Infostealer and C2 implant execution", "slug": "malware-implant-execution", "tactic": "execution", "techniques": [ "T1059" ], "observables": [ "f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85.js", "cca616647db9370c88998ae25da6997f.exe", "ae59aedc4d89d7b22db5dc65cd0b2ff68b20b74863d44f53fd346de739081694.exe", "f_01b5ab.html", "VOLTA infostealer", "NIK C2 Windows implant" ] }, { "name": "AI-driven credential and keystroke theft", "slug": "automated-credential-theft", "tactic": "credential-access", "techniques": [ "T1555" ], "observables": [ "LLM-based credential analysis", "Dumping credentials from compromised sessions", "Victim keystroke streaming", "Automated generation of high-value dossiers from harvested data" ] }, { "name": "AI-enabled command and control", "slug": "ai-enabled-command-and-control", "tactic": "command-and-control", "techniques": [ "T1071" ], "observables": [ "NIK C2 framework communication", "Integrated AI model data analysis within compromised sessions" ] } ], "summary": "Threat actors are exploiting zero-day vulnerabilities in Microsoft Outlook (CVE-2026-124194) and Google Chrome (CVE-2026-125350) to deliver AI-enhanced malware. Payloads such as the VOLTA infostealer and NIK C2 framework utilize large language models to automate the analysis of stolen credentials and keystrokes, significantly accelerating post-exploitation phases." }, "severity": "high", "rationale": "Start with devices identified in hb_vulnerability_finding. Note that hb_vulnerability_finding uses device_uid; analysts must resolve these to hostnames before populating the scope_hosts parameter for endpoint-surface queries.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has exploited zero-day vulnerabilities in Microsoft Outlook or Google Chrome to execute AI-integrated implants that automate credential harvesting and data analysis.", "parameters": { "cve_ids": { "from": { "ref": "talos", "kind": "article", "observed": "2026-11-12" }, "type": "list[string]", "default": [ "CVE-2026-124194", "CVE-2026-125350" ], "description": "CVEs addressed in the November 2026 Patch Tuesday with known active exploitation." }, "scope_hosts": { "from": { "ref": "hunt-analyst", "kind": "manual", "observed": "2026-11-12" }, "type": "list[host]", "default": [], "description": "Hostnames identified as vulnerable in the scoping step; leave empty to hunt across the entire estate." }, "lookback_days": { "from": { "ref": "incident-response-policy", "kind": "manual", "observed": "2026-11-12" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "malware_hashes": { "from": { "ref": "talos", "kind": "article", "observed": "2026-11-12" }, "type": "list[hash]", "default": [ "f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85", "7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f", "ae59aedc4d89d7b22db5dc65cd0b2ff68b20b74863d44f53fd346de739081694", "f0f8ceed9d5db100de257e6c8a4c85b08a30fd9591de754169adcfe0cf627bcb", "985c3972712218c62d2418b41056dba5fe883ca5104d8ec12041f8611db344f9" ], "description": "Known hashes for VOLTA and NIK C2 implants." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://blog.talosintelligence.com/never-be-afraid-to-ask-questions/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://blog.talosintelligence.com/never-be-afraid-to-ask-questions/", "name": "Talos \u2014 Never be afraid to ask questions" } ], "blind_spots": [ { "id": "no-agent-on-host", "risk": "A host without an agent provides no telemetry for process launches or application errors, leaving a gap in the behavioral search.", "owner": "Asset Management", "stage": "malware-implant-execution", "question": "Are there vulnerable, unmanaged devices executing these implants?", "requires": "Endpoint agent coverage", "remediation": "Deploy agents to all corporate-owned endpoints and audit managed status." }, { "id": "keystroke-logging-gap", "risk": "Without specific input-monitoring telemetry, the keystroke-streaming feature of NIK C2 is invisible, leaving credential theft to be inferred only from object-access events.", "owner": "Detection Engineering", "stage": "automated-credential-theft", "question": "Is the NIK C2 implant actively streaming victim keystrokes?", "requires": "Detailed keystroke or input telemetry", "remediation": "Investigate EDR capabilities for monitoring keyboard hook activity." } ] }, "name": "AI-Enhanced Client Exploitation and Automated Credential Theft", "description": "This hunt targets the exploitation of CVE-2026-124194 and CVE-2026-125350, which allow remote attackers to execute code via crafted client-side content. Following initial access, the hunt looks for the VOLTA and NIK C2 implants, which use AI to prioritize stolen credentials and stream keystrokes. By correlating application crashes on vulnerable hosts with rare process launches and automated credential access, the hunt identifies successful compromises that traditional signatures might miss." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "coverage": [ { "stage": "vulnerability-exploitation-outlook-chrome", "steps": [ "scoping-vulnerable-inventory", "client-application-crashes" ], "status": "covered" }, { "stage": "malware-implant-execution", "steps": [ "rare-binaries-and-known-hashes" ], "status": "covered" }, { "stage": "automated-credential-theft", "steps": [ "credential-access-activity" ], "status": "covered" }, { "stage": "ai-enabled-command-and-control", "reason": "The AI-driven logic of the C2 occurs within the compromised session or on the attacker's infrastructure; standard network telemetry can see the connection but not the integrated AI analysis.", "status": "not_visible" } ], "rationale": "An adversary has exploited zero-day vulnerabilities in Microsoft Outlook or Google Chrome to execute AI-integrated implants that automate credential harvesting and data analysis.", "blind_spots": [ { "id": "no-agent-on-host", "risk": "A host without an agent provides no telemetry for process launches or application errors, leaving a gap in the behavioral search.", "owner": "Asset Management", "stage": "malware-implant-execution", "question": "Are there vulnerable, unmanaged devices executing these implants?", "requires": "Endpoint agent coverage", "remediation": "Deploy agents to all corporate-owned endpoints and audit managed status." }, { "id": "keystroke-logging-gap", "risk": "Without specific input-monitoring telemetry, the keystroke-streaming feature of NIK C2 is invisible, leaving credential theft to be inferred only from object-access events.", "owner": "Detection Engineering", "stage": "automated-credential-theft", "question": "Is the NIK C2 implant actively streaming victim keystrokes?", "requires": "Detailed keystroke or input telemetry", "remediation": "Investigate EDR capabilities for monitoring keyboard hook activity." } ], "scoping_notes": "Start with devices identified in hb_vulnerability_finding. Note that hb_vulnerability_finding uses device_uid; analysts must resolve these to hostnames before populating the scope_hosts parameter for endpoint-surface queries.", "beyond_detection": "This hunt does not rely on static file signatures, which are easily rotated. It pivots from application failure modes (memory violation crashes) to fleet-wide prevalence and automated credential-store access, providing a contextual view of the attack chain that a single detection rule cannot replicate." } }, { "id": "scoping-vulnerable-inventory", "type": "query", "label": "Identify vulnerable hosts", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_uid, cve_uid, title, first_seen FROM hb_vulnerability_finding WHERE instr(',' || '{{cve_ids}}' || ',', ',' || cve_uid || ',') > 0", "surface": "hb_vulnerability_finding", "description": "Find devices currently missing patches for the actively exploited Outlook and Chrome CVEs.", "expected_signal": "A list of device UIDs that are susceptible to the zero-day exploits. This list is used to prioritize the behavioral search." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify vulnerable hosts", "reads": [ "cve_uid", "device_uid", "first_seen", "title" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT device_uid, cve_uid, title, first_seen FROM hb_vulnerability_finding WHERE instr(',' || '{{cve_ids}}' || ',', ',' || cve_uid || ',') > 0", "silence": "not_evidence_of_absence", "expected": "A list of device UIDs that are susceptible to the zero-day exploits. This list is used to prioritize the behavioral search.", "verified": "dry-run", "verified_at": "2026-11-13" } }, { "id": "client-application-crashes", "type": "query", "label": "Client application crashes", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, app_name, exception_code, message, time FROM hb_application_error WHERE (LOWER(app_name) LIKE '%chrome.exe' OR LOWER(app_name) LIKE '%outlook.exe') AND exception_code = 'c0000005' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_application_error", "description": "Find Access Violation (c0000005) errors in Outlook or Chrome, often indicating memory corruption during exploitation.", "expected_signal": "A concentration of crashes on specific vulnerable hosts during the lookback period." }, "parents": [ { "id": "scoping-vulnerable-inventory" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Client application crashes", "reads": [ "app_name", "device_hostname", "exception_code", "message", "time" ], "source": "hb_application_error", "target": "endpoint", "content": "SELECT device_hostname, app_name, exception_code, message, time FROM hb_application_error WHERE (LOWER(app_name) LIKE '%chrome.exe' OR LOWER(app_name) LIKE '%outlook.exe') AND exception_code = 'c0000005' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A concentration of crashes on specific vulnerable hosts during the lookback period.", "verified": "dry-run", "verified_at": "2026-11-13" } }, { "id": "rare-binaries-and-known-hashes", "type": "query", "label": "Rare binaries and known hashes", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT LOWER(process_path) AS path, process_hash_sha256, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\appdata\\%' OR LOWER(process_path) LIKE '%\\users\\public\\%' OR instr(',' || '{{malware_hashes}}' || ',', ',' || LOWER(process_hash_sha256) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY path, process_hash_sha256 HAVING hosts <= 3 ORDER BY hosts ASC", "surface": "hb_process_activity", "description": "Stack-count rare processes launched from user-writable paths or matching known implant hashes.", "expected_signal": "Rare binaries appearing on a small number of hosts, potentially matching known malicious hashes." }, "parents": [ { "id": "scoping-vulnerable-inventory" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Rare binaries and known hashes", "reads": [ "device_hostname", "process_hash_sha256", "process_path", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_path) AS path, process_hash_sha256, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\appdata\\%' OR LOWER(process_path) LIKE '%\\users\\public\\%' OR instr(',' || '{{malware_hashes}}' || ',', ',' || LOWER(process_hash_sha256) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY path, process_hash_sha256 HAVING hosts <= 3 ORDER BY hosts ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Rare binaries appearing on a small number of hosts, potentially matching known malicious hashes.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_path", "process_hash_sha256" ], "rare_below": 3 }, "verified_at": "2026-11-13" } }, { "id": "early-stage-triage", "type": "analytic", "label": "Early stage triage", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "scoping-vulnerable-inventory", "client-application-crashes", "rare-binaries-and-known-hashes" ], "objective": "Identify hosts where a client-side crash was followed by the execution of a rare or malicious process.", "description": "Determine if the crashes and rare binaries suggest a successful exploitation event.", "max_iterations": 3, "expected_signal": "A per-host verdict linking instability to malicious execution.", "success_criteria": "A list of suspicious hosts with cited crash and process events." }, "parents": [ { "id": "client-application-crashes", "kind": "merge" }, { "id": "rare-binaries-and-known-hashes", "kind": "merge" } ] }, { "id": "credential-access-activity", "type": "query", "label": "Credential access activity", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, actor_process_name, object_name, access_mask, time FROM hb_resource_activity WHERE (LOWER(object_name) LIKE '%lsass%' OR object_type = 'SAM_USER') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_resource_activity", "description": "Monitor for unauthorized access to sensitive credential stores (LSASS, SAM) typically targeted by NIK C2 and VOLTA.", "expected_signal": "Access events to LSASS or SAM by processes not expected to do so (excluding known AV/EDR)." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Credential access activity", "reads": [ "access_mask", "actor_process_name", "device_hostname", "object_name", "object_type", "time" ], "source": "hb_resource_activity", "target": "endpoint", "content": "SELECT device_hostname, actor_process_name, object_name, access_mask, time FROM hb_resource_activity WHERE (LOWER(object_name) LIKE '%lsass%' OR object_type = 'SAM_USER') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Access events to LSASS or SAM by processes not expected to do so (excluding known AV/EDR).", "verified": "dry-run", "verified_at": "2026-11-13" } }, { "id": "follow-on-triage", "type": "analytic", "label": "Follow-on triage", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "early-stage-triage", "credential-access-activity" ], "objective": "Determine if any host showing signs of exploitation has also engaged in automated credential theft.", "description": "Correlate early-stage evidence with credential harvesting to confirm active compromise.", "max_iterations": 5, "expected_signal": "High-confidence malicious verdicts for endpoints exhibiting the full attack chain.", "success_criteria": "A final malicious | suspicious | benign verdict per host." }, "parents": [ { "id": "credential-access-activity" } ] }, { "id": "routing-decision", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the follow-on-triage verdict is malicious for at least one host", "condition": "the follow-on-triage verdict is malicious for at least one host", "blind_spot": "no-agent-on-host", "confidence": "high", "description": "Direct the workflow based on the agent's final assessment of the hosts.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "follow-on-triage" } ] }, { "id": "contain-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Prevent further credential exfiltration or lateral movement by isolating the compromised endpoint.", "instructions": "Isolate the host and initiate a full password reset for all accounts logged into this machine in the last 24 hours.", "action_approval": "required" }, "parents": [ { "id": "routing-decision", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review", "config": { "assignee": "analyst", "description": "Verify the agent's findings and look for signs of lateral movement or persistence.", "instructions": "Review the cited crash events and credential access. Check for any outbound network connections to suspicious domains that weren't captured in the C2 list." }, "parents": [ { "id": "routing-decision", "branch": "default" }, { "id": "routing-decision", "branch": "on_unavailable" }, { "id": "routing-decision", "branch": "on_refutes" }, { "id": "contain-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Document the hunt outcome and identify gaps in telemetry.", "instructions": "Record the vulnerable hosts that were successfully patched. Note any unmanaged devices that were identified as out-of-scope for the behavioral steps." }, "parents": [ { "id": "analyst-review" } ] } ] }