{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The presence of ransomware-linked tools like Grixba and AdFind following a trojanized installer execution indicates a high risk of imminent ransomware deployment. Detecting this early stage is critical to preventing the final impact." }, "name": "EarthTime Trojan to Ransomware Reconnaissance", "type": "investigation", "labels": [ "hunt", "attack.t1204.002", "attack.t1036.005", "attack.t1127.001", "attack.t1055", "attack.t1547.001", "attack.t1087", "attack.t1482", "attack.t1562.001" ], "series": { "slug": "blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs", "index": 1, "title": "Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs", "total": 3 }, "related": [ { "hunt": "ransomware-lateral-movement-rdp", "reason": "Lateral movement via RDP using local accounts is handled in the second hunt of this series.", "relation": "out-of-scope-alternative" }, { "hunt": "ransomware-data-exfiltration-ftp", "reason": "WinSCP exfiltration to FTP servers is handled in the third hunt of this series.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple rule for AdFind or MSBuild will generate noise; this hunt correlates the initial trojan execution (EarthTime) with the MSBuild injection anomaly and the subsequent rare discovery tool execution across the fleet, providing context that a single rule lacks.", "coverage": [ { "stage": "initial-access-trojanized-installer", "steps": [ "earthtime-scoping" ], "status": "covered" }, { "stage": "execution-sectoprat-injection", "steps": [ "msbuild-anomaly", "c2-connections" ], "status": "covered" }, { "stage": "persistence-mechanisms", "steps": [ "persistence-and-staging" ], "status": "covered" }, { "stage": "discovery-internal-reconnaissance", "steps": [ "discovery-prevalence" ], "status": "covered" }, { "stage": "defense-evasion", "steps": [ "defender-tampering", "persistence-and-staging" ], "status": "covered" }, { "stage": "credential-access-and-privilege-escalation", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" }, { "stage": "lateral-movement", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" }, { "stage": "collection-and-exfiltration", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" }, { "stage": "command-and-control", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Trojanized EarthTime Installer", "slug": "initial-access-trojanized-installer", "tactic": "initial-access", "techniques": [ "T1204.002", "T1036.005" ], "observables": [ "EarthTime.exe from Downloads folder", "Brave Pragmatic Network Technology Co., Ltd. revoked certificate", "GlobalSign GCC R45 EV CodeSigning CA 2020" ] }, { "name": "SectopRAT Injection and C2 Fetch", "slug": "execution-sectoprat-injection", "tactic": "execution", "techniques": [ "T1059.003", "T1127.001", "T1055" ], "observables": [ "EarthTime.exe spawning cmd.exe spawning MSBuild.exe with no arguments", "Process injection into MSBuild.exe", "Pastebin connection for C2 configuration" ] }, { "name": "Startup Shortcut and Local Account Creation", "slug": "persistence-mechanisms", "tactic": "persistence", "techniques": [ "T1547.001", "T1136.001" ], "observables": [ "Shortcut (.lnk) created in %AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", "Creation of a new local account with administrative privileges" ] }, { "name": "DCSync and Veeam Credential Harvesting", "slug": "credential-access-and-privilege-escalation", "tactic": "credential-access", "techniques": [ "T1484.002", "T1003.006", "T1059.001" ], "observables": [ "DCSync attack against Domain Controller", "PowerShell script executed on backup server to retrieve Veeam credentials" ] }, { "name": "Internal Discovery Tool Deployment", "slug": "discovery-internal-reconnaissance", "tactic": "discovery", "techniques": [ "T1087", "T1482", "T1018", "T1046" ], "observables": [ "AdFind.exe", "SharpHound.exe", "netscan.exe (SoftPerfect)", "GT_NET.exe (Grixba)", "ipconfig", "nltest" ] }, { "name": "Lateral Movement via RDP and PsExec", "slug": "lateral-movement", "tactic": "lateral-movement", "techniques": [ "T1021.001", "T1570", "T1021.002" ], "observables": [ "RDP connections (port 3389) using created local account and built-in Administrator", "PsExec used to execute SystemBC on remote hosts", "wmiexec used for remote reconnaissance commands" ] }, { "name": "WinRAR Staging and WinSCP Exfiltration", "slug": "collection-and-exfiltration", "tactic": "exfiltration", "techniques": [ "T1560.001", "T1048.003" ], "observables": [ "WinRAR archiving file shares", "WinSCP transferring archives to cloud host via unencrypted FTP" ] }, { "name": "SystemBC and Betruger C2 Infrastructure", "slug": "command-and-control", "tactic": "command-and-control", "techniques": [ "T1090.003", "T1105" ], "observables": [ "WakeWordEngine.dll or conhost.dll (SystemBC) in C:\\Users\\Public\\Music\\", "rundll32.exe calling exported Reset function", "Betruger backdoor deployment", "C2 IPs: 45.141.87.55 (9000, 15647) and 149.28.101.219 (443)" ] }, { "name": "Security Tampering and Masquerading", "slug": "defense-evasion", "tactic": "defense-evasion", "techniques": [ "T1562.001", "T1027", "T1036" ], "observables": [ "Disabling Microsoft Defender protections", "Binaries with spoofed metadata (SentinelOne, Avast)", "Timestomping activities", "Use of C:\\Users\\Public\\Music\\ as staging directory" ] } ], "summary": "An affiliate threat actor likely linked to multiple ransomware groups used a trojanized version of the EarthTime application to deploy SectopRAT and SystemBC. They performed extensive internal discovery with tools like AdFind and Grixba, moved laterally via RDP and PsExec, and ultimately archived and exfiltrated sensitive data via WinSCP over clear-text FTP." }, "severity": "high", "rationale": "The hunt should initially focus on workstations where EarthTime.exe would likely be downloaded, then expand to domain controllers and file servers once discovery tools are identified.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has gained initial access via a trojanized EarthTime installer, established a beachhead using SectopRAT with MSBuild injection, and is now performing environment discovery using specialized ransomware reconnaissance tools.", "parameters": { "c2_ips": { "from": { "ref": "dfir-report", "kind": "article", "observed": "2025-09-08" }, "type": "list[ip]", "default": [ "45.141.87.55", "149.28.101.219" ], "description": "Known SectopRAT and SystemBC C2 infrastructure." }, "scope_hosts": { "from": { "ref": "hunt-standard", "kind": "manual", "observed": "2025-01-01" }, "type": "list[host]", "default": [], "description": "Target hosts for follow-on queries; leave empty for fleet-wide." }, "lookback_days": { "from": { "ref": "hunt-standard", "kind": "manual", "observed": "2025-01-01" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "discovery_tools": { "from": { "ref": "dfir-report", "kind": "article", "observed": "2025-09-08" }, "type": "list[string]", "default": [ "adfind.exe", "sharphound.exe", "netscan.exe", "gt_net.exe" ], "description": "Reconnaissance tools used by ransomware affiliates." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/", "name": "The DFIR Report \u2014 Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs" } ], "blind_spots": [ { "id": "limited-endpoint-telemetry", "risk": "We might miss attempts where the installer failed to run because of certificate revocation, but the host is still being targeted.", "stage": "initial-access-trojanized-installer", "question": "whether the revoked certificate was checked by the local OS", "requires": "detailed certificate validation logs on the endpoint" }, { "id": "process-injection-visibility", "risk": "Relying on command-line anomalies for MSBuild might miss later versions that use different injection vectors.", "stage": "execution-sectoprat-injection", "question": "whether the MSBuild process has SectopRAT resident in memory", "requires": "hb_module_activity with in-memory YARA scan capability" } ] }, "name": "EarthTime Trojan to Ransomware Reconnaissance", "description": "This hunt follows the progression from a social-engineered initial access event to full-scale environment discovery. It first identifies the initial beachhead created by a trojanized installer and the subsequent MSBuild process injection. It then pivots to find evidence of follow-on activities typical of ransomware affiliates, including local persistence, staging in public folders, and the execution of discovery tools like Grixba, AdFind, and SharpHound. The hunt uses a phased approach to correlate the initial infection with the heavy reconnaissance footprint seen in multi-gang ransomware intrusions." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs", "index": 1, "title": "Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs", "total": 3 }, "coverage": [ { "stage": "initial-access-trojanized-installer", "steps": [ "earthtime-scoping" ], "status": "covered" }, { "stage": "execution-sectoprat-injection", "steps": [ "msbuild-anomaly", "c2-connections" ], "status": "covered" }, { "stage": "persistence-mechanisms", "steps": [ "persistence-and-staging" ], "status": "covered" }, { "stage": "discovery-internal-reconnaissance", "steps": [ "discovery-prevalence" ], "status": "covered" }, { "stage": "defense-evasion", "steps": [ "defender-tampering", "persistence-and-staging" ], "status": "covered" }, { "stage": "credential-access-and-privilege-escalation", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" }, { "stage": "lateral-movement", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" }, { "stage": "collection-and-exfiltration", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" }, { "stage": "command-and-control", "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.", "status": "out_of_scope" } ], "rationale": "An adversary has gained initial access via a trojanized EarthTime installer, established a beachhead using SectopRAT with MSBuild injection, and is now performing environment discovery using specialized ransomware reconnaissance tools.", "blind_spots": [ { "id": "limited-endpoint-telemetry", "risk": "We might miss attempts where the installer failed to run because of certificate revocation, but the host is still being targeted.", "stage": "initial-access-trojanized-installer", "question": "whether the revoked certificate was checked by the local OS", "requires": "detailed certificate validation logs on the endpoint" }, { "id": "process-injection-visibility", "risk": "Relying on command-line anomalies for MSBuild might miss later versions that use different injection vectors.", "stage": "execution-sectoprat-injection", "question": "whether the MSBuild process has SectopRAT resident in memory", "requires": "hb_module_activity with in-memory YARA scan capability" } ], "scoping_notes": "The hunt should initially focus on workstations where EarthTime.exe would likely be downloaded, then expand to domain controllers and file servers once discovery tools are identified.", "beyond_detection": "A simple rule for AdFind or MSBuild will generate noise; this hunt correlates the initial trojan execution (EarthTime) with the MSBuild injection anomaly and the subsequent rare discovery tool execution across the fleet, providing context that a single rule lacks." } }, { "id": "earthtime-scoping", "type": "query", "label": "Identify EarthTime beachhead hosts", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, process_path, process_cmd_line, user_name, time FROM hb_process_activity WHERE LOWER(process_name) LIKE '%\\downloads\\earthtime.exe' AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Find hosts where the malicious EarthTime.exe was executed from the user's Downloads folder.", "expected_signal": "The specific trojanized installer executing from a predictable user path. Silence confirms the absence of this specific initial access vector." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify EarthTime beachhead hosts", "reads": [ "device_hostname", "process_cmd_line", "process_name", "process_path", "time", "user_name" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_path, process_cmd_line, user_name, time FROM hb_process_activity WHERE LOWER(process_name) LIKE '%\\downloads\\earthtime.exe' AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "The specific trojanized installer executing from a predictable user path. Silence confirms the absence of this specific initial access vector.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "msbuild-anomaly", "type": "query", "label": "MSBuild execution without arguments", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, current_directory, time FROM hb_process_activity WHERE LOWER(process_name) LIKE '%\\msbuild.exe' AND (process_cmd_line IS NULL OR process_cmd_line = '' OR LOWER(process_cmd_line) LIKE '%msbuild.exe') AND LOWER(current_directory) LIKE '%\\downloads%' AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Find MSBuild.exe launched from the downloads directory with no arguments, a sign of SectopRAT injection.", "expected_signal": "A high-fidelity indicator of ArechClient2/SectopRAT process injection." }, "parents": [ { "id": "earthtime-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "MSBuild execution without arguments", "reads": [ "current_directory", "device_hostname", "process_cmd_line", "process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, current_directory, time FROM hb_process_activity WHERE LOWER(process_name) LIKE '%\\msbuild.exe' AND (process_cmd_line IS NULL OR process_cmd_line = '' OR LOWER(process_cmd_line) LIKE '%msbuild.exe') AND LOWER(current_directory) LIKE '%\\downloads%' AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A high-fidelity indicator of ArechClient2/SectopRAT process injection.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "c2-connections", "type": "query", "label": "Network connections to C2 IPs", "config": { "dsl": "sqlite", "role": "enrichment", "source": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_network_connection", "description": "Identify any host communicating with the infrastructure named in the report.", "expected_signal": "Connections to ports 9000, 15647, or 443 at the target IPs." }, "parents": [ { "id": "earthtime-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Network connections to C2 IPs", "reads": [ "device_hostname", "dst_endpoint_ip", "dst_endpoint_port", "process_name", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Connections to ports 9000, 15647, or 443 at the target IPs.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "early-stage-agent", "type": "analytic", "label": "Triage early compromise", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "earthtime-scoping", "msbuild-anomaly", "c2-connections" ], "objective": "Verify if the EarthTime execution led to MSBuild injection and network activity.", "description": "Determine if a beachhead is confirmed based on installer execution and process anomalies.", "max_iterations": 3, "expected_signal": "A verdict on whether the initial access was successful on specific hosts.", "success_criteria": "A per-host verdict of infected or clean." }, "parents": [ { "id": "msbuild-anomaly", "kind": "merge" }, { "id": "c2-connections", "kind": "merge" } ] }, { "id": "persistence-and-staging", "type": "query", "label": "Persistence shortcuts and staging files", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, file_path, activity_name, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(file_path) LIKE '%\\microsoft\\windows\\start menu\\programs\\startup\\%' OR LOWER(file_path) LIKE '%\\users\\public\\music\\%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Find shortcuts in the startup folder and malicious DLL staging in the Public Music folder.", "expected_signal": "File writes like WakeWordEngine.dll or conhost.dll in the public music folder." }, "parents": [ { "id": "early-stage-agent" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Persistence shortcuts and staging files", "reads": [ "activity_name", "device_hostname", "file_path", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_path, activity_name, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(file_path) LIKE '%\\microsoft\\windows\\start menu\\programs\\startup\\%' OR LOWER(file_path) LIKE '%\\users\\public\\music\\%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "File writes like WakeWordEngine.dll or conhost.dll in the public music folder.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "discovery-prevalence", "type": "query", "label": "Discovery tool execution prevalence", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_name) AS tool, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (instr(',' || '{{discovery_tools}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_name) = 'nltest.exe' OR LOWER(process_name) = 'adfind.exe') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY tool HAVING hosts <= 3 ORDER BY hosts ASC", "surface": "hb_process_activity", "description": "Stack-count discovery tool execution across the fleet to highlight rare or unauthorized usage.", "expected_signal": "A small number of hosts running specialized recon tools like Grixba (GT_NET.exe) or AdFind." }, "parents": [ { "id": "early-stage-agent" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Discovery tool execution prevalence", "reads": [ "device_hostname", "process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_name) AS tool, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (instr(',' || '{{discovery_tools}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_name) = 'nltest.exe' OR LOWER(process_name) = 'adfind.exe') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY tool HAVING hosts <= 3 ORDER BY hosts ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A small number of hosts running specialized recon tools like Grixba (GT_NET.exe) or AdFind.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_name" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "defender-tampering", "type": "query", "label": "Microsoft Defender registry tampering", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_data, process_name, time FROM hb_registry_activity WHERE LOWER(reg_target) LIKE '%\\policies\\microsoft\\windows defender\\%' AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_registry_activity", "description": "Check for registry modifications aimed at disabling Defender protections.", "expected_signal": "Modification of DisableAntiSpyware or Real-Time Protection keys." }, "parents": [ { "id": "early-stage-agent" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Microsoft Defender registry tampering", "reads": [ "device_hostname", "process_name", "reg_target", "reg_value_data", "time" ], "source": "hb_registry_activity", "target": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_data, process_name, time FROM hb_registry_activity WHERE LOWER(reg_target) LIKE '%\\policies\\microsoft\\windows defender\\%' AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Modification of DisableAntiSpyware or Real-Time Protection keys.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "full-intrusion-agent", "type": "analytic", "label": "Comprehensive intrusion analysis", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "early-stage-agent", "persistence-and-staging", "discovery-prevalence", "defender-tampering" ], "objective": "Weigh whether the early compromise indicators and the follow-on discovery tool execution suggest an active ransomware affiliate intrusion.", "description": "Synthesize the early-stage findings with the follow-on discovery and evasion artifacts.", "max_iterations": 6, "expected_signal": "A detailed reconstruction of the intrusion stages per host.", "success_criteria": "A verdict of malicious for hosts exhibiting multiple stages of the attack chain." }, "parents": [ { "id": "persistence-and-staging", "kind": "merge" }, { "id": "discovery-prevalence", "kind": "merge" }, { "id": "defender-tampering", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route based on compromise level", "config": { "fuzzy": true, "judge": "hunter", "question": "the agent verdict is malicious for at least one host involving both initial execution and follow-on discovery tools", "condition": "the agent verdict is malicious for at least one host involving both initial execution and follow-on discovery tools", "blind_spot": "limited-endpoint-telemetry", "confidence": "high", "description": "Direct the workflow based on the agent's final verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "full-intrusion-agent" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Prevent further lateral movement or data exfiltration.", "instructions": "Isolate the host immediately. Prioritize domain controllers and file servers if they appear in the results.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-manual-review", "type": "task", "label": "Detailed analyst investigation", "config": { "assignee": "analyst", "description": "Review the full sequence of events and verify the presence of the Betruger backdoor or local account creation.", "instructions": "Examine the hosts for new local administrator accounts and startup shortcuts. Look for Betruger backdoor remnants (spawned by SectopRAT) and investigate the WinSCP/FTP activity for potential data theft." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Hunt close-out", "config": { "assignee": "analyst", "description": "Document findings and determine if the detection candidate should be promoted.", "instructions": "Document the hosts affected and the tools identified. If MSBuild injection was confirmed, promote the msbuild-anomaly query to a standing detection rule." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-manual-review" } ] } ] }