{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Blockchain gateways and SaaS platforms for C2 resolution make traditional domain blacklisting ineffective. Identifying rare lookups to these services detects resilient malware before ransomware deployment."
      },
      "name": "Decentralized and SaaS C2 Infrastructure",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1102.001",
        "attack.t1572"
      ],
      "series": {
        "slug": "flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware",
        "index": 2,
        "title": "Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware",
        "total": 3
      },
      "related": [
        {
          "hunt": "initial-access-trojanized-msi",
          "reason": "This hunt focuses on network aftermath; the malicious MSI installation is a separate execution stage.",
          "relation": "out-of-scope-alternative"
        },
        {
          "hunt": "secondary-payload-sideloading",
          "reason": "Sideloading detection requires file and module activity telemetry not used in this network hunt.",
          "relation": "out-of-scope-alternative"
        },
        {
          "hunt": "etherrat-tuktuk-infection-discovery",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "Static detection rules for specific gateways are easily bypassed by rotating infrastructure. This hunt uses prevalence and behavioral process correlation across multiple surfaces to find the infrastructure-agnostic pattern of decentralized resolution.",
      "coverage": [
        {
          "stage": "blockchain-and-saas-c2",
          "steps": [
            "dns-lookups-to-infra",
            "rare-infrastructure-lookups",
            "suspicious-outbound-connections"
          ],
          "status": "covered"
        },
        {
          "stage": "initial-access-trojanized-msi",
          "reason": "Belongs to the initial access hunt in this series.",
          "status": "out_of_scope"
        },
        {
          "stage": "impact-gpo-ransomware",
          "reason": "Requires hb_scheduled_job and hb_file_activity over the SYSVOL directory.",
          "status": "not_visible"
        },
        {
          "stage": "etherrat-execution-node-js",
          "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "persistence-registry-run-key",
          "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "internal-reconnaissance-and-discovery",
          "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "secondary-payload-sideloading",
          "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "credential-access-lsass-dumping",
          "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "lateral-movement-rmm-and-netexec",
          "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "data-exfiltration-rclone",
          "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Trojanized MSI installer",
            "slug": "initial-access-trojanized-msi",
            "tactic": "initial-access",
            "techniques": [
              "T1204.002"
            ],
            "observables": [
              "msiexec.exe /V",
              "MVnVmUYj.cmd",
              "RAMMap utility masquerade"
            ]
          },
          {
            "name": "EtherRAT execution via Node.js",
            "slug": "etherrat-execution-node-js",
            "tactic": "execution",
            "techniques": [
              "T1059.003",
              "T1105"
            ],
            "observables": [
              "curl -sLo \"C:\\Users\\REDACTED\\AppData\\Local\\Temp\\9gY0LJMyXW.zip\" \"https://nodejs.org/dist/v18.20.5/node-v18.20.5-win-x64.zip\"",
              "node-v18.20.5-win-x64.zip",
              "node.exe",
              "A7Pnj975bl.cfg"
            ]
          },
          {
            "name": "Persistence via Registry Run key",
            "slug": "persistence-registry-run-key",
            "tactic": "persistence",
            "techniques": [
              "T1547.001"
            ],
            "observables": [
              "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v AppResolver /d \"conhost --headless \"C:\\Users\\REDACTED\\AppData\\Local\\P2RsupmqXnmx\\gksVMg\\node.exe\" \"C:\\Users\\REDACTED\\AppData\\Local\\P2RsupmqXnmx\\A7Pnj975bl.cfg\"\" /f",
              "AppResolver"
            ]
          },
          {
            "name": "Internal reconnaissance and discovery",
            "slug": "internal-reconnaissance-and-discovery",
            "tactic": "discovery",
            "techniques": [
              "T1082",
              "T1518.001",
              "T1087.002",
              "T1018"
            ],
            "observables": [
              "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command \"[System.Globalization.CultureInfo]::InstalledUICulture.Name\"",
              "powershell -Command \"try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }\"",
              "net group \"Domain Admins\" /domain",
              "nltest /domain_trusts /all_trusts",
              "netscan.exe"
            ]
          },
          {
            "name": "TukTuk deployment via DLL sideloading",
            "slug": "secondary-payload-sideloading",
            "tactic": "defense-evasion",
            "techniques": [
              "T1574.002"
            ],
            "observables": [
              "Greenshot.exe",
              "SyncTrayzor.exe",
              "docfx.exe",
              "Cake.exe"
            ]
          },
          {
            "name": "Blockchain and SaaS C2",
            "slug": "blockchain-and-saas-c2",
            "tactic": "command-and-control",
            "techniques": [
              "T1102.001",
              "T1572"
            ],
            "observables": [
              "1rpc.io",
              "goldsky.arweave.net",
              "trycloudflare.com",
              "supabase.co",
              "1rpc.io",
              "goldsky.arweave.net"
            ]
          },
          {
            "name": "Credential Access via LSASS dumping",
            "slug": "credential-access-lsass-dumping",
            "tactic": "credential-access",
            "techniques": [
              "T1003.001",
              "T1558.003"
            ],
            "observables": [
              "rundll32.exe C:\\windows\\System32\\comsvcs.dll, #+0000^24",
              "Kerberoasting",
              "NTDS dumping"
            ]
          },
          {
            "name": "Lateral movement via RMM and NetExec",
            "slug": "lateral-movement-rmm-and-netexec",
            "tactic": "lateral-movement",
            "techniques": [
              "T1219",
              "T1021.001",
              "T1021.002"
            ],
            "observables": [
              "GoToResolveProcessChecker.exe",
              "nxc smb REDACTED_IP -u REDACTED_USER -p REDACTED_PASSWORD --ntds",
              "nxc",
              "winrm"
            ]
          },
          {
            "name": "Data exfiltration via Rclone",
            "slug": "data-exfiltration-rclone",
            "tactic": "exfiltration",
            "techniques": [
              "T1567.002"
            ],
            "observables": [
              "rclone",
              "Wasabi cloud storage"
            ]
          },
          {
            "name": "Ransomware deployment via GPO",
            "slug": "impact-gpo-ransomware",
            "tactic": "impact",
            "techniques": [
              "T1486",
              "T1489",
              "T1053.005",
              "T1484.001"
            ],
            "observables": [
              "The Gentlemen ransomware",
              "Microsoft Defender disabled",
              "GPO execution via SYSVOL/NETLOGON",
              "vssadmin.exe delete shadows"
            ]
          }
        ],
        "summary": "A threat actor used a trojanized MSI installer to deploy EtherRAT, leveraging Ethereum blockchain and TryCloudflare for resilient C2 before deploying the TukTuk framework via DLL sideloading. The intrusion progressed through extensive AD discovery and lateral movement using NetExec and GoTo Resolve, concluding with data exfiltration via Rclone and domain-wide deployment of The Gentleman ransomware via GPO and scheduled tasks."
      },
      "severity": "high",
      "rationale": "The hunt begins with endpoints and servers that lack a business requirement for blockchain or decentralized storage access. Focus on high-value targets like domain controllers and database servers first.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An intruder uses decentralized blockchain gateways or SaaS platforms to resolve C2 configuration and tunnel traffic, bypassing static network perimeter filters.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Specific hosts to investigate; leave empty to scan the entire estate."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of historical telemetry to examine."
        },
        "malware_process_names": {
          "from": {
            "ref": "https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/",
            "kind": "article",
            "observed": "2026-05-11"
          },
          "type": "list[string]",
          "default": [
            "node.exe",
            "greenshot.exe",
            "synctrayzor.exe",
            "docfx.exe",
            "cake.exe"
          ],
          "description": "Legitimate process names abused or trojanized in this intrusion."
        },
        "c2_infrastructure_domains": {
          "from": {
            "ref": "https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/",
            "kind": "article",
            "observed": "2026-05-11"
          },
          "type": "list[domain]",
          "default": [
            "1rpc.io",
            "goldsky.arweave.net",
            "arweave.net",
            "g8way.io",
            "supabase.co",
            "supabase.com",
            "trycloudflare.com",
            "ably.com",
            "clickhouse.com"
          ],
          "description": "Known blockchain gateways and SaaS platforms used for C2 resolution."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/",
          "name": "The DFIR Report \u2014 Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware"
        }
      ],
      "blind_spots": [
        {
          "id": "no-dns-process-correlation",
          "risk": "An analyst cannot distinguish between a browser visit and background malware resolution, increasing false positives.",
          "stage": "blockchain-and-saas-c2",
          "question": "Which process initiated the blockchain gateway resolution?",
          "requires": "endpoint telemetry linking DNS queries to specific processes"
        },
        {
          "id": "encrypted-c2-payloads",
          "risk": "The hunt sees the gateway but not the contents of the configuration rotation.",
          "stage": "blockchain-and-saas-c2",
          "question": "What configuration was retrieved from the Ethereum or Arweave blob?",
          "requires": "TLS inspection or memory forensics"
        }
      ]
    },
    "name": "Decentralized and SaaS C2 Infrastructure",
    "description": "This hunt targets the network infrastructure pattern used by EtherRAT and TukTuk. These malware families use Ethereum and Arweave blockchain gateways to resolve dynamic C2 addresses and use SaaS platforms like Supabase or TryCloudflare for persistent command channels. The hunt identifies rare lookups to these services and correlates them with suspicious processes or non-standard binaries executing on the host."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware",
          "index": 2,
          "title": "Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware",
          "total": 3
        },
        "coverage": [
          {
            "stage": "blockchain-and-saas-c2",
            "steps": [
              "dns-lookups-to-infra",
              "rare-infrastructure-lookups",
              "suspicious-outbound-connections"
            ],
            "status": "covered"
          },
          {
            "stage": "initial-access-trojanized-msi",
            "reason": "Belongs to the initial access hunt in this series.",
            "status": "out_of_scope"
          },
          {
            "stage": "impact-gpo-ransomware",
            "reason": "Requires hb_scheduled_job and hb_file_activity over the SYSVOL directory.",
            "status": "not_visible"
          },
          {
            "stage": "etherrat-execution-node-js",
            "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "persistence-registry-run-key",
            "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "internal-reconnaissance-and-discovery",
            "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "secondary-payload-sideloading",
            "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "credential-access-lsass-dumping",
            "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "lateral-movement-rmm-and-netexec",
            "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "data-exfiltration-rclone",
            "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An intruder uses decentralized blockchain gateways or SaaS platforms to resolve C2 configuration and tunnel traffic, bypassing static network perimeter filters.",
        "blind_spots": [
          {
            "id": "no-dns-process-correlation",
            "risk": "An analyst cannot distinguish between a browser visit and background malware resolution, increasing false positives.",
            "stage": "blockchain-and-saas-c2",
            "question": "Which process initiated the blockchain gateway resolution?",
            "requires": "endpoint telemetry linking DNS queries to specific processes"
          },
          {
            "id": "encrypted-c2-payloads",
            "risk": "The hunt sees the gateway but not the contents of the configuration rotation.",
            "stage": "blockchain-and-saas-c2",
            "question": "What configuration was retrieved from the Ethereum or Arweave blob?",
            "requires": "TLS inspection or memory forensics"
          }
        ],
        "scoping_notes": "The hunt begins with endpoints and servers that lack a business requirement for blockchain or decentralized storage access. Focus on high-value targets like domain controllers and database servers first.",
        "beyond_detection": "Static detection rules for specific gateways are easily bypassed by rotating infrastructure. This hunt uses prevalence and behavioral process correlation across multiple surfaces to find the infrastructure-agnostic pattern of decentralized resolution."
      }
    },
    {
      "id": "dns-lookups-to-infra",
      "type": "query",
      "label": "DNS lookups to decentralized infrastructure",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, query_hostname, time FROM hb_dns_activity WHERE (instr(',' || '{{c2_infrastructure_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%.trycloudflare.com') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_dns_activity",
        "description": "Find hosts resolving blockchain gateways or SaaS C2 platforms mentioned in the report to build a candidate list.",
        "expected_signal": "The query returns a list of hosts and processes communicating with decentralized infrastructure. Silence means no direct resolution of these domains occurred."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "DNS lookups to decentralized infrastructure",
        "reads": [
          "device_hostname",
          "process_name",
          "query_hostname",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, query_hostname, time FROM hb_dns_activity WHERE (instr(',' || '{{c2_infrastructure_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%.trycloudflare.com') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "The query returns a list of hosts and processes communicating with decentralized infrastructure. Silence means no direct resolution of these domains occurred.",
        "verified": "dry-run",
        "verified_at": "2026-09-24"
      }
    },
    {
      "id": "rare-infrastructure-lookups",
      "type": "query",
      "label": "Rare infrastructure domain lookups",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT LOWER(query_hostname) AS domain, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS lookup_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE (instr(',' || '{{c2_infrastructure_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%.trycloudflare.com') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY domain HAVING host_count <= 5 ORDER BY host_count ASC",
        "surface": "hb_dns_activity",
        "description": "Stack-count domain lookups to blockchain and SaaS gateways to isolate unusual resolution behavior in the fleet.",
        "expected_signal": "The query returns domains appearing on five or fewer hosts. These are high-priority candidates for decentralized C2 resolution."
      },
      "parents": [
        {
          "id": "dns-lookups-to-infra"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare infrastructure domain lookups",
        "reads": [
          "query_hostname",
          "device_hostname",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT LOWER(query_hostname) AS domain, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS lookup_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE (instr(',' || '{{c2_infrastructure_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%.trycloudflare.com') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY domain HAVING host_count <= 5 ORDER BY host_count ASC",
        "silence": "evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "The query returns domains appearing on five or fewer hosts. These are high-priority candidates for decentralized C2 resolution.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "query_hostname"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-09-24"
      }
    },
    {
      "id": "suspicious-outbound-connections",
      "type": "query",
      "label": "Suspicious outbound network connections",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "network",
        "content": "SELECT device_hostname, process_name, process_path, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE (instr(',' || '{{malware_process_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_path) LIKE '%\\\\appdata\\\\%' OR LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%') AND direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_network_connection",
        "description": "Identify established network connections from the trojanized binaries or processes running from suspicious user-writable paths.",
        "expected_signal": "The query shows trojanized binaries or user-path executables making outbound connections. Rare destination ports or IPs increase suspicion."
      },
      "parents": [
        {
          "id": "dns-lookups-to-infra"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Suspicious outbound network connections",
        "reads": [
          "device_hostname",
          "process_name",
          "process_path",
          "dst_endpoint_ip",
          "dst_endpoint_port",
          "direction",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, process_name, process_path, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE (instr(',' || '{{malware_process_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_path) LIKE '%\\\\appdata\\\\%' OR LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%') AND direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "The query shows trojanized binaries or user-path executables making outbound connections. Rare destination ports or IPs increase suspicion.",
        "verified": "dry-run",
        "verified_at": "2026-09-24"
      }
    },
    {
      "id": "triage-network-evidence",
      "type": "analytic",
      "label": "Triage network evidence",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "dns-lookups-to-infra",
          "rare-infrastructure-lookups",
          "suspicious-outbound-connections"
        ],
        "objective": "Determine if network connections to blockchain/SaaS domains represent legitimate use or decentralized C2 activity for EtherRAT and TukTuk.",
        "description": "Analyze combined DNS and network connection data to determine if a host is using blockchain or SaaS for C2.",
        "max_iterations": 6,
        "expected_signal": "The agent returns a per-host verdict citing specific rows from the DNS lookups and network connections.",
        "success_criteria": "A verdict of malicious, suspicious, or benign for each host, citing rare domains or suspicious process paths."
      },
      "parents": [
        {
          "id": "rare-infrastructure-lookups",
          "kind": "merge"
        },
        {
          "id": "suspicious-outbound-connections",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious for at least one host",
        "condition": "the triage verdict is malicious for at least one host",
        "blind_spot": "no-dns-process-correlation",
        "confidence": "high",
        "description": "Route the hunt based on the agent triage results.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-network-evidence"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate affected host",
      "config": {
        "target": "endpoint",
        "description": "Stop potential C2 traffic and exfiltration by isolating the host from the network.",
        "instructions": "Isolate the host and preserve its memory for further analysis of the C2 configuration blob.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Manual analyst review",
      "config": {
        "assignee": "analyst",
        "description": "Verify the agent findings and investigate for additional indicators like memory-resident artifacts.",
        "instructions": "Review the DNS and network connection rows. Check for parent-child relationships between node.exe and suspicious payloads. Search for Drive-Id patterns if Arweave gateways were contacted."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Hunt close out",
      "config": {
        "assignee": "analyst",
        "description": "Document findings and update the hunt for future iterations.",
        "instructions": "Summarize findings. If new C2 domains were discovered in command lines or telemetry, update the parameter list for future runs."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-review"
        }
      ]
    }
  ]
}