{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Threat actors are bypassing email-based controls by using trusted SaaS environments for phishing. A negative result over the enrolled estate confirms that these high-trust channels are not currently being used as a beachhead." }, "name": "Collaboration Platform Phishing and Execution", "type": "investigation", "labels": [ "hunt", "attack.t1566", "attack.t1684.001" ], "series": { "slug": "identity-abuse-through-trusted-communication-channels", "index": 1, "title": "Identity Abuse Through Trusted Communication Channels", "total": 2 }, "related": [ { "hunt": "mfa-tampering-via-appliance", "reason": "Modification of authentication processes on firewalls or VPN appliances requires distinct logs from vendor-native tables.", "relation": "out-of-scope-alternative" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A rule fires on the lpk.dll filename; the hunt asks whether the host also communicated with an authentication-themed phishing link and whether the parent binary is rare across the fleet, using three surfaces and an agent to weigh the context.", "coverage": [ { "stage": "initial-access-collaboration-phishing", "steps": [ "lead-communication-activity", "lead-agent" ], "status": "covered" }, { "stage": "trusted-channel-impersonation", "steps": [ "lead-communication-activity" ], "status": "covered" }, { "stage": "endpoint-payload-execution", "steps": [ "rare-appdata-binaries", "payload-extraction" ], "status": "covered" }, { "stage": "authentication-process-modification", "reason": "Belongs to another part of the 'Identity Abuse Through Trusted Communication Channels' series.", "status": "out_of_scope" }, { "stage": "credential-exfiltration-webhook", "reason": "Belongs to another part of the 'Identity Abuse Through Trusted Communication Channels' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Identity Phishing via Collaboration Tools", "slug": "initial-access-collaboration-phishing", "tactic": "initial-access", "techniques": [ "T1566" ], "observables": [ "hooks.slack.com", "Google Sites authentication links", "External federation chat requests in Microsoft Teams", "Requests to approve MFA notifications" ] }, { "name": "Impersonation of Trusted Personas", "slug": "trusted-channel-impersonation", "tactic": "stealth", "techniques": [ "T1684.001" ], "observables": [ "Google Meet interview sessions", "IT support impersonation", "Recruitment-themed social engineering", "Malicious GitHub repository cloning" ] }, { "name": "User-Executed Malicious Payloads", "slug": "endpoint-payload-execution", "tactic": "execution", "techniques": [ "T1566" ], "observables": [ "WinRAR.exe", "lpk.dll", "npm install", "Explorer.exe launching RAR files", "Extraction of masquerading DLLs" ] }, { "name": "Modification of Authentication Process", "slug": "authentication-process-modification", "tactic": "persistence", "techniques": [ "T1556" ], "observables": [ "Removal of MFA/2FA from privileged accounts", "Scripts on VPN/firewall appliances disabling security settings", "Creation of weekly scheduled tasks for credential collection" ] }, { "name": "Exfiltration via Native Slack Webhook", "slug": "credential-exfiltration-webhook", "tactic": "exfiltration", "techniques": [ "T1556" ], "observables": [ "POST requests to hooks.slack.com", "curl user-agent in outbound appliance traffic", "Native Slack notification integrations on network hardware" ] } ], "summary": "Threat actors exploit trusted collaboration platforms like Microsoft Teams and Slack to deliver phishing links and impersonate internal stakeholders for initial access. Post-compromise, they maintain persistence by modifying authentication settings on network appliances and use native Slack webhook integrations to exfiltrate credentials and sensitive data." }, "severity": "high", "rationale": "Focus the investigation on users with high-trust profiles like developers or HR personnel. If broad activity is seen on Google Sites, narrow to processes other than the system browser.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has compromised an enterprise identity using collaboration tools to bypass email-based controls and execute malicious code via sideloading or malicious dependencies.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hosts from the scoping step." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "phishing_domains": { "from": { "ref": "unit42-collaboration-abuse", "kind": "article", "observed": "2026-08-20" }, "type": "list[domain]", "default": [ "hooks.slack.com", "sites.google.com", "google.meet" ], "description": "Domains observed in recruitment or IT-themed social engineering campaigns." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/communication-channel-identity-risks/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/communication-channel-identity-risks/", "name": "Unit 42 \u2014 Identity Abuse Through Trusted Communication Channels" } ], "blind_spots": [ { "id": "no-http-visibility", "risk": "If HTTP traffic from the endpoint is not captured, the primary lead for the gated flow is lost.", "stage": "initial-access-collaboration-phishing", "question": "whether the user visited a phishing site or webhook link", "requires": "hb_http_activity or hb_dns_activity" }, { "id": "private-saas-content", "risk": "We can see the destination but not the message that enticed the user.", "stage": "initial-access-collaboration-phishing", "question": "what the specific social engineering bait contained", "requires": "SaaS Audit Logs (Slack/Teams)" } ] }, "name": "Collaboration Platform Phishing and Execution", "description": "The adversary uses high-trust channels like Slack or Teams to deliver phishing links or malicious files, often posing as IT support or recruitment personnel. This hunt identifies hosts using these tools and checks for suspicious outbound traffic to known phishing sites or webhooks. Once a lead is identified, the hunt investigates endpoint activity for characteristic execution patterns, such as the loading of masquerading DLLs or the execution of rare binaries from user-writable folders. An analyst then reviews the correlated network and endpoint evidence to confirm the compromise." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "identity-abuse-through-trusted-communication-channels", "index": 1, "title": "Identity Abuse Through Trusted Communication Channels", "total": 2 }, "coverage": [ { "stage": "initial-access-collaboration-phishing", "steps": [ "lead-communication-activity", "lead-agent" ], "status": "covered" }, { "stage": "trusted-channel-impersonation", "steps": [ "lead-communication-activity" ], "status": "covered" }, { "stage": "endpoint-payload-execution", "steps": [ "rare-appdata-binaries", "payload-extraction" ], "status": "covered" }, { "stage": "authentication-process-modification", "reason": "Belongs to another part of the 'Identity Abuse Through Trusted Communication Channels' series.", "status": "out_of_scope" }, { "stage": "credential-exfiltration-webhook", "reason": "Belongs to another part of the 'Identity Abuse Through Trusted Communication Channels' series.", "status": "out_of_scope" } ], "rationale": "An intruder has compromised an enterprise identity using collaboration tools to bypass email-based controls and execute malicious code via sideloading or malicious dependencies.", "blind_spots": [ { "id": "no-http-visibility", "risk": "If HTTP traffic from the endpoint is not captured, the primary lead for the gated flow is lost.", "stage": "initial-access-collaboration-phishing", "question": "whether the user visited a phishing site or webhook link", "requires": "hb_http_activity or hb_dns_activity" }, { "id": "private-saas-content", "risk": "We can see the destination but not the message that enticed the user.", "stage": "initial-access-collaboration-phishing", "question": "what the specific social engineering bait contained", "requires": "SaaS Audit Logs (Slack/Teams)" } ], "scoping_notes": "Focus the investigation on users with high-trust profiles like developers or HR personnel. If broad activity is seen on Google Sites, narrow to processes other than the system browser.", "beyond_detection": "A rule fires on the lpk.dll filename; the hunt asks whether the host also communicated with an authentication-themed phishing link and whether the parent binary is rare across the fleet, using three surfaces and an agent to weigh the context." } }, { "id": "scope-collaboration-clients", "type": "query", "label": "Scope collaboration tool installation", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%slack%' OR LOWER(package_name) LIKE '%teams%' OR LOWER(package_name) LIKE '%zoom%' OR LOWER(package_name) LIKE '%meet%'", "surface": "hb_software_inventory", "description": "Identify the hosts that could be affected by collaboration-based phishing by listing where Slack, Teams, or meeting software is installed.", "expected_signal": "A list of hosts with collaboration software installed. Silence means these specific tools were not found in the inventory." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope collaboration tool installation", "reads": [ "device_hostname", "package_name", "vendor_name" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%slack%' OR LOWER(package_name) LIKE '%teams%' OR LOWER(package_name) LIKE '%zoom%' OR LOWER(package_name) LIKE '%meet%'", "silence": "not_evidence_of_absence", "expected": "A list of hosts with collaboration software installed. Silence means these specific tools were not found in the inventory.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "lead-communication-activity", "type": "query", "label": "Phishing or webhook communication lead", "config": { "dsl": "sqlite", "role": "triage", "source": "web", "content": "SELECT device_hostname, url_hostname, url_path, url_query, user_agent, actor_user_name, time FROM hb_http_activity WHERE (instr(',' || '{{phishing_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0) AND (LOWER(url_path) LIKE '%login%' OR LOWER(url_path) LIKE '%verify%' OR LOWER(url_path) LIKE '%auth%' OR LOWER(url_path) LIKE '%sign-in%' OR LOWER(url_query) LIKE '%login%' OR LOWER(url_query) LIKE '%verify%' OR LOWER(url_query) LIKE '%auth%' OR LOWER(url_query) LIKE '%sign-in%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_http_activity", "description": "Identify potential phishing links or webhook activity originating from user hosts to established collaboration services, filtering for authentication keywords.", "expected_signal": "Requests to Google Sites authentication proxies or Slack hooks containing auth keywords. Silence proves absence only if proxy logs are complete." }, "parents": [ { "id": "scope-collaboration-clients" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Phishing or webhook communication lead", "reads": [ "device_hostname", "url_hostname", "url_path", "url_query", "user_agent", "actor_user_name", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, url_hostname, url_path, url_query, user_agent, actor_user_name, time FROM hb_http_activity WHERE (instr(',' || '{{phishing_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0) AND (LOWER(url_path) LIKE '%login%' OR LOWER(url_path) LIKE '%verify%' OR LOWER(url_path) LIKE '%auth%' OR LOWER(url_path) LIKE '%sign-in%' OR LOWER(url_query) LIKE '%login%' OR LOWER(url_query) LIKE '%verify%' OR LOWER(url_query) LIKE '%auth%' OR LOWER(url_query) LIKE '%sign-in%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Requests to Google Sites authentication proxies or Slack hooks containing auth keywords. Silence proves absence only if proxy logs are complete.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "lead-agent", "type": "analytic", "label": "Evaluate communication lead", "config": { "cite": "required", "tools": [ "endpoint", "web" ], "context": [ "lead-communication-activity" ], "objective": "Review the URL patterns and paths to identify authentication-themed links. Specifically check the user_agent field for non-browser or outdated versions that indicate automated tools or old-versioned collaboration clients.", "description": "Identify suspicious URLs and user agents that suggest a social engineering or credential harvesting attempt.", "max_iterations": 3, "expected_signal": "A per-host verdict on whether the identified URLs represent a credible phishing or impersonation lead.", "success_criteria": "A verdict for each host citing specific URLs and user agents." }, "parents": [ { "id": "lead-communication-activity" } ] }, { "id": "gate-decision", "type": "checkpoint", "label": "Gate: Is the communication suspicious?", "config": { "fuzzy": true, "judge": "hunter", "question": "the lead-agent verdict indicates suspicious collaboration-related network traffic or unusual user agents for at least one host", "condition": "the lead-agent verdict indicates suspicious collaboration-related network traffic or unusual user agents for at least one host", "blind_spot": "no-http-visibility", "confidence": "medium", "description": "Open the expensive endpoint investigations only when a suspicious communication lead is present.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "lead-agent" } ] }, { "id": "rare-appdata-binaries", "type": "query", "label": "Rare binaries in user-writable paths", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_name) AS filename, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\appdata\\%' OR LOWER(process_path) LIKE '%\\temp\\%' OR LOWER(process_path) LIKE '%/tmp/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_name) HAVING hosts <= 3 ORDER BY hosts, runs", "surface": "hb_process_activity", "description": "Identify unique binaries running from AppData or Temp folders, grouping by filename to avoid user-profile noise.", "expected_signal": "A filename seen on three or fewer hosts; indicates a unique payload or developer-side software." }, "parents": [ { "id": "gate-decision", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare binaries in user-writable paths", "reads": [ "process_name", "process_path", "device_hostname", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_name) AS filename, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\appdata\\%' OR LOWER(process_path) LIKE '%\\temp\\%' OR LOWER(process_path) LIKE '%/tmp/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_name) HAVING hosts <= 3 ORDER BY hosts, runs", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A filename seen on three or fewer hosts; indicates a unique payload or developer-side software.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_name" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "payload-extraction", "type": "query", "label": "Loading of masquerading payloads", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, module_name, module_path, process_name, time FROM hb_module_activity WHERE activity_id = 1 AND (LOWER(module_name) = 'lpk.dll' OR LOWER(module_original_file_name) = 'lpk.dll') AND (LOWER(module_path) LIKE '%\\appdata\\%' OR LOWER(module_path) LIKE '%\\users\\public\\%' OR LOWER(module_path) LIKE '%\\downloads\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_module_activity", "description": "Detect the actual loading of masquerading DLLs, such as lpk.dll, from user-writable paths.", "expected_signal": "A module load event for lpk.dll from a user-writable path, suggesting sideloading." }, "parents": [ { "id": "gate-decision", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Loading of masquerading payloads", "reads": [ "device_hostname", "module_name", "module_path", "process_name", "time" ], "source": "hb_module_activity", "target": "endpoint", "content": "SELECT device_hostname, module_name, module_path, process_name, time FROM hb_module_activity WHERE activity_id = 1 AND (LOWER(module_name) = 'lpk.dll' OR LOWER(module_original_file_name) = 'lpk.dll') AND (LOWER(module_path) LIKE '%\\appdata\\%' OR LOWER(module_path) LIKE '%\\users\\public\\%' OR LOWER(module_path) LIKE '%\\downloads\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A module load event for lpk.dll from a user-writable path, suggesting sideloading.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "triage-agent", "type": "analytic", "label": "Triage phishing and execution", "config": { "cite": "required", "tools": [ "endpoint", "web" ], "context": [ "lead-agent", "rare-appdata-binaries", "payload-extraction" ], "objective": "Identify hosts where a suspicious communication lead from lead-agent is followed by payload loading or rare binary execution within a tight time window.", "description": "Synthesize the network lead and endpoint activity to confirm a collaboration-based identity attack.", "max_iterations": 6, "expected_signal": "A high-confidence verdict linking the social engineering to technical compromise.", "success_criteria": "A confirmed or benign verdict per host with a clear timeline of events." }, "parents": [ { "id": "rare-appdata-binaries", "kind": "merge" }, { "id": "payload-extraction", "kind": "merge" } ] }, { "id": "route-decision", "type": "checkpoint", "label": "Final route", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-agent verdict is malicious for at least one host", "condition": "the triage-agent verdict is malicious for at least one host", "confidence": "high", "description": "Initiate response for confirmed compromises.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-agent" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate endpoint", "config": { "target": "endpoint", "description": "Prevent further lateral movement or credential exfiltration from a compromised beachhead.", "instructions": "Isolate the identified host and collect a triage image of the Downloads and AppData folders.", "action_approval": "required" }, "parents": [ { "id": "route-decision", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst triage review", "config": { "assignee": "analyst", "description": "Final human review of the agent's findings and containment outcome.", "instructions": "Review the correlated network and endpoint evidence. If the DLL sideloading or rare binary execution is confirmed, transition to a full incident response playbook." }, "parents": [ { "id": "gate-decision", "branch": "default" }, { "id": "gate-decision", "branch": "on_unavailable" }, { "id": "route-decision", "branch": "default" }, { "id": "route-decision", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close and document", "config": { "assignee": "analyst", "description": "Standard close-out task for negative results.", "instructions": "Document the lack of evidence for collaboration-based identity phishing in the examined timeframe." }, "parents": [ { "id": "gate-decision", "branch": "on_refutes" }, { "id": "route-decision", "branch": "on_refutes" } ] } ] }