{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "The rise in targeted AI credential theft and immature but destructive ransomware like VYPR necessitates a proactive hunt across endpoints to ensure data integrity and prevent operational outages."
      },
      "name": "AI-Secret Theft and Ransomware Post-Exploitation",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1021.002",
        "attack.t1021.001",
        "attack.t1003",
        "attack.t1567.002",
        "attack.t1041",
        "attack.t1486",
        "credential access",
        "defense evasion",
        "execution",
        "exfiltration",
        "impact",
        "initial access",
        "lateral movement",
        "persistence"
      ],
      "series": {
        "slug": "ir-trends-q3-2026-actors-impersonate-it-help-desks-in-vishing-attacks-as-ransomware-activity-inc",
        "index": 3,
        "title": "IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases",
        "total": 3
      },
      "related": [
        {
          "hunt": "rmm-access-social-engineering",
          "reason": "Initial access via social engineering and RMM tools is covered by a precursor hunt.",
          "relation": "out-of-scope-alternative"
        },
        {
          "hunt": "edr-impairment-rmm-execution",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A simple rule might catch a ransom note, but this hunt connects the targeted software (AI tools) to the behavior (keychain scraping and rare discovery tools) and the final outcome (Rclone exfiltration), providing the full context needed for a high-severity response.",
      "coverage": [
        {
          "stage": "lateral-movement-discovery",
          "steps": [
            "discovery-prevalence"
          ],
          "status": "covered"
        },
        {
          "stage": "credential-access-ai-secrets",
          "steps": [
            "keychain-details"
          ],
          "status": "covered"
        },
        {
          "stage": "exfiltration-over-c2",
          "steps": [
            "exfiltration-rclone"
          ],
          "status": "covered"
        },
        {
          "stage": "data-encryption-for-impact",
          "steps": [
            "ransom-impact"
          ],
          "status": "covered"
        },
        {
          "stage": "vishing-rmm-access",
          "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "edge-vulnerability-exploitation",
          "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "persistence-web-shell-accounts",
          "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "rmm-dropper-execution",
          "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "defense-evasion-edr-impairment",
          "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "IT help desk vishing and remote assistance",
            "slug": "vishing-rmm-access",
            "tactic": "initial-access",
            "techniques": [
              "T1566",
              "T1133"
            ],
            "observables": [
              "Microsoft Quick Assist",
              "IT help desk impersonation",
              "vishing calls"
            ]
          },
          {
            "name": "Exploitation of Cisco IOS XE management interface",
            "slug": "edge-vulnerability-exploitation",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "CVE-2023-20198",
              "web-based management interface access"
            ]
          },
          {
            "name": "Web shell implant and privileged account creation",
            "slug": "persistence-web-shell-accounts",
            "tactic": "persistence",
            "techniques": [
              "T1505.003",
              "T1133"
            ],
            "observables": [
              "BadCandy web shell",
              "privilege 15 command",
              "local user creation on network device"
            ]
          },
          {
            "name": "RMM deployment and MSI installation",
            "slug": "rmm-dropper-execution",
            "tactic": "execution",
            "techniques": [
              "T1059.001"
            ],
            "observables": [
              "MeshAgent",
              "PowerShell",
              "MSI package",
              "remote IP download"
            ]
          },
          {
            "name": "EDR killing via BYOVD and task termination",
            "slug": "defense-evasion-edr-impairment",
            "tactic": "defense-evasion",
            "techniques": [
              "T1562.001",
              "T1070.001"
            ],
            "observables": [
              "taskkill.exe",
              "cscm.exe",
              "sfc.exe",
              "BYOVD",
              "vulnerable drivers",
              "Windows Defender real-time protection disabled",
              "event logs cleared"
            ]
          },
          {
            "name": "Network discovery and lateral movement",
            "slug": "lateral-movement-discovery",
            "tactic": "lateral-movement",
            "techniques": [
              "T1021.002",
              "T1021.001"
            ],
            "observables": [
              "PsExec.exe",
              "MSTSC",
              "IP scan",
              "Microsoft Terminal Services Client"
            ]
          },
          {
            "name": "macOS keychain scraping for AI credentials",
            "slug": "credential-access-ai-secrets",
            "tactic": "credential-access",
            "techniques": [
              "T1003"
            ],
            "observables": [
              "macOS keychain",
              "Anthropic Claude Code secrets",
              "credential scraping scripts"
            ]
          },
          {
            "name": "Data exfiltration via Rclone",
            "slug": "exfiltration-over-c2",
            "tactic": "exfiltration",
            "techniques": [
              "T1567.002",
              "T1041"
            ],
            "observables": [
              "Rclone",
              "multi-day exfiltration"
            ]
          },
          {
            "name": "Ransomware encryption",
            "slug": "data-encryption-for-impact",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "VYPR",
              "Interlock",
              "ransom note"
            ]
          }
        ],
        "summary": "Threat actors utilized vishing to impersonate IT help desks and establish remote sessions via Microsoft Quick Assist, or exploited CVE-2023-20198 on Cisco IOS XE edge devices to gain entry. Post-compromise, they deployed RMM tools and vulnerable drivers to terminate EDR systems (BYOVD) before conducting multi-day data exfiltration via Rclone and deploying ransomware variants like VYPR and Interlock."
      },
      "severity": "high",
      "rationale": "Focus on developer environments first, then expand to the general server estate if discovery tools are found outside the developer scope.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is targeting hosts with AI development tools to scrape keychain secrets, moving laterally using discovery tools before exfiltrating data via Rclone and deploying ransomware like VYPR or Interlock.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "Analyst scoping",
            "kind": "manual",
            "observed": "2026-10-29"
          },
          "type": "list[host]",
          "default": [],
          "description": "Limit the hunt to specific hostnames; leave empty to scan the entire estate."
        },
        "ransom_notes": {
          "from": {
            "ref": "Talos Q3 2026 Report",
            "kind": "article",
            "observed": "2026-10-29"
          },
          "type": "list[string]",
          "default": [
            "vypr_read_me.txt",
            "interlock_instructions.txt",
            "read_me.txt"
          ],
          "description": "Filenames of ransom notes identified in the report."
        },
        "ai_tool_names": {
          "from": {
            "ref": "Talos Q3 2026 Report",
            "kind": "article",
            "observed": "2026-10-29"
          },
          "type": "list[string]",
          "default": [
            "github-copilot",
            "claude-code",
            "anthropic",
            "copilot-cli"
          ],
          "description": "Package names of targeted AI development tools."
        },
        "lookback_days": {
          "from": {
            "ref": "Standard lookback window",
            "kind": "manual",
            "observed": "2026-10-29"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "discovery_tools": {
          "from": {
            "ref": "Talos Q3 2026 Report",
            "kind": "article",
            "observed": "2026-10-29"
          },
          "type": "list[string]",
          "default": [
            "psexec.exe",
            "psexec64.exe",
            "mstsc.exe",
            "advanced_ip_scanner.exe",
            "ipscan.exe"
          ],
          "description": "Binaries used for lateral movement and internal discovery."
        },
        "rclone_keywords": {
          "from": {
            "ref": "Talos Q3 2026 Report",
            "kind": "article",
            "observed": "2026-10-29"
          },
          "type": "list[string]",
          "default": [
            "rclone",
            "rclone.exe",
            "rclone64.exe"
          ],
          "description": "Executable names associated with the Rclone exfiltration tool."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://blog.talosintelligence.com/ir-trends-q3-2026/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://blog.talosintelligence.com/ir-trends-q3-2026/",
          "name": "Talos IR Trends Q3 2026: Actors impersonate IT help desks"
        }
      ],
      "blind_spots": [
        {
          "id": "no-agent-coverage",
          "risk": "A host without an agent provides no telemetry for process or script activity, allowing the actor to operate unobserved.",
          "question": "Whether the hunt missed unmanaged systems used as beachheads",
          "requires": "EDR agent presence"
        },
        {
          "id": "keychain-script-masking",
          "risk": "If the attacker uses a compiled binary to access the keychain, it will not appear in hb_script_activity, only as a process name in hb_process_activity.",
          "stage": "credential-access-ai-secrets",
          "question": "Whether the keychain was scraped via a direct binary call instead of a script block",
          "requires": "Native macOS keychain auditing"
        }
      ]
    },
    "name": "AI-Secret Theft and Ransomware Post-Exploitation",
    "description": "This hunt focuses on the post-exploitation phase of a ransomware intrusion, specifically targeting the theft of AI-related secrets (Anthropic/GitHub Copilot) and the subsequent exfiltration. It pivots from an initial software inventory scan for targeted AI tools into a phased analysis of lateral movement, credential scraping, and final impact indicators. By correlating these behaviors, the hunt identifies sophisticated actors who blend in with developer activities before executing the final ransomware payload."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "ir-trends-q3-2026-actors-impersonate-it-help-desks-in-vishing-attacks-as-ransomware-activity-inc",
          "index": 3,
          "title": "IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases",
          "total": 3
        },
        "coverage": [
          {
            "stage": "lateral-movement-discovery",
            "steps": [
              "discovery-prevalence"
            ],
            "status": "covered"
          },
          {
            "stage": "credential-access-ai-secrets",
            "steps": [
              "keychain-details"
            ],
            "status": "covered"
          },
          {
            "stage": "exfiltration-over-c2",
            "steps": [
              "exfiltration-rclone"
            ],
            "status": "covered"
          },
          {
            "stage": "data-encryption-for-impact",
            "steps": [
              "ransom-impact"
            ],
            "status": "covered"
          },
          {
            "stage": "vishing-rmm-access",
            "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "edge-vulnerability-exploitation",
            "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "persistence-web-shell-accounts",
            "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "rmm-dropper-execution",
            "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "defense-evasion-edr-impairment",
            "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary is targeting hosts with AI development tools to scrape keychain secrets, moving laterally using discovery tools before exfiltrating data via Rclone and deploying ransomware like VYPR or Interlock.",
        "blind_spots": [
          {
            "id": "no-agent-coverage",
            "risk": "A host without an agent provides no telemetry for process or script activity, allowing the actor to operate unobserved.",
            "question": "Whether the hunt missed unmanaged systems used as beachheads",
            "requires": "EDR agent presence"
          },
          {
            "id": "keychain-script-masking",
            "risk": "If the attacker uses a compiled binary to access the keychain, it will not appear in hb_script_activity, only as a process name in hb_process_activity.",
            "stage": "credential-access-ai-secrets",
            "question": "Whether the keychain was scraped via a direct binary call instead of a script block",
            "requires": "Native macOS keychain auditing"
          }
        ],
        "scoping_notes": "Focus on developer environments first, then expand to the general server estate if discovery tools are found outside the developer scope.",
        "beyond_detection": "A simple rule might catch a ransom note, but this hunt connects the targeted software (AI tools) to the behavior (keychain scraping and rare discovery tools) and the final outcome (Rclone exfiltration), providing the full context needed for a high-severity response."
      }
    },
    {
      "id": "scoping-ai-tools",
      "type": "query",
      "label": "Scope hosts with AI development tools",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE (instr(',' || '{{ai_tool_names}}' || ',', ',' || LOWER(package_name) || ',') > 0)",
        "surface": "hb_software_inventory",
        "description": "Identify hosts running tools that the adversary is specifically targeting for secret theft.",
        "expected_signal": "A list of developer workstations or servers where AI secrets might reside. Silence indicates no targeted software is present."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Scope hosts with AI development tools",
        "reads": [
          "device_hostname",
          "package_name",
          "package_version",
          "vendor_name"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE (instr(',' || '{{ai_tool_names}}' || ',', ',' || LOWER(package_name) || ',') > 0)",
        "silence": "not_evidence_of_absence",
        "expected": "A list of developer workstations or servers where AI secrets might reside. Silence indicates no targeted software is present.",
        "verified": "dry-run",
        "verified_at": "2026-10-30"
      }
    },
    {
      "id": "discovery-prevalence",
      "type": "query",
      "label": "Identify rare discovery tool usage",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT LOWER(process_name) AS tool_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND (instr(',' || '{{discovery_tools}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{discovery_tools}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING host_count < 5 ORDER BY host_count ASC",
        "surface": "hb_process_activity",
        "description": "Detect the use of lateral movement tools that are uncommon across the fleet.",
        "expected_signal": "Discovery tools used on a small number of hosts. Silence proves no rare usage of these specific binaries."
      },
      "parents": [
        {
          "id": "scoping-ai-tools"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Identify rare discovery tool usage",
        "reads": [
          "device_hostname",
          "process_name",
          "process_original_file_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT LOWER(process_name) AS tool_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND (instr(',' || '{{discovery_tools}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{discovery_tools}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING host_count < 5 ORDER BY host_count ASC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Discovery tools used on a small number of hosts. Silence proves no rare usage of these specific binaries.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "tool_name"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-10-30"
      }
    },
    {
      "id": "keychain-details",
      "type": "query",
      "label": "Search for macOS keychain scraping",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, actor_user_name, script_content, time FROM hb_script_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND (LOWER(script_content) LIKE '%security find-generic-password%' OR LOWER(script_content) LIKE '%security find-internet-password%') AND (LOWER(script_content) LIKE '%anthropic%' OR LOWER(script_content) LIKE '%claude%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_script_activity",
        "description": "Find scripts targeting AI platform secrets within the macOS keychain.",
        "expected_signal": "Script blocks using native macOS commands to access the keychain for AI platform secrets. Silence indicates no such scripted scraping was detected."
      },
      "parents": [
        {
          "id": "scoping-ai-tools"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Search for macOS keychain scraping",
        "reads": [
          "device_hostname",
          "actor_user_name",
          "script_content",
          "time"
        ],
        "source": "hb_script_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, actor_user_name, script_content, time FROM hb_script_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND (LOWER(script_content) LIKE '%security find-generic-password%' OR LOWER(script_content) LIKE '%security find-internet-password%') AND (LOWER(script_content) LIKE '%anthropic%' OR LOWER(script_content) LIKE '%claude%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Script blocks using native macOS commands to access the keychain for AI platform secrets. Silence indicates no such scripted scraping was detected.",
        "verified": "dry-run",
        "verified_at": "2026-10-30"
      }
    },
    {
      "id": "early-triage",
      "type": "analytic",
      "label": "Assess early discovery and theft",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint"
        ],
        "context": [
          "scoping-ai-tools",
          "discovery-prevalence",
          "keychain-details"
        ],
        "objective": "Identify hosts that have targeted AI software and exhibit rare discovery tool usage or keychain scraping activity.",
        "description": "Evaluate if identified hosts show both the targeted tools and suspicious discovery behavior.",
        "max_iterations": 4,
        "expected_signal": "Verdict on whether hosts are likely compromised for secret theft.",
        "success_criteria": "A per-host verdict citing specific rows from the inventory and script logs."
      },
      "parents": [
        {
          "id": "discovery-prevalence",
          "kind": "merge"
        },
        {
          "id": "keychain-details",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "exfiltration-rclone",
      "type": "query",
      "label": "Detect Rclone exfiltration activity",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT LOWER(process_name) AS tool_name, device_hostname, process_cmd_line, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND (instr(',' || '{{rclone_keywords}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{rclone_keywords}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3 HAVING host_count < 5 ORDER BY host_count ASC",
        "surface": "hb_process_activity",
        "description": "Identify the use of Rclone for exfiltrating data, as observed in VYPR campaigns.",
        "expected_signal": "Rclone executions that are rare across the estate, specifically those involving sync or copy operations. Silence indicates no unusual Rclone usage was seen."
      },
      "parents": [
        {
          "id": "early-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Detect Rclone exfiltration activity",
        "reads": [
          "device_hostname",
          "process_name",
          "process_original_file_name",
          "process_cmd_line",
          "user_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT LOWER(process_name) AS tool_name, device_hostname, process_cmd_line, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND (instr(',' || '{{rclone_keywords}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{rclone_keywords}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3 HAVING host_count < 5 ORDER BY host_count ASC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Rclone executions that are rare across the estate, specifically those involving sync or copy operations. Silence indicates no unusual Rclone usage was seen.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "tool_name"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-10-30"
      }
    },
    {
      "id": "ransom-impact",
      "type": "query",
      "label": "Identify ransom note creation",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE activity_id = 1 AND (instr(',' || '{{ransom_notes}}' || ',', ',' || LOWER(file_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_file_activity",
        "description": "Find definitive evidence of ransomware deployment from VYPR or Interlock variants.",
        "expected_signal": "The query detects the creation of known ransom note filenames on disk. Silence proves no known note filenames were created in the window."
      },
      "parents": [
        {
          "id": "early-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Identify ransom note creation",
        "reads": [
          "device_hostname",
          "file_name",
          "file_path",
          "process_name",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE activity_id = 1 AND (instr(',' || '{{ransom_notes}}' || ',', ',' || LOWER(file_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "The query detects the creation of known ransom note filenames on disk. Silence proves no known note filenames were created in the window.",
        "verified": "dry-run",
        "verified_at": "2026-10-30"
      }
    },
    {
      "id": "final-triage",
      "type": "analytic",
      "label": "Synthesize intrusion chain",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint"
        ],
        "context": [
          "early-triage",
          "exfiltration-rclone",
          "ransom-impact"
        ],
        "objective": "Correlate the early-stage triage results with follow-on exfiltration and ransom note findings to confirm a high-confidence ransomware intrusion.",
        "description": "Determine if the observed behavior represents a completed intrusion chain from discovery to ransom.",
        "max_iterations": 6,
        "expected_signal": "Final verdict on the severity of the intrusion.",
        "success_criteria": "A comprehensive verdict citing the transition from secret theft to final ransomware impact."
      },
      "parents": [
        {
          "id": "exfiltration-rclone",
          "kind": "merge"
        },
        {
          "id": "ransom-impact",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-verdict",
      "type": "checkpoint",
      "label": "Route on final verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the final triage verdict is malicious for at least one host, particularly where ransom notes or Rclone exfiltration is confirmed",
        "condition": "the final triage verdict is malicious for at least one host, particularly where ransom notes or Rclone exfiltration is confirmed",
        "blind_spot": "no-agent-coverage",
        "confidence": "high",
        "description": "Direct the response based on the agent's confidence in a malicious intrusion.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "final-triage"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate impacted endpoint",
      "config": {
        "target": "endpoint",
        "description": "Halt exfiltration or encryption by isolating the compromised host.",
        "instructions": "Isolate the host via the EDR console and revoke any active sessions for users logged into the system.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-remediation",
      "type": "task",
      "label": "Perform manual remediation",
      "config": {
        "assignee": "analyst",
        "description": "Review findings and perform clean-up of persistence or credential theft.",
        "instructions": "Rotate all AI platform API keys found on the host. Review process logs for the source of Rclone and PsExec. Document any confirmed data theft."
      },
      "parents": [
        {
          "id": "route-verdict",
          "branch": "default"
        },
        {
          "id": "route-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "route-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out hunt",
      "config": {
        "assignee": "analyst",
        "description": "Final documentation and evaluation for detection promotion.",
        "instructions": "Record the hosts examined and any confirmed IOCs. Promote the ransom note query to a permanent detection rule."
      },
      "parents": [
        {
          "id": "analyst-remediation"
        }
      ]
    }
  ]
}