---
analysis: A single rule might catch the password spray, but this hunt correlates the
  external spray with framework artifacts (AUTHORIZATION.md) and subsequent high-impact
  behaviors like document tampering on the same hosts.
blind_spots:
- id: limited-cloud-logging
  question: whether unauthenticated writes were logged for specific document buckets
  requires: CloudTrail Data Events or equivalent for specific storage buckets
  risk: A stealthy document modification via an unauthenticated endpoint might not
    appear in management-plane logs.
  stage: data-retrieval-and-document-modification
- id: missing-auth-file-history
  question: if the AUTHORIZATION.md file was created and subsequently deleted by the
    agent
  requires: EDR file creation event persistence
  risk: If file-creation events have short retention, a long-running autonomous operation
    might leave no trace of its initial setup.
  stage: web-shell-and-agent-deployment
coverage:
- stage: autonomous-recon-and-credential-spraying
  status: covered
  steps:
  - scope-exposed-services
  - auth-signin-spray
- stage: web-shell-and-agent-deployment
  status: covered
  steps:
  - cairn-artifact-detection
- stage: unauthorized-account-creation
  status: covered
  steps:
  - admin-account-persistence
- stage: data-retrieval-and-document-modification
  status: covered
  steps:
  - cloud-document-tampering
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: keep-as-periodic-hunt
  justification: The rise of autonomous agent frameworks like Cairn allows attackers
    to conduct rapid, end-to-end intrusions with minimal human intervention. Detecting
    the early stages of these automated loops is essential to prevent large-scale
    data theft or document tampering.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An autonomous AI agent is conducting an end-to-end intrusion, starting
  with credential spraying and proceeding to deploy framework artifacts like AUTHORIZATION.md
  before creating persistent admin accounts and tampering with cloud storage.
labels:
- hunt
- attack.t1110.003
- attack.t1190
- attack.t1133
- attack.t1505.003
- attack.t1565
- impact
- initial access
- persistence
name: Autonomous Cairn AI Framework Exploitation
parameters:
  breached_users:
    default: []
    description: User accounts flagged in early-stage triage for follow-on persistence
      checks.
    from:
      kind: manual
      observed: '2024-11-12'
      ref: analyst-defined
    type: list[string]
  cairn_egress_ips:
    default:
    - 82.29.129.54
    - 154.44.31.4
    description: Known Cairn controller and egress staging nodes.
    from:
      kind: article
      observed: '2026-11-12'
      ref: unit42-cairn-2026
    type: list[ip]
  lookback_days:
    default: '14'
    description: Days of history to examine.
    from:
      kind: manual
      observed: '2024-11-12'
      ref: default
    type: number
  scope_hosts:
    default: []
    description: Specific hostnames identified in the scoping step to focus on; leave
      empty to scan the entire estate.
    from:
      kind: manual
      observed: '2024-11-12'
      ref: analyst-defined
    type: list[host]
  scope_ips:
    default: []
    description: Source IPs flagged in the early-stage triage to focus follow-on hunting.
    from:
      kind: manual
      observed: '2024-11-12'
      ref: analyst-defined
    type: list[ip]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/
    gates:
    - dry-run
    - lint
    model: hb_google/gemini-3-flash-preview
rationale: Focus on internet-facing application servers and VPN gateways. Widen to
  internal systems if AUTHORIZATION.md is detected on any perimeter host.
references:
- name: "Unit 42 \u2014 Attackers Use Autonomous AI to Target Semiconductor, Defense\
    \ and Civil Society Sectors"
  url: https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/
related:
- hunt: mcp-server-git-remote
  reason: Another autonomous agent technique involving Model Context Protocol (MCP)
    servers.
  relation: sibling
scenario:
  stages:
  - name: Autonomous Recon and Credential Spraying
    observables:
    - 'IP: 82.29.129.54'
    - Weak-password spraying against internet-facing application servers
    - Autonomous enumeration of root domains
    - Targeted use of VPN gateway addresses and group passwords
    slug: autonomous-recon-and-credential-spraying
    tactic: initial-access
    techniques:
    - T1110.003
    - T1190
    - T1133
  - name: Web Shell and Agent Deployment
    observables:
    - Deployment of webshells
    - 'File creation: AUTHORIZATION.md'
    - Presence of 'AIScan Runner Skills' logic (skill pack)
    slug: web-shell-and-agent-deployment
    tactic: persistence
    techniques:
    - T1505.003
  - name: Unauthorized Account Creation
    observables:
    - Creation of persistent administrator accounts in production systems
    slug: unauthorized-account-creation
    tactic: persistence
    techniques:
    - T1133
  - name: Data Retrieval and Document Modification
    observables:
    - Modification of live industry standards-ballot document files
    - Mass exposure of personal data records (exceeding 1M records)
    - Retrieval of military and government identities
    - Unauthenticated cloud-storage writes
    slug: data-retrieval-and-document-modification
    tactic: impact
    techniques:
    - T1565
  summary: The China-nexus actor CL-STA-1238 used the open-source Cairn AI agent framework
    to autonomously conduct multi-stage operations against semiconductor, defense,
    and civil society targets. These autonomous agents mapped attack surfaces, performed
    password spraying, exploited web applications, and achieved persistence through
    web shells and unauthorized administrator account creation.
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  identity:
    category: identity
    name: Identity / sign-in telemetry
    telemetry:
    - identity
tlp: clear
type: investigation
---


# Autonomous Cairn AI Framework Exploitation

This hunt identifies the multi-stage behavior of the Cairn AI agentic framework. It first identifies anomalous shell processes on web and VPN infrastructure, then searches for early indicators of agent activity: password spraying and the framework-specific AUTHORIZATION.md file. Finally, the hunt pivots to identify unauthorized administrator account creation and suspicious modifications to cloud-stored documents linked to the initial breach entities.

## scope-exposed-services
<!-- Search for anomalous web/VPN child processes -->
Identify web or VPN servers exhibiting behavioral signs of exploitation, such as shells spawned by service processes.

```sqlite target=endpoint role=scoping params=(scope_hosts=scope_hosts, lookback_days=lookback_days)
~~~yaml
expected: A list of hostnames and processes where a service has spawned a shell or
  interpreter. Silence indicates no such common shell-spawn behavior was observed
  on scoped hosts.
reads:
- device_hostname
- parent_process_name
- process_cmd_line
- process_name
- time
silence: not_evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-11-13'
~~~
SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%http%' OR LOWER(parent_process_name) LIKE '%nginx%' OR LOWER(parent_process_name) LIKE '%apache%' OR LOWER(parent_process_name) LIKE '%vpn%') AND (LOWER(process_name) IN ('cmd.exe', 'powershell.exe', 'sh', 'bash', 'zsh', 'python', 'perl', 'php')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## early-indicators-parallel
<!-- Parallel search for early agent indicators -->
parallel:
- → auth-signin-spray
- → cairn-artifact-detection
join: → early-stage-triage

## auth-signin-spray
<!-- Credential spraying from known and anomalous IPs -->
Detect the initial credential access attempts performed by the framework, broadening the search to any source IP showing spray patterns.

```sqlite target=identity role=baseline params=(cairn_egress_ips=cairn_egress_ips, lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
baseline:
  compare: new_this_window
  window: '{{lookback_days}}d'
expected: Source IPs attempting multiple users or matching report indicators. High
  distinct_users count suggests a spray.
prevalence:
  by: actor_user_name
  key:
  - src_endpoint_ip
  rare_below: 5
reads:
- actor_user_name
- device_hostname
- src_endpoint_ip
- status
- time
silence: evidence_of_absence
source: hb_auth_signin
verified: dry-run
verified_at: '2026-11-13'
~~~
SELECT src_endpoint_ip, COUNT(DISTINCT actor_user_name) AS distinct_users, device_hostname, status, MAX(time) AS last_attempt FROM hb_auth_signin WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip, device_hostname, status HAVING distinct_users > 5 OR (instr(',' || '{{cairn_egress_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0)
```

## cairn-artifact-detection
<!-- Detection of AUTHORIZATION.md -->
Find the unique evidence-gathering file created by the Cairn framework on compromised systems.

```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: Creation of this specific filename. Silence suggests the framework has not
  established a presence on these hosts using this artifact.
reads:
- device_hostname
- file_name
- file_path
- process_name
- time
silence: not_evidence_of_absence
source: hb_file_activity
verified: dry-run
verified_at: '2026-11-13'
~~~
SELECT device_hostname, file_path, file_name, process_name, time FROM hb_file_activity WHERE LOWER(file_name) = 'authorization.md' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## early-stage-triage
<!-- Analyze early access indicators -->
```agent target=hunter
cite: required
context:
- scope-exposed-services
- auth-signin-spray
- cairn-artifact-detection
max_iterations: 3
objective: Determine if any host shows evidence of a credential spray or shell activity
  followed by the creation of an AUTHORIZATION.md file.
success_criteria: Per-host verdict citing specific IPs, shell processes, and file
  paths.
tools:
- endpoint
- identity
```

## admin-account-persistence
<!-- Anomalous administrator account creation -->
Detect the creation of persistent admin accounts occurring on flagged hosts or by flagged users.

```sqlite target=endpoint role=triage params=(lookback_days=lookback_days, scope_hosts=scope_hosts, breached_users=breached_users)
~~~yaml
expected: A new account with administrative keywords created in the window on a host
  flagged earlier.
reads:
- activity_id
- actor_user_name
- device_hostname
- time
- user_name
silence: not_evidence_of_absence
source: hb_account_change
verified: dry-run
verified_at: '2026-11-13'
~~~
SELECT device_hostname, user_name, actor_user_name, time FROM hb_account_change WHERE activity_id = 1 AND (LOWER(user_name) LIKE '%admin%' OR LOWER(user_name) LIKE '%svc%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND ('{{breached_users}}' = '' OR instr(',' || '{{breached_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## cloud-document-tampering
<!-- Restricted cloud storage document writes -->
Identify document modifications in cloud storage specifically originating from the IPs or users flagged in the earlier stages.

```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days, scope_ips=scope_ips, breached_users=breached_users)
~~~yaml
expected: A cloud storage write to a document resource originating from a flagged
  entity. Silence indicates no document-level storage writes occurred via these actors.
reads:
- actor_user_name
- api_operation
- api_service_name
- cloud_account_uid
- resource_uid
- src_endpoint_ip
- time
silence: evidence_of_absence
source: hb_cloud_api_activity
verified: dry-run
verified_at: '2026-11-13'
~~~
SELECT cloud_account_uid, api_operation, resource_uid, actor_user_name, src_endpoint_ip, time FROM hb_cloud_api_activity WHERE (LOWER(api_service_name) LIKE '%s3%' OR LOWER(api_service_name) LIKE '%storage%') AND (LOWER(resource_uid) LIKE '%.docx' OR LOWER(resource_uid) LIKE '%.pdf' OR LOWER(resource_uid) LIKE '%.xlsx') AND (api_operation LIKE '%Put%' OR api_operation LIKE '%Write%') AND ('{{scope_ips}}' = '' OR instr(',' || '{{scope_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) AND ('{{breached_users}}' = '' OR instr(',' || '{{breached_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## follow-on-triage
<!-- Synthesize full attack chain -->
```agent target=hunter
cite: required
context:
- early-stage-triage
- admin-account-persistence
- cloud-document-tampering
max_iterations: 4
objective: Correlate early-stage breach entities with persistence events to confirm
  an active intrusion chain.
success_criteria: A verdict of malicious if the chain is complete for any host or
  cloud account.
tools:
- endpoint
- identity
```

## route-on-verdict
<!-- Route on verdict -->
if~: "the follow-on triage verdict is malicious for at least one host or cloud tenant" (confidence: high, judge=hunter)
then: → isolate-compromised-host
indeterminate: → analyst-incident-review
unavailable: → analyst-incident-review (blind_spot: limited-cloud-logging)
else: → hunt-closure

## isolate-compromised-host
<!-- Isolate host and revoke credentials -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the affected host, revoke any newly created administrator credentials, and restore document versions from cloud storage backups.
```
→ analyst-incident-review

## analyst-incident-review
<!-- Analyst incident review -->
```manual target=analyst
Review the findings for false positives (e.g., authorized security testing). Document the full timeline of the agent's actions.
```
→ hunt-closure

## hunt-closure
<!-- Hunt closure -->
```manual target=analyst
Record what was found, tune the egress IP list, and update the scoping parameters for future runs.
```
→ end