{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "The 2026 Frost Radar highlights that a vulnerability is only a risk if it is running and reachable; this hunt correlates identity abuse with the runtime network telemetry needed to prioritize real intrusions."
      },
      "name": "Cloud Workload Identity and Network Triage",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1078.004",
        "attack.t1071.001",
        "attack.t1190"
      ],
      "series": {
        "slug": "microsoft-named-a-leader-in-the-frost-radar-cloud-workload-protection-platforms-2026",
        "index": 2,
        "title": "Microsoft named a Leader in the Frost Radar\u2122: Cloud Workload Protection Platforms, 2026",
        "total": 2
      },
      "related": [
        {
          "hunt": "kubernetes-drift-analysis",
          "reason": "Detection of execution within the container itself via runtime drift is handled by a separate hunt.",
          "relation": "out-of-scope-alternative"
        },
        {
          "hunt": "cloud-workload-runtime-exploitation-behavior",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A single rule can find known C2 domains; this hunt stack-counts DNS lookups specifically for container hosts identified in inventory and correlates them with administrative identity activity.",
      "coverage": [
        {
          "stage": "over-permissioned-identity-access",
          "steps": [
            "cloud-identity-signins",
            "triage-risk"
          ],
          "status": "covered"
        },
        {
          "stage": "outbound-command-and-control",
          "steps": [
            "rare-workload-dns",
            "triage-risk"
          ],
          "status": "covered"
        },
        {
          "stage": "initial-access-exploit",
          "reason": "Belongs to another part of the 'Microsoft named a Leader in the Frost Radar\u2122: Cloud Workload Protection Platforms, 2026' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "runtime-container-execution",
          "reason": "Belongs to another part of the 'Microsoft named a Leader in the Frost Radar\u2122: Cloud Workload Protection Platforms, 2026' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "persistence-through-drift",
          "reason": "Belongs to another part of the 'Microsoft named a Leader in the Frost Radar\u2122: Cloud Workload Protection Platforms, 2026' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Exploit Public-Facing Application",
            "slug": "initial-access-exploit",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "Incoming HTTP requests to vulnerable web applications",
              "Presence of known vulnerabilities on internet-exposed assets",
              "Misconfigured cloud infrastructure services"
            ]
          },
          {
            "name": "Malicious Process Execution in Containers",
            "slug": "runtime-container-execution",
            "tactic": "execution",
            "techniques": [
              "T1059"
            ],
            "observables": [
              "Suspicious process launches in Kubernetes pods",
              "eBPF-detected anomalous runtime events",
              "Interactive shell execution within running containers"
            ]
          },
          {
            "name": "Container Binary Drift",
            "slug": "persistence-through-drift",
            "tactic": "defense-evasion",
            "techniques": [
              "T1542"
            ],
            "observables": [
              "Unauthorized binary changes mid-run (drift)",
              "Modifications to files within running container layers",
              "Unexpected process activity from modified binaries"
            ]
          },
          {
            "name": "Abuse of Over-Permissioned Identities",
            "slug": "over-permissioned-identity-access",
            "tactic": "credential-access",
            "techniques": [
              "T1078"
            ],
            "observables": [
              "Authentication using high-privilege service accounts",
              "Anomalous sign-ins to cloud control planes (Azure, AWS, GCP)",
              "Identity-linked access to Kubernetes API and resources"
            ]
          },
          {
            "name": "Outbound Command and Control",
            "slug": "outbound-command-and-control",
            "tactic": "command-and-control",
            "techniques": [
              "T1071"
            ],
            "observables": [
              "DNS queries from Kubernetes pods to external domains",
              "Outbound network connections to suspicious IP addresses",
              "High-volume data transfer from container workloads"
            ]
          }
        ],
        "summary": "This campaign involves the exploitation of public-facing applications to gain initial access to cloud workloads, particularly Kubernetes environments. Once inside, attackers execute malicious processes, leverage over-permissioned identities, and establish persistence through binary drift and outbound command-and-control traffic."
      },
      "severity": "medium",
      "rationale": "Target workloads running Docker, Kubelet, or Containerd. Use the hostnames identified in the scoping step to narrow the network investigation in the parallel branches.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary uses over-permissioned cloud identities to compromise container workloads, establishing persistence through rare outbound network channels that bypass standard scanning.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "analyst-defined-scope",
            "kind": "manual",
            "observed": "2026-08-19"
          },
          "type": "list[host]",
          "default": [],
          "description": "Target hostnames found in the scoping step; leave empty to scan all cloud instances."
        },
        "lookback_days": {
          "from": {
            "ref": "hunt-standard-lookback",
            "kind": "manual",
            "observed": "2026-08-19"
          },
          "type": "number",
          "default": "14",
          "description": "Days of historical telemetry to examine."
        },
        "cloud_providers": {
          "from": {
            "ref": "msrc-blog-frost-radar-2026",
            "kind": "article",
            "observed": "2026-08-19"
          },
          "type": "list[string]",
          "default": [
            "aws",
            "azure",
            "gcp"
          ],
          "description": "Cloud providers to monitor for control plane access."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.microsoft.com/en-us/security/blog/2026/08/19/microsoft-named-a-leader-in-the-frost-radar-cloud-workload-protection-platforms-2026/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.microsoft.com/en-us/security/blog/2026/08/19/microsoft-named-a-leader-in-the-frost-radar-cloud-workload-protection-platforms-2026/",
          "name": "Microsoft named a Leader in the Frost Radar: Cloud Workload Protection Platforms, 2026"
        }
      ],
      "blind_spots": [
        {
          "id": "encrypted-c2-blindspot",
          "risk": "Encrypted C2 traffic over standard ports may appear as legitimate workload traffic to unknown external APIs.",
          "stage": "outbound-command-and-control",
          "question": "Is the rare outbound traffic legitimate API usage or encrypted C2?",
          "requires": "TLS inspection or application-proxy logs"
        },
        {
          "id": "missing-k8s-audit-logs",
          "risk": "Adversaries can modify the orchestration plane (K8s API) without generating a standard cloud login event, leaving the initial compromise steps invisible.",
          "stage": "over-permissioned-identity-access",
          "question": "Did the identity modify K8s configurations or secrets?",
          "requires": "hb_auth_signin enrichment with K8s API audit data"
        }
      ]
    },
    "name": "Cloud Workload Identity and Network Triage",
    "description": "This hunt identifies and correlates identity-based control plane abuse with network-level anomalies in running container environments. By combining software inventory to scope container hosts, cloud authentication logs to identify identity abuse, and stack-counted DNS activity to find rare command-and-control targets, the hunt provides a unified view of post-exploitation risk in cloud-native workloads."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "microsoft-named-a-leader-in-the-frost-radar-cloud-workload-protection-platforms-2026",
          "index": 2,
          "title": "Microsoft named a Leader in the Frost Radar\u2122: Cloud Workload Protection Platforms, 2026",
          "total": 2
        },
        "coverage": [
          {
            "stage": "over-permissioned-identity-access",
            "steps": [
              "cloud-identity-signins",
              "triage-risk"
            ],
            "status": "covered"
          },
          {
            "stage": "outbound-command-and-control",
            "steps": [
              "rare-workload-dns",
              "triage-risk"
            ],
            "status": "covered"
          },
          {
            "stage": "initial-access-exploit",
            "reason": "Belongs to another part of the 'Microsoft named a Leader in the Frost Radar\u2122: Cloud Workload Protection Platforms, 2026' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "runtime-container-execution",
            "reason": "Belongs to another part of the 'Microsoft named a Leader in the Frost Radar\u2122: Cloud Workload Protection Platforms, 2026' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "persistence-through-drift",
            "reason": "Belongs to another part of the 'Microsoft named a Leader in the Frost Radar\u2122: Cloud Workload Protection Platforms, 2026' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary uses over-permissioned cloud identities to compromise container workloads, establishing persistence through rare outbound network channels that bypass standard scanning.",
        "blind_spots": [
          {
            "id": "encrypted-c2-blindspot",
            "risk": "Encrypted C2 traffic over standard ports may appear as legitimate workload traffic to unknown external APIs.",
            "stage": "outbound-command-and-control",
            "question": "Is the rare outbound traffic legitimate API usage or encrypted C2?",
            "requires": "TLS inspection or application-proxy logs"
          },
          {
            "id": "missing-k8s-audit-logs",
            "risk": "Adversaries can modify the orchestration plane (K8s API) without generating a standard cloud login event, leaving the initial compromise steps invisible.",
            "stage": "over-permissioned-identity-access",
            "question": "Did the identity modify K8s configurations or secrets?",
            "requires": "hb_auth_signin enrichment with K8s API audit data"
          }
        ],
        "scoping_notes": "Target workloads running Docker, Kubelet, or Containerd. Use the hostnames identified in the scoping step to narrow the network investigation in the parallel branches.",
        "beyond_detection": "A single rule can find known C2 domains; this hunt stack-counts DNS lookups specifically for container hosts identified in inventory and correlates them with administrative identity activity."
      }
    },
    {
      "id": "scope-container-workloads",
      "type": "query",
      "label": "Scope container workloads",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_name, vendor_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%docker%' OR LOWER(package_name) LIKE '%kube%' OR LOWER(package_name) LIKE '%containerd%') OR (LOWER(vendor_name) LIKE '%kubernetes%' OR LOWER(vendor_name) LIKE '%docker%')",
        "surface": "hb_software_inventory",
        "description": "Find the hosts running container orchestration and runtime software to narrow the hunt's focus to workloads.",
        "expected_signal": "A list of hostnames associated with container infrastructure. Silence means no container engines were identified in the current inventory."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Scope container workloads",
        "reads": [
          "device_hostname",
          "package_name",
          "vendor_name",
          "package_version"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_name, vendor_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%docker%' OR LOWER(package_name) LIKE '%kube%' OR LOWER(package_name) LIKE '%containerd%') OR (LOWER(vendor_name) LIKE '%kubernetes%' OR LOWER(vendor_name) LIKE '%docker%')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames associated with container infrastructure. Silence means no container engines were identified in the current inventory.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "cloud-identity-signins",
      "type": "query",
      "label": "Cloud identity sign-ins",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, dst_endpoint_name, provider, time FROM hb_auth_signin WHERE status_id = 1 AND instr(',' || '{{cloud_providers}}' || ',', ',' || LOWER(provider) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_auth_signin",
        "description": "Identify administrative sign-ins to cloud control planes that could precede workload modifications.",
        "expected_signal": "Successful logins to AWS, Azure, or GCP consoles and APIs. Unusual source IPs for admin users are higher risk."
      },
      "parents": [
        {
          "id": "scope-container-workloads"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Cloud identity sign-ins",
        "reads": [
          "actor_user_name",
          "src_endpoint_ip",
          "dst_endpoint_name",
          "provider",
          "time",
          "status_id"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, dst_endpoint_name, provider, time FROM hb_auth_signin WHERE status_id = 1 AND instr(',' || '{{cloud_providers}}' || ',', ',' || LOWER(provider) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Successful logins to AWS, Azure, or GCP consoles and APIs. Unusual source IPs for admin users are higher risk.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "rare-workload-dns",
      "type": "query",
      "label": "Rare workload DNS activity",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT query_hostname, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY query_hostname HAVING hosts <= 3 ORDER BY hosts ASC, lookups DESC",
        "surface": "hb_dns_activity",
        "description": "Stack-count DNS queries across the workload fleet to find rare destinations indicative of C2 persistence.",
        "expected_signal": "DNS hostnames queried by only a few container workloads. Silence on this surface may indicate IP-direct communication."
      },
      "parents": [
        {
          "id": "scope-container-workloads"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Rare workload DNS activity",
        "reads": [
          "query_hostname",
          "device_hostname",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT query_hostname, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY query_hostname HAVING hosts <= 3 ORDER BY hosts ASC, lookups DESC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "DNS hostnames queried by only a few container workloads. Silence on this surface may indicate IP-direct communication.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "query_hostname"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "triage-risk",
      "type": "analytic",
      "label": "Triage workload risk",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "cloud-identity-signins",
          "rare-workload-dns"
        ],
        "objective": "Determine if any successful administrative sign-in originated from a source IP or occurred at a time that corresponds with the first appearance of a rare DNS destination from a container host. Assess if the over-permissioned account likely modified the workload.",
        "description": "Correlate identity sign-in telemetry with rare network behavior to identify compromised accounts and workloads.",
        "max_iterations": 6,
        "expected_signal": "A detailed verdict linking identities to the anomalous behavior of specific workloads.",
        "success_criteria": "A per-host and per-identity verdict of malicious | suspicious | benign, citing specific rows and timestamps."
      },
      "parents": [
        {
          "id": "cloud-identity-signins",
          "kind": "merge"
        },
        {
          "id": "rare-workload-dns",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-risk",
      "type": "checkpoint",
      "label": "Route on risk",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage-risk verdict is malicious for at least one workload-identity pair",
        "condition": "the triage-risk verdict is malicious for at least one workload-identity pair",
        "blind_spot": "encrypted-c2-blindspot",
        "confidence": "high",
        "description": "Direct the response based on the agent's correlation verdict.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-risk"
        }
      ]
    },
    {
      "id": "isolate-and-revoke",
      "type": "action",
      "label": "Isolate and revoke",
      "config": {
        "target": "endpoint",
        "description": "Neutralize the intrusion by revoking credentials and isolating the workload.",
        "instructions": "Isolate the identified container host and revoke all active session tokens for the compromised cloud identity.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-risk",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst review",
      "config": {
        "assignee": "analyst",
        "description": "Verify the findings to ensure legitimate administrative activities were not incorrectly flagged.",
        "instructions": "Review the cited rows from the triage agent. Verify if the rare DNS queries represent legitimate new application dependencies or known malicious domains."
      },
      "parents": [
        {
          "id": "route-risk",
          "branch": "default"
        },
        {
          "id": "route-risk",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-and-revoke"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Finalize the hunt and record gaps.",
        "instructions": "Document the hosts and identities examined. Note any visibility gaps such as missing Kubernetes audit logs for future platform hardening."
      },
      "parents": [
        {
          "id": "route-risk",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-review"
        }
      ]
    }
  ]
}