{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Nearly half of malware with C2 activity bypasses DNS entirely. This hunt correlates connection metadata (D2IP) with application indicators (malformed methods) to identify what standard DNS-based filtering misses."
      },
      "name": "D2IP Malware and Obfuscated HTTP Exfiltration",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1071.001",
        "attack.t1568",
        "attack.t1041",
        "attack.t1132.001",
        "attack.t1185",
        "attack.t1056.001",
        "attack.t1105"
      ],
      "related": [
        {
          "hunt": "standard-http-c2-path-hunting",
          "reason": "This hunt focuses on connections that lack a preceding DNS resolution; standard hunts assume resolution exists.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A simple detection rule for the backslash-GET method or known IPs is easily bypassed by rotation. This hunt adds value by baselining Direct-to-IP behavior across the fleet, allowing an analyst to find unknown threats using the same behavioral profile.",
      "coverage": [
        {
          "stage": "direct-to-ip-payload-delivery",
          "steps": [
            "match-known-c2-ips",
            "suspicious-proxy-endpoints"
          ],
          "status": "covered"
        },
        {
          "stage": "dns-bypass-c2",
          "steps": [
            "baseline-d2ip-connections",
            "match-known-c2-ips"
          ],
          "status": "covered"
        },
        {
          "stage": "obfuscated-http-exfiltration",
          "steps": [
            "malformed-backslash-get"
          ],
          "status": "covered"
        },
        {
          "stage": "in-browser-proxy-theft",
          "steps": [
            "suspicious-proxy-endpoints"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "D2IP Payload Delivery",
            "slug": "direct-to-ip-payload-delivery",
            "tactic": "execution",
            "techniques": [
              "T1105"
            ],
            "observables": [
              "/st.exe",
              "/hiddenbin/",
              "Wget/1.13.4",
              "HTTP Range headers",
              "178.16.54.109",
              "2.26.98.67"
            ]
          },
          {
            "name": "DNS-Bypass Command and Control",
            "slug": "dns-bypass-c2",
            "tactic": "command-and-control",
            "techniques": [
              "T1071.001",
              "T1568"
            ],
            "observables": [
              "wss://154.92.19.71:39989",
              "154.92.19.71",
              "87.120.107.33",
              "194.76.227.94",
              "Hardcoded IP addresses in binary strings",
              "TCP connections without prior DNS queries"
            ]
          },
          {
            "name": "Obfuscated HTTP Exfiltration",
            "slug": "obfuscated-http-exfiltration",
            "tactic": "exfiltration",
            "techniques": [
              "T1041",
              "T1132.001"
            ],
            "observables": [
              "\\GET method prefix",
              "URI length 250-666 characters",
              "Hex-like payload encoding",
              "Rotating destination ports and IPs"
            ]
          },
          {
            "name": "In-Browser Proxy Credential Theft",
            "slug": "in-browser-proxy-theft",
            "tactic": "credential-access",
            "techniques": [
              "T1185",
              "T1056.001"
            ],
            "observables": [
              "/churl",
              "/fsave",
              "pcid",
              "clid",
              "87.120.107.33",
              "194.76.227.94"
            ]
          }
        ],
        "summary": "Nearly half of modern malware samples bypass DNS-based defenses by using direct-to-IP (D2IP) communication for command-and-control and payload delivery. High-profile threats including Phorpiex, SectopRAT, and Mozi botnets utilize this technique to download components, exfiltrate credentials via in-browser proxies, and maintain P2P mesh networks while remaining invisible to DNS security layers."
      },
      "severity": "high",
      "rationale": "Start with general endpoints. If high-fidelity malformed HTTP activity is detected, focus specifically on those hosts and expand the lookback to catch the original infection vector.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is using hard-coded IP addresses and malformed HTTP protocols to bypass DNS-based security controls, exfiltrate data, and proxy credential theft in real-time.",
      "parameters": {
        "c2_ips": {
          "from": {
            "ref": "unit42-d2ip-2024",
            "kind": "article",
            "observed": "2024-08-04"
          },
          "type": "list[ip]",
          "default": [
            "154.92.19.71",
            "178.16.54.109",
            "87.120.107.33",
            "194.76.227.94",
            "2.26.98.67",
            "62.60.179.230",
            "91.92.243.29",
            "103.245.236.146",
            "178.16.54.31",
            "206.189.229.43"
          ],
          "description": "Known malicious destination IP addresses from the research."
        },
        "scope_hosts": {
          "from": {
            "ref": "analyst-defined",
            "kind": "manual",
            "observed": "2024-08-04"
          },
          "type": "list[host]",
          "default": [],
          "description": "Optional list of hostnames to focus the hunt; leave empty to scan the entire estate."
        },
        "lookback_days": {
          "from": {
            "ref": "standard-lookback",
            "kind": "manual",
            "observed": "2024-08-04"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "malicious_paths": {
          "from": {
            "ref": "unit42-d2ip-2024",
            "kind": "article",
            "observed": "2024-08-04"
          },
          "type": "list[string]",
          "default": [
            "/churl",
            "/fsave",
            "/new.php",
            "/st.exe"
          ],
          "description": "URI paths associated with Phorpiex and SectopRAT exfiltration and payload delivery."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/",
          "name": "Unit 42 \u2014 Almost Half of Malware Samples Communicate Direct to IP"
        }
      ],
      "blind_spots": [
        {
          "id": "incomplete-proxy-visibility",
          "risk": "Malware using TLS will hide its URI and HTTP method from the surface, leaving only raw IP destination metadata in hb_network_connection.",
          "stage": "obfuscated-http-exfiltration",
          "question": "whether encrypted HTTPS requests use the backslash-GET method or malicious paths",
          "requires": "hb_http_activity from a decrypted forward proxy"
        },
        {
          "id": "dns-cache-hits",
          "risk": "A host might appear to be performing D2IP if its local cache answered the query and the telemetry source only captures live network DNS traffic.",
          "stage": "dns-bypass-c2",
          "question": "whether a connection was truly D2IP or simply missed because the OS cache was used",
          "requires": "hb_dns_activity covering both live lookups and local cache hits"
        }
      ]
    },
    "name": "D2IP Malware and Obfuscated HTTP Exfiltration",
    "description": "This hunt identifies malware that avoids DNS resolution, rendering standard DNS-based filtering blind. It focuses on identifying Direct-to-IP (D2IP) connections, corroborating them with malformed HTTP signals like the backslash-GET method and long encoded URIs, and checking for specific browser-proxy endpoints used by SectopRAT for credential theft. It follows a phased approach to link network-level anomalies with application-layer evidence of exfiltration."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "direct-to-ip-payload-delivery",
            "steps": [
              "match-known-c2-ips",
              "suspicious-proxy-endpoints"
            ],
            "status": "covered"
          },
          {
            "stage": "dns-bypass-c2",
            "steps": [
              "baseline-d2ip-connections",
              "match-known-c2-ips"
            ],
            "status": "covered"
          },
          {
            "stage": "obfuscated-http-exfiltration",
            "steps": [
              "malformed-backslash-get"
            ],
            "status": "covered"
          },
          {
            "stage": "in-browser-proxy-theft",
            "steps": [
              "suspicious-proxy-endpoints"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary is using hard-coded IP addresses and malformed HTTP protocols to bypass DNS-based security controls, exfiltrate data, and proxy credential theft in real-time.",
        "blind_spots": [
          {
            "id": "incomplete-proxy-visibility",
            "risk": "Malware using TLS will hide its URI and HTTP method from the surface, leaving only raw IP destination metadata in hb_network_connection.",
            "stage": "obfuscated-http-exfiltration",
            "question": "whether encrypted HTTPS requests use the backslash-GET method or malicious paths",
            "requires": "hb_http_activity from a decrypted forward proxy"
          },
          {
            "id": "dns-cache-hits",
            "risk": "A host might appear to be performing D2IP if its local cache answered the query and the telemetry source only captures live network DNS traffic.",
            "stage": "dns-bypass-c2",
            "question": "whether a connection was truly D2IP or simply missed because the OS cache was used",
            "requires": "hb_dns_activity covering both live lookups and local cache hits"
          }
        ],
        "scoping_notes": "Start with general endpoints. If high-fidelity malformed HTTP activity is detected, focus specifically on those hosts and expand the lookback to catch the original infection vector.",
        "beyond_detection": "A simple detection rule for the backslash-GET method or known IPs is easily bypassed by rotation. This hunt adds value by baselining Direct-to-IP behavior across the fleet, allowing an analyst to find unknown threats using the same behavioral profile."
      }
    },
    {
      "id": "scope-managed-endpoints",
      "type": "query",
      "label": "Scope to managed endpoints",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE package_type IN ('deb', 'rpm', 'msi', 'pkg')",
        "surface": "hb_software_inventory",
        "description": "Identify active hosts in the inventory to provide a baseline for the scope_hosts parameter.",
        "expected_signal": "A list of hostnames representing the managed estate. This step is for inventory reference."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Scope to managed endpoints",
        "reads": [
          "device_hostname",
          "package_type"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE package_type IN ('deb', 'rpm', 'msi', 'pkg')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames representing the managed estate. This step is for inventory reference.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "match-known-c2-ips",
      "type": "query",
      "label": "Match known C2 IP addresses",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "network",
        "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_network_connection",
        "description": "Identify any host directly contacting the IP addresses named in the research.",
        "expected_signal": "Connections to specific report IPs. Silence is expected if the adversary has rotated their infrastructure."
      },
      "parents": [
        {
          "id": "scope-managed-endpoints"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Match known C2 IP addresses",
        "reads": [
          "device_hostname",
          "process_name",
          "dst_endpoint_ip",
          "dst_endpoint_port",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Connections to specific report IPs. Silence is expected if the adversary has rotated their infrastructure.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "baseline-d2ip-connections",
      "type": "query",
      "label": "Stack-count connections without DNS resolution",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "network",
        "content": "SELECT dst_endpoint_ip, process_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_network_connection WHERE (dst_endpoint_hostname IS NULL OR dst_endpoint_hostname = '') AND direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_ip, process_name HAVING host_count <= 3 ORDER BY host_count ASC",
        "surface": "hb_network_connection",
        "description": "Find rare outbound connections where the hostname is missing, indicating a D2IP bypass.",
        "expected_signal": "Small clusters of hosts talking to an IP that was never resolved via DNS. Benign tools (like internal admin scripts) will have high host counts."
      },
      "parents": [
        {
          "id": "scope-managed-endpoints"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Stack-count connections without DNS resolution",
        "reads": [
          "dst_endpoint_ip",
          "process_name",
          "device_hostname",
          "dst_endpoint_hostname",
          "direction",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT dst_endpoint_ip, process_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_network_connection WHERE (dst_endpoint_hostname IS NULL OR dst_endpoint_hostname = '') AND direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_ip, process_name HAVING host_count <= 3 ORDER BY host_count ASC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Small clusters of hosts talking to an IP that was never resolved via DNS. Benign tools (like internal admin scripts) will have high host counts.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "dst_endpoint_ip",
            "process_name"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "early-stage-agent",
      "type": "analytic",
      "label": "Evaluate early C2 and D2IP findings",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network",
          "web"
        ],
        "context": [
          "match-known-c2-ips",
          "baseline-d2ip-connections"
        ],
        "objective": "Identify hosts making rare or matched outbound connections that bypassed DNS resolution.",
        "description": "Determine which hosts exhibit the most suspicious Direct-to-IP behavior to focus the follow-on application search.",
        "max_iterations": 3,
        "expected_signal": "A prioritized list of hosts with suspicious network-plane behavior.",
        "success_criteria": "A verdict of suspicious or malicious for hosts with low-prevalence D2IP traffic."
      },
      "parents": [
        {
          "id": "match-known-c2-ips",
          "kind": "merge"
        },
        {
          "id": "baseline-d2ip-connections",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "malformed-backslash-get",
      "type": "query",
      "label": "Detect malformed backslash-GET and long URIs",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "web",
        "content": "SELECT device_hostname, http_method, url_full, LENGTH(url_full) AS uri_len, time FROM hb_http_activity WHERE (http_method LIKE '%\\GET%' OR LENGTH(url_full) BETWEEN 250 AND 666) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Find the high-fidelity backslash-GET method and URIs with lengths (250-666) characteristic of exfiltration.",
        "expected_signal": "Requests using '\\GET' or unusually long URIs. Benign tracking scripts may have long URIs, but the '\\GET' string is a definitive malware indicator."
      },
      "parents": [
        {
          "id": "early-stage-agent"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Detect malformed backslash-GET and long URIs",
        "reads": [
          "device_hostname",
          "http_method",
          "url_full",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, http_method, url_full, LENGTH(url_full) AS uri_len, time FROM hb_http_activity WHERE (http_method LIKE '%\\GET%' OR LENGTH(url_full) BETWEEN 250 AND 666) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Requests using '\\GET' or unusually long URIs. Benign tracking scripts may have long URIs, but the '\\GET' string is a definitive malware indicator.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "suspicious-proxy-endpoints",
      "type": "query",
      "label": "Detect suspicious proxy and dropper endpoints",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "web",
        "content": "SELECT device_hostname, url_path, url_hostname, time FROM hb_http_activity WHERE (instr(',' || '{{malicious_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0 OR url_path LIKE '%/hiddenbin/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Find traffic to endpoints used by Phorpiex and SectopRAT for payload delivery and credential exfiltration.",
        "expected_signal": "Requests to /churl, /fsave, /st.exe, or hidden directories. Matching these on hosts that also show D2IP behavior confirms a high-confidence threat."
      },
      "parents": [
        {
          "id": "early-stage-agent"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Detect suspicious proxy and dropper endpoints",
        "reads": [
          "device_hostname",
          "url_path",
          "url_hostname",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_path, url_hostname, time FROM hb_http_activity WHERE (instr(',' || '{{malicious_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0 OR url_path LIKE '%/hiddenbin/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Requests to /churl, /fsave, /st.exe, or hidden directories. Matching these on hosts that also show D2IP behavior confirms a high-confidence threat.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "follow-on-agent",
      "type": "analytic",
      "label": "Final synthesis and verdict",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network",
          "web"
        ],
        "context": [
          "early-stage-agent",
          "malformed-backslash-get",
          "suspicious-proxy-endpoints"
        ],
        "objective": "Link D2IP connections from the first phase to malformed HTTP exfiltration or browser-proxy activity in the second phase.",
        "description": "Correlate early stage network findings with the follow-on application signals to identify confirmed compromises.",
        "max_iterations": 5,
        "expected_signal": "A confirmed list of compromised hosts with specific evidence of exfiltration or theft.",
        "success_criteria": "A malicious verdict for any host where a D2IP network connection correlates with malformed HTTP methods or known-bad URIs."
      },
      "parents": [
        {
          "id": "malformed-backslash-get",
          "kind": "merge"
        },
        {
          "id": "suspicious-proxy-endpoints",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the follow-on-agent verdict is malicious for at least one host",
        "condition": "the follow-on-agent verdict is malicious for at least one host",
        "blind_spot": "incomplete-proxy-visibility",
        "confidence": "high",
        "description": "Direct confirmed threats to containment and ambiguous cases to manual review.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "follow-on-agent"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate compromised host",
      "config": {
        "target": "endpoint",
        "description": "Prevent further exfiltration of credentials and data.",
        "instructions": "Isolate the host immediately. Collect the binary responsible for the network traffic and examine it for hard-coded IP strings. Revoke any browser session tokens used by the host during the lookback period.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst review and tuning",
      "config": {
        "assignee": "analyst",
        "description": "Review evidence for ambiguous findings and refine the D2IP baseline.",
        "instructions": "Examine the context of the D2IP connections. If the destination is a cloud provider (AWS/Azure) and the URI contains long encoded strings, prioritize the investigation. Verify if the process is a legitimate browser or a standalone binary."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Document findings and schedule the hunt for future execution.",
        "instructions": "Record the results. If no malicious activity was found, ensure any newly discovered legitimate D2IP admin tools are noted for future exclusions."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}