{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "The Blinder Tunnel campaign targets critical infrastructure via engineers. Identifying staged execution-hijack files early prevents the establishment of persistent tunneling bridges."
      },
      "name": "Blinder Tunnel .csproj Hijacking and C2",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1574.002",
        "attack.t1041",
        "attack.t1572",
        "attack.t1195.002",
        "attack.t1566"
      ],
      "related": [
        {
          "hunt": "github-api-malware-delivery",
          "reason": "This hunt focuses on the .csproj infection chain; general GitHub abuse for delivery is a broader topic.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A standard rule might flag MSBuild, but this hunt connects staged binary renaming, rare execution from AppData, and GitHub C2 in a phased story that requires an analyst to weigh correlated evidence.",
      "coverage": [
        {
          "stage": "stage-t1041",
          "steps": [
            "github-api-c2"
          ],
          "status": "covered"
        },
        {
          "stage": "stage-t1190",
          "reason": "The campaign uses social engineering phishing lures rather than exploitation of public-facing applications.",
          "status": "out_of_scope"
        },
        {
          "stage": "stage-t1195-002",
          "reason": "Malicious code delivery occurs via a weaponized archive in phishing, not a hijacked software update stream.",
          "status": "out_of_scope"
        },
        {
          "stage": "stage-t1566",
          "reason": "Initial phishing delivery via email or external communication is not visible on the provided endpoint surfaces.",
          "status": "not_visible"
        },
        {
          "stage": "stage-t1572",
          "steps": [
            "chisel-execution"
          ],
          "status": "covered"
        },
        {
          "stage": "stage-t1574-002",
          "steps": [
            "msbuild-file-staging",
            "runtime-broker-prevalence"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "T1041",
            "slug": "stage-t1041",
            "tactic": "unknown",
            "techniques": [
              "T1041"
            ]
          },
          {
            "name": "T1190",
            "slug": "stage-t1190",
            "tactic": "unknown",
            "techniques": [
              "T1190"
            ]
          },
          {
            "name": "T1195.002",
            "slug": "stage-t1195-002",
            "tactic": "unknown",
            "techniques": [
              "T1195.002"
            ]
          },
          {
            "name": "T1566",
            "slug": "stage-t1566",
            "tactic": "unknown",
            "techniques": [
              "T1566"
            ]
          },
          {
            "name": "T1572",
            "slug": "stage-t1572",
            "tactic": "unknown",
            "techniques": [
              "T1572"
            ]
          },
          {
            "name": "T1574.002",
            "slug": "stage-t1574-002",
            "tactic": "unknown",
            "techniques": [
              "T1574.002"
            ]
          }
        ],
        "summary": "Blinder Tunnel Campaign Targets Iraqi Infrastructure"
      },
      "severity": "medium",
      "rationale": "Focus on servers and workstations with developer tools like Visual Studio or MSBuild. Widen if MSBuild activity is observed on hosts not labeled as developer workstations.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An intruder has delivered a weaponized Visual Studio project that uses MSBuild to stage malicious binaries into a local appdata path and initiate an AppDomainManager hijack for command-and-control.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Hosts identified in the scoping step; leave empty to hunt across the entire estate."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "github_domains": {
          "from": {
            "ref": "unit42-blinder-tunnel",
            "kind": "article",
            "observed": "2026-10-06"
          },
          "type": "list[domain]",
          "default": [
            "github.com",
            "api.github.com",
            "raw.githubusercontent.com"
          ],
          "description": "GitHub domains used for C2 communication and payload retrieval."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/",
          "name": "Unit 42 \u2014 Blinder Tunnel Campaign Targets Iraqi Infrastructure"
        }
      ],
      "blind_spots": [
        {
          "id": "config-content-visibility",
          "risk": "The hunt detects file creation but cannot verify malicious content without manual review.",
          "stage": "stage-t1574-002",
          "question": "Whether the config file contains the specific ETW-disabling XML tags",
          "requires": "Endpoint telemetry with file content inspection"
        },
        {
          "id": "github-api-uri",
          "risk": "GitHub is common in developer environments; without URI-level logs, process context is the only discriminator.",
          "stage": "stage-t1041",
          "question": "Whether GitHub connections target specific malicious repositories versus general usage",
          "requires": "Network proxy logs with full URI granularity"
        }
      ]
    },
    "name": "Blinder Tunnel .csproj Hijacking and C2",
    "description": "The adversary targets software engineers with weaponized Visual Studio projects to gain a foothold in critical infrastructure. This hunt starts by finding developer workstations where MSBuild has been manipulated to create files in non-standard subdirectories of the Local AppData folder. It analyzes the execution of renamed binaries from these directories and correlates them with follow-on GitHub API traffic or Chisel tunneling. An agent weighs these phased results, and an analyst confirms the suppression of event tracing."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "stage-t1041",
            "steps": [
              "github-api-c2"
            ],
            "status": "covered"
          },
          {
            "stage": "stage-t1190",
            "reason": "The campaign uses social engineering phishing lures rather than exploitation of public-facing applications.",
            "status": "out_of_scope"
          },
          {
            "stage": "stage-t1195-002",
            "reason": "Malicious code delivery occurs via a weaponized archive in phishing, not a hijacked software update stream.",
            "status": "out_of_scope"
          },
          {
            "stage": "stage-t1566",
            "reason": "Initial phishing delivery via email or external communication is not visible on the provided endpoint surfaces.",
            "status": "not_visible"
          },
          {
            "stage": "stage-t1572",
            "steps": [
              "chisel-execution"
            ],
            "status": "covered"
          },
          {
            "stage": "stage-t1574-002",
            "steps": [
              "msbuild-file-staging",
              "runtime-broker-prevalence"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An intruder has delivered a weaponized Visual Studio project that uses MSBuild to stage malicious binaries into a local appdata path and initiate an AppDomainManager hijack for command-and-control.",
        "blind_spots": [
          {
            "id": "config-content-visibility",
            "risk": "The hunt detects file creation but cannot verify malicious content without manual review.",
            "stage": "stage-t1574-002",
            "question": "Whether the config file contains the specific ETW-disabling XML tags",
            "requires": "Endpoint telemetry with file content inspection"
          },
          {
            "id": "github-api-uri",
            "risk": "GitHub is common in developer environments; without URI-level logs, process context is the only discriminator.",
            "stage": "stage-t1041",
            "question": "Whether GitHub connections target specific malicious repositories versus general usage",
            "requires": "Network proxy logs with full URI granularity"
          }
        ],
        "scoping_notes": "Focus on servers and workstations with developer tools like Visual Studio or MSBuild. Widen if MSBuild activity is observed on hosts not labeled as developer workstations.",
        "beyond_detection": "A standard rule might flag MSBuild, but this hunt connects staged binary renaming, rare execution from AppData, and GitHub C2 in a phased story that requires an analyst to weigh correlated evidence."
      }
    },
    {
      "id": "developer-workstation-scoping",
      "type": "query",
      "label": "Identify developer workstations",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%visual studio%' OR LOWER(package_name) LIKE '%msbuild%'",
        "surface": "hb_software_inventory",
        "description": "Focus the hunt on hosts with Visual Studio or MSBuild, as these are the primary targets for weaponized project files.",
        "expected_signal": "A list of hostnames belonging to software engineers or developers. Silence means the estate lacks standard developer tooling."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify developer workstations",
        "reads": [
          "device_hostname",
          "package_name"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%visual studio%' OR LOWER(package_name) LIKE '%msbuild%'",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames belonging to software engineers or developers. Silence means the estate lacks standard developer tooling.",
        "verified": "dry-run",
        "verified_at": "2026-10-07"
      }
    },
    {
      "id": "msbuild-file-staging",
      "type": "query",
      "label": "MSBuild writing to AppData subfolders",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, file_path, process_name, time FROM hb_file_activity WHERE LOWER(process_name) LIKE '%msbuild.exe' AND LOWER(file_path) LIKE '%\\microsoft\\runtimebrokers\\%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_file_activity",
        "description": "Identify instances where msbuild.exe creates files in the non-standard RuntimeBrokers path as specified in the report.",
        "expected_signal": "Creation of RuntimeBroker.exe, RuntimeBroker.exe.config, or RuntimeBroker.dll in a local appdata folder by MSBuild."
      },
      "parents": [
        {
          "id": "developer-workstation-scoping"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "MSBuild writing to AppData subfolders",
        "reads": [
          "device_hostname",
          "file_path",
          "process_name",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, file_path, process_name, time FROM hb_file_activity WHERE LOWER(process_name) LIKE '%msbuild.exe' AND LOWER(file_path) LIKE '%\\microsoft\\runtimebrokers\\%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Creation of RuntimeBroker.exe, RuntimeBroker.exe.config, or RuntimeBroker.dll in a local appdata folder by MSBuild.",
        "verified": "dry-run",
        "verified_at": "2026-10-07"
      }
    },
    {
      "id": "runtime-broker-prevalence",
      "type": "query",
      "label": "Rare RuntimeBroker execution from AppData",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT process_path, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS run_count, MIN(time) AS first_seen FROM hb_process_activity WHERE LOWER(process_path) LIKE '%\\microsoft\\runtimebrokers\\runtimebroker.exe' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_path HAVING host_count <= 5 ORDER BY host_count ASC",
        "surface": "hb_process_activity",
        "description": "Identify the execution of RuntimeBroker.exe from the non-standard Local AppData path used by the hijack.",
        "expected_signal": "A binary named RuntimeBroker.exe running from a user's Local AppData folder. Silence suggests no such hijack has occurred."
      },
      "parents": [
        {
          "id": "developer-workstation-scoping"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare RuntimeBroker execution from AppData",
        "reads": [
          "device_hostname",
          "process_path",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT process_path, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS run_count, MIN(time) AS first_seen FROM hb_process_activity WHERE LOWER(process_path) LIKE '%\\microsoft\\runtimebrokers\\runtimebroker.exe' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_path HAVING host_count <= 5 ORDER BY host_count ASC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "A binary named RuntimeBroker.exe running from a user's Local AppData folder. Silence suggests no such hijack has occurred.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "process_path"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-10-07"
      }
    },
    {
      "id": "early-stage-triage",
      "type": "analytic",
      "label": "Early Stage Triage",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "msbuild-file-staging",
          "runtime-broker-prevalence"
        ],
        "objective": "Identify hosts where MSBuild staged files in the RuntimeBrokers path followed by execution of RuntimeBroker.exe from that same location.",
        "description": "Assess whether the MSBuild file creation and the rare RuntimeBroker execution on the same host indicate an active infection.",
        "max_iterations": 3,
        "expected_signal": "A verdict identifying hosts that show the initial Blinder Tunnel staging and execution chain.",
        "success_criteria": "A list of compromised hosts with a verdict of suspicious or malicious."
      },
      "parents": [
        {
          "id": "msbuild-file-staging",
          "kind": "merge"
        },
        {
          "id": "runtime-broker-prevalence",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "github-api-c2",
      "type": "query",
      "label": "Network connections to GitHub API",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "network",
        "content": "SELECT device_hostname, process_name, dst_endpoint_hostname, time FROM hb_network_connection WHERE (LOWER(process_path) LIKE '%\\microsoft\\runtimebrokers\\%' OR LOWER(process_name) = 'runtimebroker.exe') AND instr(',' || '{{github_domains}}' || ',', ',' || LOWER(dst_endpoint_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_network_connection",
        "description": "Identify process-led connections to GitHub domains from the suspected hijacked process.",
        "expected_signal": "The suspicious RuntimeBroker process communicating with GitHub API domains."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Network connections to GitHub API",
        "reads": [
          "device_hostname",
          "process_name",
          "dst_endpoint_hostname",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, process_name, dst_endpoint_hostname, time FROM hb_network_connection WHERE (LOWER(process_path) LIKE '%\\microsoft\\runtimebrokers\\%' OR LOWER(process_name) = 'runtimebroker.exe') AND instr(',' || '{{github_domains}}' || ',', ',' || LOWER(dst_endpoint_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "The suspicious RuntimeBroker process communicating with GitHub API domains.",
        "verified": "dry-run",
        "verified_at": "2026-10-07"
      }
    },
    {
      "id": "chisel-execution",
      "type": "query",
      "label": "Chisel execution and command lines",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_path, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%chisel%' OR LOWER(process_cmd_line) LIKE '%chisel%' OR LOWER(process_cmd_line) LIKE '%client %:% %R:%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Search for the open-source Chisel tunneling tool used for persistent access.",
        "expected_signal": "Processes executing with Chisel-specific tunneling arguments. Silence means no active tunneling bridge was observed."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Chisel execution and command lines",
        "reads": [
          "device_hostname",
          "process_path",
          "process_cmd_line",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_path, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%chisel%' OR LOWER(process_cmd_line) LIKE '%chisel%' OR LOWER(process_cmd_line) LIKE '%client %:% %R:%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Processes executing with Chisel-specific tunneling arguments. Silence means no active tunneling bridge was observed.",
        "verified": "dry-run",
        "verified_at": "2026-10-07"
      }
    },
    {
      "id": "follow-on-triage",
      "type": "analytic",
      "label": "Follow-on Analysis",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "early-stage-triage",
          "github-api-c2",
          "chisel-execution"
        ],
        "objective": "Determine if hosts with suspicious RuntimeBroker execution also exhibit GitHub-based C2 or Chisel tunneling.",
        "description": "Connect the early execution evidence with follow-on network activity to provide a definitive verdict.",
        "max_iterations": 5,
        "expected_signal": "A final verdict for every targeted host that incorporates the full attack chain.",
        "success_criteria": "A verdict of malicious citing the progression from staging to network persistence."
      },
      "parents": [
        {
          "id": "github-api-c2",
          "kind": "merge"
        },
        {
          "id": "chisel-execution",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the follow-on-triage verdict is malicious for at least one host",
        "condition": "the follow-on-triage verdict is malicious for at least one host",
        "blind_spot": "config-content-visibility",
        "confidence": "high",
        "description": "Automate response for confirmed intrusions while routing ambiguous cases to an analyst.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "follow-on-triage"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate host",
      "config": {
        "target": "endpoint",
        "description": "Isolate the compromised developer workstation to stop C2 and lateral movement.",
        "instructions": "Isolate the identified host. Collect contents of the %LOCALAPPDATA%\\Microsoft\\RuntimeBrokers directory for analysis.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "remediation-review",
      "type": "task",
      "label": "Remediation and analyst review",
      "config": {
        "assignee": "analyst",
        "description": "Human review of agent reasoning and cited evidence.",
        "instructions": "Review cited rows. Confirm presence of RuntimeBroker.exe.config and verify if the etwEnable flag is disabled. Examine user downloads for Dubai Airport recruitment archives."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Record findings and close the hunt.",
        "instructions": "Document hosts examined, results of file/process checks, and any evidence of C2 activity."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "remediation-review"
        }
      ]
    }
  ]
}