{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "AI-powered social engineering lures are a primary vector for modern ransomware. Catching the initial execution and verifying subsequent impact before encryption completes protects business continuity and limits data loss."
      },
      "name": "AI Social Engineering and Ransomware Operations",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1566.002",
        "attack.t1041",
        "attack.t1486",
        "credential access",
        "exfiltration",
        "impact",
        "initial access",
        "persistence"
      ],
      "series": {
        "slug": "what-cybersecurity-leaders-must-prioritize-in-2027",
        "index": 1,
        "title": "What Cybersecurity Leaders Must Prioritize in 2027",
        "total": 2
      },
      "related": [
        {
          "hunt": "rmm-platform-hijacking-hunt",
          "reason": "Abuse of RMM tools for lateral movement is covered in a dedicated hunt focusing on administrative command abuse.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A standard rule might flag shells spawned from browsers, but it cannot weigh that lead against real-world impact metrics like the volume of exfiltrated bytes and the count of modified files. This hunt uses a gated flow to confirm intent before escalating to expensive stateful analysis.",
      "coverage": [
        {
          "stage": "ai-powered-social-engineering",
          "steps": [
            "browser-spawned-shell-lead",
            "gate-agent"
          ],
          "status": "covered"
        },
        {
          "stage": "data-staging-and-exfiltration",
          "steps": [
            "exfiltration-activity"
          ],
          "status": "covered"
        },
        {
          "stage": "ransomware-encryption-and-extortion",
          "steps": [
            "encryption-activity",
            "final-triage"
          ],
          "status": "covered"
        },
        {
          "stage": "rmm-platform-hijacking",
          "reason": "Belongs to another part of the 'What Cybersecurity Leaders Must Prioritize in 2027' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "identity-theft-and-mfa-bypass",
          "reason": "Belongs to another part of the 'What Cybersecurity Leaders Must Prioritize in 2027' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "bec-and-cloud-infrastructure-abuse",
          "reason": "Belongs to another part of the 'What Cybersecurity Leaders Must Prioritize in 2027' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "AI-Powered Social Engineering and Loaders",
            "slug": "ai-powered-social-engineering",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "hyper-personalized phishing emails",
              "ClickFix lures",
              "fake CAPTCHA flows",
              "AI-assisted smishing and vishing",
              "malicious loader execution"
            ]
          },
          {
            "name": "Abuse of Trusted RMM Tools",
            "slug": "rmm-platform-hijacking",
            "tactic": "persistence",
            "techniques": [
              "T1133",
              "T1190"
            ],
            "observables": [
              "ScreenConnect hijacking",
              "unusual process chains originating from RMM tools",
              "misuse of sanctioned IT management software"
            ]
          },
          {
            "name": "Identity Compromise and MFA Bypass",
            "slug": "identity-theft-and-mfa-bypass",
            "tactic": "credential-access",
            "techniques": [
              "T1133"
            ],
            "observables": [
              "session token theft",
              "MFA bypass",
              "impossible travel logins",
              "suspicious login footprints"
            ]
          },
          {
            "name": "BEC and Cloud Application Abuse",
            "slug": "bec-and-cloud-infrastructure-abuse",
            "tactic": "persistence",
            "techniques": [
              "T1133"
            ],
            "observables": [
              "suspicious inbox rules",
              "rogue OAuth app registration",
              "interception of financial communications"
            ]
          },
          {
            "name": "Pre-Ransomware Data Exfiltration",
            "slug": "data-staging-and-exfiltration",
            "tactic": "exfiltration",
            "techniques": [
              "T1041"
            ],
            "observables": [
              "data staging",
              "exfiltration over existing C2 channels prior to encryption"
            ]
          },
          {
            "name": "Ransomware Encryption",
            "slug": "ransomware-encryption-and-extortion",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "data encryption",
              "ransomware canaries",
              "multi-extortion negotiation notices"
            ]
          }
        ],
        "summary": "In 2026, attackers are increasingly leveraging AI-powered phishing and the hijacking of trusted RMM tools like ScreenConnect to establish stealthy persistence. These campaigns often transition to identity-centric attacks, bypassing MFA via session theft and manipulating cloud environments through BEC flows, ultimately culminating in data exfiltration and multi-extortion ransomware."
      },
      "severity": "medium",
      "rationale": "The analyst starts with servers and workstations running ScreenConnect; they widen the scope to all endpoints if they suspect AI social engineering activity fleet-wide.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary uses an AI-crafted social engineering lure to execute a loader that performs data staging or ransomware encryption.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "hunt-standard",
            "kind": "manual",
            "observed": "2024-11-20"
          },
          "type": "list[host]",
          "default": [],
          "description": "Specific hosts to hunt on; leave empty to include all hosts discovered in the scoping step."
        },
        "shell_names": {
          "from": {
            "ref": "huntress-2027-priorities",
            "kind": "article",
            "observed": "2026-10-14"
          },
          "type": "list[string]",
          "default": [
            "powershell.exe",
            "cmd.exe",
            "mshta.exe",
            "conhost.exe",
            "cscript.exe",
            "wscript.exe"
          ],
          "description": "Interpreters or shells frequently spawned by malicious lures."
        },
        "browser_names": {
          "from": {
            "ref": "threat-intel",
            "kind": "manual",
            "observed": "2024-11-20"
          },
          "type": "list[string]",
          "default": [
            "chrome.exe",
            "msedge.exe",
            "firefox.exe",
            "brave.exe"
          ],
          "description": "Browser process names to monitor for shell spawning."
        },
        "lookback_days": {
          "from": {
            "ref": "hunt-standard",
            "kind": "manual",
            "observed": "2024-11-20"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "file_threshold": {
          "from": {
            "ref": "hunt-standard",
            "kind": "manual",
            "observed": "2024-11-20"
          },
          "type": "number",
          "default": "100",
          "description": "Number of file modifications to flag as potential encryption or staging."
        },
        "target_rmm_vendors": {
          "from": {
            "ref": "huntress-2027-priorities",
            "kind": "article",
            "observed": "2026-10-14"
          },
          "type": "list[string]",
          "default": [
            "connectwise",
            "screenconnect"
          ],
          "description": "Vendor or package names for RMM tools mentioned in the report."
        },
        "exfil_byte_threshold": {
          "from": {
            "ref": "hunt-standard",
            "kind": "manual",
            "observed": "2024-11-20"
          },
          "type": "number",
          "default": "52428800",
          "description": "Outbound traffic threshold in bytes for potential exfiltration."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.huntress.com/blog/what-does-the-future-hold-for-todays-cybersecurity-leaders",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.huntress.com/blog/what-does-the-future-hold-for-todays-cybersecurity-leaders",
          "name": "Huntress \u2014 What Cybersecurity Leaders Must Prioritize in 2027"
        }
      ],
      "blind_spots": [
        {
          "id": "no-process-lineage",
          "risk": "A host without lineage tracking will show the shell but not its browser origin, hiding the social engineering vector.",
          "stage": "ai-powered-social-engineering",
          "question": "whether a browser spawned a malicious shell",
          "requires": "hb_process_activity with parent-child tracking"
        },
        {
          "id": "exfil-via-browsers",
          "risk": "This hunt focuses on non-browser processes for exfiltration; a direct upload to Dropbox or Mega.nz from the browser would be missed.",
          "stage": "data-staging-and-exfiltration",
          "question": "whether data was exfiltrated directly through the browser",
          "requires": "hb_http_activity with request body size"
        },
        {
          "id": "no-endpoint-control",
          "risk": "If the host is not enrolled in an isolation-capable provider, encryption will continue until manual intervention occurs.",
          "stage": "ransomware-encryption-and-extortion",
          "question": "can the host be isolated automatically",
          "requires": "Endpoint control agent for isolation"
        }
      ]
    },
    "name": "AI Social Engineering and Ransomware Operations",
    "description": "This hunt identifies social engineering lures that bypass traditional filters. The hunt identifies hosts with remote management tools, then queries for browsers spawning interpreters. The hunt gates expensive queries into data staging and exfiltration only when the agent confirms a suspicious foothold, allowing the analyst to weigh the initial execution against subsequent volumes of file and network activity."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "what-cybersecurity-leaders-must-prioritize-in-2027",
          "index": 1,
          "title": "What Cybersecurity Leaders Must Prioritize in 2027",
          "total": 2
        },
        "coverage": [
          {
            "stage": "ai-powered-social-engineering",
            "steps": [
              "browser-spawned-shell-lead",
              "gate-agent"
            ],
            "status": "covered"
          },
          {
            "stage": "data-staging-and-exfiltration",
            "steps": [
              "exfiltration-activity"
            ],
            "status": "covered"
          },
          {
            "stage": "ransomware-encryption-and-extortion",
            "steps": [
              "encryption-activity",
              "final-triage"
            ],
            "status": "covered"
          },
          {
            "stage": "rmm-platform-hijacking",
            "reason": "Belongs to another part of the 'What Cybersecurity Leaders Must Prioritize in 2027' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "identity-theft-and-mfa-bypass",
            "reason": "Belongs to another part of the 'What Cybersecurity Leaders Must Prioritize in 2027' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "bec-and-cloud-infrastructure-abuse",
            "reason": "Belongs to another part of the 'What Cybersecurity Leaders Must Prioritize in 2027' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary uses an AI-crafted social engineering lure to execute a loader that performs data staging or ransomware encryption.",
        "blind_spots": [
          {
            "id": "no-process-lineage",
            "risk": "A host without lineage tracking will show the shell but not its browser origin, hiding the social engineering vector.",
            "stage": "ai-powered-social-engineering",
            "question": "whether a browser spawned a malicious shell",
            "requires": "hb_process_activity with parent-child tracking"
          },
          {
            "id": "exfil-via-browsers",
            "risk": "This hunt focuses on non-browser processes for exfiltration; a direct upload to Dropbox or Mega.nz from the browser would be missed.",
            "stage": "data-staging-and-exfiltration",
            "question": "whether data was exfiltrated directly through the browser",
            "requires": "hb_http_activity with request body size"
          },
          {
            "id": "no-endpoint-control",
            "risk": "If the host is not enrolled in an isolation-capable provider, encryption will continue until manual intervention occurs.",
            "stage": "ransomware-encryption-and-extortion",
            "question": "can the host be isolated automatically",
            "requires": "Endpoint control agent for isolation"
          }
        ],
        "scoping_notes": "The analyst starts with servers and workstations running ScreenConnect; they widen the scope to all endpoints if they suspect AI social engineering activity fleet-wide.",
        "beyond_detection": "A standard rule might flag shells spawned from browsers, but it cannot weigh that lead against real-world impact metrics like the volume of exfiltrated bytes and the count of modified files. This hunt uses a gated flow to confirm intent before escalating to expensive stateful analysis."
      }
    },
    {
      "id": "find-rmm-hosts",
      "type": "query",
      "label": "Identify hosts with RMM tools",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE instr(',' || '{{target_rmm_vendors}}' || ',', ',' || LOWER(vendor_name) || ',') > 0 OR instr(',' || '{{target_rmm_vendors}}' || ',', ',' || LOWER(package_name) || ',') > 0",
        "surface": "hb_software_inventory",
        "description": "The hunt finds the hosts running RMM software like ScreenConnect that are high-priority targets for platform hijacking and lateral movement.",
        "expected_signal": "A list of hosts running ConnectWise or ScreenConnect software. Silence means no such RMM software is installed via managed package managers."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify hosts with RMM tools",
        "reads": [
          "device_hostname",
          "vendor_name",
          "package_name"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE instr(',' || '{{target_rmm_vendors}}' || ',', ',' || LOWER(vendor_name) || ',') > 0 OR instr(',' || '{{target_rmm_vendors}}' || ',', ',' || LOWER(package_name) || ',') > 0",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hosts running ConnectWise or ScreenConnect software. Silence means no such RMM software is installed via managed package managers.",
        "verified": "dry-run",
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "browser-spawned-shell-lead",
      "type": "query",
      "label": "Browser-spawned shell or interpreter",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{browser_names}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 AND instr(',' || '{{shell_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "The hunt finds the initial execution of an AI-powered social engineering lure where a browser launches a system shell.",
        "expected_signal": "A shell process whose parent is a common web browser. Silence means no direct shell execution from browsers was observed in this window."
      },
      "parents": [
        {
          "id": "find-rmm-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Browser-spawned shell or interpreter",
        "reads": [
          "device_hostname",
          "process_name",
          "process_cmd_line",
          "parent_process_name",
          "user_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{browser_names}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 AND instr(',' || '{{shell_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A shell process whose parent is a common web browser. Silence means no direct shell execution from browsers was observed in this window.",
        "verified": "dry-run",
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "gate-agent",
      "type": "analytic",
      "label": "Analyze Lead for Malicious Intent",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "browser-spawned-shell-lead"
        ],
        "objective": "Decide if the command lines in browser-spawned-shell-lead represent a social engineering lure or loader foothold.",
        "description": "The agent assesses whether the browser-spawned activity looks like a malicious lure (e.g., encoded commands or web downloads) to avoid expensive impact queries on benign activity.",
        "max_iterations": 3,
        "expected_signal": "A per-host verdict of malicious, suspicious, or benign.",
        "success_criteria": "A clear verdict for every host cited."
      },
      "parents": [
        {
          "id": "browser-spawned-shell-lead"
        }
      ]
    },
    {
      "id": "gate-decision",
      "type": "checkpoint",
      "label": "Gate Decision",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the gate-agent verdict is suspicious or malicious for at least one host",
        "condition": "the gate-agent verdict is suspicious or malicious for at least one host",
        "blind_spot": "no-process-lineage",
        "confidence": "high",
        "description": "The hunt routes execution to impact queries only if the agent finds a suspicious foothold.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "gate-agent"
        }
      ]
    },
    {
      "id": "exfiltration-activity",
      "type": "query",
      "label": "High-volume outbound exfiltration",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "network",
        "content": "SELECT device_hostname, process_name, dst_endpoint_ip, SUM(traffic_bytes) as total_bytes, COUNT(*) as connection_count FROM hb_network_connection WHERE direction = 'outbound' AND state_kind = 'log' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, dst_endpoint_ip HAVING total_bytes > {{exfil_byte_threshold}} ORDER BY total_bytes DESC",
        "surface": "hb_network_connection",
        "description": "The hunt detects potential exfiltration by finding processes sending unusually large amounts of data to external IPs.",
        "expected_signal": "A host sending >50MB to a single destination. Silence suggests no high-volume exfiltration occurred via tracked network flows."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "High-volume outbound exfiltration",
        "reads": [
          "device_hostname",
          "process_name",
          "dst_endpoint_ip",
          "traffic_bytes",
          "direction",
          "state_kind",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, process_name, dst_endpoint_ip, SUM(traffic_bytes) as total_bytes, COUNT(*) as connection_count FROM hb_network_connection WHERE direction = 'outbound' AND state_kind = 'log' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, dst_endpoint_ip HAVING total_bytes > {{exfil_byte_threshold}} ORDER BY total_bytes DESC",
        "silence": "not_evidence_of_absence",
        "expected": "A host sending >50MB to a single destination. Silence suggests no high-volume exfiltration occurred via tracked network flows.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "process_name",
            "dst_endpoint_ip"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "encryption-activity",
      "type": "query",
      "label": "Rapid file modification",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, COUNT(DISTINCT file_path) as file_count FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_name IN ('Create', 'Update', 'Rename', 'Delete') AND (LOWER(file_path) LIKE '%\\\\users\\\\%' OR LOWER(file_path) LIKE '%\\\\appdata\\\\%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name HAVING file_count > {{file_threshold}} ORDER BY file_count DESC",
        "surface": "hb_file_activity",
        "description": "The hunt identifies potential ransomware encryption by counting file modifications in user-writable paths.",
        "expected_signal": "A single process modifying hundreds of files. Silence means no large-scale file manipulation was observed."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Rapid file modification",
        "reads": [
          "device_hostname",
          "process_name",
          "file_path",
          "activity_name",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, COUNT(DISTINCT file_path) as file_count FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_name IN ('Create', 'Update', 'Rename', 'Delete') AND (LOWER(file_path) LIKE '%\\\\users\\\\%' OR LOWER(file_path) LIKE '%\\\\appdata\\\\%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name HAVING file_count > {{file_threshold}} ORDER BY file_count DESC",
        "silence": "not_evidence_of_absence",
        "expected": "A single process modifying hundreds of files. Silence means no large-scale file manipulation was observed.",
        "verified": "dry-run",
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "final-triage",
      "type": "analytic",
      "label": "Final Correlative Triage",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "gate-agent",
          "exfiltration-activity",
          "encryption-activity"
        ],
        "objective": "Determine if the suspicion from gate-agent is confirmed by the high-volume activity in exfiltration-activity or encryption-activity.",
        "description": "The agent weighs the initial lure execution against subsequent impact to confirm a ransomware operation.",
        "max_iterations": 6,
        "expected_signal": "A high-confidence verdict linking phish to impact.",
        "success_criteria": "A final verdict citing specific rows and volumes of data/files."
      },
      "parents": [
        {
          "id": "exfiltration-activity",
          "kind": "merge"
        },
        {
          "id": "encryption-activity",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-impact",
      "type": "checkpoint",
      "label": "Route based on impact",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the final-triage verdict is malicious and confirms either high-volume file modification or high-volume outbound network traffic",
        "condition": "the final-triage verdict is malicious and confirms either high-volume file modification or high-volume outbound network traffic",
        "blind_spot": "no-endpoint-control",
        "confidence": "high",
        "description": "The hunt triggers containment if the agent confirms impact.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "final-triage"
        }
      ]
    },
    {
      "id": "isolate-infected-host",
      "type": "action",
      "label": "Isolate Infected Host",
      "config": {
        "target": "endpoint",
        "description": "The hunt stops encryption and data theft immediately.",
        "instructions": "Isolate the host immediately. Coordinate with the SOC to collect the binary for forensic analysis.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-impact",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Final Analyst Review",
      "config": {
        "assignee": "analyst",
        "description": "The analyst confirms the operation and prepares a report.",
        "instructions": "Review the cited rows from final-triage. Verify the process lineage and confirm if the outbound traffic was to a known C2 or storage provider."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "default"
        },
        {
          "id": "gate-decision",
          "branch": "on_unavailable"
        },
        {
          "id": "route-on-impact",
          "branch": "default"
        },
        {
          "id": "route-on-impact",
          "branch": "on_unavailable"
        },
        {
          "id": "route-on-impact",
          "branch": "on_refutes"
        },
        {
          "id": "isolate-infected-host"
        }
      ]
    },
    {
      "id": "close-out-benign",
      "type": "task",
      "label": "Close out benign",
      "config": {
        "assignee": "analyst",
        "description": "The analyst records findings for non-malicious runs.",
        "instructions": "Record that browser activity was reviewed and found benign. No evidence of social engineering lures or subsequent impact was observed."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}