{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Exploiting unpatched client-side and kernel-mode vulnerabilities are primary vectors for initial access and privilege escalation. Confirming whether vulnerable software is present and actively being exploited is essential for risk prioritization." }, "name": "Client-side and Kernel Vulnerability Monitoring", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1203", "attack.t1574.001", "attack.t1068", "execution", "privilege escalation" ], "related": [ { "hunt": "unusual-dll-load-events", "reason": "Search path hijacking can also be detected by hb_module_activity, but that surface is higher volume.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single detection rule may flag the software version or the shell execution, but this hunt combines vulnerability exposure with fleet-wide behavioral baselining to distinguish legitimate installer activity from malicious hijacking.", "coverage": [ { "stage": "client-execution-foxit-pdf", "steps": [ "vulnerability-lead", "rare-suspicious-child-processes" ], "status": "covered" }, { "stage": "privilege-escalation-adobe-installer", "steps": [ "vulnerability-lead", "installer-dll-anomalies" ], "status": "covered" }, { "stage": "privilege-escalation-windows-kernel", "steps": [ "vulnerability-lead", "unusual-driver-activity" ], "status": "covered" } ], "scenario": { "stages": [ { "name": "Foxit Reader RCE via JavaScript", "slug": "client-execution-foxit-pdf", "tactic": "execution", "techniques": [ "T1203" ], "observables": [ "Foxit Reader version 2026.1.1.36485", "malformed PDF document", "JavaScript checkbox CBF_Widget operations", "Array object memory corruption" ] }, { "name": "Adobe Photoshop Installer Search Path Hijacking", "slug": "privilege-escalation-adobe-installer", "tactic": "privilege-escalation", "techniques": [ "T1574.001" ], "observables": [ "Photoshop_Set-Up.exe version 2.11.0.30", "malicious library file placement in installer directory", "CVE-2026-48388" ] }, { "name": "Windows Kernel Driver Exploitation", "slug": "privilege-escalation-windows-kernel", "tactic": "privilege-escalation", "techniques": [ "T1068" ], "observables": [ "netio.sys", "tcpip.sys", "Windows Cloud Files Mini Filter Driver version 10.0.26100.8457", "Cloud Filter API calls", "crafted I/O request packets (IRP)", "dedicated application to trigger driver vulnerability" ] } ], "summary": "This research details multiple critical vulnerabilities in Adobe Photoshop, Foxit Reader, and Windows kernel components that enable remote code execution and local privilege escalation. Attackers can exploit these flaws through malformed PDF files containing JavaScript, hijacked search paths during software installation, or crafted I/O request packets targeting system drivers." }, "severity": "high", "rationale": "Start with workstations running Foxit Reader and Adobe Photoshop. Focus on hosts identified by the lead query as having unpatched CVEs. Widen the scope to include any server running vulnerable Windows kernel builds if the driver behavioral query yields results.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "Adversaries are exploiting unpatched vulnerabilities in client applications like Foxit Reader and Adobe Photoshop, or Windows kernel drivers like netio.sys and tcpip.sys, to execute code or elevate privileges.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2026-10-07" }, "type": "list[host]", "default": [], "description": "List of hostnames to focus the behavioral investigation; defaults to all hosts if empty." }, "target_cves": { "from": { "ref": "talos-2026-10-07", "kind": "article", "observed": "2026-10-07" }, "type": "list[string]", "default": [ "CVE-2026-48388", "CVE-2026-49177", "CVE-2026-50475", "CVE-2026-57256", "CVE-2026-58613", "CVE-2026-80093", "CVE-2026-91799" ], "description": "List of CVE IDs from the Talos research paper." }, "lookback_days": { "from": { "ref": "standard-lookback", "kind": "manual", "observed": "2026-10-07" }, "type": "number", "default": "14", "description": "Days of history to examine for behavioral evidence." }, "target_drivers": { "from": { "ref": "talos-2026-10-07", "kind": "article", "observed": "2026-10-07" }, "type": "list[string]", "default": [ "netio.sys", "tcpip.sys", "cldflt.sys" ], "description": "System drivers named in the research to monitor for non-standard loads." }, "suspicious_interpreters": { "from": { "ref": "common-shells", "kind": "manual", "observed": "2026-10-07" }, "type": "list[string]", "default": [ "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "bash.exe", "python.exe" ], "description": "Common shells or interpreters often spawned during successful exploitation." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://blog.talosintelligence.com/microsoft-adobe-apple-and-foxit-vulnerabilities/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://blog.talosintelligence.com/microsoft-adobe-apple-and-foxit-vulnerabilities/", "name": "Cisco Talos \u2014 Microsoft, Adobe, Apple, and Foxit vulnerabilities" } ], "blind_spots": [ { "id": "missing-vulnerability-data", "risk": "A host may appear safe because of a stale scan, causing the gate to close prematurely.", "question": "whether a host is vulnerable if it has not been scanned recently", "requires": "hb_vulnerability_finding or hb_software_inventory" }, { "id": "kernel-irp-telemetry", "risk": "Kernel exploitation may occur without spawning new processes, making it invisible to process telemetry unless a driver is replaced.", "stage": "privilege-escalation-windows-kernel", "question": "whether malformed packets were sent to netio.sys or tcpip.sys", "requires": "Kernel-level IRP or API monitoring" }, { "id": "no-agent-coverage", "risk": "Gaps in agent deployment mean large portions of the estate are unmonitored for behavior.", "question": "whether exploitation is occurring on unmanaged devices", "requires": "Endpoint agent on all targeted OS versions" } ] }, "name": "Client-side and Kernel Vulnerability Monitoring", "description": "This hunt identifies potential exploitation of several 2026 vulnerabilities in Foxit Reader, Adobe Photoshop, and Windows kernel drivers. It uses a gated flow, first identifying hosts with known vulnerable versions before launching behavioral queries to find rare child processes, unauthorized DLL writes in installer paths, and system drivers loading from non-standard directories. By correlating vulnerability state with behavioral anomalies, the hunt distinguishes between general software presence and active exploitation attempts." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "coverage": [ { "stage": "client-execution-foxit-pdf", "steps": [ "vulnerability-lead", "rare-suspicious-child-processes" ], "status": "covered" }, { "stage": "privilege-escalation-adobe-installer", "steps": [ "vulnerability-lead", "installer-dll-anomalies" ], "status": "covered" }, { "stage": "privilege-escalation-windows-kernel", "steps": [ "vulnerability-lead", "unusual-driver-activity" ], "status": "covered" } ], "rationale": "Adversaries are exploiting unpatched vulnerabilities in client applications like Foxit Reader and Adobe Photoshop, or Windows kernel drivers like netio.sys and tcpip.sys, to execute code or elevate privileges.", "blind_spots": [ { "id": "missing-vulnerability-data", "risk": "A host may appear safe because of a stale scan, causing the gate to close prematurely.", "question": "whether a host is vulnerable if it has not been scanned recently", "requires": "hb_vulnerability_finding or hb_software_inventory" }, { "id": "kernel-irp-telemetry", "risk": "Kernel exploitation may occur without spawning new processes, making it invisible to process telemetry unless a driver is replaced.", "stage": "privilege-escalation-windows-kernel", "question": "whether malformed packets were sent to netio.sys or tcpip.sys", "requires": "Kernel-level IRP or API monitoring" }, { "id": "no-agent-coverage", "risk": "Gaps in agent deployment mean large portions of the estate are unmonitored for behavior.", "question": "whether exploitation is occurring on unmanaged devices", "requires": "Endpoint agent on all targeted OS versions" } ], "scoping_notes": "Start with workstations running Foxit Reader and Adobe Photoshop. Focus on hosts identified by the lead query as having unpatched CVEs. Widen the scope to include any server running vulnerable Windows kernel builds if the driver behavioral query yields results.", "beyond_detection": "A single detection rule may flag the software version or the shell execution, but this hunt combines vulnerability exposure with fleet-wide behavioral baselining to distinguish legitimate installer activity from malicious hijacking." } }, { "id": "vulnerability-lead", "type": "query", "label": "Vulnerable host scoping", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_uid, cve_uid, affected_package_name, affected_package_version, severity, status FROM hb_vulnerability_finding WHERE instr(',' || '{{target_cves}}' || ',', ',' || cve_uid || ',') > 0 AND status != 'suppressed'", "surface": "hb_vulnerability_finding", "description": "Identify hosts with active vulnerability findings for the CVEs mentioned in the research to justify further behavioral analysis.", "expected_signal": "A list of device_uids that currently possess the vulnerabilities. Silence means no known vulnerable software is reporting to the vulnerability surface." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Vulnerable host scoping", "reads": [ "device_uid", "cve_uid", "affected_package_name", "affected_package_version", "severity", "status" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT device_uid, cve_uid, affected_package_name, affected_package_version, severity, status FROM hb_vulnerability_finding WHERE instr(',' || '{{target_cves}}' || ',', ',' || cve_uid || ',') > 0 AND status != 'suppressed'", "silence": "not_evidence_of_absence", "expected": "A list of device_uids that currently possess the vulnerabilities. Silence means no known vulnerable software is reporting to the vulnerability surface.", "verified": "dry-run", "verified_at": "2026-10-08" } }, { "id": "gate-assessment", "type": "analytic", "label": "Assess vulnerability exposure", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "vulnerability-lead" ], "objective": "Determine if any enrolled hosts are at high risk due to the target CVEs.", "description": "Decide if the vulnerable host population is significant enough to open behavioral queries.", "max_iterations": 3, "expected_signal": "A summary of how many unique hosts are vulnerable and which CVEs are most prevalent.", "success_criteria": "A per-host vulnerability summary citing the scoping rows." }, "parents": [ { "id": "vulnerability-lead" } ] }, { "id": "exposure-gate", "type": "checkpoint", "label": "Gate on vulnerability presence", "config": { "fuzzy": true, "judge": "hunter", "question": "The gate-assessment indicates at least one host has an active, unsuppressed target CVE.", "condition": "The gate-assessment indicates at least one host has an active, unsuppressed target CVE.", "blind_spot": "missing-vulnerability-data", "confidence": "high", "description": "Conserve resources by only running behavioral queries if the environment is confirmed to be vulnerable.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "gate-assessment" } ] }, { "id": "rare-suspicious-child-processes", "type": "query", "label": "Rare suspicious child processes", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, parent_process_cmd_line, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%foxitreader.exe' OR LOWER(parent_process_name) LIKE '%photoshop_set-up.exe') AND (instr(',' || '{{suspicious_interpreters}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, process_name, process_cmd_line, parent_process_name, parent_process_cmd_line HAVING hosts < 3", "surface": "hb_process_activity", "description": "Detect shells or interpreters spawned by Foxit Reader or the Adobe installer that are rare across the fleet and help distinguish exploitation from legitimate activity.", "expected_signal": "Processes like cmd.exe appearing as children of Foxit Reader on very few hosts. Silence means no suspicious child processes were detected." }, "parents": [ { "id": "exposure-gate", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare suspicious child processes", "reads": [ "device_hostname", "process_name", "process_original_file_name", "process_cmd_line", "parent_process_name", "parent_process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, parent_process_cmd_line, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%foxitreader.exe' OR LOWER(parent_process_name) LIKE '%photoshop_set-up.exe') AND (instr(',' || '{{suspicious_interpreters}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, process_name, process_cmd_line, parent_process_name, parent_process_cmd_line HAVING hosts < 3", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Processes like cmd.exe appearing as children of Foxit Reader on very few hosts. Silence means no suspicious child processes were detected.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_name", "parent_process_name" ], "rare_below": 3 }, "verified_at": "2026-10-08" } }, { "id": "installer-dll-anomalies", "type": "query", "label": "Installer search-path DLL anomalies", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, file_path, file_name, activity_name, time FROM hb_file_activity WHERE LOWER(process_name) LIKE '%photoshop_set-up.exe' AND activity_id = 1 AND LOWER(file_name) LIKE '%.dll' AND LOWER(file_path) NOT LIKE '%\\\\appdata\\\\local\\\\temp\\\\%' AND LOWER(file_path) NOT LIKE '%\\\\windows\\\\temp\\\\%' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_file_activity", "description": "Detect DLL creation by the Adobe installer in unexpected locations, specifically targeting search-path hijacking (CVE-2026-48388).", "expected_signal": "DLL files created by the installer in its own directory or other non-temporary, user-writable locations. Silence indicates standard installer behavior." }, "parents": [ { "id": "exposure-gate", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Installer search-path DLL anomalies", "reads": [ "device_hostname", "process_name", "file_path", "file_name", "activity_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, file_path, file_name, activity_name, time FROM hb_file_activity WHERE LOWER(process_name) LIKE '%photoshop_set-up.exe' AND activity_id = 1 AND LOWER(file_name) LIKE '%.dll' AND LOWER(file_path) NOT LIKE '%\\\\appdata\\\\local\\\\temp\\\\%' AND LOWER(file_path) NOT LIKE '%\\\\windows\\\\temp\\\\%' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "DLL files created by the installer in its own directory or other non-temporary, user-writable locations. Silence indicates standard installer behavior.", "verified": "dry-run", "verified_at": "2026-10-08" } }, { "id": "unusual-driver-activity", "type": "query", "label": "Suspicious kernel driver load paths", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, module_name, module_path, module_signature_status, time FROM hb_module_activity WHERE instr(',' || '{{target_drivers}}' || ',', ',' || LOWER(module_name) || ',') > 0 AND LOWER(module_path) NOT LIKE 'c:\\\\windows\\\\system32\\\\drivers\\\\%' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_module_activity", "description": "Identify loads of sensitive system drivers from non-standard directories using hb_module_activity as a proxy for kernel-mode loads.", "expected_signal": "Sensitive system drivers loading from locations other than the standard drivers directory. Silence means these drivers are only loading from their expected paths." }, "parents": [ { "id": "exposure-gate", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Suspicious kernel driver load paths", "reads": [ "device_hostname", "module_name", "module_path", "module_signature_status", "time" ], "source": "hb_module_activity", "target": "endpoint", "content": "SELECT device_hostname, module_name, module_path, module_signature_status, time FROM hb_module_activity WHERE instr(',' || '{{target_drivers}}' || ',', ',' || LOWER(module_name) || ',') > 0 AND LOWER(module_path) NOT LIKE 'c:\\\\windows\\\\system32\\\\drivers\\\\%' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "Sensitive system drivers loading from locations other than the standard drivers directory. Silence means these drivers are only loading from their expected paths.", "verified": "dry-run", "verified_at": "2026-10-08" } }, { "id": "triage-verdict", "type": "analytic", "label": "Final evidence triage", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "gate-assessment", "rare-suspicious-child-processes", "installer-dll-anomalies", "unusual-driver-activity" ], "objective": "Determine if any vulnerable hosts show signs of successful exploitation based on rare child processes, DLL hijacking, or unusual kernel driver activity.", "description": "Correlate vulnerability presence with the findings across processes, files, and kernel drivers to provide a single verdict per host.", "max_iterations": 6, "expected_signal": "A per-host verdict of malicious, suspicious, or benign based on the combination of exposure and behavior.", "success_criteria": "A final verdict citing specific rows and the vulnerability status of each host." }, "parents": [ { "id": "rare-suspicious-child-processes", "kind": "merge" }, { "id": "installer-dll-anomalies", "kind": "merge" }, { "id": "unusual-driver-activity", "kind": "merge" } ] }, { "id": "route-verdict", "type": "checkpoint", "label": "Route on triage verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "The triage-verdict is malicious for at least one host.", "condition": "The triage-verdict is malicious for at least one host.", "blind_spot": "no-agent-coverage", "confidence": "high", "description": "Route malicious findings to containment and suspicious ones to manual review.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-verdict" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Contain confirmed exploitation to prevent lateral movement.", "instructions": "Isolate the host via the EDR. Remove any identified malicious DLLs or installer binaries after collection.", "action_approval": "required" }, "parents": [ { "id": "route-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review", "config": { "assignee": "analyst", "description": "Conduct manual investigation of suspicious or indeterminate findings.", "instructions": "Review the process tree for the identified Foxit or Adobe events. Determine if the file created by the installer is a known DLL name (e.g. version.dll, dwmapi.dll) in an unexpected path." }, "parents": [ { "id": "exposure-gate", "branch": "default" }, { "id": "exposure-gate", "branch": "on_unavailable" }, { "id": "route-verdict", "branch": "default" }, { "id": "route-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Document findings and update vulnerability remediation records.", "instructions": "Record identified vulnerable hosts. If exploitation was not found, pass the vulnerable host list to the patching team." }, "parents": [ { "id": "exposure-gate", "branch": "on_refutes" }, { "id": "route-verdict", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }