{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Amatera infostealer detections in Latin America topped the charts in 2026; its ability to steal developer secrets and M365 tokens makes it a critical threat to organizational cloud infrastructure. A negative result confirms that these specific social engineering techniques are not currently successful in the estate."
      },
      "name": "Amatera Infostealer Initial Access and Persistence",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1566",
        "attack.t1059.001",
        "attack.t1218.011",
        "attack.t1053.005",
        "attack.t1070",
        "attack.t1555",
        "attack.t1115",
        "collection",
        "credential access",
        "defense evasion",
        "execution",
        "impact",
        "initial access",
        "persistence"
      ],
      "series": {
        "slug": "amatera-how-the-prolific-infostealer-works-and-spreads",
        "index": 1,
        "title": "Amatera: How the prolific infostealer works and spreads",
        "total": 2
      },
      "related": [
        {
          "hunt": "browser-extension-and-cookie-theft",
          "reason": "Amatera also steals browser cookies and session tokens, which requires specialized hunting in hb_file_activity for browser profile access.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A single detection rule would struggle with the variability of user-pasted commands; this hunt pivots from the execution context (explorer as parent) to network indicators and follow-on persistence (scheduled tasks) to distinguish accidental user error from active infostealer compromise.",
      "coverage": [
        {
          "stage": "initial-access-delivery",
          "steps": [
            "dns-to-amatera-infra"
          ],
          "status": "covered"
        },
        {
          "stage": "execution-user-pasted-commands",
          "steps": [
            "execution-from-run-dialog"
          ],
          "status": "covered"
        },
        {
          "stage": "persistence-scheduled-task",
          "steps": [
            "new-scheduled-tasks"
          ],
          "status": "covered"
        },
        {
          "stage": "defense-evasion-history-clearing",
          "steps": [
            "powershell-history-tampering"
          ],
          "status": "covered"
        },
        {
          "stage": "credential-and-clipboard-collection",
          "reason": "Belongs to another part of the 'Amatera: How the prolific infostealer works and spreads' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "cloud-resource-authorization",
          "reason": "Belongs to another part of the 'Amatera: How the prolific infostealer works and spreads' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "impact-data-encryption",
          "reason": "Belongs to another part of the 'Amatera: How the prolific infostealer works and spreads' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Social Engineering and SEO Poisoning",
            "slug": "initial-access-delivery",
            "tactic": "initial-access",
            "techniques": [
              "T1566",
              "T1190"
            ],
            "observables": [
              "Impersonation of AI tools (Claude Code, NotebookLM, JetBrains)",
              "Fake CAPTCHA sites",
              "Fake browser error/crash pages",
              "Compromised WordPress sites",
              "SVG files and fake documents",
              "Domain psw.amatera"
            ]
          },
          {
            "name": "User-Initiated Command Execution",
            "slug": "execution-user-pasted-commands",
            "tactic": "execution",
            "techniques": [
              "T1059.001",
              "T1218.011"
            ],
            "observables": [
              "Commands pasted into Run dialog (Win+R)",
              "powershell.exe",
              "rundll32.exe",
              "Suspicious PowerShell script blocks containing download instructions"
            ]
          },
          {
            "name": "Task Scheduler Persistence",
            "slug": "persistence-scheduled-task",
            "tactic": "persistence",
            "techniques": [
              "T1053.005"
            ],
            "observables": [
              "schtasks.exe",
              "Creation of new scheduled tasks",
              "Unusual task XML definitions"
            ]
          },
          {
            "name": "PowerShell History Tampering",
            "slug": "defense-evasion-history-clearing",
            "tactic": "defense-evasion",
            "techniques": [
              "T1070"
            ],
            "observables": [
              "Deletion or clearing of ConsoleHost_history.txt"
            ]
          },
          {
            "name": "Local Credential and Wallet Theft",
            "slug": "credential-and-clipboard-collection",
            "tactic": "credential-access",
            "techniques": [
              "T1555",
              "T1115"
            ],
            "observables": [
              "Access to browser 'Login Data', 'Cookies', and 'Web Data' SQLite files",
              "Clipboard monitoring for cryptocurrency wallet addresses",
              "Theft of SSH keys and FTP credentials"
            ]
          },
          {
            "name": "OAuth Token and Cloud Storage Access",
            "slug": "cloud-resource-authorization",
            "tactic": "collection",
            "techniques": [
              "T1566",
              "T1530"
            ],
            "observables": [
              "ConsentFix OAuth token authorization grants",
              "Unauthorized access to SharePoint and OneDrive files",
              "Extraction of secrets from development environments"
            ]
          },
          {
            "name": "Ransomware Rebranding Activity",
            "slug": "impact-data-encryption",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "Encryption of files on target systems"
            ]
          }
        ],
        "summary": "Amatera is a C++ infostealer distributed via 'ClickFix' social engineering, SEO poisoning, and malicious ads targeting developers. Once executed, it establishes persistence through scheduled tasks and exfiltrates browser credentials, session tokens, and sensitive files from local systems and cloud storage services like SharePoint."
      },
      "severity": "high",
      "rationale": "The campaign specifically targets developers and users of AI tools. Focus first on workstations with JetBrains, Claude, or Snowflake client software. Use a 14-day lookback to capture both the initial social engineering (ClickFix) and subsequent persistence mechanisms.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An intruder has used social engineering to trick a user into executing PowerShell commands from the Run dialog, leading to the installation of the Amatera infostealer and persistent scheduled tasks.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "analyst-defined",
            "kind": "manual",
            "observed": "2024-11-20"
          },
          "type": "list[host]",
          "default": [],
          "description": "Optional list of hosts to narrow the hunt; leave empty to scan the entire estate."
        },
        "lookback_days": {
          "from": {
            "ref": "hunt-standard",
            "kind": "manual",
            "observed": "2024-11-20"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine for initial execution and follow-on activity."
        },
        "amatera_domains": {
          "from": {
            "ref": "eset-research-amatera",
            "kind": "article",
            "observed": "2026-10-29"
          },
          "type": "list[domain]",
          "default": [
            "psw.amatera"
          ],
          "description": "Known domains associated with Amatera infrastructure."
        },
        "dev_tool_patterns": {
          "from": {
            "ref": "eset-research-amatera",
            "kind": "article",
            "observed": "2026-10-29"
          },
          "type": "list[string]",
          "default": [
            "claude",
            "jetbrains",
            "snowflake",
            "notebooklm",
            "comet"
          ],
          "description": "Software patterns to identify potential high-value developer workstations."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.welivesecurity.com/en/malware/amatera-how-prolific-infostealer-works-spreads/",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.welivesecurity.com/en/malware/amatera-how-prolific-infostealer-works-spreads/",
          "name": "ESET Research \u2014 Amatera: How the prolific infostealer works and spreads"
        }
      ],
      "blind_spots": [
        {
          "id": "limited-retention-windows",
          "risk": "A host infected three weeks ago may show persistence but no longer have the initial network delivery telemetry in the lookback window.",
          "owner": "Security Engineering",
          "stage": "initial-access-delivery",
          "question": "whether the initial DNS query to psw.amatera occurred before the 14-day lookback",
          "requires": "60+ days of hb_dns_activity",
          "remediation": "Increase DNS log retention for developer-class workstations."
        },
        {
          "id": "clipboard-monitoring-gap",
          "risk": "The hunt relies on the process parent-child relationship (explorer -> powershell) and command line content, which can be bypassed if the user runs the command through other means.",
          "owner": "Detection Engineering",
          "stage": "execution-user-pasted-commands",
          "question": "whether the user actually copied malicious content from a browser before pasting it into the Run dialog",
          "requires": "hb_clipboard_activity (not currently available)",
          "remediation": "Explore EDR capability for monitoring clipboard-to-command-line transfers."
        }
      ]
    },
    "name": "Amatera Infostealer Initial Access and Persistence",
    "description": "Amatera is a professionalized infostealer that frequently uses ClickFix techniques, where victims are social-engineered into pasting malicious commands directly into Windows system utilities. This hunt identifies the initial user-driven execution, corroborates it with known network infrastructure, and then tracks follow-on persistence and defense evasion through PowerShell history tampering."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "amatera-how-the-prolific-infostealer-works-and-spreads",
          "index": 1,
          "title": "Amatera: How the prolific infostealer works and spreads",
          "total": 2
        },
        "coverage": [
          {
            "stage": "initial-access-delivery",
            "steps": [
              "dns-to-amatera-infra"
            ],
            "status": "covered"
          },
          {
            "stage": "execution-user-pasted-commands",
            "steps": [
              "execution-from-run-dialog"
            ],
            "status": "covered"
          },
          {
            "stage": "persistence-scheduled-task",
            "steps": [
              "new-scheduled-tasks"
            ],
            "status": "covered"
          },
          {
            "stage": "defense-evasion-history-clearing",
            "steps": [
              "powershell-history-tampering"
            ],
            "status": "covered"
          },
          {
            "stage": "credential-and-clipboard-collection",
            "reason": "Belongs to another part of the 'Amatera: How the prolific infostealer works and spreads' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "cloud-resource-authorization",
            "reason": "Belongs to another part of the 'Amatera: How the prolific infostealer works and spreads' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "impact-data-encryption",
            "reason": "Belongs to another part of the 'Amatera: How the prolific infostealer works and spreads' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An intruder has used social engineering to trick a user into executing PowerShell commands from the Run dialog, leading to the installation of the Amatera infostealer and persistent scheduled tasks.",
        "blind_spots": [
          {
            "id": "limited-retention-windows",
            "risk": "A host infected three weeks ago may show persistence but no longer have the initial network delivery telemetry in the lookback window.",
            "owner": "Security Engineering",
            "stage": "initial-access-delivery",
            "question": "whether the initial DNS query to psw.amatera occurred before the 14-day lookback",
            "requires": "60+ days of hb_dns_activity",
            "remediation": "Increase DNS log retention for developer-class workstations."
          },
          {
            "id": "clipboard-monitoring-gap",
            "risk": "The hunt relies on the process parent-child relationship (explorer -> powershell) and command line content, which can be bypassed if the user runs the command through other means.",
            "owner": "Detection Engineering",
            "stage": "execution-user-pasted-commands",
            "question": "whether the user actually copied malicious content from a browser before pasting it into the Run dialog",
            "requires": "hb_clipboard_activity (not currently available)",
            "remediation": "Explore EDR capability for monitoring clipboard-to-command-line transfers."
          }
        ],
        "scoping_notes": "The campaign specifically targets developers and users of AI tools. Focus first on workstations with JetBrains, Claude, or Snowflake client software. Use a 14-day lookback to capture both the initial social engineering (ClickFix) and subsequent persistence mechanisms.",
        "beyond_detection": "A single detection rule would struggle with the variability of user-pasted commands; this hunt pivots from the execution context (explorer as parent) to network indicators and follow-on persistence (scheduled tasks) to distinguish accidental user error from active infostealer compromise."
      }
    },
    {
      "id": "software-scoping",
      "type": "query",
      "label": "Scope to developer workstations",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (instr(',' || '{{dev_tool_patterns}}' || ',', ',' || LOWER(package_name) || ',') > 0) GROUP BY device_hostname, package_name, package_version",
        "surface": "hb_software_inventory",
        "description": "Identify hosts running tools mentioned in the Amatera campaign to prioritize the hunt on developer workstations.",
        "expected_signal": "A list of hosts frequently using AI or development tools. Silence means no such software was found, not that the hosts are safe."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Scope to developer workstations",
        "reads": [
          "device_hostname",
          "package_name",
          "package_version"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (instr(',' || '{{dev_tool_patterns}}' || ',', ',' || LOWER(package_name) || ',') > 0) GROUP BY device_hostname, package_name, package_version",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hosts frequently using AI or development tools. Silence means no such software was found, not that the hosts are safe.",
        "verified": "dry-run",
        "verified_at": "2026-10-30"
      }
    },
    {
      "id": "execution-from-run-dialog",
      "type": "query",
      "label": "PowerShell execution from Run dialog",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%\\explorer.exe') AND (LOWER(process_name) LIKE '%\\powershell.exe' OR LOWER(process_name) LIKE '%\\rundll32.exe') AND (LOWER(process_cmd_line) LIKE '%-enc%' OR LOWER(process_cmd_line) LIKE '%invoke-webrequest%' OR LOWER(process_cmd_line) LIKE '%iwr%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Find PowerShell or Rundll32 processes launched directly from explorer.exe, which is the hallmark of the ClickFix social engineering vector.",
        "expected_signal": "PowerShell commands with obfuscated or download-related flags launched by explorer.exe. This typically represents a user pasting a command from the browser."
      },
      "parents": [
        {
          "id": "software-scoping"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "PowerShell execution from Run dialog",
        "reads": [
          "device_hostname",
          "process_name",
          "process_cmd_line",
          "parent_process_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%\\explorer.exe') AND (LOWER(process_name) LIKE '%\\powershell.exe' OR LOWER(process_name) LIKE '%\\rundll32.exe') AND (LOWER(process_cmd_line) LIKE '%-enc%' OR LOWER(process_cmd_line) LIKE '%invoke-webrequest%' OR LOWER(process_cmd_line) LIKE '%iwr%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "PowerShell commands with obfuscated or download-related flags launched by explorer.exe. This typically represents a user pasting a command from the browser.",
        "verified": "dry-run",
        "verified_at": "2026-10-30"
      }
    },
    {
      "id": "dns-to-amatera-infra",
      "type": "query",
      "label": "DNS activity to Amatera domains",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE (instr(',' || '{{amatera_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_dns_activity",
        "description": "Identify if any hosts in the estate have attempted to resolve the reported Amatera infostealer C2 or distribution infrastructure.",
        "expected_signal": "Any DNS resolution for psw.amatera. Silence does not prove safety as domains rotate frequently."
      },
      "parents": [
        {
          "id": "software-scoping"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "DNS activity to Amatera domains",
        "reads": [
          "device_hostname",
          "query_hostname",
          "process_name",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE (instr(',' || '{{amatera_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Any DNS resolution for psw.amatera. Silence does not prove safety as domains rotate frequently.",
        "verified": "dry-run",
        "verified_at": "2026-10-30"
      }
    },
    {
      "id": "early-stage-triage",
      "type": "analytic",
      "label": "Triage initial access evidence",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint"
        ],
        "context": [
          "execution-from-run-dialog",
          "dns-to-amatera-infra"
        ],
        "objective": "Determine if any host shows evidence of a user-driven infection via pasted commands corroborated by network activity.",
        "description": "Analyze whether the observed process execution and DNS traffic indicate a successful user-initiated infection.",
        "max_iterations": 4,
        "expected_signal": "A per-host verdict identifying whether the execution was likely malicious.",
        "success_criteria": "A verdict for each host with supporting row citations."
      },
      "parents": [
        {
          "id": "execution-from-run-dialog",
          "kind": "merge"
        },
        {
          "id": "dns-to-amatera-infra",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "new-scheduled-tasks",
      "type": "query",
      "label": "New scheduled task creation",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, job_name, job_cmd_line, job_user_name, time FROM hb_scheduled_job WHERE activity_id IN (1, 2) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "surface": "hb_scheduled_job",
        "description": "Amatera is known to create unusual scheduled tasks for persistence. This query finds jobs created or updated during the lookback period.",
        "expected_signal": "Creation of non-standard tasks, particularly those running PowerShell or binaries from user-writable paths."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "New scheduled task creation",
        "reads": [
          "device_hostname",
          "job_name",
          "job_cmd_line",
          "job_user_name",
          "time"
        ],
        "source": "hb_scheduled_job",
        "target": "endpoint",
        "content": "SELECT device_hostname, job_name, job_cmd_line, job_user_name, time FROM hb_scheduled_job WHERE activity_id IN (1, 2) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "silence": "not_evidence_of_absence",
        "expected": "Creation of non-standard tasks, particularly those running PowerShell or binaries from user-writable paths.",
        "verified": "dry-run",
        "verified_at": "2026-10-30"
      }
    },
    {
      "id": "powershell-history-tampering",
      "type": "query",
      "label": "PowerShell history tampering",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT device_hostname, file_path, process_name, activity_name, COUNT(*) OVER (PARTITION BY file_path) as global_frequency, time FROM hb_file_activity WHERE LOWER(file_path) LIKE '%\\microsoft\\windows\\powershell\\powershell\\consolehost_history.txt' AND activity_id IN (3, 4) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "surface": "hb_file_activity",
        "description": "The report suggests attackers clear PowerShell history to hide the pasted commands. This query finds deletions of the ConsoleHost_history.txt file.",
        "expected_signal": "Deletions or suspicious updates to the PowerShell history file. This is rare in standard administrative workflows."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "PowerShell history tampering",
        "reads": [
          "device_hostname",
          "file_path",
          "process_name",
          "activity_name",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, file_path, process_name, activity_name, COUNT(*) OVER (PARTITION BY file_path) as global_frequency, time FROM hb_file_activity WHERE LOWER(file_path) LIKE '%\\microsoft\\windows\\powershell\\powershell\\consolehost_history.txt' AND activity_id IN (3, 4) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Deletions or suspicious updates to the PowerShell history file. This is rare in standard administrative workflows.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "file_path"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-30"
      }
    },
    {
      "id": "follow-on-triage",
      "type": "analytic",
      "label": "Weigh complete infection chain",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint"
        ],
        "context": [
          "early-stage-triage",
          "new-scheduled-tasks",
          "powershell-history-tampering"
        ],
        "objective": "Decide if the host has been compromised by Amatera based on the full chain of execution, network, persistence, and evasion evidence.",
        "description": "Combine the early access evidence with follow-on persistence and evasion signals to confirm the Amatera infection.",
        "max_iterations": 5,
        "expected_signal": "A comprehensive verdict for each host, linking the initial Run-command paste to the persistence and history clearing.",
        "success_criteria": "A final verdict of malicious | suspicious | benign per host."
      },
      "parents": [
        {
          "id": "new-scheduled-tasks",
          "kind": "merge"
        },
        {
          "id": "powershell-history-tampering",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "The follow-on-triage verdict is malicious or suspicious for at least one host.",
        "condition": "The follow-on-triage verdict is malicious or suspicious for at least one host.",
        "blind_spot": "limited-retention-windows",
        "confidence": "high",
        "description": "Route the hunt based on the agent's final decision.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "follow-on-triage"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate compromised host",
      "config": {
        "target": "endpoint",
        "description": "Prevent further data exfiltration and potential secondary payload deployment by isolating the affected host.",
        "instructions": "Isolate the host from the network. Collect the suspicious PowerShell history file and any binaries referenced in the scheduled tasks for analysis.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-manual-review",
      "type": "task",
      "label": "Review and secret rotation",
      "config": {
        "assignee": "analyst",
        "description": "Final analyst confirmation and follow-on remediation steps.",
        "instructions": "Review the rows cited by the agents. If malicious, perform a full secret rotation including M365 session tokens, passwords, and SSH keys. Review Microsoft 365 Unified Audit Logs for the affected user during the lookback period."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out hunt",
      "config": {
        "assignee": "analyst",
        "description": "Record findings and close the hunt.",
        "instructions": "Document the hosts examined. If no suspicious activity was found, record this as evidence of absence for the Amatera campaign in this estate."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}