{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Autonomous agents accelerate the speed of probing and exploitation; a negative result across internet-facing assets confirms that the organization is not currently being targeted by high-volume automated campaigns." }, "name": "Autonomous Perimeter Probing and Identity Abuse", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1566", "attack.t1133", "command and control", "impact", "initial access", "persistence" ], "series": { "slug": "one-breach-please-and-make-no-mistakes", "index": 1, "title": "One breach, please, and make no mistakes", "total": 2 }, "related": [ { "hunt": "lateral-movement-by-autonomous-agents", "reason": "Once an agentic swarm gains access, it communicates internally and moves laterally, requiring internal network and process analysis.", "relation": "follows" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A single WAF rule might block a specific user agent or SQLi string, but this hunt correlates the volumetric perimeter probing with host-level process behavior and simultaneous pressure on the identity layer (MFA fatigue), which traditional single-surface rules cannot associate.", "coverage": [ { "stage": "exploit-public-facing-app", "steps": [ "high-volume-bot-probing", "suspicious-web-children" ], "status": "covered" }, { "stage": "identity-access-phishing", "steps": [ "identity-mfa-fatigue" ], "status": "covered" }, { "stage": "persistence-and-traversal", "reason": "Belongs to another part of the 'One breach, please, and make no mistakes' series.", "status": "out_of_scope" }, { "stage": "c2-dns-beaconing", "reason": "Belongs to another part of the 'One breach, please, and make no mistakes' series.", "status": "out_of_scope" }, { "stage": "exfiltration-and-impact", "reason": "Belongs to another part of the 'One breach, please, and make no mistakes' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Exploitation of Public-Facing Applications", "slug": "exploit-public-facing-app", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "High volume of SQL injection attempts", "Requests from Python, curl, or wget user agents", "Spike in WAF alerts", "Automated traffic hitting unpatched vulnerabilities" ] }, { "name": "Identity Access and Phishing", "slug": "identity-access-phishing", "tactic": "initial-access", "techniques": [ "T1566", "T1133" ], "observables": [ "Phishing invoices sent at volume", "HR onboarding requests for fabricated identities", "MFA prompt-bombing (push/SMS fatigue)", "VPN access attempts with valid credentials" ] }, { "name": "Internal Persistence and Traversal", "slug": "persistence-and-traversal", "tactic": "persistence", "techniques": [ "T1133" ], "observables": [ "Malicious Group Policy Object (GPO) deployment", "Active Directory modifications", "Spike in east-west network traffic", "Rapid rotation of stolen credentials", "Worm-like traversal through internal segments" ] }, { "name": "Application Layer C2", "slug": "c2-dns-beaconing", "tactic": "command-and-control", "techniques": [ "T1071" ], "observables": [ "DNS beaconing for command-and-control", "Anomalous DNS query volume", "Traffic to external infrastructure used for agent coordination" ] }, { "name": "Data Exfiltration and Impact", "slug": "exfiltration-and-impact", "tactic": "impact", "techniques": [ "T1486" ], "observables": [ "Theft of AI model weights", "Theft of customer data", "Encryption of local and remote drives", "Spam and package stuffing on public repositories (e.g., RubyGems)" ] } ], "summary": "Autonomous AI agent swarms automate and compress the attack lifecycle into hours, utilizing high-volume automated probing, phishing, and vulnerability exploitation. Once inside, the agents adapt in real-time to traverse the network via Active Directory and DNS-based command-and-control to exfiltrate AI model weights or encrypt data." }, "severity": "high", "rationale": "Start with internet-facing web servers and DMZ hosts. If the estate is large, narrow the hunt to hosts reporting critical vulnerabilities in hb_vulnerability_finding.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An automated swarm of AI agents is relentlessly probing public-facing applications for vulnerabilities while simultaneously attempting to fatigue employees with MFA prompts to secure initial access.", "parameters": { "probing_ips": { "from": { "ref": "analyst-entry", "kind": "manual" }, "type": "list[ip]", "default": [], "description": "Source IPs identified in the first step to correlate with identity fatigue." }, "scope_hosts": { "from": { "ref": "analyst-entry", "kind": "manual" }, "type": "list[host]", "default": [], "description": "Hostnames identified in the scoping query to focus the process behavior analysis." }, "lookback_days": { "from": { "ref": "talos-agentic-threats", "kind": "article", "observed": "2026-10-07" }, "type": "number", "default": "7", "description": "Days of history to examine for automated probing spikes." }, "bot_ua_fragment": { "from": { "ref": "talos-agentic-threats", "kind": "article", "observed": "2026-10-07" }, "type": "string", "default": "%python%", "description": "SQL LIKE fragment to identify automated tool user agents." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://blog.talosintelligence.com/one-breach-please-and-make-no-mistakes/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://blog.talosintelligence.com/one-breach-please-and-make-no-mistakes/", "name": "Talos \u2014 One breach, please, and make no mistakes" } ], "blind_spots": [ { "id": "no-identity-telemetry", "risk": "A coordination between probing and identity pressure would be invisible if the identity provider is not reporting to the lake.", "stage": "identity-access-phishing", "question": "whether the probing IPs targeted users on platforms not currently enrolled in the sign-in surface", "requires": "hb_auth_signin with MFA failure details from all SSO providers" }, { "id": "encrypted-payload-blindness", "risk": "Volumetric probing is seen, but the intent (e.g., SQLi vs. directory traversal) may be obscured if the payload resides only in the request body.", "stage": "exploit-public-facing-app", "question": "whether specific SQL injection or exploit payloads were present in the HTTP POST body", "requires": "Decrypted HTTP body inspection in hb_http_activity" } ] }, "name": "Autonomous Perimeter Probing and Identity Abuse", "description": "This hunt identifies the early 'noisy' phase of an agentic attack by detecting volumetric HTTP probing from non-browser user agents such as Python, curl, or wget. It then fans out to evaluate the behavior of web server processes on those targeted hosts and checks for concurrent MFA fatigue indicators originating from the same source infrastructure. An agent weighs these signals to distinguish between background internet noise and a coordinated, multi-stage autonomous campaign targeting both the organization's perimeter and its identity layer." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "one-breach-please-and-make-no-mistakes", "index": 1, "title": "One breach, please, and make no mistakes", "total": 2 }, "coverage": [ { "stage": "exploit-public-facing-app", "steps": [ "high-volume-bot-probing", "suspicious-web-children" ], "status": "covered" }, { "stage": "identity-access-phishing", "steps": [ "identity-mfa-fatigue" ], "status": "covered" }, { "stage": "persistence-and-traversal", "reason": "Belongs to another part of the 'One breach, please, and make no mistakes' series.", "status": "out_of_scope" }, { "stage": "c2-dns-beaconing", "reason": "Belongs to another part of the 'One breach, please, and make no mistakes' series.", "status": "out_of_scope" }, { "stage": "exfiltration-and-impact", "reason": "Belongs to another part of the 'One breach, please, and make no mistakes' series.", "status": "out_of_scope" } ], "rationale": "An automated swarm of AI agents is relentlessly probing public-facing applications for vulnerabilities while simultaneously attempting to fatigue employees with MFA prompts to secure initial access.", "blind_spots": [ { "id": "no-identity-telemetry", "risk": "A coordination between probing and identity pressure would be invisible if the identity provider is not reporting to the lake.", "stage": "identity-access-phishing", "question": "whether the probing IPs targeted users on platforms not currently enrolled in the sign-in surface", "requires": "hb_auth_signin with MFA failure details from all SSO providers" }, { "id": "encrypted-payload-blindness", "risk": "Volumetric probing is seen, but the intent (e.g., SQLi vs. directory traversal) may be obscured if the payload resides only in the request body.", "stage": "exploit-public-facing-app", "question": "whether specific SQL injection or exploit payloads were present in the HTTP POST body", "requires": "Decrypted HTTP body inspection in hb_http_activity" } ], "scoping_notes": "Start with internet-facing web servers and DMZ hosts. If the estate is large, narrow the hunt to hosts reporting critical vulnerabilities in hb_vulnerability_finding.", "beyond_detection": "A single WAF rule might block a specific user agent or SQLi string, but this hunt correlates the volumetric perimeter probing with host-level process behavior and simultaneous pressure on the identity layer (MFA fatigue), which traditional single-surface rules cannot associate." } }, { "id": "high-volume-bot-probing", "type": "query", "label": "High-volume bot-like HTTP probing", "config": { "dsl": "sqlite", "role": "scoping", "source": "web", "content": "SELECT device_hostname, url_hostname, user_agent, src_endpoint_ip, COUNT(*) AS request_count, MIN(time) AS first_seen FROM hb_http_activity WHERE (LOWER(user_agent) LIKE '{{bot_ua_fragment}}' OR LOWER(user_agent) LIKE '%curl%' OR LOWER(user_agent) LIKE '%wget%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_hostname, user_agent, src_endpoint_ip HAVING request_count > 100 ORDER BY request_count DESC", "surface": "hb_http_activity", "description": "Identify hosts receiving excessive traffic from automated tools, which often precedes an agentic exploit attempt.", "expected_signal": "A list of hostnames and source IPs showing high-volume requests from non-browser tools. Silence means no such volumetric probing occurred from these toolsets." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "High-volume bot-like HTTP probing", "reads": [ "device_hostname", "url_hostname", "user_agent", "src_endpoint_ip", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, url_hostname, user_agent, src_endpoint_ip, COUNT(*) AS request_count, MIN(time) AS first_seen FROM hb_http_activity WHERE (LOWER(user_agent) LIKE '{{bot_ua_fragment}}' OR LOWER(user_agent) LIKE '%curl%' OR LOWER(user_agent) LIKE '%wget%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_hostname, user_agent, src_endpoint_ip HAVING request_count > 100 ORDER BY request_count DESC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A list of hostnames and source IPs showing high-volume requests from non-browser tools. Silence means no such volumetric probing occurred from these toolsets.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "user_agent" ], "rare_below": 3 }, "verified_at": "2026-10-08" } }, { "id": "suspicious-web-children", "type": "query", "label": "Suspicious child processes from web servers", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%httpd%' OR LOWER(parent_process_name) LIKE '%nginx%' OR LOWER(parent_process_name) LIKE '%w3wp%' OR LOWER(parent_process_name) LIKE '%tomcat%') AND (LOWER(process_name) IN ('cmd.exe', 'powershell.exe', 'sh', 'bash', 'whoami', 'id', 'curl', 'wget')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Find shells or discovery tools launched by web server processes on the probed hosts, indicating successful exploitation.", "expected_signal": "Shells or reconnaissance tools spawned by a web server. Silence indicates no obvious command execution followed the probing phase." }, "parents": [ { "id": "high-volume-bot-probing" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Suspicious child processes from web servers", "reads": [ "device_hostname", "process_name", "process_cmd_line", "parent_process_name", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%httpd%' OR LOWER(parent_process_name) LIKE '%nginx%' OR LOWER(parent_process_name) LIKE '%w3wp%' OR LOWER(parent_process_name) LIKE '%tomcat%') AND (LOWER(process_name) IN ('cmd.exe', 'powershell.exe', 'sh', 'bash', 'whoami', 'id', 'curl', 'wget')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Shells or reconnaissance tools spawned by a web server. Silence indicates no obvious command execution followed the probing phase.", "verified": "dry-run", "verified_at": "2026-10-08" } }, { "id": "identity-mfa-fatigue", "type": "query", "label": "Identify MFA fatigue from probing IPs", "config": { "dsl": "sqlite", "role": "triage", "source": "identity", "content": "SELECT actor_user_name, src_endpoint_ip, status_detail, COUNT(*) AS fail_count FROM hb_auth_signin WHERE status_id = 2 AND ('{{probing_ips}}' = '' OR instr(',' || '{{probing_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3 HAVING fail_count > 15 ORDER BY fail_count DESC", "surface": "hb_auth_signin", "description": "Determine if the same source infrastructure used for probing is also attacking the identity layer via MFA prompt bombing.", "expected_signal": "Spikes in authentication failures from the same IPs identified in the probing phase. Silence indicates the probing and identity attacks are not coordinated from the same source." }, "parents": [ { "id": "high-volume-bot-probing" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Identify MFA fatigue from probing IPs", "reads": [ "actor_user_name", "src_endpoint_ip", "status_detail", "status_id", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT actor_user_name, src_endpoint_ip, status_detail, COUNT(*) AS fail_count FROM hb_auth_signin WHERE status_id = 2 AND ('{{probing_ips}}' = '' OR instr(',' || '{{probing_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3 HAVING fail_count > 15 ORDER BY fail_count DESC", "silence": "not_evidence_of_absence", "expected": "Spikes in authentication failures from the same IPs identified in the probing phase. Silence indicates the probing and identity attacks are not coordinated from the same source.", "verified": "dry-run", "verified_at": "2026-10-08" } }, { "id": "agent-triage", "type": "analytic", "label": "Evaluate coordinated agentic behavior", "config": { "cite": "required", "tools": [ "endpoint", "identity", "web" ], "context": [ "high-volume-bot-probing", "suspicious-web-children", "identity-mfa-fatigue" ], "objective": "Determine if any host targeted in the probing phase shows suspicious process execution and if the same source IPs are responsible for MFA prompt-bombing patterns.", "description": "Analyze the HTTP traffic volume, subsequent process behavior, and identity-layer failures to determine if a coordinated swarm is active.", "max_iterations": 6, "expected_signal": "A per-host and per-IP verdict on whether the activity is malicious or benign.", "success_criteria": "A verdict of malicious, suspicious, or benign citing correlated rows across at least two surfaces." }, "parents": [ { "id": "suspicious-web-children", "kind": "merge" }, { "id": "identity-mfa-fatigue", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on agent verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the agent-triage verdict is malicious for at least one host or source IP", "condition": "the agent-triage verdict is malicious for at least one host or source IP", "blind_spot": "no-identity-telemetry", "confidence": "high", "description": "Route the findings to containment or further analyst review based on the triage results.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "agent-triage" } ] }, { "id": "isolate-target", "type": "action", "label": "Isolate host and revoke sessions", "config": { "target": "endpoint", "description": "Immediately contain the host to stop further exploitation by the swarm.", "instructions": "Isolate the endpoint and revoke any active sessions for users identified in the MFA fatigue triage.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-validation", "type": "task", "label": "Analyst validation and tuning", "config": { "assignee": "analyst", "description": "Manually review the evidence and tune bot user-agent fragments for future runs.", "instructions": "Review the cited rows. Verify if the volumetric probing aligns with a known vulnerability scan or a legitimate automated process. Update the bot_ua_fragment parameter if new agents were observed." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-target" } ] }, { "id": "close-out", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Finalize the findings and document any observed gaps in perimeter visibility.", "instructions": "Document the hosts targeted and whether any successful exploitation was suspected. Record any blind spots identified during the run." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-validation" } ] } ] }