{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Akira ransomware results in catastrophic operational disruption. Detecting the precursor credential theft and exfiltration is the last line of defense before encryption." }, "name": "Akira Ransomware Deployment and Credential Access", "type": "investigation", "labels": [ "hunt", "attack.t1003.003", "attack.t1003.001", "attack.t1555", "attack.t1048.003", "attack.t1486" ], "series": { "slug": "flash-alert-from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira", "index": 3, "title": "Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira", "total": 3 }, "related": [ { "hunt": "akira-initial-access-and-bumblebee", "reason": "This hunt picks up where initial access and Bumblebee deployment end.", "relation": "follows" }, { "hunt": "bumblebee-recon-privileged-persistence", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple rule for wbadmin may miss variation; this hunt correlates software inventory with rare commands across several surfaces and uses an agent to weigh the entire chain of events.", "coverage": [ { "stage": "credential-access-ntds-dump", "steps": [ "wbadmin-ntds-extraction" ], "status": "covered" }, { "stage": "credential-access-postgre-lsass", "steps": [ "rare-credential-theft-commands" ], "status": "covered" }, { "stage": "exfiltration-sftp", "steps": [ "exfiltration-connections" ], "status": "covered" }, { "stage": "impact-akira-ransomware", "steps": [ "ransomware-payload-execution" ], "status": "covered" }, { "stage": "initial-access-seo-poisoning", "reason": "Belongs to another part of the 'Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" }, { "stage": "execution-malware-loading", "reason": "Belongs to another part of the 'Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" }, { "stage": "command-and-control-bumblebee-adaptix", "reason": "Belongs to another part of the 'Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" }, { "stage": "discovery-host-and-domain", "reason": "Belongs to another part of the 'Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" }, { "stage": "persistence-domain-account-creation", "reason": "Belongs to another part of the 'Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" }, { "stage": "lateral-movement-rdp", "reason": "Belongs to another part of the 'Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" }, { "stage": "persistence-and-tunneling", "reason": "Belongs to another part of the 'Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Initial Access via SEO Poisoning", "slug": "initial-access-seo-poisoning", "tactic": "initial-access", "techniques": [ "T1189" ], "observables": [ "opmanager.pro", "ManageEngine-OpManager.msi", "angryipscanner.org", "axiscamerastation.org", "ip-scanner.org" ] }, { "name": "Bumblebee Loading and Execution", "slug": "execution-malware-loading", "tactic": "execution", "techniques": [ "T1574.002", "T1204.002" ], "observables": [ "msiexec.exe", "consent.exe", "msimg32.dll", "186b26df63df3b7334043b47659cba4185c948629d857d47452cc1936f0aa5da", "a6df0b49a5ef9ffd6513bfe061fb60f6d2941a440038e2de8a7aeb1914945331" ] }, { "name": "Bumblebee and Adaptix C2", "slug": "command-and-control-bumblebee-adaptix", "tactic": "command-and-control", "techniques": [ "T1071.001", "T1568.002" ], "observables": [ "109.205.195.211", "188.40.187.145", "172.96.137.160", "ev2sirbd269o5j.org", "2rxyt9urhq0bgj.org", "AdgNsy.exe" ] }, { "name": "Host and Domain Reconnaissance", "slug": "discovery-host-and-domain", "tactic": "discovery", "techniques": [ "T1082", "T1087.002", "T1069.002" ], "observables": [ "systeminfo", "nltest /dclist:", "whoami /groups", "net group \"domain admins\" /dom" ] }, { "name": "Privileged Account Creation", "slug": "persistence-domain-account-creation", "tactic": "persistence", "techniques": [ "T1136.002" ], "observables": [ "net user backup_DA", "net user backup_EA", "net group \"Enterprise Administrators\" backup_EA /add" ] }, { "name": "Lateral Movement via RDP", "slug": "lateral-movement-rdp", "tactic": "lateral-movement", "techniques": [ "T1021.001" ], "observables": [ "backup_EA" ] }, { "name": "NTDS.dit Extraction", "slug": "credential-access-ntds-dump", "tactic": "credential-access", "techniques": [ "T1003.003" ], "observables": [ "wbadmin.exe start backup -backuptarget:\\\\127.0.0.1\\C$\\ProgramData\\ -include:\"C:\\windows\\NTDS\\ntds.dit\"", "ntds.dit" ] }, { "name": "Persistence and External Tunneling", "slug": "persistence-and-tunneling", "tactic": "persistence", "techniques": [ "T1133", "T1572" ], "observables": [ "RustDesk", "ssh root@193.242.184.150 -R *:10400", "83.229.17.60" ] }, { "name": "Database and Memory Credential Theft", "slug": "credential-access-postgre-lsass", "tactic": "credential-access", "techniques": [ "T1003.001", "T1555" ], "observables": [ "psql.exe -U postgres -d VeeamBackup -c \"SELECT user_name,password FROM credentials\"", "rundll32.exe C:\\windows\\System32\\comsvcs.dll, #+000024" ] }, { "name": "Data Exfiltration via FileZilla", "slug": "exfiltration-sftp", "tactic": "exfiltration", "techniques": [ "T1048.003" ], "observables": [ "FileZilla", "185.174.100.203" ] }, { "name": "Akira Ransomware Deployment", "slug": "impact-akira-ransomware", "tactic": "impact", "techniques": [ "T1486" ], "observables": [ "locker.exe", "win.exe", "de730d969854c3697fd0e0803826b4222f3a14efe47e4c60ed749fff6edce19d" ] } ], "summary": "Threat actors utilized SEO poisoning for 'ManageEngine OpManager' to deliver Bumblebee malware, which dropped AdaptixC2 for post-exploitation. The intrusion involved domain account creation, NTDS.dit dumping via wbadmin, and lateral movement to a backup server before exfiltrating data and deploying Akira ransomware." }, "severity": "critical", "rationale": "Prioritize Domain Controllers for the wbadmin check and backup servers (Veeam/Postgres) for the database credential check.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has escalated privileges through NTDS dumping and database credential harvesting, and is now exfiltrating data before deploying Akira ransomware.", "parameters": { "exfil_ips": { "from": { "ref": "https://thedfirreport.com/2025/08/05/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-2/", "kind": "article", "observed": "2025-08-05" }, "type": "list[ip]", "default": [ "185.174.100.203", "193.242.184.150", "83.229.17.60" ], "description": "Known exfiltration and proxy tunnel servers." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hostnames to scope the hunt." }, "akira_hashes": { "from": { "ref": "https://thedfirreport.com/2025/08/05/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-2/", "kind": "article", "observed": "2025-08-05" }, "type": "list[hash]", "default": [ "de730d969854c3697fd0e0803826b4222f3a14efe47e4c60ed749fff6edce19d", "18b8e6762afd29a09becae283083c74a19fc09db1f2c3412c42f1b0178bc122a" ], "description": "Hashes for Akira ransomware payloads (locker.exe, win.exe)." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://thedfirreport.com/2025/08/05/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-2/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://thedfirreport.com/2025/08/05/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-2/", "name": "From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira" } ], "blind_spots": [ { "id": "missing-endpoint-telemetry", "risk": "A ransomware payload executing on a server without an agent is invisible until system failure.", "stage": "impact-akira-ransomware", "question": "Are unmanaged servers undergoing encryption?", "requires": "Endpoint telemetry from all managed and unmanaged assets" }, { "id": "lsass-protection-blindness", "risk": "We see the command but cannot confirm if the attacker actually obtained credentials without seeing the resulting dump file.", "stage": "credential-access-postgre-lsass", "question": "Was the LSASS dump attempt successful or blocked by security software?", "requires": "hb_process_activity with error codes or OS signals" } ] }, "name": "Akira Ransomware Deployment and Credential Access", "description": "This hunt focuses on the final and most destructive stages of the Akira ransomware lifecycle. It identifies high-value assets like Domain Controllers and backup servers, then searches for credential extraction from the NTDS.dit file and Veeam databases. The hunt then follows the intrusion into data exfiltration via SFTP and the multi-host deployment of the Akira ransomware payload. An agent correlates early-stage credential theft with late-stage encryption to confirm the full intrusion chain." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "flash-alert-from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira", "index": 3, "title": "Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira", "total": 3 }, "coverage": [ { "stage": "credential-access-ntds-dump", "steps": [ "wbadmin-ntds-extraction" ], "status": "covered" }, { "stage": "credential-access-postgre-lsass", "steps": [ "rare-credential-theft-commands" ], "status": "covered" }, { "stage": "exfiltration-sftp", "steps": [ "exfiltration-connections" ], "status": "covered" }, { "stage": "impact-akira-ransomware", "steps": [ "ransomware-payload-execution" ], "status": "covered" }, { "stage": "initial-access-seo-poisoning", "reason": "Belongs to another part of the 'Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" }, { "stage": "execution-malware-loading", "reason": "Belongs to another part of the 'Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" }, { "stage": "command-and-control-bumblebee-adaptix", "reason": "Belongs to another part of the 'Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" }, { "stage": "discovery-host-and-domain", "reason": "Belongs to another part of the 'Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" }, { "stage": "persistence-domain-account-creation", "reason": "Belongs to another part of the 'Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" }, { "stage": "lateral-movement-rdp", "reason": "Belongs to another part of the 'Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" }, { "stage": "persistence-and-tunneling", "reason": "Belongs to another part of the 'Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira' series.", "status": "out_of_scope" } ], "rationale": "An intruder has escalated privileges through NTDS dumping and database credential harvesting, and is now exfiltrating data before deploying Akira ransomware.", "blind_spots": [ { "id": "missing-endpoint-telemetry", "risk": "A ransomware payload executing on a server without an agent is invisible until system failure.", "stage": "impact-akira-ransomware", "question": "Are unmanaged servers undergoing encryption?", "requires": "Endpoint telemetry from all managed and unmanaged assets" }, { "id": "lsass-protection-blindness", "risk": "We see the command but cannot confirm if the attacker actually obtained credentials without seeing the resulting dump file.", "stage": "credential-access-postgre-lsass", "question": "Was the LSASS dump attempt successful or blocked by security software?", "requires": "hb_process_activity with error codes or OS signals" } ], "scoping_notes": "Prioritize Domain Controllers for the wbadmin check and backup servers (Veeam/Postgres) for the database credential check.", "beyond_detection": "A simple rule for wbadmin may miss variation; this hunt correlates software inventory with rare commands across several surfaces and uses an agent to weigh the entire chain of events." } }, { "id": "identify-high-value-assets", "type": "query", "label": "Identify High-Value Assets", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, vendor_name FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%veeam%' OR LOWER(package_name) LIKE '%postgres%' OR LOWER(package_name) LIKE '%sql%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_software_inventory", "description": "Locate Domain Controllers and systems running backup or database software likely to be targeted for credentials.", "expected_signal": "A list of servers that represent high-value targets for an adversary. Silence indicates these software packages are not installed via a tracked manager." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify High-Value Assets", "reads": [ "device_hostname", "package_name", "vendor_name" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, vendor_name FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%veeam%' OR LOWER(package_name) LIKE '%postgres%' OR LOWER(package_name) LIKE '%sql%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "A list of servers that represent high-value targets for an adversary. Silence indicates these software packages are not installed via a tracked manager.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "wbadmin-ntds-extraction", "type": "query", "label": "wbadmin NTDS Extraction", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE LOWER(process_name) LIKE '%wbadmin.exe' AND LOWER(process_cmd_line) LIKE '%ntds.dit%' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_process_activity", "description": "Detect use of the wbadmin backup utility to export the Active Directory database.", "expected_signal": "A wbadmin process with a command line including ntds.dit. This is a high-confidence signal for domain controller compromise." }, "parents": [ { "id": "identify-high-value-assets" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "wbadmin NTDS Extraction", "reads": [ "device_hostname", "process_name", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE LOWER(process_name) LIKE '%wbadmin.exe' AND LOWER(process_cmd_line) LIKE '%ntds.dit%' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "evidence_of_absence", "expected": "A wbadmin process with a command line including ntds.dit. This is a high-confidence signal for domain controller compromise.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "rare-credential-theft-commands", "type": "query", "label": "Rare Credential Theft Commands", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT process_cmd_line, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%comsvcs.dll%' OR (LOWER(process_name) LIKE '%psql.exe' AND LOWER(process_cmd_line) LIKE '%credentials%')) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_cmd_line HAVING host_count <= 2", "surface": "hb_process_activity", "description": "Find rare commands targeting LSASS memory or Veeam credentials across the fleet.", "expected_signal": "Command lines that appear on very few hosts. Fleet-wide normal activity is excluded by the count threshold." }, "parents": [ { "id": "identify-high-value-assets" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare Credential Theft Commands", "reads": [ "process_cmd_line", "device_hostname", "time", "process_name" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT process_cmd_line, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%comsvcs.dll%' OR (LOWER(process_name) LIKE '%psql.exe' AND LOWER(process_cmd_line) LIKE '%credentials%')) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_cmd_line HAVING host_count <= 2", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Command lines that appear on very few hosts. Fleet-wide normal activity is excluded by the count threshold.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_cmd_line" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "early-credential-agent", "type": "analytic", "label": "Early Credential Triage", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "wbadmin-ntds-extraction", "rare-credential-theft-commands" ], "objective": "Determine if any host has successfully executed credential extraction commands against NTDS or databases.", "description": "Assess whether observed commands indicate successful credential extraction precursors.", "max_iterations": 3, "expected_signal": "Verdicts identifying specific hosts compromised during credential harvesting.", "success_criteria": "A per-host verdict of malicious | suspicious | benign citing the command and target file." }, "parents": [ { "id": "wbadmin-ntds-extraction", "kind": "merge" }, { "id": "rare-credential-theft-commands", "kind": "merge" } ] }, { "id": "exfiltration-connections", "type": "query", "label": "Exfiltration Connections", "config": { "dsl": "sqlite", "role": "enrichment", "source": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, traffic_bytes, time FROM hb_network_connection WHERE instr(',' || '{{exfil_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_network_connection", "description": "Detect network connections to known exfiltration servers or proxy tunnels.", "expected_signal": "Outbound connections to specified IPs. High traffic bytes from FileZilla or SSH processes are indicators of exfiltration." }, "parents": [ { "id": "early-credential-agent" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Exfiltration Connections", "reads": [ "device_hostname", "process_name", "dst_endpoint_ip", "dst_endpoint_port", "traffic_bytes", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, traffic_bytes, time FROM hb_network_connection WHERE instr(',' || '{{exfil_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "Outbound connections to specified IPs. High traffic bytes from FileZilla or SSH processes are indicators of exfiltration.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "ransomware-payload-execution", "type": "query", "label": "Ransomware Payload Execution", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_hash_sha256, process_cmd_line, time FROM hb_process_activity WHERE (instr(',' || '{{akira_hashes}}' || ',', ',' || process_hash_sha256 || ',') > 0 OR LOWER(process_name) LIKE '%locker.exe' OR LOWER(process_name) LIKE '%win.exe') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_process_activity", "description": "Identify the execution of Akira ransomware payloads by file name or reported hash.", "expected_signal": "A process match for Akira. Any result is an immediate indication of system encryption." }, "parents": [ { "id": "early-credential-agent" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Ransomware Payload Execution", "reads": [ "device_hostname", "process_name", "process_hash_sha256", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_hash_sha256, process_cmd_line, time FROM hb_process_activity WHERE (instr(',' || '{{akira_hashes}}' || ',', ',' || process_hash_sha256 || ',') > 0 OR LOWER(process_name) LIKE '%locker.exe' OR LOWER(process_name) LIKE '%win.exe') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "evidence_of_absence", "expected": "A process match for Akira. Any result is an immediate indication of system encryption.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "final-intrusion-agent", "type": "analytic", "label": "Final Intrusion Assessment", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "early-credential-agent", "exfiltration-connections", "ransomware-payload-execution" ], "objective": "Determine if the combined evidence proves a complete ransomware intrusion from credential theft to file encryption.", "description": "Synthesize early credential access with late-stage exfiltration and impact.", "max_iterations": 5, "expected_signal": "A final verdict confirming the presence of an Akira ransomware intrusion.", "success_criteria": "A detailed timeline of the breach, listing compromised hosts and the source of truth for each stage." }, "parents": [ { "id": "exfiltration-connections", "kind": "merge" }, { "id": "ransomware-payload-execution", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on Verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the final assessment confirms malicious activity on at least one host", "condition": "the final assessment confirms malicious activity on at least one host", "blind_spot": "missing-endpoint-telemetry", "confidence": "high", "description": "Direct the hunt to immediate action if a ransomware incident is confirmed.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "final-intrusion-agent" } ] }, { "id": "contain-affected-hosts", "type": "action", "label": "Contain Affected Hosts", "config": { "target": "endpoint", "description": "Immediately isolate compromised systems to prevent further encryption or lateral movement.", "instructions": "Isolate every host identified as malicious or suspicious by the agent triage. Revoke all domain administrator credentials created or accessed during the lookback window.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-manual-review", "type": "task", "label": "Analyst Manual Review", "config": { "assignee": "analyst", "description": "Verify the automated findings and determine the extent of operational impact.", "instructions": "Review the cited telemetry. Confirm the locker.exe execution and the wbadmin command syntax. Check for evidence of data staging in C:\\ProgramData before exfiltration occurred. Initiate a restoration process from offline backups for encrypted systems." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "contain-affected-hosts" } ] }, { "id": "close-out", "type": "task", "label": "Close Out", "config": { "assignee": "analyst", "description": "Document results and promote successful queries to permanent detection rules.", "instructions": "Record the hunt results. If the wbadmin query identified a verified intrusion, promote it to a standing detection rule. Document any unmanaged servers that were encrypted." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-manual-review" } ] } ] }