{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Phishing and supply chain compromise are the primary entry vectors for most intrusion campaigns. Verifying the absence of these footholds over the reporting window provides significant assurance of security posture." }, "name": "Delivery and Payload Execution Monitoring", "type": "investigation", "labels": [ "hunt", "attack.t1566", "attack.t1195", "attack.t1204.002", "initial access" ], "series": { "slug": "top-5-initial-access-threat-vectors-observed-by-unit-42-in-september-2026", "index": 2, "title": "Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026", "total": 2 }, "related": [ { "hunt": "public-application-exploitation-perimeter", "reason": "This hunt focuses on client-side and internal software vectors; edge application exploitation is a distinct threat model.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "Standard rules may detect known malicious hashes, but this hunt uses prevalence (stack-counting) and cross-surface corroboration (installer history joined with browser downloads and rare process execution) to identify previously unseen payloads.", "coverage": [ { "stage": "phishing-and-social-engineering", "steps": [ "rare-writable-processes", "phishing-downloads" ], "status": "covered" }, { "stage": "supply-chain-compromise", "steps": [ "unusual-installers" ], "status": "covered" }, { "stage": "public-application-exploitation", "reason": "Belongs to another part of the 'Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026' series.", "status": "out_of_scope" }, { "stage": "credential-abuse-and-spraying", "reason": "Belongs to another part of the 'Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026' series.", "status": "out_of_scope" }, { "stage": "drive-by-watering-hole", "reason": "Belongs to another part of the 'Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Exploitation of Public-Facing Applications", "slug": "public-application-exploitation", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "internet-facing web applications", "database instances", "perimeter services" ] }, { "name": "Credential Abuse and Spraying", "slug": "credential-abuse-and-spraying", "tactic": "initial-access", "techniques": [ "T1078" ], "observables": [ "pre-harvested credentials", "sprayed credentials", "illicitly obtained authentication material" ] }, { "name": "Phishing and Targeted Social Engineering", "slug": "phishing-and-social-engineering", "tactic": "initial-access", "techniques": [ "T1566" ], "observables": [ "electronic messaging", "browser-centric lures", "payload execution" ] }, { "name": "Supply Chain Compromise", "slug": "supply-chain-compromise", "tactic": "initial-access", "techniques": [ "T1195" ], "observables": [ "manipulated product delivery", "trusted-relationship exploitation" ] }, { "name": "Drive-By Compromise via Watering Hole", "slug": "drive-by-watering-hole", "tactic": "initial-access", "techniques": [ "T1189" ], "observables": [ "compromised web destinations", "site visitation", "automated browser exploitation" ] } ], "summary": "This campaign overview identifies exploitation of public-facing applications and legitimate credential abuse as the most frequent initial access methods, alongside phishing and high-impact supply chain compromises. These vectors are used to establish persistent footholds and bypass perimeter defenses by blending in with legitimate user activity." }, "severity": "medium", "rationale": "Start with workstations and servers identified in the unusual software installation step. If no leads are found, expand the search to all devices and focus on the rare-writable-processes signal.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has established initial access through a compromised supply chain or a phishing attachment, resulting in unusual package installations or rare process execution from browser-originating downloads.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-defined-scope", "kind": "manual", "observed": "2026-10-16" }, "type": "list[host]", "default": [], "description": "List of hostnames to focus the investigation on, typically from the scoping step results." }, "lookback_days": { "from": { "ref": "hunt-standard-lookback", "kind": "manual", "observed": "2026-10-16" }, "type": "number", "default": "14", "description": "Days of history to examine for initial access signals." }, "browser_processes": { "from": { "ref": "unit42-initial-access-2026", "kind": "article", "observed": "2026-10-16" }, "type": "list[string]", "default": [ "chrome.exe", "msedge.exe", "outlook.exe", "teams.exe" ], "description": "Parent processes typically responsible for downloading or receiving external payloads." }, "phishing_extensions": { "from": { "ref": "unit42-initial-access-2026", "kind": "article", "observed": "2026-10-16" }, "type": "list[string]", "default": [ ".exe", ".msi", ".zip", ".iso", ".vbs", ".js", ".msix", ".appx" ], "description": "Suspicious extensions commonly used in phishing payloads or containerized malware." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/top-5-initial-access-vectors-september-2026/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/top-5-initial-access-vectors-september-2026/", "name": "Unit 42 \u2014 Top 5 Initial Access Threat Vectors Observed in September 2026" } ], "blind_spots": [ { "id": "limited-endpoint-telemetry", "risk": "A compromised host without telemetry provides no signals for the hunt, making it an invisible foothold.", "question": "Are there hosts missing endpoint agents?", "requires": "hb_process_activity and hb_file_activity" }, { "id": "non-msi-appx-blindness", "risk": "The hb_application_lifecycle surface primarily captures AppX and MSI installers; legacy installers might be missed.", "stage": "supply-chain-compromise", "question": "Was the software installed via a standalone EXE setup file?", "requires": "hb_process_activity monitoring for installer processes" } ] }, "name": "Delivery and Payload Execution Monitoring", "description": "Adversaries frequently bypass perimeter defenses by exploiting trusted software distribution channels or using social engineering to deliver payloads directly to the endpoint. This hunt monitors for these footholds by identifying unusual software installation events (supply chain leads) and corroborating them with browser-originating file activity and rare process launches in user-writable paths. An agent then evaluates the combined evidence per host to distinguish legitimate software deployment from malicious intrusion." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "top-5-initial-access-threat-vectors-observed-by-unit-42-in-september-2026", "index": 2, "title": "Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026", "total": 2 }, "coverage": [ { "stage": "phishing-and-social-engineering", "steps": [ "rare-writable-processes", "phishing-downloads" ], "status": "covered" }, { "stage": "supply-chain-compromise", "steps": [ "unusual-installers" ], "status": "covered" }, { "stage": "public-application-exploitation", "reason": "Belongs to another part of the 'Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026' series.", "status": "out_of_scope" }, { "stage": "credential-abuse-and-spraying", "reason": "Belongs to another part of the 'Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026' series.", "status": "out_of_scope" }, { "stage": "drive-by-watering-hole", "reason": "Belongs to another part of the 'Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026' series.", "status": "out_of_scope" } ], "rationale": "An adversary has established initial access through a compromised supply chain or a phishing attachment, resulting in unusual package installations or rare process execution from browser-originating downloads.", "blind_spots": [ { "id": "limited-endpoint-telemetry", "risk": "A compromised host without telemetry provides no signals for the hunt, making it an invisible foothold.", "question": "Are there hosts missing endpoint agents?", "requires": "hb_process_activity and hb_file_activity" }, { "id": "non-msi-appx-blindness", "risk": "The hb_application_lifecycle surface primarily captures AppX and MSI installers; legacy installers might be missed.", "stage": "supply-chain-compromise", "question": "Was the software installed via a standalone EXE setup file?", "requires": "hb_process_activity monitoring for installer processes" } ], "scoping_notes": "Start with workstations and servers identified in the unusual software installation step. If no leads are found, expand the search to all devices and focus on the rare-writable-processes signal.", "beyond_detection": "Standard rules may detect known malicious hashes, but this hunt uses prevalence (stack-counting) and cross-surface corroboration (installer history joined with browser downloads and rare process execution) to identify previously unseen payloads." } }, { "id": "unusual-installers", "type": "query", "label": "Unusual or unsigned software installations", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_full_name, package_source_uri, signer_subject_name, deployment_flags, time FROM hb_application_lifecycle WHERE (signer_subject_name IS NULL OR signer_subject_name = '' OR deployment_flags = 8388608 OR LOWER(package_source_uri) LIKE 'http:%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_application_lifecycle", "description": "Identify potential supply chain compromises by finding package installations that lack valid signatures or originate from unusual source URIs.", "expected_signal": "A row indicates an unsigned or potentially external package was installed. Silence proves no such installations were logged by the AppX or MSI providers." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Unusual or unsigned software installations", "reads": [ "device_hostname", "package_full_name", "package_source_uri", "signer_subject_name", "deployment_flags", "time" ], "source": "hb_application_lifecycle", "target": "endpoint", "content": "SELECT device_hostname, package_full_name, package_source_uri, signer_subject_name, deployment_flags, time FROM hb_application_lifecycle WHERE (signer_subject_name IS NULL OR signer_subject_name = '' OR deployment_flags = 8388608 OR LOWER(package_source_uri) LIKE 'http:%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "A row indicates an unsigned or potentially external package was installed. Silence proves no such installations were logged by the AppX or MSI providers.", "verified": "dry-run", "verified_at": "2026-10-17" } }, { "id": "rare-writable-processes", "type": "query", "label": "Rare processes from user-writable paths", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, process_path, time FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\\\downloads\\\\%' OR LOWER(process_path) LIKE '%\\\\temp\\\\%' OR LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%') AND LOWER(process_path) IN (SELECT LOWER(process_path) FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\\\downloads\\\\%' OR LOWER(process_path) LIKE '%\\\\temp\\\\%' OR LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING COUNT(DISTINCT device_hostname) <= 3) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Find executables running from Downloads, Temp, or Public folders that are rare across the fleet, suggesting a user-initiated payload.", "expected_signal": "A binary seen on only one or two hosts in a user-writable path. High host counts likely indicate legitimate temporary software like installers or updaters." }, "parents": [ { "id": "unusual-installers" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare processes from user-writable paths", "reads": [ "device_hostname", "process_path", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_path, time FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\\\downloads\\\\%' OR LOWER(process_path) LIKE '%\\\\temp\\\\%' OR LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%') AND LOWER(process_path) IN (SELECT LOWER(process_path) FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\\\downloads\\\\%' OR LOWER(process_path) LIKE '%\\\\temp\\\\%' OR LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING COUNT(DISTINCT device_hostname) <= 3) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A binary seen on only one or two hosts in a user-writable path. High host counts likely indicate legitimate temporary software like installers or updaters.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_path" ], "rare_below": 3 }, "verified_at": "2026-10-17" } }, { "id": "phishing-downloads", "type": "query", "label": "Suspicious file downloads from browsers", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, process_name, file_path, file_name, time FROM hb_file_activity WHERE instr(',' || '{{browser_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND (LOWER(file_name) LIKE '%.exe' OR LOWER(file_name) LIKE '%.msi' OR LOWER(file_name) LIKE '%.zip' OR LOWER(file_name) LIKE '%.iso' OR LOWER(file_name) LIKE '%.vbs' OR LOWER(file_name) LIKE '%.js' OR LOWER(file_name) LIKE '%.msix' OR LOWER(file_name) LIKE '%.appx' OR (instr(file_name, '.') > 0 AND instr(',' || '{{phishing_extensions}}' || ',', ',' || LOWER(SUBSTR(file_name, INSTR(file_name, '.'))) || ',') > 0)) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Corroborate phishing lures by identifying browser or mail processes writing files with executable or container extensions.", "expected_signal": "Rows mapping a browser or mail client to a newly written payload file. Silence does not prove absence if the adversary used a non-standard download method." }, "parents": [ { "id": "unusual-installers" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Suspicious file downloads from browsers", "reads": [ "device_hostname", "process_name", "file_path", "file_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, file_path, file_name, time FROM hb_file_activity WHERE instr(',' || '{{browser_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND (LOWER(file_name) LIKE '%.exe' OR LOWER(file_name) LIKE '%.msi' OR LOWER(file_name) LIKE '%.zip' OR LOWER(file_name) LIKE '%.iso' OR LOWER(file_name) LIKE '%.vbs' OR LOWER(file_name) LIKE '%.js' OR LOWER(file_name) LIKE '%.msix' OR LOWER(file_name) LIKE '%.appx' OR (instr(file_name, '.') > 0 AND instr(',' || '{{phishing_extensions}}' || ',', ',' || LOWER(SUBSTR(file_name, INSTR(file_name, '.'))) || ',') > 0)) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Rows mapping a browser or mail client to a newly written payload file. Silence does not prove absence if the adversary used a non-standard download method.", "verified": "dry-run", "verified_at": "2026-10-17" } }, { "id": "triage-verdict", "type": "analytic", "label": "Weigh initial access evidence", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "unusual-installers", "rare-writable-processes", "phishing-downloads" ], "objective": "Determine if any host shows evidence of a malicious initial access foothold. Correlate findings per-host and bridge the gap between unusual installers (suggesting supply chain compromise) and subsequent rare process activity or suspicious browser-originating downloads.", "description": "Analyse the installation events, rare process launches, and browser downloads to determine if a host has been compromised.", "max_iterations": 5, "expected_signal": "A per-host verdict of malicious, suspicious, or benign.", "success_criteria": "A final verdict for every host that appeared in more than one query result, citing the specific rows that connect the delivery to execution." }, "parents": [ { "id": "rare-writable-processes", "kind": "merge" }, { "id": "phishing-downloads", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on triage results", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-verdict verdict is malicious for at least one host", "condition": "the triage-verdict verdict is malicious for at least one host", "blind_spot": "limited-endpoint-telemetry", "confidence": "high", "description": "Direct the hunt based on the agent's findings.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-verdict" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Contain the threat after a confirmed malicious finding.", "instructions": "Isolate the host and initiate an incident response ticket. Collect the binary identified in the rare-writable-processes step for analysis.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-validation", "type": "task", "label": "Perform analyst deep-dive", "config": { "assignee": "analyst", "description": "Confirm the agent's findings and tune the hunt.", "instructions": "Review the rows cited by the triage agent. Check for any legitimate business context for the unsigned installation or the rare process launch. If the host was isolated, verify the artifact is indeed malicious." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "isolate-host" } ] }, { "id": "final-wrap-up", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Document findings and schedule the next run.", "instructions": "Record the total number of hosts examined and any confirmed compromises. If a false positive was identified, document the software name for future exclusion." }, "parents": [ { "id": "analyst-validation" } ] } ] }