{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "AI infrastructure components are becoming high-value control points. Intruders target them to monetize compute resources and establish persistence near high-value credential material." }, "name": "AI Infrastructure Host Monetization and Persistence", "type": "investigation", "labels": [ "hunt", "attack.t1105", "attack.t1036.005", "attack.t1082", "attack.t1046", "attack.t1496", "attack.t1098.004", "attack.t1053.003", "attack.t1090.003" ], "series": { "slug": "when-ai-infrastructure-becomes-the-target-securing-gateways-and-control-points", "index": 2, "title": "When AI infrastructure becomes the target: Securing gateways and control points", "total": 2 }, "related": [ { "hunt": "ai-gateway-credential-theft", "reason": "Credential harvesting from gateway memory or databases is handled in the sibling hunt.", "relation": "out-of-scope-alternative" }, { "hunt": "ai-gateway-exploitation-credential-theft", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "This hunt uses a fleet-wide prevalence baseline to find masqueraded payloads launched from temporary paths, then pivots to low-signal hardware tuning events (MSR loading) and configuration harvesting that single rules would find too noisy.", "coverage": [ { "stage": "masqueraded-payload-delivery", "steps": [ "payload-delivery-prevalence" ], "status": "covered" }, { "stage": "host-and-miner-discovery", "steps": [ "discovery-and-cleanup" ], "status": "covered" }, { "stage": "resource-hijacking-cryptomining", "steps": [ "msr-module-load" ], "status": "covered" }, { "stage": "host-persistence-mechanisms", "steps": [ "persistence-activity" ], "status": "covered" }, { "stage": "initial-access-ai-gateway-exploitation", "reason": "Belongs to another part of the 'When AI infrastructure becomes the target: Securing gateways and control points' series.", "status": "out_of_scope" }, { "stage": "runtime-credential-harvesting", "reason": "Belongs to another part of the 'When AI infrastructure becomes the target: Securing gateways and control points' series.", "status": "out_of_scope" }, { "stage": "application-layer-data-exfiltration", "reason": "Belongs to another part of the 'When AI infrastructure becomes the target: Securing gateways and control points' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Exploitation of Exposed AI Control Points", "slug": "initial-access-ai-gateway-exploitation", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "CVE-2026-42271", "CVE-2026-48710", "CVE-2026-49869", "CVE-2026-45312", "CVE-2026-28797", "CVE-2026-24770", "CVE-2025-68700", "Outbound Burp Collaborator callbacks from RAGFlow server", "POST /mcp-rest/test/connection", "POST /mcp-rest/test/tools/list" ] }, { "name": "Gateway Runtime Secret Harvesting", "slug": "runtime-credential-harvesting", "tactic": "credential-access", "techniques": [ "T1552.001" ], "observables": [ "Reading /proc/1/environ from gateway PID 1", "Filtering environment for 'master', 'API key', 'token', 'password', 'DATABASE_URL'", "Python urllib, curl, or wget used for exfiltration of environment blocks" ] }, { "name": "Masqueraded Payload Delivery and Execution", "slug": "masqueraded-payload-delivery", "tactic": "execution", "techniques": [ "T1105", "T1036.005" ], "observables": [ "ELF binaries staged in temporary paths", "Service-style naming masquerading as benign Linux daemons", "Shell-stage downloaders with short timeouts and fallbacks", "python3 -c commands retrieving remote payloads" ] }, { "name": "Host Discovery and Competitor Cleanup", "slug": "host-and-miner-discovery", "tactic": "discovery", "techniques": [ "T1082", "T1046" ], "observables": [ "Silent passwordless sudo checks", "Listening port inspection", "Process sweeps for competing miners or remote shells", "Modification of crontab to remove other miner entries" ] }, { "name": "AI Gateway Database Exfiltration", "slug": "application-layer-data-exfiltration", "tactic": "collection", "techniques": [ "T1041" ], "observables": [ "Access to postgres.database.azure.com", "Queries against LiteLLM_ProxyModelTable and LiteLLM_VerificationToken", "Self-contained python3 one-liners installing PostgreSQL support", "Base64-encoded exfiltration in small chunks" ] }, { "name": "Compute Resource Hijacking", "slug": "resource-hijacking-cryptomining", "tactic": "impact", "techniques": [ "T1496" ], "observables": [ "XMRig deployment", "Loading Linux Model-Specific Register (msr) module with write access", "RandomX-related CPU tuning" ] }, { "name": "System Persistence and C2", "slug": "host-persistence-mechanisms", "tactic": "persistence", "techniques": [ "T1098.004", "T1053.003", "T1090.003" ], "observables": [ "Modification of SSH authorized_keys under service accounts", "Hidden-file relay execution", "Masqueraded systemd service names", "Periodic out-of-band callbacks (C2 relay)" ] } ], "summary": "Attackers are targeting exposed AI infrastructure components like LiteLLM gateways, RAGFlow document engines, and Kestra orchestrators to harvest LLM provider keys and credentials. Once access is gained, they pivot to container host persistence and monetize compromised compute resources through cryptomining." }, "severity": "high", "rationale": "The hunt should initially focus on hosts identified as running LiteLLM, RAGFlow, or Kestra using the software inventory step.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An attacker has compromised an AI gateway or retrieval engine and is now deploying masqueraded payloads to monetize the host via cryptomining and establish durable SSH or systemd persistence.", "parameters": { "ai_apps": { "type": "list[string]", "default": [ "litellm", "ragflow", "kestra" ], "description": "AI infrastructure software names to scope the hunt." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hostnames to focus on; leave empty to hunt across the entire estate." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/", "name": "MSRC - When AI infrastructure becomes the target: Securing gateways and control points" } ], "blind_spots": [ { "id": "msr-write-parameters", "risk": "Legitimate system utilities might load the msr module; without seeing the write parameter, we cannot confirm if it was for mining tuning.", "stage": "resource-hijacking-cryptomining", "question": "Was the msr module loaded with write access enabled (allow_writes=1)?", "requires": "hb_module_activity with module parameters" }, { "id": "limited-snapshot-visibility", "risk": "Short-lived payloads might be missed if the data source relies on periodic process snapshots rather than an execution stream.", "stage": "masqueraded-payload-delivery", "question": "Did the payload execute and terminate between snapshots?", "requires": "continuous event stream for hb_process_activity" }, { "id": "ssh-key-content", "risk": "We can see the file was touched but not what key was added, preventing attribution to a known actor without host forensics.", "stage": "host-persistence-mechanisms", "question": "What public key was added to authorized_keys?", "requires": "hb_file_activity with content capture" } ] }, "name": "AI Infrastructure Host Monetization and Persistence", "description": "This hunt focuses on the post-exploitation phase of attacks targeting AI infrastructure like LiteLLM, RAGFlow, and Kestra. It examines the transition from initial gateway command execution to host-level abuse. We first identify hosts running AI software, then hunt for masqueraded binaries in temporary paths using a prevalence baseline to find rare items. We corroborate these with host discovery commands, cryptomining indicators such as MSR module loading, and persistence mechanisms like SSH authorized_keys modifications." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "when-ai-infrastructure-becomes-the-target-securing-gateways-and-control-points", "index": 2, "title": "When AI infrastructure becomes the target: Securing gateways and control points", "total": 2 }, "coverage": [ { "stage": "masqueraded-payload-delivery", "steps": [ "payload-delivery-prevalence" ], "status": "covered" }, { "stage": "host-and-miner-discovery", "steps": [ "discovery-and-cleanup" ], "status": "covered" }, { "stage": "resource-hijacking-cryptomining", "steps": [ "msr-module-load" ], "status": "covered" }, { "stage": "host-persistence-mechanisms", "steps": [ "persistence-activity" ], "status": "covered" }, { "stage": "initial-access-ai-gateway-exploitation", "reason": "Belongs to another part of the 'When AI infrastructure becomes the target: Securing gateways and control points' series.", "status": "out_of_scope" }, { "stage": "runtime-credential-harvesting", "reason": "Belongs to another part of the 'When AI infrastructure becomes the target: Securing gateways and control points' series.", "status": "out_of_scope" }, { "stage": "application-layer-data-exfiltration", "reason": "Belongs to another part of the 'When AI infrastructure becomes the target: Securing gateways and control points' series.", "status": "out_of_scope" } ], "rationale": "An attacker has compromised an AI gateway or retrieval engine and is now deploying masqueraded payloads to monetize the host via cryptomining and establish durable SSH or systemd persistence.", "blind_spots": [ { "id": "msr-write-parameters", "risk": "Legitimate system utilities might load the msr module; without seeing the write parameter, we cannot confirm if it was for mining tuning.", "stage": "resource-hijacking-cryptomining", "question": "Was the msr module loaded with write access enabled (allow_writes=1)?", "requires": "hb_module_activity with module parameters" }, { "id": "limited-snapshot-visibility", "risk": "Short-lived payloads might be missed if the data source relies on periodic process snapshots rather than an execution stream.", "stage": "masqueraded-payload-delivery", "question": "Did the payload execute and terminate between snapshots?", "requires": "continuous event stream for hb_process_activity" }, { "id": "ssh-key-content", "risk": "We can see the file was touched but not what key was added, preventing attribution to a known actor without host forensics.", "stage": "host-persistence-mechanisms", "question": "What public key was added to authorized_keys?", "requires": "hb_file_activity with content capture" } ], "scoping_notes": "The hunt should initially focus on hosts identified as running LiteLLM, RAGFlow, or Kestra using the software inventory step.", "beyond_detection": "This hunt uses a fleet-wide prevalence baseline to find masqueraded payloads launched from temporary paths, then pivots to low-signal hardware tuning events (MSR loading) and configuration harvesting that single rules would find too noisy." } }, { "id": "identify-ai-hosts", "type": "query", "label": "Identify AI infrastructure hosts", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT device_uid, device_hostname FROM hb_software_inventory WHERE (instr(',' || '{{ai_apps}}' || ',', ',' || LOWER(package_name) || ',') > 0 OR instr(',' || '{{ai_apps}}' || ',', ',' || LOWER(vendor_name) || ',') > 0)", "surface": "hb_software_inventory", "description": "Scope the hunt to Linux hosts running targeted AI software or retrieval engines, retrieving both UIDs and hostnames for precise filtering.", "expected_signal": "A list of host UIDs and names currently running AI gateways or retrieval engines. This narrows the search for subsequent behavioural telemetry." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify AI infrastructure hosts", "reads": [ "device_uid", "device_hostname", "package_name", "vendor_name" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT DISTINCT device_uid, device_hostname FROM hb_software_inventory WHERE (instr(',' || '{{ai_apps}}' || ',', ',' || LOWER(package_name) || ',') > 0 OR instr(',' || '{{ai_apps}}' || ',', ',' || LOWER(vendor_name) || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "A list of host UIDs and names currently running AI gateways or retrieval engines. This narrows the search for subsequent behavioural telemetry.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "payload-delivery-prevalence", "type": "query", "label": "Rare binaries in temporary paths", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS executions, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '/tmp/%' OR LOWER(process_path) LIKE '/var/tmp/%' OR LOWER(process_path) LIKE '/dev/shm/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING executions <= 10 AND hosts <= 3 ORDER BY hosts ASC", "surface": "hb_process_activity", "description": "Find masqueraded payloads by stack-counting binaries executed from world-writable directories.", "expected_signal": "Rare binaries executing from world-writable paths. Malicious binaries may run many times on a single victim but are rare across the fleet." }, "parents": [ { "id": "identify-ai-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare binaries in temporary paths", "reads": [ "process_path", "device_hostname", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS executions, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '/tmp/%' OR LOWER(process_path) LIKE '/var/tmp/%' OR LOWER(process_path) LIKE '/dev/shm/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING executions <= 10 AND hosts <= 3 ORDER BY hosts ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Rare binaries executing from world-writable paths. Malicious binaries may run many times on a single victim but are rare across the fleet.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_path" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "discovery-and-cleanup", "type": "query", "label": "Host discovery and cleanup", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%sudo -l%' OR LOWER(process_cmd_line) LIKE '%crontab -l%' OR LOWER(process_cmd_line) LIKE '%netstat -anp%' OR LOWER(process_cmd_line) LIKE '%rm %crontab%') AND (instr(',' || '{{ai_apps}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Detect commands used for environment fingerprinting launched directly from AI gateway parent processes.", "expected_signal": "A sequence of discovery commands or crontab modifications appearing on the same hosts that launched rare temporary binaries from the gateway context." }, "parents": [ { "id": "identify-ai-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Host discovery and cleanup", "reads": [ "device_hostname", "process_cmd_line", "parent_process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%sudo -l%' OR LOWER(process_cmd_line) LIKE '%crontab -l%' OR LOWER(process_cmd_line) LIKE '%netstat -anp%' OR LOWER(process_cmd_line) LIKE '%rm %crontab%') AND (instr(',' || '{{ai_apps}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A sequence of discovery commands or crontab modifications appearing on the same hosts that launched rare temporary binaries from the gateway context.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "agent-early-read", "type": "analytic", "label": "Early stage triage", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "payload-delivery-prevalence", "discovery-and-cleanup" ], "objective": "Determine if the rare binaries in /tmp and the discovery commands suggest an attacker is prepping the host for monetization or persistence.", "description": "Evaluate whether rare payloads and discovery commands indicate an active host compromise.", "max_iterations": 3, "expected_signal": "A verdict characterizing the risk level of the detected processes.", "success_criteria": "A per-host verdict of malicious | suspicious | benign, citing specific binary paths and command lines." }, "parents": [ { "id": "payload-delivery-prevalence", "kind": "merge" }, { "id": "discovery-and-cleanup", "kind": "merge" } ] }, { "id": "msr-module-load", "type": "query", "label": "MSR module loading", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, module_name, process_name, time FROM hb_module_activity WHERE LOWER(module_name) = 'msr' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_module_activity", "description": "Detect the Linux Model-Specific Register module loading, a marker for cryptominer CPU tuning.", "expected_signal": "The msr module being loaded by an unexpected process, suggesting RandomX/XMRig optimization." }, "parents": [ { "id": "agent-early-read" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "MSR module loading", "reads": [ "device_hostname", "module_name", "process_name", "time" ], "source": "hb_module_activity", "target": "endpoint", "content": "SELECT device_hostname, module_name, process_name, time FROM hb_module_activity WHERE LOWER(module_name) = 'msr' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "The msr module being loaded by an unexpected process, suggesting RandomX/XMRig optimization.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "config-env-harvesting", "type": "query", "label": "Gateway config and environment harvesting", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE (process_cmd_line LIKE '%/proc/1/environ%' OR process_cmd_line LIKE '%DATABASE_URL%' OR process_cmd_line LIKE '%API_KEY%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Detect attempts to read gateway process environments or configuration files for secret harvesting.", "expected_signal": "Commands targeting process environments or database connection strings, indicating follow-on credential harvesting." }, "parents": [ { "id": "agent-early-read" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Gateway config and environment harvesting", "reads": [ "device_hostname", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE (process_cmd_line LIKE '%/proc/1/environ%' OR process_cmd_line LIKE '%DATABASE_URL%' OR process_cmd_line LIKE '%API_KEY%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Commands targeting process environments or database connection strings, indicating follow-on credential harvesting.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "persistence-activity", "type": "query", "label": "Persistence via systemd and SSH", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, file_path, LOWER(process_name) AS normalized_process_name, time FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%/authorized_keys' OR LOWER(file_path) LIKE '/etc/systemd/system/%') AND activity_id IN (1, 3, 5) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Identify changes to SSH authorized_keys or systemd service configurations.", "expected_signal": "Unauthorized file modifications to persistent Linux system paths, often by masqueraded processes." }, "parents": [ { "id": "agent-early-read" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Persistence via systemd and SSH", "reads": [ "device_hostname", "file_path", "process_name", "time", "activity_id" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_path, LOWER(process_name) AS normalized_process_name, time FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%/authorized_keys' OR LOWER(file_path) LIKE '/etc/systemd/system/%') AND activity_id IN (1, 3, 5) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Unauthorized file modifications to persistent Linux system paths, often by masqueraded processes.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "agent-follow-on-read", "type": "analytic", "label": "Follow-on triage and correlation", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "agent-early-read", "msr-module-load", "config-env-harvesting", "persistence-activity" ], "objective": "Decide if the suspicious early activity on a host is confirmed as a malicious compromise by the presence of cryptomining, harvesting, or persistence indicators.", "description": "Synthesize the entire attack chain from delivery through to impact.", "max_iterations": 4, "expected_signal": "A comprehensive verdict on the host compromise.", "success_criteria": "A final verdict citing the linkage between rare binaries, discovery, harvesting attempts, MSR loading, and persistence." }, "parents": [ { "id": "msr-module-load", "kind": "merge" }, { "id": "config-env-harvesting", "kind": "merge" }, { "id": "persistence-activity", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route based on compromise", "config": { "fuzzy": true, "judge": "hunter", "question": "the final triage verdict is malicious for at least one host", "condition": "the final triage verdict is malicious for at least one host", "blind_spot": "limited-snapshot-visibility", "confidence": "high", "description": "Direct action based on the agent's confidence in the intrusion.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "agent-follow-on-read" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Sever attacker access and stop resource abuse.", "instructions": "Isolate the host immediately. Prevent any further outbound connections to C2 or mining pools.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "forensic-review", "type": "task", "label": "Forensic review", "config": { "assignee": "analyst", "description": "Verify the agent's findings and extract indicators.", "instructions": "Review the binaries identified in the prevalence step. Collect the modified SSH keys and systemd unit files. Determine if the initial access vulnerability in the AI software was patched." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Document the hunt outcome and any identified gaps.", "instructions": "Log the number of affected hosts and the specific AI workloads involved. Update any detection rules based on the observed masquerading patterns." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "forensic-review" } ] } ] }