{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "AI agents compress the attack timeline from weeks to hours; identifying the behavioral loop of an autonomous agent is the only way to stop a breach before it reaches the secrets management or pipeline layers."
      },
      "name": "Automated Service Infiltration and Data Harvesting",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1046",
        "attack.t1552.001",
        "attack.t1078"
      ],
      "series": {
        "slug": "an-ai-assisted-cyber-attack-inside-a-unit-42-investigation",
        "index": 1,
        "title": "An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation",
        "total": 2
      },
      "related": [
        {
          "hunt": "secrets-manager-takeover",
          "reason": "This hunt identifies the beachhead and credential harvesting; the next stage is the abuse of harvested secrets to escalate privileges.",
          "relation": "follows"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A standard detection rule might flag a single exploit; this hunt pivots between infrastructure exposure, specific AI-orchestration filesystem artifacts, and bursty network patterns to confirm an autonomous intrusion loop.",
      "coverage": [
        {
          "stage": "web-service-breach-and-mapping",
          "steps": [
            "scope-web-services",
            "detect-bursty-recon"
          ],
          "status": "covered"
        },
        {
          "stage": "repository-secrets-harvesting",
          "steps": [
            "detect-agent-orchestration-files",
            "analyze-artifacts"
          ],
          "status": "covered"
        },
        {
          "stage": "secrets-manager-takeover",
          "reason": "Belongs to another part of the 'An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "cicd-pipeline-exploitation",
          "reason": "Belongs to another part of the 'An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "ai-infrastructure-hijacking",
          "reason": "Belongs to another part of the 'An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Public Web Service Breach and Automated Recon",
            "slug": "web-service-breach-and-mapping",
            "tactic": "initial-access",
            "techniques": [
              "T1190",
              "T1046",
              "T0000",
              "T0002"
            ],
            "observables": [
              "Publicly accessible web service breach",
              "Automated recon agent mapping internal microservices",
              "Service discovery tool execution",
              "Bursty API requests",
              "Structured Markdown files for inter-agent communication"
            ]
          },
          {
            "name": "Enterprise Repository Secrets Harvesting",
            "slug": "repository-secrets-harvesting",
            "tactic": "credential-access",
            "techniques": [
              "T1552.001",
              "T0014"
            ],
            "observables": [
              "Code scraping across enterprise repositories",
              "Extraction of hard-coded tokens and service passwords",
              "Presence of Python caches and paired asset folders",
              "Markdown files containing harvested metadata"
            ]
          },
          {
            "name": "Secrets Manager Privilege Escalation",
            "slug": "secrets-manager-takeover",
            "tactic": "privilege-escalation",
            "techniques": [
              "T1555",
              "T0016"
            ],
            "observables": [
              "Infiltration of secrets management system using stolen tokens",
              "Harvesting of master administrative credentials",
              "Parallel authentications from single identities",
              "Rapid 401/200 HTTP state shifts during access attempts"
            ]
          },
          {
            "name": "DevOps Pipeline Hijacking",
            "slug": "cicd-pipeline-exploitation",
            "tactic": "persistence",
            "techniques": [
              "T1578",
              "T0010"
            ],
            "observables": [
              "Unauthorized CI/CD build triggers",
              "Execution of custom workflows in code applications",
              "Attempts to modify Terraform configurations",
              "Exfiltration of cloud access keys via pipeline actions"
            ]
          },
          {
            "name": "AI Infrastructure Post-Compromise Abuse",
            "slug": "ai-infrastructure-hijacking",
            "tactic": "impact",
            "techniques": [
              "T1078",
              "T0043"
            ],
            "observables": [
              "LLM calls to multiple frontier AI agents in parallel",
              "Invocation of cloud AI models via stolen API keys",
              "Bursty model usage from unexpected identities",
              "AI endpoints used as post-compromise orchestration infrastructure"
            ]
          }
        ],
        "summary": "An attacker used autonomous AI agents to compress weeks of intrusion tradecraft into a 10-hour campaign, breaching a web service to map the internal network and harvest secrets. The agents then escalated privileges through a secrets manager to hijack CI/CD pipelines and repurpose enterprise AI infrastructure for post-compromise operations."
      },
      "severity": "high",
      "rationale": "The hunt begins by identifying hosts with web service packages. Focus investigation on those that show bursty HTTP traffic or localized Python artifacts, which are typical for agentic AI intrusions.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An intruder is using autonomous AI agents to breach public web services and map internal microservices while harvesting credentials, leaving behind unique filesystem artifacts and high-frequency network recon patterns.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "List of hostnames to focus on after the scoping step; leave empty to search the entire estate."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "agent_indicators": {
          "from": {
            "ref": "unit42-ai-attack",
            "kind": "article",
            "observed": "2026-09-02"
          },
          "type": "list[string]",
          "default": [
            "plan.md",
            "task.md",
            "agent.md",
            "report.md"
          ],
          "description": "Filenames typically used by agentic AI frameworks for inter-session context passing."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/",
          "name": "Unit 42 \u2014 An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation"
        }
      ],
      "blind_spots": [
        {
          "id": "inventory-lag",
          "risk": "Snapshot-based software inventory may miss transient or newly spawned containers used as entry points.",
          "stage": "web-service-breach-and-mapping",
          "question": "whether a newly deployed container is missing from the scoping query",
          "requires": "hb_software_inventory with real-time updates",
          "remediation": "Implement continuous container image scanning and real-time inventory updates."
        },
        {
          "id": "log-truncation",
          "risk": "If HTTP logs are truncated or if mapping occurs over non-standard ports not logged by proxies, the bursty recon signal will be incomplete.",
          "stage": "web-service-breach-and-mapping",
          "question": "whether the agent successfully mapped specific internal microservices",
          "requires": "hb_http_activity with full url_path and headers",
          "remediation": "Ensure full URL logging is enabled for all internal API traffic."
        }
      ]
    },
    "name": "Automated Service Infiltration and Data Harvesting",
    "description": "This hunt focuses on the initial infiltration and mapping stages of an AI-agentic attack. It begins by scoping the attack surface to hosts running common web service packages. It then searches for the behavioral indicators of AI orchestration: the creation of structured Markdown communication files and rapid Python cache generation. Simultaneously, it identifies automated internal reconnaissance by searching for bursty HTTP traffic patterns. An agent then weighs these findings to identify the beachhead and the extent of the internal mapping."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "an-ai-assisted-cyber-attack-inside-a-unit-42-investigation",
          "index": 1,
          "title": "An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation",
          "total": 2
        },
        "coverage": [
          {
            "stage": "web-service-breach-and-mapping",
            "steps": [
              "scope-web-services",
              "detect-bursty-recon"
            ],
            "status": "covered"
          },
          {
            "stage": "repository-secrets-harvesting",
            "steps": [
              "detect-agent-orchestration-files",
              "analyze-artifacts"
            ],
            "status": "covered"
          },
          {
            "stage": "secrets-manager-takeover",
            "reason": "Belongs to another part of the 'An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "cicd-pipeline-exploitation",
            "reason": "Belongs to another part of the 'An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "ai-infrastructure-hijacking",
            "reason": "Belongs to another part of the 'An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An intruder is using autonomous AI agents to breach public web services and map internal microservices while harvesting credentials, leaving behind unique filesystem artifacts and high-frequency network recon patterns.",
        "blind_spots": [
          {
            "id": "inventory-lag",
            "risk": "Snapshot-based software inventory may miss transient or newly spawned containers used as entry points.",
            "stage": "web-service-breach-and-mapping",
            "question": "whether a newly deployed container is missing from the scoping query",
            "requires": "hb_software_inventory with real-time updates",
            "remediation": "Implement continuous container image scanning and real-time inventory updates."
          },
          {
            "id": "log-truncation",
            "risk": "If HTTP logs are truncated or if mapping occurs over non-standard ports not logged by proxies, the bursty recon signal will be incomplete.",
            "stage": "web-service-breach-and-mapping",
            "question": "whether the agent successfully mapped specific internal microservices",
            "requires": "hb_http_activity with full url_path and headers",
            "remediation": "Ensure full URL logging is enabled for all internal API traffic."
          }
        ],
        "scoping_notes": "The hunt begins by identifying hosts with web service packages. Focus investigation on those that show bursty HTTP traffic or localized Python artifacts, which are typical for agentic AI intrusions.",
        "beyond_detection": "A standard detection rule might flag a single exploit; this hunt pivots between infrastructure exposure, specific AI-orchestration filesystem artifacts, and bursty network patterns to confirm an autonomous intrusion loop."
      }
    },
    {
      "id": "scope-web-services",
      "type": "query",
      "label": "Scope web service attack surface",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%nginx%' OR LOWER(package_name) LIKE '%apache%' OR LOWER(package_name) LIKE '%httpd%' OR LOWER(package_name) LIKE '%tomcat%' OR LOWER(package_name) LIKE '%api%')",
        "surface": "hb_software_inventory",
        "description": "Identify hosts running web server software that represent the primary entry point for the reported infiltration.",
        "expected_signal": "A list of hostnames running web or API services. Absence means no such packages are installed via tracked package managers."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Scope web service attack surface",
        "reads": [
          "device_hostname",
          "package_name"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%nginx%' OR LOWER(package_name) LIKE '%apache%' OR LOWER(package_name) LIKE '%httpd%' OR LOWER(package_name) LIKE '%tomcat%' OR LOWER(package_name) LIKE '%api%')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames running web or API services. Absence means no such packages are installed via tracked package managers.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "detect-agent-orchestration-files",
      "type": "query",
      "label": "Detect agent orchestration files",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT device_hostname, file_name, file_path, time FROM hb_file_activity WHERE (instr(',' || '{{agent_indicators}}' || ',', ',' || LOWER(file_name) || ',') > 0 OR (LOWER(file_path) LIKE '%__pycache__%' AND LOWER(file_path) NOT LIKE '%\\\\usr\\\\lib\\\\%' AND LOWER(file_path) NOT LIKE '%\\\\windows\\\\%')) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) ORDER BY time DESC",
        "surface": "hb_file_activity",
        "description": "Identify the creation of Markdown reports or Python caches used by agents to pass information between sessions.",
        "expected_signal": "Specific Markdown filenames or localized Python cache directories created on web-facing hosts. Rare files across the fleet are more suspicious."
      },
      "parents": [
        {
          "id": "scope-web-services"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Detect agent orchestration files",
        "reads": [
          "device_hostname",
          "file_name",
          "file_path",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, file_name, file_path, time FROM hb_file_activity WHERE (instr(',' || '{{agent_indicators}}' || ',', ',' || LOWER(file_name) || ',') > 0 OR (LOWER(file_path) LIKE '%__pycache__%' AND LOWER(file_path) NOT LIKE '%\\\\usr\\\\lib\\\\%' AND LOWER(file_path) NOT LIKE '%\\\\windows\\\\%')) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) ORDER BY time DESC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Specific Markdown filenames or localized Python cache directories created on web-facing hosts. Rare files across the fleet are more suspicious.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "file_name"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "detect-bursty-recon",
      "type": "query",
      "label": "Detect bursty internal reconnaissance",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "web",
        "content": "SELECT device_hostname, src_endpoint_ip, COUNT(*) AS request_count, COUNT(DISTINCT url_path) AS path_diversity, MIN(time) AS first_request, MAX(time) AS last_request FROM hb_http_activity WHERE time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, src_endpoint_ip HAVING request_count > 500 ORDER BY request_count DESC",
        "surface": "hb_http_activity",
        "description": "Identify high-volume internal HTTP activity that indicates an automated microservice mapping agent.",
        "expected_signal": "A high count of requests from a single source to many different paths in a short window. Silence suggests no automated web scanning occurred within the logs."
      },
      "parents": [
        {
          "id": "scope-web-services"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Detect bursty internal reconnaissance",
        "reads": [
          "device_hostname",
          "src_endpoint_ip",
          "url_path",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, src_endpoint_ip, COUNT(*) AS request_count, COUNT(DISTINCT url_path) AS path_diversity, MIN(time) AS first_request, MAX(time) AS last_request FROM hb_http_activity WHERE time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, src_endpoint_ip HAVING request_count > 500 ORDER BY request_count DESC",
        "silence": "not_evidence_of_absence",
        "expected": "A high count of requests from a single source to many different paths in a short window. Silence suggests no automated web scanning occurred within the logs.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "triage-agent-signals",
      "type": "analytic",
      "label": "Triage AI agent signals",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "web"
        ],
        "context": [
          "detect-agent-orchestration-files",
          "detect-bursty-recon"
        ],
        "objective": "Determine if the bursty HTTP traffic and Markdown context files together represent an autonomous AI agent breach on the scoped hosts.",
        "description": "Analyze whether the combination of exposed web services, orchestration files, and bursty traffic confirms an AI-driven intrusion.",
        "max_iterations": 4,
        "expected_signal": "A confirmed verdict identifying which hosts are compromised by an AI agent.",
        "success_criteria": "A verdict of malicious, suspicious, or benign per host with cited rows."
      },
      "parents": [
        {
          "id": "detect-agent-orchestration-files",
          "kind": "merge"
        },
        {
          "id": "detect-bursty-recon",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on triage verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage-agent-signals verdict is malicious for at least one host",
        "condition": "the triage-agent-signals verdict is malicious for at least one host",
        "blind_spot": "log-truncation",
        "confidence": "high",
        "description": "Direct the hunt based on the agent's findings.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-agent-signals"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate compromised host",
      "config": {
        "target": "endpoint",
        "description": "Stop the automated agent loop by severing its network connectivity and access to repositories.",
        "instructions": "Isolate the identified host immediately to stop the autonomous agent from further internal mapping or secrets extraction.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyze-artifacts",
      "type": "task",
      "label": "Analyze agent artifacts",
      "config": {
        "assignee": "analyst",
        "description": "Examine the content of identified Markdown files to determine what has been mapped or stolen.",
        "instructions": "Review the content of the .md files and Python cache directories found in the filesystem step; look for lists of internal IPs, extracted tokens, or service discovery summaries."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Hunt close out",
      "config": {
        "assignee": "analyst",
        "description": "Document findings and determine if follow-on hunts for secrets manager takeover are required.",
        "instructions": "Record the scoped hosts and findings. If credentials were found in the analyzed artifacts, trigger the 'Secrets Manager Takeover' follow-on hunt."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyze-artifacts"
        }
      ]
    }
  ]
}