{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The rise of autonomous agent frameworks like Cairn allows attackers to conduct rapid, end-to-end intrusions with minimal human intervention. Detecting the early stages of these automated loops is essential to prevent large-scale data theft or document tampering." }, "name": "Autonomous Cairn AI Framework Exploitation", "type": "investigation", "labels": [ "hunt", "attack.t1110.003", "attack.t1190", "attack.t1133", "attack.t1505.003", "attack.t1565", "impact", "initial access", "persistence" ], "related": [ { "hunt": "mcp-server-git-remote", "reason": "Another autonomous agent technique involving Model Context Protocol (MCP) servers.", "relation": "sibling" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A single rule might catch the password spray, but this hunt correlates the external spray with framework artifacts (AUTHORIZATION.md) and subsequent high-impact behaviors like document tampering on the same hosts.", "coverage": [ { "stage": "autonomous-recon-and-credential-spraying", "steps": [ "scope-exposed-services", "auth-signin-spray" ], "status": "covered" }, { "stage": "web-shell-and-agent-deployment", "steps": [ "cairn-artifact-detection" ], "status": "covered" }, { "stage": "unauthorized-account-creation", "steps": [ "admin-account-persistence" ], "status": "covered" }, { "stage": "data-retrieval-and-document-modification", "steps": [ "cloud-document-tampering" ], "status": "covered" } ], "scenario": { "stages": [ { "name": "Autonomous Recon and Credential Spraying", "slug": "autonomous-recon-and-credential-spraying", "tactic": "initial-access", "techniques": [ "T1110.003", "T1190", "T1133" ], "observables": [ "IP: 82.29.129.54", "Weak-password spraying against internet-facing application servers", "Autonomous enumeration of root domains", "Targeted use of VPN gateway addresses and group passwords" ] }, { "name": "Web Shell and Agent Deployment", "slug": "web-shell-and-agent-deployment", "tactic": "persistence", "techniques": [ "T1505.003" ], "observables": [ "Deployment of webshells", "File creation: AUTHORIZATION.md", "Presence of 'AIScan Runner Skills' logic (skill pack)" ] }, { "name": "Unauthorized Account Creation", "slug": "unauthorized-account-creation", "tactic": "persistence", "techniques": [ "T1133" ], "observables": [ "Creation of persistent administrator accounts in production systems" ] }, { "name": "Data Retrieval and Document Modification", "slug": "data-retrieval-and-document-modification", "tactic": "impact", "techniques": [ "T1565" ], "observables": [ "Modification of live industry standards-ballot document files", "Mass exposure of personal data records (exceeding 1M records)", "Retrieval of military and government identities", "Unauthenticated cloud-storage writes" ] } ], "summary": "The China-nexus actor CL-STA-1238 used the open-source Cairn AI agent framework to autonomously conduct multi-stage operations against semiconductor, defense, and civil society targets. These autonomous agents mapped attack surfaces, performed password spraying, exploited web applications, and achieved persistence through web shells and unauthorized administrator account creation." }, "severity": "high", "rationale": "Focus on internet-facing application servers and VPN gateways. Widen to internal systems if AUTHORIZATION.md is detected on any perimeter host.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An autonomous AI agent is conducting an end-to-end intrusion, starting with credential spraying and proceeding to deploy framework artifacts like AUTHORIZATION.md before creating persistent admin accounts and tampering with cloud storage.", "parameters": { "scope_ips": { "from": { "ref": "analyst-defined", "kind": "manual", "observed": "2024-11-12" }, "type": "list[ip]", "default": [], "description": "Source IPs flagged in the early-stage triage to focus follow-on hunting." }, "scope_hosts": { "from": { "ref": "analyst-defined", "kind": "manual", "observed": "2024-11-12" }, "type": "list[host]", "default": [], "description": "Specific hostnames identified in the scoping step to focus on; leave empty to scan the entire estate." }, "lookback_days": { "from": { "ref": "default", "kind": "manual", "observed": "2024-11-12" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "breached_users": { "from": { "ref": "analyst-defined", "kind": "manual", "observed": "2024-11-12" }, "type": "list[string]", "default": [], "description": "User accounts flagged in early-stage triage for follow-on persistence checks." }, "cairn_egress_ips": { "from": { "ref": "unit42-cairn-2026", "kind": "article", "observed": "2026-11-12" }, "type": "list[ip]", "default": [ "82.29.129.54", "154.44.31.4" ], "description": "Known Cairn controller and egress staging nodes." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/", "name": "Unit 42 \u2014 Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors" } ], "blind_spots": [ { "id": "limited-cloud-logging", "risk": "A stealthy document modification via an unauthenticated endpoint might not appear in management-plane logs.", "stage": "data-retrieval-and-document-modification", "question": "whether unauthenticated writes were logged for specific document buckets", "requires": "CloudTrail Data Events or equivalent for specific storage buckets" }, { "id": "missing-auth-file-history", "risk": "If file-creation events have short retention, a long-running autonomous operation might leave no trace of its initial setup.", "stage": "web-shell-and-agent-deployment", "question": "if the AUTHORIZATION.md file was created and subsequently deleted by the agent", "requires": "EDR file creation event persistence" } ] }, "name": "Autonomous Cairn AI Framework Exploitation", "description": "This hunt identifies the multi-stage behavior of the Cairn AI agentic framework. It first identifies anomalous shell processes on web and VPN infrastructure, then searches for early indicators of agent activity: password spraying and the framework-specific AUTHORIZATION.md file. Finally, the hunt pivots to identify unauthorized administrator account creation and suspicious modifications to cloud-stored documents linked to the initial breach entities." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "coverage": [ { "stage": "autonomous-recon-and-credential-spraying", "steps": [ "scope-exposed-services", "auth-signin-spray" ], "status": "covered" }, { "stage": "web-shell-and-agent-deployment", "steps": [ "cairn-artifact-detection" ], "status": "covered" }, { "stage": "unauthorized-account-creation", "steps": [ "admin-account-persistence" ], "status": "covered" }, { "stage": "data-retrieval-and-document-modification", "steps": [ "cloud-document-tampering" ], "status": "covered" } ], "rationale": "An autonomous AI agent is conducting an end-to-end intrusion, starting with credential spraying and proceeding to deploy framework artifacts like AUTHORIZATION.md before creating persistent admin accounts and tampering with cloud storage.", "blind_spots": [ { "id": "limited-cloud-logging", "risk": "A stealthy document modification via an unauthenticated endpoint might not appear in management-plane logs.", "stage": "data-retrieval-and-document-modification", "question": "whether unauthenticated writes were logged for specific document buckets", "requires": "CloudTrail Data Events or equivalent for specific storage buckets" }, { "id": "missing-auth-file-history", "risk": "If file-creation events have short retention, a long-running autonomous operation might leave no trace of its initial setup.", "stage": "web-shell-and-agent-deployment", "question": "if the AUTHORIZATION.md file was created and subsequently deleted by the agent", "requires": "EDR file creation event persistence" } ], "scoping_notes": "Focus on internet-facing application servers and VPN gateways. Widen to internal systems if AUTHORIZATION.md is detected on any perimeter host.", "beyond_detection": "A single rule might catch the password spray, but this hunt correlates the external spray with framework artifacts (AUTHORIZATION.md) and subsequent high-impact behaviors like document tampering on the same hosts." } }, { "id": "scope-exposed-services", "type": "query", "label": "Search for anomalous web/VPN child processes", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%http%' OR LOWER(parent_process_name) LIKE '%nginx%' OR LOWER(parent_process_name) LIKE '%apache%' OR LOWER(parent_process_name) LIKE '%vpn%') AND (LOWER(process_name) IN ('cmd.exe', 'powershell.exe', 'sh', 'bash', 'zsh', 'python', 'perl', 'php')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify web or VPN servers exhibiting behavioral signs of exploitation, such as shells spawned by service processes.", "expected_signal": "A list of hostnames and processes where a service has spawned a shell or interpreter. Silence indicates no such common shell-spawn behavior was observed on scoped hosts." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Search for anomalous web/VPN child processes", "reads": [ "device_hostname", "parent_process_name", "process_cmd_line", "process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%http%' OR LOWER(parent_process_name) LIKE '%nginx%' OR LOWER(parent_process_name) LIKE '%apache%' OR LOWER(parent_process_name) LIKE '%vpn%') AND (LOWER(process_name) IN ('cmd.exe', 'powershell.exe', 'sh', 'bash', 'zsh', 'python', 'perl', 'php')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A list of hostnames and processes where a service has spawned a shell or interpreter. Silence indicates no such common shell-spawn behavior was observed on scoped hosts.", "verified": "dry-run", "verified_at": "2026-11-13" } }, { "id": "auth-signin-spray", "type": "query", "label": "Credential spraying from known and anomalous IPs", "config": { "dsl": "sqlite", "role": "baseline", "source": "identity", "content": "SELECT src_endpoint_ip, COUNT(DISTINCT actor_user_name) AS distinct_users, device_hostname, status, MAX(time) AS last_attempt FROM hb_auth_signin WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip, device_hostname, status HAVING distinct_users > 5 OR (instr(',' || '{{cairn_egress_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0)", "surface": "hb_auth_signin", "description": "Detect the initial credential access attempts performed by the framework, broadening the search to any source IP showing spray patterns.", "expected_signal": "Source IPs attempting multiple users or matching report indicators. High distinct_users count suggests a spray." }, "parents": [ { "id": "scope-exposed-services" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Credential spraying from known and anomalous IPs", "reads": [ "actor_user_name", "device_hostname", "src_endpoint_ip", "status", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT src_endpoint_ip, COUNT(DISTINCT actor_user_name) AS distinct_users, device_hostname, status, MAX(time) AS last_attempt FROM hb_auth_signin WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip, device_hostname, status HAVING distinct_users > 5 OR (instr(',' || '{{cairn_egress_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0)", "silence": "evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "new_this_window" }, "expected": "Source IPs attempting multiple users or matching report indicators. High distinct_users count suggests a spray.", "verified": "dry-run", "prevalence": { "by": "actor_user_name", "key": [ "src_endpoint_ip" ], "rare_below": 5 }, "verified_at": "2026-11-13" } }, { "id": "cairn-artifact-detection", "type": "query", "label": "Detection of AUTHORIZATION.md", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, file_path, file_name, process_name, time FROM hb_file_activity WHERE LOWER(file_name) = 'authorization.md' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Find the unique evidence-gathering file created by the Cairn framework on compromised systems.", "expected_signal": "Creation of this specific filename. Silence suggests the framework has not established a presence on these hosts using this artifact." }, "parents": [ { "id": "scope-exposed-services" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Detection of AUTHORIZATION.md", "reads": [ "device_hostname", "file_name", "file_path", "process_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_path, file_name, process_name, time FROM hb_file_activity WHERE LOWER(file_name) = 'authorization.md' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Creation of this specific filename. Silence suggests the framework has not established a presence on these hosts using this artifact.", "verified": "dry-run", "verified_at": "2026-11-13" } }, { "id": "early-stage-triage", "type": "analytic", "label": "Analyze early access indicators", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "scope-exposed-services", "auth-signin-spray", "cairn-artifact-detection" ], "objective": "Determine if any host shows evidence of a credential spray or shell activity followed by the creation of an AUTHORIZATION.md file.", "description": "Weight the correlation between shell processes, external spraying, and local framework artifacts to identify a likely breach.", "max_iterations": 3, "expected_signal": "A list of hosts and source IPs showing evidence of agentic intrusion.", "success_criteria": "Per-host verdict citing specific IPs, shell processes, and file paths." }, "parents": [ { "id": "auth-signin-spray", "kind": "merge" }, { "id": "cairn-artifact-detection", "kind": "merge" } ] }, { "id": "admin-account-persistence", "type": "query", "label": "Anomalous administrator account creation", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, user_name, actor_user_name, time FROM hb_account_change WHERE activity_id = 1 AND (LOWER(user_name) LIKE '%admin%' OR LOWER(user_name) LIKE '%svc%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND ('{{breached_users}}' = '' OR instr(',' || '{{breached_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_account_change", "description": "Detect the creation of persistent admin accounts occurring on flagged hosts or by flagged users.", "expected_signal": "A new account with administrative keywords created in the window on a host flagged earlier." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Anomalous administrator account creation", "reads": [ "activity_id", "actor_user_name", "device_hostname", "time", "user_name" ], "source": "hb_account_change", "target": "endpoint", "content": "SELECT device_hostname, user_name, actor_user_name, time FROM hb_account_change WHERE activity_id = 1 AND (LOWER(user_name) LIKE '%admin%' OR LOWER(user_name) LIKE '%svc%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND ('{{breached_users}}' = '' OR instr(',' || '{{breached_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A new account with administrative keywords created in the window on a host flagged earlier.", "verified": "dry-run", "verified_at": "2026-11-13" } }, { "id": "cloud-document-tampering", "type": "query", "label": "Restricted cloud storage document writes", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT cloud_account_uid, api_operation, resource_uid, actor_user_name, src_endpoint_ip, time FROM hb_cloud_api_activity WHERE (LOWER(api_service_name) LIKE '%s3%' OR LOWER(api_service_name) LIKE '%storage%') AND (LOWER(resource_uid) LIKE '%.docx' OR LOWER(resource_uid) LIKE '%.pdf' OR LOWER(resource_uid) LIKE '%.xlsx') AND (api_operation LIKE '%Put%' OR api_operation LIKE '%Write%') AND ('{{scope_ips}}' = '' OR instr(',' || '{{scope_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) AND ('{{breached_users}}' = '' OR instr(',' || '{{breached_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_cloud_api_activity", "description": "Identify document modifications in cloud storage specifically originating from the IPs or users flagged in the earlier stages.", "expected_signal": "A cloud storage write to a document resource originating from a flagged entity. Silence indicates no document-level storage writes occurred via these actors." }, "parents": [ { "id": "admin-account-persistence" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Restricted cloud storage document writes", "reads": [ "actor_user_name", "api_operation", "api_service_name", "cloud_account_uid", "resource_uid", "src_endpoint_ip", "time" ], "source": "hb_cloud_api_activity", "target": "endpoint", "content": "SELECT cloud_account_uid, api_operation, resource_uid, actor_user_name, src_endpoint_ip, time FROM hb_cloud_api_activity WHERE (LOWER(api_service_name) LIKE '%s3%' OR LOWER(api_service_name) LIKE '%storage%') AND (LOWER(resource_uid) LIKE '%.docx' OR LOWER(resource_uid) LIKE '%.pdf' OR LOWER(resource_uid) LIKE '%.xlsx') AND (api_operation LIKE '%Put%' OR api_operation LIKE '%Write%') AND ('{{scope_ips}}' = '' OR instr(',' || '{{scope_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) AND ('{{breached_users}}' = '' OR instr(',' || '{{breached_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "A cloud storage write to a document resource originating from a flagged entity. Silence indicates no document-level storage writes occurred via these actors.", "verified": "dry-run", "verified_at": "2026-11-13" } }, { "id": "follow-on-triage", "type": "analytic", "label": "Synthesize full attack chain", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "early-stage-triage", "admin-account-persistence", "cloud-document-tampering" ], "objective": "Correlate early-stage breach entities with persistence events to confirm an active intrusion chain.", "description": "Connect early breach evidence with confirmed persistence and impact to reach a final verdict.", "max_iterations": 4, "expected_signal": "A high-fidelity verdict on the presence of an autonomous intruder.", "success_criteria": "A verdict of malicious if the chain is complete for any host or cloud account." }, "parents": [ { "id": "cloud-document-tampering" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the follow-on triage verdict is malicious for at least one host or cloud tenant", "condition": "the follow-on triage verdict is malicious for at least one host or cloud tenant", "blind_spot": "limited-cloud-logging", "confidence": "high", "description": "Act on confirmed autonomous activity or route for manual review.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "follow-on-triage" } ] }, { "id": "isolate-compromised-host", "type": "action", "label": "Isolate host and revoke credentials", "config": { "target": "endpoint", "description": "Contain the autonomous agent by cutting off its host access and revoking the accounts it created.", "instructions": "Isolate the affected host, revoke any newly created administrator credentials, and restore document versions from cloud storage backups.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-incident-review", "type": "task", "label": "Analyst incident review", "config": { "assignee": "analyst", "description": "Final validation of findings and tuning of scoped parameters.", "instructions": "Review the findings for false positives (e.g., authorized security testing). Document the full timeline of the agent's actions." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-compromised-host" } ] }, { "id": "hunt-closure", "type": "task", "label": "Hunt closure", "config": { "assignee": "analyst", "description": "Final record keeping.", "instructions": "Record what was found, tune the egress IP list, and update the scoping parameters for future runs." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-incident-review" } ] } ] }