{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Modern cloud workloads are high-value targets where posture scanning is insufficient. Identifying exploitation at runtime through shell activity and binary drift is critical for stopping compromises that bypass initial deployment gates." }, "name": "Cloud Workload Runtime and Exploitation Behavior", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1059", "attack.t1542" ], "series": { "slug": "microsoft-named-a-leader-in-the-frost-radar-cloud-workload-protection-platforms-2026", "index": 1, "title": "Microsoft named a Leader in the Frost Radar\u2122: Cloud Workload Protection Platforms, 2026", "total": 2 }, "related": [ { "hunt": "over-permissioned-identity-access", "reason": "That hunt focuses on the misuse of cloud identities after the workload has already been compromised.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "databricks": { "name": "databricks", "category": "siem", "huntbase": { "product": "databricks" } } }, "analysis": "A single detection rule would struggle with the noise of legitimate software updates and shell usage. This hunt uses a risk-based lead to gate expensive queries, applies prevalence counting across the fleet to isolate rare drift, and uses an agent to correlate image risk with runtime behavior across three different telemetry surfaces.", "coverage": [ { "stage": "initial-access-exploit", "steps": [ "identify-high-risk-images", "evaluate-scoping-risk" ], "status": "covered" }, { "stage": "runtime-container-execution", "steps": [ "suspicious-shell-launches" ], "status": "covered" }, { "stage": "persistence-through-drift", "steps": [ "rare-binary-drift" ], "status": "covered" }, { "stage": "over-permissioned-identity-access", "reason": "Belongs to another part of the 'Microsoft named a Leader in the Frost Radar\u2122: Cloud Workload Protection Platforms, 2026' series.", "status": "out_of_scope" }, { "stage": "outbound-command-and-control", "reason": "Belongs to another part of the 'Microsoft named a Leader in the Frost Radar\u2122: Cloud Workload Protection Platforms, 2026' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Exploit Public-Facing Application", "slug": "initial-access-exploit", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "Incoming HTTP requests to vulnerable web applications", "Presence of known vulnerabilities on internet-exposed assets", "Misconfigured cloud infrastructure services" ] }, { "name": "Malicious Process Execution in Containers", "slug": "runtime-container-execution", "tactic": "execution", "techniques": [ "T1059" ], "observables": [ "Suspicious process launches in Kubernetes pods", "eBPF-detected anomalous runtime events", "Interactive shell execution within running containers" ] }, { "name": "Container Binary Drift", "slug": "persistence-through-drift", "tactic": "defense-evasion", "techniques": [ "T1542" ], "observables": [ "Unauthorized binary changes mid-run (drift)", "Modifications to files within running container layers", "Unexpected process activity from modified binaries" ] }, { "name": "Abuse of Over-Permissioned Identities", "slug": "over-permissioned-identity-access", "tactic": "credential-access", "techniques": [ "T1078" ], "observables": [ "Authentication using high-privilege service accounts", "Anomalous sign-ins to cloud control planes (Azure, AWS, GCP)", "Identity-linked access to Kubernetes API and resources" ] }, { "name": "Outbound Command and Control", "slug": "outbound-command-and-control", "tactic": "command-and-control", "techniques": [ "T1071" ], "observables": [ "DNS queries from Kubernetes pods to external domains", "Outbound network connections to suspicious IP addresses", "High-volume data transfer from container workloads" ] } ], "summary": "This campaign involves the exploitation of public-facing applications to gain initial access to cloud workloads, particularly Kubernetes environments. Once inside, attackers execute malicious processes, leverage over-permissioned identities, and establish persistence through binary drift and outbound command-and-control traffic." }, "severity": "medium", "rationale": "Start with Databricks compute clusters running containers with non-specific tags. These clusters represent the highest risk for unpatched, public-facing vulnerabilities.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has exploited a public-facing containerized application and is maintaining persistence through binary drift or suspicious shell execution within the workload runtime.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2026-08-19" }, "type": "list[host]", "default": [], "description": "Hostnames extracted from the scoping step to focus the runtime queries." }, "lookback_days": { "from": { "ref": "hunt-standard", "kind": "manual", "observed": "2026-08-19" }, "type": "number", "default": "14", "description": "Days of history to examine for runtime behavior." }, "vulnerable_tags": { "from": { "ref": "frost-radar-2026", "kind": "article", "observed": "2026-08-19" }, "type": "list[string]", "default": [ "latest", "dev", "test", "old" ], "description": "Image tags suspected of representing unversioned or high-risk development builds." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.microsoft.com/en-us/security/blog/2026/08/19/microsoft-named-a-leader-in-the-frost-radar-cloud-workload-protection-platforms-2026/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/08/19/microsoft-named-a-leader-in-the-frost-radar-cloud-workload-protection-platforms-2026/", "name": "Microsoft named a Leader in the Frost Radar: Cloud Workload Protection Platforms, 2026" } ], "blind_spots": [ { "id": "limited-inventory-visibility", "risk": "The scoping step is limited to Databricks; other container environments like EKS or GKE are not evaluated for the same risk in this hunt.", "stage": "initial-access-exploit", "question": "Are there other unmanaged workloads outside of Databricks running these images?", "requires": "Unified cloud inventory across AWS, Azure, and GCP" }, { "id": "container-drift-blindness", "risk": "If an adversary modifies files in a memory-backed overlay that is not flushed to the host disk, the file activity surface may not capture the drift.", "stage": "persistence-through-drift", "question": "Are modifications occurring in temporary file layers that osquery cannot observe?", "requires": "hb_file_activity with container layer awareness" } ] }, "name": "Cloud Workload Runtime and Exploitation Behavior", "description": "This hunt targets the exploitation of public-facing cloud workloads by correlating high-risk container images with suspicious runtime behavior. It starts with a scoping query of Databricks clusters running images with generic or development tags, then gates deeper analysis on identified risks. The hunt subsequently fans out to find interactive shells spawned by web processes and rare file modifications within the container file system, providing a unified view of exploitation and drift." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "microsoft-named-a-leader-in-the-frost-radar-cloud-workload-protection-platforms-2026", "index": 1, "title": "Microsoft named a Leader in the Frost Radar\u2122: Cloud Workload Protection Platforms, 2026", "total": 2 }, "coverage": [ { "stage": "initial-access-exploit", "steps": [ "identify-high-risk-images", "evaluate-scoping-risk" ], "status": "covered" }, { "stage": "runtime-container-execution", "steps": [ "suspicious-shell-launches" ], "status": "covered" }, { "stage": "persistence-through-drift", "steps": [ "rare-binary-drift" ], "status": "covered" }, { "stage": "over-permissioned-identity-access", "reason": "Belongs to another part of the 'Microsoft named a Leader in the Frost Radar\u2122: Cloud Workload Protection Platforms, 2026' series.", "status": "out_of_scope" }, { "stage": "outbound-command-and-control", "reason": "Belongs to another part of the 'Microsoft named a Leader in the Frost Radar\u2122: Cloud Workload Protection Platforms, 2026' series.", "status": "out_of_scope" } ], "rationale": "An adversary has exploited a public-facing containerized application and is maintaining persistence through binary drift or suspicious shell execution within the workload runtime.", "blind_spots": [ { "id": "limited-inventory-visibility", "risk": "The scoping step is limited to Databricks; other container environments like EKS or GKE are not evaluated for the same risk in this hunt.", "stage": "initial-access-exploit", "question": "Are there other unmanaged workloads outside of Databricks running these images?", "requires": "Unified cloud inventory across AWS, Azure, and GCP" }, { "id": "container-drift-blindness", "risk": "If an adversary modifies files in a memory-backed overlay that is not flushed to the host disk, the file activity surface may not capture the drift.", "stage": "persistence-through-drift", "question": "Are modifications occurring in temporary file layers that osquery cannot observe?", "requires": "hb_file_activity with container layer awareness" } ], "scoping_notes": "Start with Databricks compute clusters running containers with non-specific tags. These clusters represent the highest risk for unpatched, public-facing vulnerabilities.", "beyond_detection": "A single detection rule would struggle with the noise of legitimate software updates and shell usage. This hunt uses a risk-based lead to gate expensive queries, applies prevalence counting across the fleet to isolate rare drift, and uses an agent to correlate image risk with runtime behavior across three different telemetry surfaces." } }, { "id": "identify-high-risk-images", "type": "query", "label": "Identify high-risk container images", "config": { "dsl": "sqlite", "role": "scoping", "source": "databricks", "content": "SELECT cluster_name, docker_image, creator_user_name, cluster_id FROM databricks_compute_cluster WHERE docker_image IS NOT NULL AND docker_image LIKE '%:%' AND instr(',' || '{{vulnerable_tags}}' || ',', ',' || REPLACE(LOWER(docker_image), SUBSTR(LOWER(docker_image), 1, INSTR(LOWER(docker_image), ':')), '') || ',') > 0", "product": "databricks", "surface": "databricks_compute_cluster", "extension": "databricks", "description": "Find clusters running images with tags that bypass version control, representing a high risk for unpatched vulnerabilities.", "expected_signal": "A list of clusters using non-versioned image tags. Silence suggests all production workloads use pinned, versioned tags." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify high-risk container images", "reads": [ "cluster_name", "docker_image", "creator_user_name", "cluster_id" ], "source": "databricks_compute_cluster", "target": "databricks", "content": "SELECT cluster_name, docker_image, creator_user_name, cluster_id FROM databricks_compute_cluster WHERE docker_image IS NOT NULL AND docker_image LIKE '%:%' AND instr(',' || '{{vulnerable_tags}}' || ',', ',' || REPLACE(LOWER(docker_image), SUBSTR(LOWER(docker_image), 1, INSTR(LOWER(docker_image), ':')), '') || ',') > 0", "silence": "not_evidence_of_absence", "expected": "A list of clusters using non-versioned image tags. Silence suggests all production workloads use pinned, versioned tags.", "verified": "dry-run", "verified_at": "2026-09-20", "target_extension": "databricks" } }, { "id": "evaluate-scoping-risk", "type": "analytic", "label": "Evaluate Scoping Risk", "config": { "cite": "required", "tools": [ "databricks", "endpoint" ], "context": [ "identify-high-risk-images" ], "objective": "Review the images identified and determine if they represent production workloads. If high-risk clusters exist, provide the mapped device hostnames to be used for the scope_hosts parameter in the next phase.", "description": "Decide if any found clusters warrant a deep runtime hunt and provide the hostname scope for the analyst.", "max_iterations": 3, "expected_signal": "A list of high-priority clusters and a decision to proceed.", "success_criteria": "A verdict naming high-risk hostnames to be scoped." }, "parents": [ { "id": "identify-high-risk-images" } ] }, { "id": "lead-gate", "type": "checkpoint", "label": "Lead Gate", "config": { "fuzzy": true, "judge": "hunter", "question": "The evaluate-scoping-risk verdict identifies at least one high-risk cluster hostname.", "condition": "The evaluate-scoping-risk verdict identifies at least one high-risk cluster hostname.", "blind_spot": "limited-inventory-visibility", "confidence": "high", "description": "Terminate the hunt early if no risky images are found, avoiding expensive telemetry queries.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "evaluate-scoping-risk" } ] }, { "id": "suspicious-shell-launches", "type": "query", "label": "Suspicious Shell Launches", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (on_disk = 0 OR (LOWER(process_name) LIKE '%sh' AND (LOWER(parent_process_name) LIKE '%java%' OR LOWER(parent_process_name) LIKE '%python%' OR LOWER(parent_process_name) LIKE '%node%' OR LOWER(parent_process_name) LIKE '%php%'))) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Detect interactive shells spawned by web applications, a primary indicator of successful RCE.", "expected_signal": "A shell process whose parent is a web-facing service. Silence confirms no common RCE patterns are active." }, "parents": [ { "id": "lead-gate", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Suspicious Shell Launches", "reads": [ "device_hostname", "process_name", "process_cmd_line", "parent_process_name", "time", "on_disk" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (on_disk = 0 OR (LOWER(process_name) LIKE '%sh' AND (LOWER(parent_process_name) LIKE '%java%' OR LOWER(parent_process_name) LIKE '%python%' OR LOWER(parent_process_name) LIKE '%node%' OR LOWER(parent_process_name) LIKE '%php%'))) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "A shell process whose parent is a web-facing service. Silence confirms no common RCE patterns are active.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "rare-binary-drift", "type": "query", "label": "Rare Binary Drift in Containers", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(file_path) AS path, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id IN (1, 3, 5) AND (LOWER(file_path) LIKE '/bin/%' OR LOWER(file_path) LIKE '/usr/bin/%' OR LOWER(file_path) LIKE '/etc/%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY path HAVING host_count <= 2 ORDER BY host_count ASC", "surface": "hb_file_activity", "description": "Identify unauthorized changes to system binaries on a small number of hosts, suggesting persistence.", "expected_signal": "File writes to protected system paths occurring on only one or two hosts. Fleet-wide writes are likely updates and ignored." }, "parents": [ { "id": "lead-gate", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare Binary Drift in Containers", "reads": [ "file_path", "device_hostname", "activity_id", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT LOWER(file_path) AS path, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id IN (1, 3, 5) AND (LOWER(file_path) LIKE '/bin/%' OR LOWER(file_path) LIKE '/usr/bin/%' OR LOWER(file_path) LIKE '/etc/%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY path HAVING host_count <= 2 ORDER BY host_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "File writes to protected system paths occurring on only one or two hosts. Fleet-wide writes are likely updates and ignored.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "file_path" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "runtime-triage", "type": "analytic", "label": "Runtime Triage", "config": { "cite": "required", "tools": [ "databricks", "endpoint" ], "context": [ "evaluate-scoping-risk", "suspicious-shell-launches", "rare-binary-drift" ], "objective": "Determine if the combination of a high-risk container image, a suspicious shell launch, and rare binary drift indicates a successful compromise. Citing specific hosts and processes is required.", "description": "Synthesize initial image risk with observed behavioral anomalies to provide a final verdict.", "max_iterations": 5, "expected_signal": "A verdict per host with supporting evidence.", "success_criteria": "A verdict of malicious | suspicious | benign per host." }, "parents": [ { "id": "suspicious-shell-launches", "kind": "merge" }, { "id": "rare-binary-drift", "kind": "merge" } ] }, { "id": "final-routing", "type": "checkpoint", "label": "Final Routing", "config": { "fuzzy": true, "judge": "hunter", "question": "The runtime-triage verdict is malicious for at least one host.", "condition": "The runtime-triage verdict is malicious for at least one host.", "blind_spot": "container-drift-blindness", "confidence": "high", "description": "Route malicious findings to containment actions or suspicious findings to manual review.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "runtime-triage" } ] }, { "id": "isolate-workload", "type": "action", "label": "Isolate Workload", "config": { "target": "endpoint", "description": "Contain the potentially compromised container node while preserving its state for forensics.", "instructions": "Isolate the compromised host node using the EDR control plane. Do not terminate running pods until a memory dump of the suspicious process is captured.", "action_approval": "required" }, "parents": [ { "id": "final-routing", "branch": "on_supports" } ] }, { "id": "analyst-final-review", "type": "task", "label": "Analyst Final Review", "config": { "assignee": "analyst", "description": "Review findings, confirm drift, and coordinate with the development team for a clean redeployment.", "instructions": "Examine the rare file writes and shell execution context. Verify if the activity corresponds to known maintenance. Coordinate with the cluster owner to redeploy using a hardened, versioned Docker image." }, "parents": [ { "id": "final-routing", "branch": "default" }, { "id": "final-routing", "branch": "on_unavailable" }, { "id": "final-routing", "branch": "on_refutes" }, { "id": "isolate-workload" } ] }, { "id": "close-out-negative", "type": "task", "label": "Close Out (No Findings)", "config": { "assignee": "analyst", "description": "Record the hunt execution over the risk-based scope with a negative result.", "instructions": "Record that the current cluster inventory uses versioned images or that no high-risk tags were found. File a recommendation to enforce image pinning at the policy level." }, "parents": [ { "id": "lead-gate", "branch": "default" }, { "id": "lead-gate", "branch": "on_unavailable" }, { "id": "lead-gate", "branch": "on_refutes" } ] }, { "id": "close-out-hunt", "type": "task", "label": "Close Out Hunt", "config": { "assignee": "analyst", "description": "Finalize the hunt record and document lessons learned.", "instructions": "Update the security policy based on findings. If binary drift was confirmed, work with the platform team to enable immutable infrastructure controls." }, "parents": [ { "id": "analyst-final-review" } ] } ] }