{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Hijacked cloud environments are the primary infrastructure for global phishing campaigns; a single compromised tenant can be used to send millions of phishing emails, causing significant reputational and financial damage."
      },
      "name": "Cloud Tenant Hijacking and Service Principal Abuse",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1078.004",
        "attack.t1098.003",
        "attack.t1090.003",
        "attack.t1560",
        "attack.t1098",
        "collection",
        "command and control",
        "exfiltration",
        "initial access",
        "persistence",
        "privilege escalation",
        "reconnaissance"
      ],
      "series": {
        "slug": "the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime",
        "index": 1,
        "title": "The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime",
        "total": 2
      },
      "related": [
        {
          "hunt": "phishing-kit-interactive-harvesting",
          "reason": "This hunt focuses on the supply-side tenant hijacking; the actual interactive credential harvesting occurs on the downstream phishing sites.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A standard detection rule can flag the PnP Management Shell, but this hunt correlates proxy-based sign-in anomalies, application-level authentication flows, and the high-volume manipulation of accounts by new principals to confirm a systematic takeover that a single-event rule would miss.",
      "coverage": [
        {
          "stage": "reconnaissance-automated-cloud-profiling",
          "steps": [
            "proxy-signins-m365"
          ],
          "status": "covered"
        },
        {
          "stage": "initial-access-app-only-auth",
          "steps": [
            "app-only-auth-flow"
          ],
          "status": "covered"
        },
        {
          "stage": "persistence-account-manipulation",
          "steps": [
            "rare-admin-operations"
          ],
          "status": "covered"
        },
        {
          "stage": "privilege-escalation-graph-abuse",
          "steps": [
            "graph-privesc-pnp"
          ],
          "status": "covered"
        },
        {
          "stage": "collection-resource-hosting-abuse",
          "steps": [
            "graph-privesc-pnp"
          ],
          "reason": "The Graph escalation to AppCatalog and SharePoint control enables the bulk hosting abuse described in the research.",
          "status": "covered"
        },
        {
          "stage": "command-and-control-dns-routing",
          "reason": "Belongs to another part of the 'The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "exfiltration-interactive-credential-harvesting",
          "reason": "Belongs to another part of the 'The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Automated Cloud Tenant Reconnaissance",
            "slug": "reconnaissance-automated-cloud-profiling",
            "tactic": "reconnaissance",
            "techniques": [
              "T1090.003",
              "T1595"
            ],
            "observables": [
              "Flask-based reconnaissance tooling",
              "Tor infrastructure for anonymity",
              "Profiling of M365 tenant enrollment opportunities",
              "Discovery of Azure cloud information"
            ]
          },
          {
            "name": "Application-Level Environment Takeover",
            "slug": "initial-access-app-only-auth",
            "tactic": "initial-access",
            "techniques": [
              "T1078.004"
            ],
            "observables": [
              "Application-only authentication flows",
              "Usage of stolen client secrets",
              "PHP, Java/Spring, and Cloudflare Workers admin panels",
              "Client secret-based directory control"
            ]
          },
          {
            "name": "Silent Password Resets and License Assignment",
            "slug": "persistence-account-manipulation",
            "tactic": "persistence",
            "techniques": [
              "T1098"
            ],
            "observables": [
              "Silent password resets (without force-change requirement)",
              "Assignment of education licenses",
              "Granting of privileged account attributes"
            ]
          },
          {
            "name": "Graph API Privilege Escalation",
            "slug": "privilege-escalation-graph-abuse",
            "tactic": "privilege-escalation",
            "techniques": [
              "T1098.003"
            ],
            "observables": [
              "Self-provisioning of PnP Management Shell service principal",
              "Granting AppCatalog.ReadWrite.All permission",
              "Broad Microsoft Graph permissions grant",
              "Full control over SharePoint API"
            ]
          },
          {
            "name": "SharePoint and OneDrive Storage Abuse",
            "slug": "collection-resource-hosting-abuse",
            "tactic": "collection",
            "techniques": [
              "T1560"
            ],
            "observables": [
              "Abuse of SharePoint as bulk hosting platform",
              "Abuse of OneDrive for phishing content hosting",
              "Conversion of hijacked storage into sellable products"
            ]
          },
          {
            "name": "DNS Management and Domain Routing",
            "slug": "command-and-control-dns-routing",
            "tactic": "command-and-control",
            "techniques": [
              "T1090.003",
              "T1568"
            ],
            "observables": [
              "Custom DNS management platform",
              "Cloudflare domain-routing configurations",
              "jewishchoice.org",
              "AI-generated nonprofit web presence"
            ]
          },
          {
            "name": "Real-time Phishing and Exfiltration",
            "slug": "exfiltration-interactive-credential-harvesting",
            "tactic": "exfiltration",
            "techniques": [
              "T1566",
              "T1041"
            ],
            "observables": [
              "WebSocket connections for real-time victim interaction",
              "Telegram bot tokens and chat IDs for exfiltration",
              "Iron Man System phishing kit",
              "Credential harvesting (usernames, passwords, credit card info)"
            ]
          }
        ],
        "summary": "Storm-3119 (YAM Store) functions as an infrastructure broker that hijacks Microsoft 365 and Azure environments through automated reconnaissance and application-level credential abuse. These compromised environments and PaaS phishing kits (Storm-2990) are then used by downstream actors to conduct large-scale credential and financial theft, leveraging real-time victim interaction via WebSockets and Telegram."
      },
      "severity": "high",
      "rationale": "Focus on tenants with education (.edu) or non-profit (.org) identifiers, as these are specifically marketed in the YAM Store ecosystem. Look for activity originating from known proxy exit nodes.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary uses stolen application secrets for application-only authentication to hijack M365 tenants, subsequently escalating privileges via the Graph API to host phishing infrastructure on SharePoint and OneDrive.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Target cloud account UIDs or actor domains; leave empty for all."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/",
          "name": "Microsoft \u2014 The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime"
        }
      ],
      "blind_spots": [
        {
          "id": "cloud-audit-retention-limit",
          "risk": "The initial takeover event may be outside the current telemetry window, leaving only the later-stage manipulation visible.",
          "stage": "persistence-account-manipulation",
          "question": "whether the initial app secret was stolen months before the manipulation began",
          "requires": "hb_cloud_api_activity with retention exceeding 90 days"
        },
        {
          "id": "app-secret-visibility",
          "risk": "Without the secret ID, an analyst cannot confirm if a legitimate secret was rotated or a stolen one was used until the app is audited.",
          "stage": "initial-access-app-only-auth",
          "question": "which specific secret for a multi-secret app was used",
          "requires": "The specific client secret ID used in hb_auth_signin"
        }
      ]
    },
    "name": "Cloud Tenant Hijacking and Service Principal Abuse",
    "description": "This hunt identifies the lifecycle of cloud tenant hijacking as observed in the Storm-3119 ecosystem. It begins by identifying anomalous application-level authentication flows and sign-ins from proxy infrastructure (T1090.003). It then follows the chain to find privilege escalation through the self-provisioning of the PnP Management Shell and the abuse of sensitive directory permissions like AppCatalog.ReadWrite.All (T1098.003). By correlating initial access with follow-on resource manipulation, the hunt distinguishes between routine automation and the systematic hijacking of organizational storage for global phishing operations."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime",
          "index": 1,
          "title": "The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime",
          "total": 2
        },
        "coverage": [
          {
            "stage": "reconnaissance-automated-cloud-profiling",
            "steps": [
              "proxy-signins-m365"
            ],
            "status": "covered"
          },
          {
            "stage": "initial-access-app-only-auth",
            "steps": [
              "app-only-auth-flow"
            ],
            "status": "covered"
          },
          {
            "stage": "persistence-account-manipulation",
            "steps": [
              "rare-admin-operations"
            ],
            "status": "covered"
          },
          {
            "stage": "privilege-escalation-graph-abuse",
            "steps": [
              "graph-privesc-pnp"
            ],
            "status": "covered"
          },
          {
            "stage": "collection-resource-hosting-abuse",
            "steps": [
              "graph-privesc-pnp"
            ],
            "reason": "The Graph escalation to AppCatalog and SharePoint control enables the bulk hosting abuse described in the research.",
            "status": "covered"
          },
          {
            "stage": "command-and-control-dns-routing",
            "reason": "Belongs to another part of the 'The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "exfiltration-interactive-credential-harvesting",
            "reason": "Belongs to another part of the 'The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary uses stolen application secrets for application-only authentication to hijack M365 tenants, subsequently escalating privileges via the Graph API to host phishing infrastructure on SharePoint and OneDrive.",
        "blind_spots": [
          {
            "id": "cloud-audit-retention-limit",
            "risk": "The initial takeover event may be outside the current telemetry window, leaving only the later-stage manipulation visible.",
            "stage": "persistence-account-manipulation",
            "question": "whether the initial app secret was stolen months before the manipulation began",
            "requires": "hb_cloud_api_activity with retention exceeding 90 days"
          },
          {
            "id": "app-secret-visibility",
            "risk": "Without the secret ID, an analyst cannot confirm if a legitimate secret was rotated or a stolen one was used until the app is audited.",
            "stage": "initial-access-app-only-auth",
            "question": "which specific secret for a multi-secret app was used",
            "requires": "The specific client secret ID used in hb_auth_signin"
          }
        ],
        "scoping_notes": "Focus on tenants with education (.edu) or non-profit (.org) identifiers, as these are specifically marketed in the YAM Store ecosystem. Look for activity originating from known proxy exit nodes.",
        "beyond_detection": "A standard detection rule can flag the PnP Management Shell, but this hunt correlates proxy-based sign-in anomalies, application-level authentication flows, and the high-volume manipulation of accounts by new principals to confirm a systematic takeover that a single-event rule would miss."
      }
    },
    {
      "id": "identify-active-tenants",
      "type": "query",
      "label": "Identify active M365 tenants",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT cloud_account_uid, api_service_name FROM hb_cloud_api_activity WHERE provider = 'm365' AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_cloud_api_activity",
        "description": "Find the M365 tenant IDs currently active in the API logs to narrow the investigation.",
        "expected_signal": "A list of cloud account UIDs representing active tenants. Silence suggests no M365 activity."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify active M365 tenants",
        "reads": [
          "api_service_name",
          "cloud_account_uid",
          "provider",
          "time"
        ],
        "source": "hb_cloud_api_activity",
        "target": "endpoint",
        "content": "SELECT DISTINCT cloud_account_uid, api_service_name FROM hb_cloud_api_activity WHERE provider = 'm365' AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of cloud account UIDs representing active tenants. Silence suggests no M365 activity.",
        "verified": "dry-run",
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "proxy-signins-m365",
      "type": "query",
      "label": "Proxy and Anonymized sign-ins",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "identity",
        "content": "SELECT actor_user_domain, actor_user_name, src_endpoint_ip, user_agent, src_location_country, time FROM hb_auth_signin WHERE provider = 'm365' AND is_proxy = 'true' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || actor_user_domain || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_auth_signin",
        "description": "Identify sign-ins coming from known proxies or anonymizing infrastructure.",
        "expected_signal": "Sign-in events flagged as originating from proxy infrastructure. Silence proves no such logins were detected."
      },
      "parents": [
        {
          "id": "identify-active-tenants"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Proxy and Anonymized sign-ins",
        "reads": [
          "actor_user_domain",
          "actor_user_name",
          "is_proxy",
          "provider",
          "src_endpoint_ip",
          "src_location_country",
          "time",
          "user_agent"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_domain, actor_user_name, src_endpoint_ip, user_agent, src_location_country, time FROM hb_auth_signin WHERE provider = 'm365' AND is_proxy = 'true' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || actor_user_domain || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "evidence_of_absence",
        "expected": "Sign-in events flagged as originating from proxy infrastructure. Silence proves no such logins were detected.",
        "verified": "dry-run",
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "app-only-auth-flow",
      "type": "query",
      "label": "Application-only authentication flows",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "identity",
        "content": "SELECT actor_user_domain, actor_user_name, auth_protocol, src_endpoint_ip, time FROM hb_auth_signin WHERE provider = 'm365' AND activity_id = 1 AND (LOWER(auth_protocol) LIKE '%secret%' OR LOWER(auth_protocol) LIKE '%client_credentials%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || actor_user_domain || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_auth_signin",
        "description": "Identify logins using application secrets rather than user sessions, a prerequisite for the Storm-3119 takeover pipeline.",
        "expected_signal": "Successful application-only logins. Benign service accounts will appear, but new or unexpected principals are suspicious."
      },
      "parents": [
        {
          "id": "identify-active-tenants"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Application-only authentication flows",
        "reads": [
          "activity_id",
          "actor_user_domain",
          "actor_user_name",
          "auth_protocol",
          "provider",
          "src_endpoint_ip",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_domain, actor_user_name, auth_protocol, src_endpoint_ip, time FROM hb_auth_signin WHERE provider = 'm365' AND activity_id = 1 AND (LOWER(auth_protocol) LIKE '%secret%' OR LOWER(auth_protocol) LIKE '%client_credentials%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || actor_user_domain || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Successful application-only logins. Benign service accounts will appear, but new or unexpected principals are suspicious.",
        "verified": "dry-run",
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "early-takeover-assessment",
      "type": "analytic",
      "label": "Assess early access indicators",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "identify-active-tenants",
          "proxy-signins-m365",
          "app-only-auth-flow"
        ],
        "objective": "Identify service principals or accounts that authenticated via proxy infrastructure using application-only flows.",
        "description": "Determine if the sign-in anomalies and application flows together suggest an active tenant takeover attempt.",
        "max_iterations": 3,
        "expected_signal": "A per-tenant assessment of takeover risk based on access patterns.",
        "success_criteria": "A list of suspected compromised service principals for follow-on analysis."
      },
      "parents": [
        {
          "id": "proxy-signins-m365",
          "kind": "merge"
        },
        {
          "id": "app-only-auth-flow",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "graph-privesc-pnp",
      "type": "query",
      "label": "Graph escalation and PnP Shell",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT api_operation, resource_name, actor_user_name, cloud_account_uid, time FROM hb_cloud_api_activity WHERE provider = 'm365' AND (LOWER(resource_name) LIKE '%pnp management shell%' OR LOWER(api_operation) LIKE '%addapproleassignment%' OR LOWER(resource_name) LIKE '%appcatalog%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || cloud_account_uid || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_cloud_api_activity",
        "description": "Find the specific privilege escalation tradecraft: self-provisioning the PnP Management Shell and granting sensitive directory permissions.",
        "expected_signal": "Granting of sensitive AppCatalog or Graph roles to the PnP Shell or new apps. Silence suggests no documented privesc attempt."
      },
      "parents": [
        {
          "id": "early-takeover-assessment"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Graph escalation and PnP Shell",
        "reads": [
          "actor_user_name",
          "api_operation",
          "cloud_account_uid",
          "provider",
          "resource_name",
          "time"
        ],
        "source": "hb_cloud_api_activity",
        "target": "endpoint",
        "content": "SELECT api_operation, resource_name, actor_user_name, cloud_account_uid, time FROM hb_cloud_api_activity WHERE provider = 'm365' AND (LOWER(resource_name) LIKE '%pnp management shell%' OR LOWER(api_operation) LIKE '%addapproleassignment%' OR LOWER(resource_name) LIKE '%appcatalog%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || cloud_account_uid || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Granting of sensitive AppCatalog or Graph roles to the PnP Shell or new apps. Silence suggests no documented privesc attempt.",
        "verified": "dry-run",
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "rare-admin-operations",
      "type": "query",
      "label": "Rare silent password and license changes",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT actor_user_name, api_operation, MIN(time) AS first_seen, COUNT(DISTINCT cloud_account_uid) AS tenant_count, COUNT(*) AS total_ops FROM hb_cloud_api_activity WHERE provider = 'm365' AND (LOWER(api_operation) LIKE '%resetpassword%' OR LOWER(api_operation) LIKE '%assignlicense%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, api_operation HAVING tenant_count <= 1 ORDER BY total_ops DESC",
        "surface": "hb_cloud_api_activity",
        "description": "Identify high-volume manipulation of accounts and licenses by service principals that are new to the environment.",
        "expected_signal": "A service principal performing password resets or license assignments that is new or rare in the environment."
      },
      "parents": [
        {
          "id": "early-takeover-assessment"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare silent password and license changes",
        "reads": [
          "actor_user_name",
          "api_operation",
          "cloud_account_uid",
          "provider",
          "time"
        ],
        "source": "hb_cloud_api_activity",
        "target": "endpoint",
        "content": "SELECT actor_user_name, api_operation, MIN(time) AS first_seen, COUNT(DISTINCT cloud_account_uid) AS tenant_count, COUNT(*) AS total_ops FROM hb_cloud_api_activity WHERE provider = 'm365' AND (LOWER(api_operation) LIKE '%resetpassword%' OR LOWER(api_operation) LIKE '%assignlicense%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, api_operation HAVING tenant_count <= 1 ORDER BY total_ops DESC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "A service principal performing password resets or license assignments that is new or rare in the environment.",
        "verified": "dry-run",
        "prevalence": {
          "by": "cloud_account_uid",
          "key": [
            "actor_user_name",
            "api_operation"
          ],
          "rare_below": 2
        },
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "full-chain-analysis",
      "type": "analytic",
      "label": "Analyze full attack chain",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "early-takeover-assessment",
          "graph-privesc-pnp",
          "rare-admin-operations"
        ],
        "objective": "Determine if the service principals identified in the first stage have proceeded to escalate privileges and perform bulk account or license changes.",
        "description": "Connect the initial anomalous access to the follow-on resource manipulation to confirm a persistent takeover.",
        "max_iterations": 5,
        "expected_signal": "A high-confidence verdict on whether a tenant has been hijacked for malicious resource hosting.",
        "success_criteria": "A final verdict citing the specific actor, the authentication anomalies, and the administrative abuse."
      },
      "parents": [
        {
          "id": "graph-privesc-pnp",
          "kind": "merge"
        },
        {
          "id": "rare-admin-operations",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on takeover verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the full-chain-analysis verdict is malicious for an identified service principal or tenant",
        "condition": "the full-chain-analysis verdict is malicious for an identified service principal or tenant",
        "blind_spot": "cloud-audit-retention-limit",
        "confidence": "high",
        "description": "Direct the response based on the agent's confidence in a tenant hijacking.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "full-chain-analysis"
        }
      ]
    },
    {
      "id": "revoke-app-access",
      "type": "action",
      "label": "Revoke App Access",
      "config": {
        "target": "identity",
        "description": "Halt the hijacking by disabling the identified service principal and its secrets.",
        "instructions": "Disable the compromised service principal in Entra ID and rotate or revoke its client secrets.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-remediation-task",
      "type": "task",
      "label": "Remediate and Audit",
      "config": {
        "assignee": "analyst",
        "description": "Perform manual verification of modified accounts and cleanup of malicious storage.",
        "instructions": "Verify any accounts that underwent silent password resets. Audit SharePoint and OneDrive for unexpected public hosting or bulk phishing templates."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "revoke-app-access"
        }
      ]
    },
    {
      "id": "close-out-task",
      "type": "task",
      "label": "Close out hunt",
      "config": {
        "assignee": "analyst",
        "description": "Finalize findings and record tuning notes.",
        "instructions": "Document the identified service principals and IP addresses. Record a tuning note for any high-volume administrative service accounts that appeared in the prevalence count."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-remediation-task"
        }
      ]
    }
  ]
}