{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "AI brands currently carry a high level of employee trust and curiosity; identifying attacks that borrow this trust is a high-priority exposure that signature-based tools often miss due to the fast rotation of lookalike domains."
      },
      "name": "AI-Themed Social Engineering and Multi-Stage Fraud",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1566",
        "attack.t1190",
        "attack.t1555",
        "attack.t1486"
      ],
      "related": [
        {
          "hunt": "m365-inbox-rule-manipulation",
          "reason": "Once an AI-themed token is harvested, the next step in the BEC chain is often creating inbox rules to hide fraudulent activity.",
          "relation": "follows"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A simple detection rule would alert on a known AI domain; this hunt pivots from the network lure to look for the specific execution of rare AI-themed binaries on the host and correlates it with cloud-based authentication anomalies, covering the full multi-stage chain.",
      "coverage": [
        {
          "stage": "ai-themed-initial-access",
          "steps": [
            "http-ai-lures",
            "dns-ai-lookalikes",
            "early-stage-agent"
          ],
          "status": "covered"
        },
        {
          "stage": "aitm-token-harvesting",
          "steps": [
            "auth-device-code-abuse",
            "follow-on-agent"
          ],
          "status": "covered"
        },
        {
          "stage": "endpoint-malware-execution",
          "steps": [
            "process-stealer-execution"
          ],
          "status": "covered"
        },
        {
          "stage": "fraudulent-impact-actions",
          "reason": "Surfaces for credit card data exposure are not available; BEC impact like inbox rules needs M365-specific mailbox activity logs not listed in the dossier.",
          "status": "not_visible"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "AI-Themed Delivery and Lures",
            "slug": "ai-themed-initial-access",
            "tactic": "initial-access",
            "techniques": [
              "T1566",
              "T1190"
            ],
            "observables": [
              "ChatGPT-themed phishing emails requesting payment updates",
              "Malvertising for fake AI Windows plugins",
              "Fraudulent DeepSeek installers distributed via GitHub",
              "Lookalike domains for AI service sign-in pages",
              "Claude-themed phishing lures"
            ]
          },
          {
            "name": "Identity and Token Harvesting",
            "slug": "aitm-token-harvesting",
            "tactic": "credential-access",
            "techniques": [
              "T1555",
              "T1566"
            ],
            "observables": [
              "Microsoft device code sign-in flow abuse",
              "Adversary-in-the-middle (AiTM) redirection chains",
              "Harvesting of session access tokens",
              "Credential harvesting via fake sign-in forms"
            ]
          },
          {
            "name": "Malware Execution and Stealer Deployment",
            "slug": "endpoint-malware-execution",
            "tactic": "execution",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "Vidar stealer execution from AI plugin installers",
              "Execution of fraudulent DeepSeek installer binaries",
              "Unauthorized installation of AI-themed browser extensions or plugins"
            ]
          },
          {
            "name": "Financial Fraud and BEC Impact",
            "slug": "fraudulent-impact-actions",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "Creation of suspicious inbox rules for email concealment",
              "Payroll fraud execution through compromised accounts",
              "Unauthorized use of harvested credit card data"
            ]
          }
        ],
        "summary": "Threat actors like Storm-3075 are exploiting AI-themed lures\u2014impersonating brands like ChatGPT, Copilot, and Claude\u2014to conduct phishing, malvertising, and fraudulent GitHub-hosted distribution. These multi-stage campaigns leverage adversary-in-the-middle (AiTM) techniques to harvest credentials and tokens, deliver infostealers like Vidar, and execute financial fraud such as business email compromise and payroll redirection."
      },
      "severity": "high",
      "rationale": "The hunt begins with hosts showing any AI-themed process activity to narrow the estate. It then expands to check network delivery across the entire environment, as phishing may target users who haven't yet run a binary.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is using lookalike AI domains and installers to trick users into downloading stealers or performing device-code authentication, leading to token theft and financial fraud.",
      "parameters": {
        "ai_domains": {
          "from": {
            "ref": "msrc-blog-2026-09-10",
            "kind": "article",
            "observed": "2026-09-10"
          },
          "type": "list[domain]",
          "default": [
            "chatgpt-plus.io",
            "claude-ai.biz",
            "deepseek-installer.io",
            "openai-update.com",
            "chatgpt-payment.net"
          ],
          "description": "Known or suspected AI-themed lookalike domains from the report."
        },
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Optional list of hostnames to focus the hunt on."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.microsoft.com/en-us/security/blog/2026/09/10/detect-and-disrupt-ai-themed-attacks-with-microsoft-defender/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/detect-and-disrupt-ai-themed-attacks-with-microsoft-defender/",
          "name": "Detect and disrupt AI-themed attacks with Microsoft Defender"
        }
      ],
      "blind_spots": [
        {
          "id": "limited-cloud-auth-retention",
          "risk": "A session token harvested weeks ago may still be active but would not appear in the current hunt window.",
          "stage": "aitm-token-harvesting",
          "question": "whether the device code abuse occurred before the current 14-day window",
          "requires": "long-term hb_auth_signin retention (90+ days)"
        },
        {
          "id": "browser-extension-visibility",
          "risk": "Silent installation of a browser extension might not trigger a process activity row, leading to a false negative for execution.",
          "stage": "endpoint-malware-execution",
          "question": "whether malicious AI-themed browser extensions were installed instead of standalone binaries",
          "requires": "hb_file_activity or browser database monitoring"
        }
      ]
    },
    "name": "AI-Themed Social Engineering and Multi-Stage Fraud",
    "description": "This hunt identifies multi-stage attacks where AI brands like ChatGPT, Claude, and DeepSeek are used as lures. It starts by finding hosts interacting with lookalike domains via HTTP and DNS, then pivots to identify fraudulent installers or suspicious Microsoft 365 device-code authentication patterns. By correlating the initial lure with follow-on execution or identity anomalies, the hunt distinguishes between legitimate AI usage and social engineering campaigns."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "ai-themed-initial-access",
            "steps": [
              "http-ai-lures",
              "dns-ai-lookalikes",
              "early-stage-agent"
            ],
            "status": "covered"
          },
          {
            "stage": "aitm-token-harvesting",
            "steps": [
              "auth-device-code-abuse",
              "follow-on-agent"
            ],
            "status": "covered"
          },
          {
            "stage": "endpoint-malware-execution",
            "steps": [
              "process-stealer-execution"
            ],
            "status": "covered"
          },
          {
            "stage": "fraudulent-impact-actions",
            "reason": "Surfaces for credit card data exposure are not available; BEC impact like inbox rules needs M365-specific mailbox activity logs not listed in the dossier.",
            "status": "not_visible"
          }
        ],
        "rationale": "An adversary is using lookalike AI domains and installers to trick users into downloading stealers or performing device-code authentication, leading to token theft and financial fraud.",
        "blind_spots": [
          {
            "id": "limited-cloud-auth-retention",
            "risk": "A session token harvested weeks ago may still be active but would not appear in the current hunt window.",
            "stage": "aitm-token-harvesting",
            "question": "whether the device code abuse occurred before the current 14-day window",
            "requires": "long-term hb_auth_signin retention (90+ days)"
          },
          {
            "id": "browser-extension-visibility",
            "risk": "Silent installation of a browser extension might not trigger a process activity row, leading to a false negative for execution.",
            "stage": "endpoint-malware-execution",
            "question": "whether malicious AI-themed browser extensions were installed instead of standalone binaries",
            "requires": "hb_file_activity or browser database monitoring"
          }
        ],
        "scoping_notes": "The hunt begins with hosts showing any AI-themed process activity to narrow the estate. It then expands to check network delivery across the entire environment, as phishing may target users who haven't yet run a binary.",
        "beyond_detection": "A simple detection rule would alert on a known AI domain; this hunt pivots from the network lure to look for the specific execution of rare AI-themed binaries on the host and correlates it with cloud-based authentication anomalies, covering the full multi-stage chain."
      }
    },
    {
      "id": "scoping-ai-activity",
      "type": "query",
      "label": "Scope hosts with AI-themed process activity",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT device_hostname FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%gpt%' OR LOWER(process_name) LIKE '%deepseek%' OR LOWER(process_name) LIKE '%claude%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Find hosts that have already executed processes containing AI brand names in their path or filename.",
        "expected_signal": "A list of hostnames that have handled AI-related binaries; silence indicates no overt AI-themed execution has occurred yet."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Scope hosts with AI-themed process activity",
        "reads": [
          "device_hostname",
          "process_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT DISTINCT device_hostname FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%gpt%' OR LOWER(process_name) LIKE '%deepseek%' OR LOWER(process_name) LIKE '%claude%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames that have handled AI-related binaries; silence indicates no overt AI-themed execution has occurred yet.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "http-ai-lures",
      "type": "query",
      "label": "HTTP requests to AI lookalike domains",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, user_agent, time FROM hb_http_activity WHERE instr(',' || '{{ai_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Identify users interacting with suspected phishing or malvertising sites disguised as AI services.",
        "expected_signal": "Direct URL hits indicating a user visited a lure site. Multiple unique paths suggest active navigation on the malicious site."
      },
      "parents": [
        {
          "id": "scoping-ai-activity"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "HTTP requests to AI lookalike domains",
        "reads": [
          "device_hostname",
          "time",
          "url_hostname",
          "url_path",
          "user_agent"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, user_agent, time FROM hb_http_activity WHERE instr(',' || '{{ai_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Direct URL hits indicating a user visited a lure site. Multiple unique paths suggest active navigation on the malicious site.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "dns-ai-lookalikes",
      "type": "query",
      "label": "DNS resolutions for AI themes",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT device_hostname, query_hostname, process_name, COUNT(*) as resolution_count FROM hb_dns_activity WHERE (instr(',' || '{{ai_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR (LOWER(query_hostname) LIKE '%chatgpt%' AND LOWER(query_hostname) NOT LIKE '%openai.com')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname, process_name",
        "surface": "hb_dns_activity",
        "description": "Detect resolution of lookalike domains even when full HTTP payload is unavailable or encrypted.",
        "expected_signal": "Resolution rows for known lures or high-entropy variations of AI brands. Grouping by process identifies the originating application."
      },
      "parents": [
        {
          "id": "scoping-ai-activity"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "DNS resolutions for AI themes",
        "reads": [
          "device_hostname",
          "process_name",
          "query_hostname",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, query_hostname, process_name, COUNT(*) as resolution_count FROM hb_dns_activity WHERE (instr(',' || '{{ai_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR (LOWER(query_hostname) LIKE '%chatgpt%' AND LOWER(query_hostname) NOT LIKE '%openai.com')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname, process_name",
        "silence": "not_evidence_of_absence",
        "expected": "Resolution rows for known lures or high-entropy variations of AI brands. Grouping by process identifies the originating application.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "query_hostname"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "early-stage-agent",
      "type": "analytic",
      "label": "Analyze AI-themed delivery",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "web"
        ],
        "context": [
          "http-ai-lures",
          "dns-ai-lookalikes"
        ],
        "objective": "Determine if any host has successfully resolved or connected to lookalike AI infrastructure that deviates from official service providers.",
        "description": "The agent weighs the HTTP and DNS results to identify hosts currently targeted by social engineering.",
        "max_iterations": 3,
        "expected_signal": "A verdict on which hosts show confirmed interest in or redirection to malicious AI infrastructure.",
        "success_criteria": "A per-host verdict citing specific domain resolutions and URL paths found."
      },
      "parents": [
        {
          "id": "http-ai-lures",
          "kind": "merge"
        },
        {
          "id": "dns-ai-lookalikes",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "process-stealer-execution",
      "type": "query",
      "label": "Stealer execution from AI installers",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%gpt%' OR LOWER(process_name) LIKE '%deepseek%' OR LOWER(process_name) LIKE '%installer%') AND (LOWER(process_path) LIKE '%\\\\downloads\\\\%' OR LOWER(process_path) LIKE '%\\\\public\\\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Identify Vidar stealer or other payloads executed via fake AI installers.",
        "expected_signal": "Execution of binaries with AI names from user-writable directories. Rare parent-child pairs for these processes suggest non-standard installation."
      },
      "parents": [
        {
          "id": "early-stage-agent"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Stealer execution from AI installers",
        "reads": [
          "device_hostname",
          "process_cmd_line",
          "process_name",
          "process_path",
          "time",
          "user_name"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%gpt%' OR LOWER(process_name) LIKE '%deepseek%' OR LOWER(process_name) LIKE '%installer%') AND (LOWER(process_path) LIKE '%\\\\downloads\\\\%' OR LOWER(process_path) LIKE '%\\\\public\\\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Execution of binaries with AI names from user-writable directories. Rare parent-child pairs for these processes suggest non-standard installation.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "process_name"
          ],
          "rare_below": 2
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "auth-device-code-abuse",
      "type": "query",
      "label": "Microsoft device code authentication patterns",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, dst_endpoint_name, auth_protocol, time FROM hb_auth_signin WHERE provider = 'm365' AND LOWER(auth_protocol) LIKE '%device%code%' AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_auth_signin",
        "description": "Identify potential session token harvesting through abuse of the legitimate device code sign-in flow.",
        "expected_signal": "Successful device code authentication events. Correlate with the source IP to see if the user is typically associated with that location."
      },
      "parents": [
        {
          "id": "early-stage-agent"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Microsoft device code authentication patterns",
        "reads": [
          "actor_user_name",
          "auth_protocol",
          "dst_endpoint_name",
          "provider",
          "src_endpoint_ip",
          "status_id",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, dst_endpoint_name, auth_protocol, time FROM hb_auth_signin WHERE provider = 'm365' AND LOWER(auth_protocol) LIKE '%device%code%' AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Successful device code authentication events. Correlate with the source IP to see if the user is typically associated with that location.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "follow-on-agent",
      "type": "analytic",
      "label": "Multi-stage attack correlation",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "web"
        ],
        "context": [
          "process-stealer-execution",
          "auth-device-code-abuse",
          "early-stage-agent"
        ],
        "objective": "Evaluate whether the delivery signals from the early-stage agent correlate with subsequent stealer execution or unusual device-code authentication on the same host or for the same user.",
        "description": "The agent links the early network evidence with endpoint execution and identity anomalies to confirm a full intrusion chain.",
        "max_iterations": 5,
        "expected_signal": "A detailed narrative connecting the AI-themed lure to specific malware or suspicious identity usage.",
        "success_criteria": "A final malicious/suspicious verdict per host, identifying the specific AI brand impersonated and the impact (stealer or token theft)."
      },
      "parents": [
        {
          "id": "process-stealer-execution",
          "kind": "merge"
        },
        {
          "id": "auth-device-code-abuse",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on attack confirmation",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "The follow-on agent identifies a confirmed correlation between an AI-themed lure and stealer execution or token harvesting.",
        "condition": "The follow-on agent identifies a confirmed correlation between an AI-themed lure and stealer execution or token harvesting.",
        "blind_spot": "limited-cloud-auth-retention",
        "confidence": "high",
        "description": "Determine whether the evidence warrants immediate isolation or further analyst review.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "follow-on-agent"
        }
      ]
    },
    {
      "id": "isolate-compromised-host",
      "type": "action",
      "label": "Isolate compromised host",
      "config": {
        "target": "endpoint",
        "description": "Contain the threat by isolating the endpoint where the stealer was executed.",
        "instructions": "Isolate the host identified in the verdict. Revoke any active sessions for users associated with device-code authentication findings.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review-investigation",
      "type": "task",
      "label": "Review evidence and identity risk",
      "config": {
        "assignee": "analyst",
        "description": "Analyst manually verifies the lures and checks for lateral movement or BEC signs like new inbox rules.",
        "instructions": "Verify the AI domains identified. For users who successfully used device-code authentication, check for new email forwarding or inbox rules in M365 that could indicate BEC."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-compromised-host"
        }
      ]
    },
    {
      "id": "close-out-report",
      "type": "task",
      "label": "Close out and tune lures",
      "config": {
        "assignee": "analyst",
        "description": "Finalize the hunt and update the AI domain list based on findings.",
        "instructions": "Document the findings. If malicious AI-themed domains were found, add them to the global blocklist and update the hunt parameters."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-review-investigation"
        }
      ]
    }
  ]
}