{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "AI agents move data far faster than humans, rendering traditional manual monitoring ineffective; a negative result ensures that autonomous exfiltration is not occurring under the guise of AI productivity."
      },
      "name": "Autonomous AI Agent and Shadow AI Activity",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1090.003",
        "attack.t1071.001",
        "defense evasion",
        "execution",
        "exfiltration",
        "initial access"
      ],
      "related": [
        {
          "hunt": "prompt-injection-reconnaissance",
          "reason": "This hunt focuses on the behavioral footprint of AI agents, not the prompt injection techniques used to manipulate them.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A single rule might fire on a Tor connection, but this hunt correlates vulnerability state, proxy sign-ins, and machine-speed API counts across three different telemetry surfaces to detect novel 'synthetic insider' patterns.",
      "coverage": [
        {
          "stage": "initial-access-ai-assisted-exploitation",
          "steps": [
            "vulnerable-hosts",
            "proxy-sign-ins"
          ],
          "status": "covered"
        },
        {
          "stage": "defense-evasion-anonymization",
          "steps": [
            "tor-gateway-dns"
          ],
          "status": "covered"
        },
        {
          "stage": "execution-synthetic-insiders",
          "steps": [
            "superhuman-api-velocity"
          ],
          "status": "covered"
        },
        {
          "stage": "exfiltration-shadow-ai-prompts",
          "steps": [
            "shadow-ai-http-traffic"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "AI-Accelerated Initial Access",
            "slug": "initial-access-ai-assisted-exploitation",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "Exploitation of public-facing web applications or hypervisors",
              "Signs of identity fraud in sign-in events using AI-generated media",
              "Onboarding of fraudulent 'fake candidates' with legitimate internal access"
            ]
          },
          {
            "name": "Multi-hop Proxy Anonymization",
            "slug": "defense-evasion-anonymization",
            "tactic": "defense-evasion",
            "techniques": [
              "T1090.003"
            ],
            "observables": [
              "Network connections routed through chained proxies or Tor-gateways",
              "DNS lookups for .onion domains or known tor-to-web services",
              "Traffic masking origin of automated AI reconnaissance tools"
            ]
          },
          {
            "name": "AI Agent Post-Breach Activity",
            "slug": "execution-synthetic-insiders",
            "tactic": "execution",
            "observables": [
              "Autonomous AI agents executing system actions without human approval",
              "API activity from LLM integration keys moving data at superhuman velocity",
              "Synthetic insiders behaving like legitimate users but with excessive permissions"
            ]
          },
          {
            "name": "Exfiltration via Shadow AI",
            "slug": "exfiltration-shadow-ai-prompts",
            "tactic": "exfiltration",
            "observables": [
              "HTTP requests to unauthorized LLM providers (api.openai.com, anthropic.com)",
              "Pasting sensitive IP or PII into unapproved chat-based AI domains",
              "Large data uploads to unmonitored third-party AI infrastructure"
            ]
          }
        ],
        "summary": "Adversaries leverage AI-accelerated zero-day exploitation and automated hiring fraud to secure legitimate access to corporate environments. Once inside, they deploy autonomous AI agents as 'synthetic insiders' to move data at machine speed, exfiltrating sensitive intellectual property through unapproved shadow AI tools and LLM prompts over multi-hop proxy infrastructure."
      },
      "severity": "medium",
      "rationale": "Begin with internet-facing systems reporting critical vulnerabilities. The velocity query is most effective in cloud control-plane environments where automated agents reside.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is using AI-assisted exploitation or fraudulent identity onboarding to gain initial access, followed by the deployment of automated synthetic insiders that move data to unauthorized LLM providers at machine speed.",
      "parameters": {
        "ai_domains": {
          "from": {
            "ref": "proofpoint-ai-risks",
            "kind": "article",
            "observed": "2026-10-12"
          },
          "type": "list[domain]",
          "default": [
            "api.openai.com",
            "chatgpt.com",
            "anthropic.com",
            "claude.ai",
            "gemini.google.com",
            "perplexity.ai"
          ],
          "description": "Domains of third-party AI/LLM providers to monitor for shadow AI activity."
        },
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Specific hostnames to focus on; leave empty to hunt across the entire estate."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "proxy_gateways": {
          "from": {
            "ref": "common-tor-gateways",
            "kind": "manual",
            "observed": "2024-01-01"
          },
          "type": "list[domain]",
          "default": [
            "tor2web.org",
            "tor2web.info",
            "onion.pet",
            "onion.dog",
            "onion.ws"
          ],
          "description": "Known Tor-to-web gateways used to anonymize traffic."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.proofpoint.com/us/newsroom/news/hidden-ai-security-risks-threatening-businesses",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.proofpoint.com/us/newsroom/news/hidden-ai-security-risks-threatening-businesses",
          "name": "Proofpoint \u2014 The Hidden AI Security Risks Threatening Businesses"
        }
      ],
      "blind_spots": [
        {
          "id": "cloud-api-latency",
          "risk": "Cloud logging latency (e.g., CloudTrail) may allow an agent to finish exfiltrating data before the hunt can observe the velocity spikes.",
          "stage": "execution-synthetic-insiders",
          "question": "How quickly can we see the machine-speed actions of an AI agent?",
          "requires": "Real-time API auditing"
        },
        {
          "id": "tls-encryption",
          "risk": "Without TLS decryption, the hunt can see the destination and the size of the upload but cannot confirm the classification of the data.",
          "stage": "exfiltration-shadow-ai-prompts",
          "question": "What content was in the request body to the AI provider?",
          "requires": "Endpoint TLS decryption or HTTP inspection"
        }
      ]
    },
    "name": "Autonomous AI Agent and Shadow AI Activity",
    "description": "This hunt identifies the emergence of synthetic insiders and shadow AI usage. It follows a phased approach: first scoping internet-facing vulnerabilities and identifying multi-hop proxy evasion or proxy-based sign-ins. The second phase pivots to detect superhuman API velocity and data movement to unauthorized AI platforms. An agentic triage correlates early access indicators with behavioral exfiltration patterns to identify autonomous threats."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "initial-access-ai-assisted-exploitation",
            "steps": [
              "vulnerable-hosts",
              "proxy-sign-ins"
            ],
            "status": "covered"
          },
          {
            "stage": "defense-evasion-anonymization",
            "steps": [
              "tor-gateway-dns"
            ],
            "status": "covered"
          },
          {
            "stage": "execution-synthetic-insiders",
            "steps": [
              "superhuman-api-velocity"
            ],
            "status": "covered"
          },
          {
            "stage": "exfiltration-shadow-ai-prompts",
            "steps": [
              "shadow-ai-http-traffic"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary is using AI-assisted exploitation or fraudulent identity onboarding to gain initial access, followed by the deployment of automated synthetic insiders that move data to unauthorized LLM providers at machine speed.",
        "blind_spots": [
          {
            "id": "cloud-api-latency",
            "risk": "Cloud logging latency (e.g., CloudTrail) may allow an agent to finish exfiltrating data before the hunt can observe the velocity spikes.",
            "stage": "execution-synthetic-insiders",
            "question": "How quickly can we see the machine-speed actions of an AI agent?",
            "requires": "Real-time API auditing"
          },
          {
            "id": "tls-encryption",
            "risk": "Without TLS decryption, the hunt can see the destination and the size of the upload but cannot confirm the classification of the data.",
            "stage": "exfiltration-shadow-ai-prompts",
            "question": "What content was in the request body to the AI provider?",
            "requires": "Endpoint TLS decryption or HTTP inspection"
          }
        ],
        "scoping_notes": "Begin with internet-facing systems reporting critical vulnerabilities. The velocity query is most effective in cloud control-plane environments where automated agents reside.",
        "beyond_detection": "A single rule might fire on a Tor connection, but this hunt correlates vulnerability state, proxy sign-ins, and machine-speed API counts across three different telemetry surfaces to detect novel 'synthetic insider' patterns."
      }
    },
    {
      "id": "vulnerable-hosts",
      "type": "query",
      "label": "Identify vulnerable internet-facing assets",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_uid, resource_uid, cve_uid, severity, title FROM hb_vulnerability_finding WHERE severity_id >= 4 AND status != 'suppressed' ORDER BY severity_id DESC",
        "surface": "hb_vulnerability_finding",
        "description": "Scope the hunt to devices with high or critical vulnerabilities that are susceptible to initial access exploits.",
        "expected_signal": "A list of device UIDs and associated high-severity vulnerabilities. This step provides the context of exposure for the estate."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify vulnerable internet-facing assets",
        "reads": [
          "device_uid",
          "resource_uid",
          "cve_uid",
          "severity",
          "severity_id",
          "status",
          "title"
        ],
        "source": "hb_vulnerability_finding",
        "target": "endpoint",
        "content": "SELECT device_uid, resource_uid, cve_uid, severity, title FROM hb_vulnerability_finding WHERE severity_id >= 4 AND status != 'suppressed' ORDER BY severity_id DESC",
        "silence": "not_evidence_of_absence",
        "expected": "A list of device UIDs and associated high-severity vulnerabilities. This step provides the context of exposure for the estate.",
        "verified": "dry-run",
        "verified_at": "2026-10-16"
      }
    },
    {
      "id": "tor-gateway-dns",
      "type": "query",
      "label": "DNS lookups for Tor-to-web gateways",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT device_hostname, actor_user_name, query_hostname, process_name, COUNT(*) as lookup_count FROM hb_dns_activity WHERE (instr(',' || '{{proxy_gateways}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, actor_user_name, query_hostname, process_name",
        "surface": "hb_dns_activity",
        "description": "Identify hosts using gateways to mask their connection to dark web resources or C2 infrastructure.",
        "expected_signal": "Rare DNS queries for gateways like onion.pet. Silence proves no gateways were resolved during the window."
      },
      "parents": [
        {
          "id": "vulnerable-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "DNS lookups for Tor-to-web gateways",
        "reads": [
          "device_hostname",
          "actor_user_name",
          "query_hostname",
          "process_name",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, actor_user_name, query_hostname, process_name, COUNT(*) as lookup_count FROM hb_dns_activity WHERE (instr(',' || '{{proxy_gateways}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, actor_user_name, query_hostname, process_name",
        "silence": "evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Rare DNS queries for gateways like onion.pet. Silence proves no gateways were resolved during the window.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "query_hostname"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-16"
      }
    },
    {
      "id": "proxy-sign-ins",
      "type": "query",
      "label": "Proxy-based sign-in anomalies",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, src_location_country, device_hostname, is_proxy, status FROM hb_auth_signin WHERE is_proxy = 'true' AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_auth_signin",
        "description": "Identify users logging in via known anonymizers, suggesting bypass of location-based controls or identity fraud.",
        "expected_signal": "Successful logons where is_proxy is true. This marks potentially fraudulent identities or sessions."
      },
      "parents": [
        {
          "id": "vulnerable-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Proxy-based sign-in anomalies",
        "reads": [
          "actor_user_name",
          "src_endpoint_ip",
          "src_location_country",
          "device_hostname",
          "is_proxy",
          "status",
          "status_id",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, src_location_country, device_hostname, is_proxy, status FROM hb_auth_signin WHERE is_proxy = 'true' AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Successful logons where is_proxy is true. This marks potentially fraudulent identities or sessions.",
        "verified": "dry-run",
        "verified_at": "2026-10-16"
      }
    },
    {
      "id": "early-stage-triage",
      "type": "analytic",
      "label": "Evaluate access risk",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "web"
        ],
        "context": [
          "vulnerable-hosts",
          "tor-gateway-dns",
          "proxy-sign-ins"
        ],
        "objective": "Determine if vulnerabilities and proxy usage indicate a legitimate security incident or identity risk.",
        "description": "Determine if the scoped hosts and evasion indicators represent a credible threat beachhead.",
        "max_iterations": 3,
        "expected_signal": "A list of high-risk users and hosts to carry forward into behavioral analysis.",
        "success_criteria": "A per-host verdict of suspicious | benign citing specific vulnerabilities or proxy logons."
      },
      "parents": [
        {
          "id": "tor-gateway-dns",
          "kind": "merge"
        },
        {
          "id": "proxy-sign-ins",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "superhuman-api-velocity",
      "type": "query",
      "label": "Superhuman API activity velocity",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT actor_user_name, api_operation, strftime('%Y-%m-%d %H', time) AS hour, COUNT(*) as op_count FROM hb_cloud_api_activity WHERE time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, api_operation, hour HAVING op_count > 500 ORDER BY op_count DESC",
        "surface": "hb_cloud_api_activity",
        "description": "Find principals executing operations at a frequency that suggests automated AI agents rather than human users.",
        "expected_signal": "Users with hundreds of API calls in a single hour, indicating an automated synthetic insider."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Superhuman API activity velocity",
        "reads": [
          "actor_user_name",
          "api_operation",
          "time"
        ],
        "source": "hb_cloud_api_activity",
        "target": "endpoint",
        "content": "SELECT actor_user_name, api_operation, strftime('%Y-%m-%d %H', time) AS hour, COUNT(*) as op_count FROM hb_cloud_api_activity WHERE time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, api_operation, hour HAVING op_count > 500 ORDER BY op_count DESC",
        "silence": "not_evidence_of_absence",
        "expected": "Users with hundreds of API calls in a single hour, indicating an automated synthetic insider.",
        "verified": "dry-run",
        "verified_at": "2026-10-16"
      }
    },
    {
      "id": "shadow-ai-http-traffic",
      "type": "query",
      "label": "Shadow AI HTTP traffic",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "web",
        "content": "SELECT device_hostname, actor_user_name, url_hostname, url_path, http_method, request_body_len FROM hb_http_activity WHERE (instr(',' || '{{ai_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY request_body_len DESC",
        "surface": "hb_http_activity",
        "description": "Identify large data transfers to unauthorized third-party LLM providers.",
        "expected_signal": "Rows indicating significant uploads to OpenAI or Anthropic endpoints. Silence suggests no traffic to these specific domains."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Shadow AI HTTP traffic",
        "reads": [
          "device_hostname",
          "actor_user_name",
          "url_hostname",
          "url_path",
          "http_method",
          "request_body_len",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, actor_user_name, url_hostname, url_path, http_method, request_body_len FROM hb_http_activity WHERE (instr(',' || '{{ai_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY request_body_len DESC",
        "silence": "not_evidence_of_absence",
        "expected": "Rows indicating significant uploads to OpenAI or Anthropic endpoints. Silence suggests no traffic to these specific domains.",
        "verified": "dry-run",
        "verified_at": "2026-10-16"
      }
    },
    {
      "id": "follow-on-triage",
      "type": "analytic",
      "label": "Final behavioral triage",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "web"
        ],
        "context": [
          "early-stage-triage",
          "superhuman-api-velocity",
          "shadow-ai-http-traffic"
        ],
        "objective": "Determine if the identified principals are behaving as automated malicious agents and if exfiltration to AI providers has occurred.",
        "description": "Synthesize early access risk with automated behavioral patterns to confirm the presence of a malicious synthetic insider.",
        "max_iterations": 6,
        "expected_signal": "A detailed verdict linking proxy access to superhuman API activity or shadow AI exfiltration.",
        "success_criteria": "A verdict of malicious for principals that exhibit both anomalous access and automated behavioral patterns."
      },
      "parents": [
        {
          "id": "superhuman-api-velocity",
          "kind": "merge"
        },
        {
          "id": "shadow-ai-http-traffic",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the follow-on-triage verdict is malicious for at least one host or principal",
        "condition": "the follow-on-triage verdict is malicious for at least one host or principal",
        "blind_spot": "cloud-api-latency",
        "confidence": "high",
        "description": "Route to containment if the synthetic insider threat is confirmed.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "follow-on-triage"
        }
      ]
    },
    {
      "id": "isolate-and-revoke",
      "type": "action",
      "label": "Isolate host and revoke credentials",
      "config": {
        "target": "endpoint",
        "description": "Contain the autonomous threat by removing access and isolating the compromised endpoint.",
        "instructions": "Isolate the host and revoke all active cloud sessions and keys for the identified principal.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst review and confirmation",
      "config": {
        "assignee": "analyst",
        "description": "Review the superhuman activity logs and HTTP traffic to confirm exfiltrated content.",
        "instructions": "Examine the specific request bodies and API operations. Determine if the uploads contained PII or intellectual property."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-and-revoke"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Record results and document any required tuning for legitimate AI agents.",
        "instructions": "Document the incident and notify the data protection officer. If activity was legitimate, add the principal to the exclusion list for velocity monitoring."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-review"
        }
      ]
    }
  ]
}