--- analysis: While individual rules fire on schtasks or encoded powershell, this hunt pivots between identity (auth_signin), script content (script_activity), and persistent job configuration (scheduled_job) while baselining outbound traffic to confirm a coherent sequence that a single-surface rule cannot see. The analyst must weigh the combination of these signals to reach a verdict. blind_spots: - id: incomplete-telemetry-chain owner: SIEM Engineering question: Whether a stage of the attack chain is missed due to a host not reporting to one specific surface. remediation: Audit log ingestion for all four required surfaces per Windows asset. requires: Unified coverage across auth, script, and job surfaces risk: If a host reports auth sign-ins but fails to report script activity, the agent will lack the context to confirm execution, leading to a false negative. - id: no-vpn-telemetry owner: Network Engineering question: Whether the remote access occurred via a VPN gateway not reporting to the auth surface. remediation: Integrate VPN logs into hb_auth_signin. requires: hb_auth_signin from VPN provider risk: Remote access via undocumented gateways would bypass the rare-remote-logons query. stage: initial-access-remote-signin coverage: - stage: initial-access-remote-signin status: covered steps: - rare-remote-logons - stage: execution-powershell-scripts status: covered steps: - suspicious-script-activity - stage: persistence-scheduled-task status: covered steps: - scheduled-task-persistence - stage: c2-malicious-network-connection status: covered steps: - suspicious-network-connections guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: Linking identity, execution, and persistence context is the only way to reliably distinguish administrative maintenance from multi-stage intrusions. This hunt prevents single-stage alerts from being closed without investigating the broader intrusion story. methodology: model-assisted trigger: intel-report hypothesis: An adversary has gained initial access via remote services, executed PowerShell for post-exploitation, and established persistence through scheduled tasks to maintain a C2 connection. labels: - hunt - attack.t1053.005 - attack.t1059.001 - attack.t1133 - command and control - execution - initial access - persistence name: Contextual Investigation of Phased PowerShell Intrusions parameters: admin_accounts: default: - Administrator - root - svc_admin description: Privileged accounts to monitor for rare remote interactive sign-ins. from: kind: manual observed: '2024-01-01' ref: internal-privileged-account-list type: list[string] compromised_hostnames: default: [] description: Hosts flagged in the early triage phase to be investigated for persistence. type: list[host] lookback_days: default: '14' description: Days of history to examine. type: number scope_hosts: default: [] description: Initial Windows host list to narrow the search. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.sekoia.com/blog/ai-soc-agents-are-only-as-good-as-the-context-they-can-see gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Focus on Windows domain controllers and administrator workstations first. Ensure that PowerShell Script Block Logging is enabled on target hosts. The hunt filters for hosts with rare remote interactive logins to reduce noise from common network traffic. references: - name: Why AI SOC Agents Need Context to Investigate Alerts url: https://www.sekoia.com/blog/ai-soc-agents-are-only-as-good-as-the-context-they-can-see related: - hunt: lateral-movement-from-privileged-logon reason: This hunt focuses on persistence and C2; lateral movement after a remote admin logon is a distinct follow-on scenario. relation: sibling scenario: stages: - name: External Remote Access observables: - Sign-in from an unusual country - Connection via corporate VPN - Sign-in to privileged administrator account slug: initial-access-remote-signin tactic: initial-access techniques: - T1133 - name: PowerShell Execution observables: - Suspicious PowerShell command-line arguments - Encoded PowerShell commands - PowerShell script blocks downloading external files slug: execution-powershell-scripts tactic: execution techniques: - T1059.001 - name: Scheduled Task Persistence observables: - Scheduled task creation using schtasks - Recurring task execution (e.g., nightly) - Service account assigned to scheduled job slug: persistence-scheduled-task tactic: persistence techniques: - T1053.005 - name: Command and Control Connection observables: - Workstation contacting a malicious IP address - Connection to a suspicious domain - Outbound network traffic from endpoint processes slug: c2-malicious-network-connection tactic: command-and-control summary: An adversary gains initial access through external remote services or compromised accounts, followed by the execution of malicious PowerShell scripts. They establish persistence using scheduled tasks and maintain communication with command-and-control infrastructure via network connections to suspicious IP addresses. severity: medium targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent identity: category: identity name: Identity / sign-in telemetry telemetry: - identity network: category: network name: Network telemetry telemetry: - network tlp: clear type: investigation --- # Contextual Investigation of Phased PowerShell Intrusions This hunt follows a complete attack chain from initial remote access to command and control. By linking identity telemetry from sign-ins with endpoint script activity and persistent scheduled jobs, it distinguishes between routine administrative work and a multi-stage breach. The phased approach allows an agent to first evaluate access and execution evidence before investigating the resulting persistence and rare network connections. The hunt uses two baseline queries to isolate rare behavior from common fleet noise. ## scoping-hosts Narrow the investigation to Windows devices currently reporting telemetry. ```sqlite target=endpoint role=scoping params=(lookback_days=lookback_days) ~~~yaml expected: A list of hostnames. Silence suggests no Windows devices are enrolled. reads: - hostname - platform - time silence: not_evidence_of_absence source: hb_devices verified: dry-run verified_at: '2026-09-29' ~~~ SELECT hostname AS device_hostname FROM hb_devices WHERE platform = 'Windows' AND time >= datetime('now', '-{{lookback_days}} days') ``` ## parallel-early parallel: - → rare-remote-logons - → suspicious-script-activity join: → triage-early-stage ## rare-remote-logons Detect initial access via RDP targeting admin accounts, baselined by host count to find anomalies. ```sqlite target=identity role=baseline params=(admin_accounts=admin_accounts, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Sign-ins from rare source IPs to specific hosts. Silence suggests only common or internal access occurred. prevalence: by: dst_endpoint_name key: - src_endpoint_ip rare_below: 3 reads: - dst_endpoint_name - actor_user_name - src_endpoint_ip - src_location_country - logon_type - time silence: not_evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-09-29' ~~~ SELECT dst_endpoint_name, actor_user_name, src_endpoint_ip, src_location_country, COUNT(DISTINCT dst_endpoint_name) AS host_count, MIN(time) AS first_seen FROM hb_auth_signin WHERE logon_type = 'Remote Interactive' AND (instr(',' || '{{admin_accounts}}' || ',', ',' || actor_user_name || ',') > 0 OR '{{admin_accounts}}' = '') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip, actor_user_name, src_location_country HAVING host_count < 3 ``` ## suspicious-script-activity Search for script blocks containing download logic or web client calls indicative of staging. ```sqlite target=endpoint role=detection-candidate params=(scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: Script contents performing external downloads. Silence means no such script blocks were logged. reads: - device_hostname - actor_user_name - script_content - time silence: not_evidence_of_absence source: hb_script_activity verified: dry-run verified_at: '2026-09-29' ~~~ SELECT device_hostname, actor_user_name, script_content, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%webclient%' OR LOWER(script_content) LIKE '%download%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-early-stage ```agent target=hunter cite: required context: - rare-remote-logons - suspicious-script-activity max_iterations: 4 objective: Determine if remote logins correlate with suspicious script execution on the same hosts or by the same accounts. Output a list of compromised_hostnames that show this combined behavior to be used as a parameter in the next phase. success_criteria: A verdict citing specific logins and script blocks. The output must explicitly list the hostnames for the next phase. tools: - endpoint - identity - network ``` ## parallel-follow-on parallel: - → scheduled-task-persistence - → suspicious-network-connections join: → full-chain-assessment ## scheduled-task-persistence Find scheduled tasks on compromised hosts that execute scripts from user-writable or temporary paths. ```sqlite target=endpoint role=triage params=(compromised_hostnames=compromised_hostnames, lookback_days=lookback_days) ~~~yaml expected: Tasks pointing at staging directories on identified hosts. Silence suggests no persistence via this mechanism. reads: - device_hostname - job_name - job_cmd_line - job_user_name - time silence: not_evidence_of_absence source: hb_scheduled_job verified: dry-run verified_at: '2026-09-29' ~~~ SELECT device_hostname, job_name, job_cmd_line, job_user_name, time FROM hb_scheduled_job WHERE (LOWER(job_cmd_line) LIKE '%powershell%' OR LOWER(job_cmd_line) LIKE '%cmd.exe%') AND (LOWER(job_cmd_line) LIKE '%\\temp\\%' OR LOWER(job_cmd_line) LIKE '%\\public\\%' OR LOWER(job_cmd_line) LIKE '%\\appdata\\%') AND ('{{compromised_hostnames}}' = '' OR instr(',' || '{{compromised_hostnames}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## suspicious-network-connections Identify outbound connections to destinations that are rare across the fleet, suggesting C2 traffic. ```sqlite target=network role=baseline params=(compromised_hostnames=compromised_hostnames, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Connections to rare IPs on identified hosts. Silence provides evidence of absence for new external beaconing from these hosts. prevalence: by: device_hostname key: - dst_endpoint_ip rare_below: 5 reads: - device_hostname - dst_endpoint_ip - process_name - direction - time silence: evidence_of_absence source: hb_network_connection verified: dry-run verified_at: '2026-09-29' ~~~ SELECT device_hostname, dst_endpoint_ip, process_name, COUNT(*) AS connection_count, MIN(time) AS first_seen FROM hb_network_connection WHERE direction = 'outbound' AND ('{{compromised_hostnames}}' = '' OR instr(',' || '{{compromised_hostnames}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip, process_name HAVING (SELECT COUNT(DISTINCT device_hostname) FROM hb_network_connection AS internal WHERE internal.dst_endpoint_ip = hb_network_connection.dst_endpoint_ip) < 5 ``` ## full-chain-assessment ```agent target=hunter cite: required context: - triage-early-stage - scheduled-task-persistence - suspicious-network-connections max_iterations: 5 objective: Evaluate the complete attack chain per host. Specifically assess the temporal proximity between the remote logins (Step 3) and the task creation (Step 7). Determine if the persistence and rare connections represent a coherent multi-stage intrusion. success_criteria: A verdict citing rows from all phases. The agent must comment on whether tasks were created shortly after a suspicious login. tools: - endpoint - identity - network ``` ## route-on-verdict if~: "the full-chain-assessment verdict identifies a malicious sequence of access, execution, and either persistence or C2 traffic, especially where the task was created shortly after login" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: incomplete-telemetry-chain) else: → analyst-review ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host identified in the full-chain verdict and revoke active sessions for the involved administrator account. ``` → analyst-review ## analyst-review ```manual target=analyst Examine the timeline constructed by the agent. Verify if the PowerShell script execution and scheduled task align with legitimate administrator maintenance or represent an intrusion. Confirm if the outbound IP is an unknown destination. ``` → hunt-closeout ## hunt-closeout ```manual target=analyst Document the investigation findings. Record which hosts were identified and why others were excluded. List any rare destination IPs found for potential blocklisting. ``` → end