--- analysis: A simple rule for new browser extensions is too noisy for most fleets. This hunt uses a phased sequence to pivot from HTTP traffic and cloud API grants into rare software inventory, providing the necessary context to identify a true malicious chain. blind_spots: - id: no-decryption question: What content was submitted to the phishing URL after the initial interaction. requires: TLS decryption on a forward proxy risk: We can see the domain visited but not whether credentials or tokens were exfiltrated in the request payload. stage: initial-access-phishing-collaboration - id: extension-data-gap question: The specific internal capabilities or permissions of a loaded browser extension. requires: Browser internal database monitoring risk: The hunt sees the extension name and vendor but may not see if it has permissions to read page content or intercept form submissions. stage: malicious-browser-extensions - id: cloud-api-latency question: Whether an OAuth grant occurred in the last few minutes. requires: Unified Audit Log (UAL) near-real-time streaming risk: There is a known delay in cloud API logging that might prevent identifying a very recent compromise. stage: oauth-phishing-and-consent coverage: - stage: initial-access-phishing-collaboration status: covered steps: - phishing-clicks - stage: oauth-phishing-and-consent status: covered steps: - oauth-grants - stage: malicious-browser-extensions status: covered steps: - rare-extensions - stage: session-hijacking-credential-access status: covered steps: - anomalous-signins guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: Modern collaboration attacks use AI to bypass standard email gateways; organizations must confirm that post-click persistence mechanisms like malicious extensions are not present on critical assets. methodology: model-assisted trigger: intel-report hypothesis: An adversary has bypassed traditional email defenses using AI-enhanced social engineering to trick a user into granting OAuth permissions or installing a malicious browser extension, leading to session hijacking and persistent access. labels: - hunt - attack.t1566 - attack.t1176 - attack.t1190 - attack.t1557 - credential access - initial access - persistence name: AI-Enhanced Collaboration and Browser Attacks parameters: browser_names: default: - chrome - firefox - msedge - safari description: Common browser package names to identify candidate hosts. from: kind: manual observed: '2026-09-22' ref: hunt-standard type: list[string] lookback_days: default: '14' description: Days of history to examine. from: kind: manual observed: '2026-09-22' ref: hunt-standard type: number phishing_domains: default: - proofpoint.com - secure-login-verify.com - microsoft-consent.net description: Known or suspicious domains linked to phishing; includes the article domain as a baseline. from: kind: article observed: '2026-09-22' ref: proofpoint-ai-era-press-release type: list[domain] scope_hosts: default: [] description: Optional list of hosts to narrow the hunt; typically populated from the scoping results. from: kind: manual observed: '2026-09-22' ref: hunt-standard type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.proofpoint.com/us/newsroom/press-releases/proofpoint-stops-attacks-traditional-defenses-miss-ai-era gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: Scope the hunt to critical business workstations first, particularly finance and executive users, as they are primary targets for AI-enhanced transaction fraud and social engineering. references: - name: Proofpoint Stops the Attacks Traditional Defenses Miss in the AI Era url: https://www.proofpoint.com/us/newsroom/press-releases/proofpoint-stops-attacks-traditional-defenses-miss-ai-era related: - hunt: cloud-app-registration-monitoring reason: This hunt focuses on browser-borne threats and extensions; a broader cloud-native hunt for any application registration is a sibling. relation: out-of-scope-alternative scenario: stages: - name: Social Engineering via Trusted Relationships observables: - Compromised supplier email threads - Fraudulent payment requests - Post-click phishing URLs - Phishing attachments slug: initial-access-phishing-collaboration tactic: initial-access techniques: - T1566 - name: OAuth Phishing and Credential Theft observables: - Malicious OAuth consent requests - Credential theft via phishing landing pages - Abuse of trusted application permissions slug: oauth-phishing-and-consent tactic: initial-access techniques: - T1566 - name: Persistence via Malicious Browser Extensions observables: - Installation of unauthorized browser extensions - Malicious extension files in user profiles - Suspicious extension-originating network traffic slug: malicious-browser-extensions tactic: persistence techniques: - T1176 - name: Session Hijacking and Post-Click Theft observables: - Session cookie theft - Unauthorized session hijacking in the browser - Suspicious authentication attempts using stolen sessions slug: session-hijacking-credential-access tactic: credential-access techniques: - T1557 summary: Attackers leverage compromised supplier email threads, fraudulent payment requests, and OAuth phishing to bypass traditional defenses. These sophisticated campaigns lead to the installation of malicious browser extensions and session hijacking to maintain persistent access to corporate collaboration environments. severity: medium targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent identity: category: identity name: Identity / sign-in telemetry telemetry: - identity web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # AI-Enhanced Collaboration and Browser Attacks This hunt targets sophisticated collaboration attacks that use trusted relationships to move from a phishing click to a persistent browser implant. AI-generated lures often bypass standard signature-based gateways, requiring a search for behavioral anomalies across the entire attack chain. The hunt follows a phased approach: first identifying suspicious initial interactions and cloud permission grants, then searching for follow-on persistence in the form of rare browser extensions and anomalous sign-in patterns. By correlating these stages, the hunt identifies compromised accounts and hosts that traditional per-tool defenses miss. ## scoping-browsers Identify the workstations that run common browsers where extensions could be installed as a baseline for the hunt. ```sqlite target=endpoint role=scoping params=(browser_names=browser_names) ~~~yaml expected: A list of hosts currently running browsers. Zero hosts means no browsers are inventoried, suggesting a collection gap. reads: - device_hostname - package_name - package_version silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-09-29' ~~~ SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (instr(',' || '{{browser_names}}' || ',', ',' || LOWER(package_name) || ',') > 0 OR LOWER(package_name) LIKE '%chrome%' OR LOWER(package_name) LIKE '%firefox%' OR LOWER(package_name) LIKE '%edge%') ``` ## parallel-initial-access parallel: - → phishing-clicks - → oauth-grants join: → triage-initial-access ## phishing-clicks Find connections to known phishing domains or URLs with suspicious keywords indicating a social engineering lure. ```sqlite target=web role=enrichment params=(phishing_domains=phishing_domains, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: Rows indicate a host interacted with a suspicious URL. Silence suggests no observed phishing traffic in the window. reads: - device_hostname - url_full - src_endpoint_ip - user_agent - time - url_hostname silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-09-29' ~~~ SELECT device_hostname, url_full, src_endpoint_ip, user_agent, time FROM hb_http_activity WHERE (instr(',' || '{{phishing_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 OR LOWER(url_full) LIKE '%login%' OR LOWER(url_full) LIKE '%consent%' OR LOWER(url_full) LIKE '%authorize%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## oauth-grants Detect when a user grants permissions to an application, which often follows a successful phishing lure. ```sqlite target=endpoint role=triage params=(lookback_days=lookback_days) ~~~yaml expected: Users granting broad permissions to applications. Silence means no such cloud events were recorded. reads: - actor_user_name - api_operation - resource_name - src_endpoint_ip - time - provider silence: not_evidence_of_absence source: hb_cloud_api_activity verified: dry-run verified_at: '2026-09-29' ~~~ SELECT actor_user_name, api_operation, resource_name, src_endpoint_ip, time FROM hb_cloud_api_activity WHERE provider = 'm365' AND (LOWER(api_operation) LIKE '%consent%' OR LOWER(api_operation) LIKE '%permission%' OR LOWER(api_operation) LIKE '%app role%') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-initial-access ```agent target=hunter cite: required context: - phishing-clicks - oauth-grants max_iterations: 4 objective: Identify users or hosts who visited phishing URLs and subsequently granted suspicious OAuth permissions. success_criteria: A list of high-risk principals and endpoints. tools: - endpoint - identity - web ``` ## parallel-follow-on parallel: - → rare-extensions - → anomalous-signins join: → triage-final ## rare-extensions Find browser extensions seen on very few hosts, indicating a potential targeted malicious implant. ```sqlite target=endpoint role=detection-candidate params=(scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Extensions found on only one or two hosts. This is a durable signal of persistence if it follows a phishing interaction. prevalence: by: device_hostname key: - package_name - vendor_name rare_below: 3 reads: - package_name - vendor_name - device_hostname - collected_at - package_type silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-09-29' ~~~ SELECT package_name, vendor_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(collected_at) AS first_seen FROM hb_software_inventory WHERE package_type = 'extension' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY package_name, vendor_name HAVING host_count <= 3 ORDER BY host_count ASC ``` ## anomalous-signins Identify successful logins where MFA was not recorded, suggesting session hijacking from the browser. ```sqlite target=identity role=baseline params=(scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: Successful sign-ins without MFA, especially from IPs that match the phishing workstation. reads: - actor_user_name - device_hostname - src_endpoint_ip - mfa - status - time - status_id silence: not_evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-09-29' ~~~ SELECT actor_user_name, device_hostname, src_endpoint_ip, mfa, status, time FROM hb_auth_signin WHERE status_id = 1 AND (mfa = 'false' OR mfa IS NULL) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-final ```agent target=hunter cite: required context: - rare-extensions - anomalous-signins - triage-initial-access max_iterations: 6 objective: Determine if a phishing click or OAuth grant was followed by a rare extension installation or anomalous session reuse on the same host or user identity. success_criteria: A per-host verdict of malicious | suspicious | benign, citing the connected rows across surfaces. tools: - endpoint - identity - web ``` ## route-remediation if~: "the triage verdict is malicious for at least one user or host" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: cloud-api-latency) else: → close-out ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the identified endpoints, revoke the malicious OAuth grants in the Microsoft 365 portal, and terminate all active sessions for the affected users. ``` → analyst-review ## analyst-review ```manual target=analyst Review the cited rows for the phishing interaction, the OAuth grant, and the rare extension. Confirm if the extension behavior is truly malicious and if the sign-in without MFA represents a hijacked session. ``` → close-out ## close-out ```manual target=analyst Record the total number of hosts and users examined. Note any visibility gaps, such as hosts missing browser extension inventory or cloud API logs that were missing critical user agent details. ``` → end