{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Protecting e-commerce availability and customer payment trust is critical during the peak holiday season; CosmicSting exploitation leads directly to large-scale data theft and loss of revenue." }, "name": "E-Commerce Edge Exploitation and API Abuse", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1110.004", "attack.t1505.003", "attack.t1195", "attack.t1041", "credential access", "execution", "impact", "initial access", "persistence" ], "series": { "slug": "unwrapping-retail-peak-season-cyber-threats", "index": 1, "title": "Unwrapping Retail Peak Season Cyber Threats", "total": 2 }, "related": [ { "hunt": "employee-phishing-to-cloud-fraud", "reason": "This hunt focuses on public-facing edge exploitation, whereas gift card fraud often involves phishing employees for cloud console access.", "relation": "out-of-scope-alternative" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A simple rule might fire on a single XXE payload, but this hunt correlates vulnerability exposure with auth spikes and file-system integrity across multiple surfaces to find persistent skimmers that evasion-focused attackers hide.", "coverage": [ { "stage": "initial-access-commerce-exploit", "steps": [ "identify-vulnerable-commerce", "http-exploitation-probes" ], "status": "covered" }, { "stage": "credential-access-api-stuffing", "steps": [ "api-auth-stuffing" ], "status": "covered" }, { "stage": "persistence-digital-skimmer-injection", "steps": [ "js-file-modifications" ], "status": "covered" }, { "stage": "initial-access-employee-social-engineering", "reason": "Belongs to another part of the 'Unwrapping Retail Peak Season Cyber Threats' series.", "status": "out_of_scope" }, { "stage": "execution-autonomous-agent", "reason": "Belongs to another part of the 'Unwrapping Retail Peak Season Cyber Threats' series.", "status": "out_of_scope" }, { "stage": "impact-cloud-fraud-exfiltration", "reason": "Belongs to another part of the 'Unwrapping Retail Peak Season Cyber Threats' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Adobe Commerce XXE Exploitation", "slug": "initial-access-commerce-exploit", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "CVE-2024-34102", "CosmicSting", "Adobe Commerce", "XML External Entity (XXE) crafted documents", "unpatched e-commerce servers" ] }, { "name": "Employee Phishing and Smishing", "slug": "initial-access-employee-social-engineering", "tactic": "initial-access", "techniques": [ "T1566" ], "observables": [ "Storm-0539", "phishing messages", "smishing messages", "social engineering of retail employees" ] }, { "name": "Automated Credential Stuffing", "slug": "credential-access-api-stuffing", "tactic": "credential-access", "techniques": [ "T1110.004" ], "observables": [ "automated scripts targeting mobile app APIs", "web login API traffic spikes", "stolen credential databases", "login failures followed by success" ] }, { "name": "Digital Skimming and Backdoor Installation", "slug": "persistence-digital-skimmer-injection", "tactic": "persistence", "techniques": [ "T1505.003", "T1195" ], "observables": [ "JavaScript payment skimming scripts", "checkout flow modification", "persistent server backdoors", "unauthorized client-side script manipulation" ] }, { "name": "Autonomous AI Agent Activity", "slug": "execution-autonomous-agent", "tactic": "execution", "techniques": [ "T1059" ], "observables": [ "Cairn autonomous penetration testing agent", "Bling Libra AI reconnaissance", "Claude AI accelerated exfiltration", "autonomous penetration testing harnesses" ] }, { "name": "Cloud Gift Card Fraud and Data Theft", "slug": "impact-cloud-fraud-exfiltration", "tactic": "impact", "techniques": [ "T1486", "T1041" ], "observables": [ "unauthorized gift card issuance", "loyalty account balance draining", "Storm-0539 cloud infrastructure exploitation", "exfiltration of payment card records", "ALPHV inventory replenishment disruption" ] } ], "summary": "Retailers during peak shopping season face a diverse threat landscape including digital skimming via CVE-2024-34102, AI-accelerated autonomous intrusions, and cloud-based gift card fraud following employee phishing. These campaigns prioritize operational disruption through ransomware or direct financial gain via credential stuffing and payment record exfiltration." }, "severity": "high", "rationale": "Start with internet-facing Adobe Commerce or Magento instances. Use the resource_uid from the lead query to identify hostnames for the scope_hosts parameter. If vulnerability scan data is missing, the analyst should run the hunt without scoping.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "Adversaries are exploiting e-commerce vulnerabilities like CosmicSting to gain initial access, followed by credential stuffing against customer APIs and the injection of digital skimmers into checkout flows.", "parameters": { "target_cve": { "from": { "ref": "Unit 42", "kind": "article", "observed": "2024-10-28" }, "type": "string", "default": "CVE-2024-34102", "description": "The CosmicSting XXE vulnerability ID." }, "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2026-10-28" }, "type": "list[host]", "default": [], "description": "Hostnames identified as vulnerable in the lead step; leave empty to hunt across the entire estate." }, "lookback_days": { "from": { "ref": "hunt-standard", "kind": "manual", "observed": "2026-10-28" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "commerce_paths": { "from": { "ref": "Unit 42", "kind": "article", "observed": "2024-10-28" }, "type": "list[path]", "default": [ "/rest/all/v1/guest-carts/", "/rest/default/v1/guest-carts/", "/checkout/", "/customer/account/login/" ], "description": "Common Adobe Commerce and e-commerce API paths targeted for exploitation and credential stuffing." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats/", "name": "Unit 42 \u2014 Unwrapping Retail Peak Season Cyber Threats" } ], "blind_spots": [ { "id": "missing-vulnerability-scans", "risk": "A shadow-IT e-commerce site could be compromised without being caught by the lead query.", "owner": "Vulnerability Management", "stage": "initial-access-commerce-exploit", "question": "whether an unmanaged e-commerce server exists that is not scanned for CVE-2024-34102", "requires": "comprehensive coverage in hb_vulnerability_finding", "remediation": "Cross-reference hb_software_inventory with hb_exposed_assets to identify unmanaged web servers." }, { "id": "http-request-body-blindness", "risk": "We can see the target path but cannot confirm the exploitation attempt without the XML body content.", "owner": "Security Engineering", "stage": "initial-access-commerce-exploit", "question": "the specific XML payload sent in a suspected XXE attack", "requires": "hb_http_activity with full request body", "remediation": "Enable WAF request-body inspection for critical commerce API endpoints." } ] }, "name": "E-Commerce Edge Exploitation and API Abuse", "description": "The hunt follows a gated flow: it first identifies exposed servers through vulnerability scans, and only fans out to behavioral telemetry when a risk is confirmed. This ensures that the hunt prioritizes expensive data loss and authentication telemetry for known-vulnerable assets. By narrowing the focus to hosts with active CosmicSting exposure, the hunt effectively separates high-volume API traffic and file activity from the background noise of holiday retail operations." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "unwrapping-retail-peak-season-cyber-threats", "index": 1, "title": "Unwrapping Retail Peak Season Cyber Threats", "total": 2 }, "coverage": [ { "stage": "initial-access-commerce-exploit", "steps": [ "identify-vulnerable-commerce", "http-exploitation-probes" ], "status": "covered" }, { "stage": "credential-access-api-stuffing", "steps": [ "api-auth-stuffing" ], "status": "covered" }, { "stage": "persistence-digital-skimmer-injection", "steps": [ "js-file-modifications" ], "status": "covered" }, { "stage": "initial-access-employee-social-engineering", "reason": "Belongs to another part of the 'Unwrapping Retail Peak Season Cyber Threats' series.", "status": "out_of_scope" }, { "stage": "execution-autonomous-agent", "reason": "Belongs to another part of the 'Unwrapping Retail Peak Season Cyber Threats' series.", "status": "out_of_scope" }, { "stage": "impact-cloud-fraud-exfiltration", "reason": "Belongs to another part of the 'Unwrapping Retail Peak Season Cyber Threats' series.", "status": "out_of_scope" } ], "rationale": "Adversaries are exploiting e-commerce vulnerabilities like CosmicSting to gain initial access, followed by credential stuffing against customer APIs and the injection of digital skimmers into checkout flows.", "blind_spots": [ { "id": "missing-vulnerability-scans", "risk": "A shadow-IT e-commerce site could be compromised without being caught by the lead query.", "owner": "Vulnerability Management", "stage": "initial-access-commerce-exploit", "question": "whether an unmanaged e-commerce server exists that is not scanned for CVE-2024-34102", "requires": "comprehensive coverage in hb_vulnerability_finding", "remediation": "Cross-reference hb_software_inventory with hb_exposed_assets to identify unmanaged web servers." }, { "id": "http-request-body-blindness", "risk": "We can see the target path but cannot confirm the exploitation attempt without the XML body content.", "owner": "Security Engineering", "stage": "initial-access-commerce-exploit", "question": "the specific XML payload sent in a suspected XXE attack", "requires": "hb_http_activity with full request body", "remediation": "Enable WAF request-body inspection for critical commerce API endpoints." } ], "scoping_notes": "Start with internet-facing Adobe Commerce or Magento instances. Use the resource_uid from the lead query to identify hostnames for the scope_hosts parameter. If vulnerability scan data is missing, the analyst should run the hunt without scoping.", "beyond_detection": "A simple rule might fire on a single XXE payload, but this hunt correlates vulnerability exposure with auth spikes and file-system integrity across multiple surfaces to find persistent skimmers that evasion-focused attackers hide." } }, { "id": "identify-vulnerable-commerce", "type": "query", "label": "Identify vulnerable e-commerce assets", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT resource_uid, severity, title, first_seen FROM hb_vulnerability_finding WHERE cve_uid = '{{target_cve}}' AND status != 'suppressed'", "surface": "hb_vulnerability_finding", "description": "Find servers with active CosmicSting (CVE-2024-34102) findings to narrow the hunt scope.", "expected_signal": "Rows identify specific vulnerable resources. Silence means no known exposure exists for this CVE, allowing the hunt to stop early." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify vulnerable e-commerce assets", "reads": [ "resource_uid", "severity", "title", "first_seen" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT resource_uid, severity, title, first_seen FROM hb_vulnerability_finding WHERE cve_uid = '{{target_cve}}' AND status != 'suppressed'", "silence": "not_evidence_of_absence", "expected": "Rows identify specific vulnerable resources. Silence means no known exposure exists for this CVE, allowing the hunt to stop early.", "verified": "dry-run", "verified_at": "2026-10-29" } }, { "id": "analyze-lead", "type": "analytic", "label": "Analyze lead findings", "config": { "cite": "required", "tools": [ "endpoint", "identity", "web" ], "context": [ "identify-vulnerable-commerce" ], "objective": "Determine if the vulnerability finding is significant enough to trigger intensive behavioral queries.", "description": "Assess the severity and duration of the identified vulnerabilities to determine if the behavioral hunt should proceed.", "max_iterations": 3, "expected_signal": "A prioritized list of vulnerable resources.", "success_criteria": "A decision to proceed to behavioral queries or terminate the hunt." }, "parents": [ { "id": "identify-vulnerable-commerce" } ] }, { "id": "gate-vulnerability", "type": "checkpoint", "label": "Gate: Proceed on vulnerability", "config": { "fuzzy": true, "judge": "hunter", "question": "the analyze-lead verdict identified at least one high-risk vulnerable resource", "condition": "the analyze-lead verdict identified at least one high-risk vulnerable resource", "blind_spot": "missing-vulnerability-scans", "confidence": "high", "description": "Control whether expensive behavioral telemetry is examined based on the vulnerability lead.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "analyze-lead" } ] }, { "id": "http-exploitation-probes", "type": "query", "label": "HTTP exploitation probes", "config": { "dsl": "sqlite", "role": "triage", "source": "web", "content": "SELECT device_hostname, url_path, url_query, src_endpoint_ip, status_code, time FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{commerce_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0) AND (LOWER(url_query) LIKE '%entity%' OR LOWER(url_query) LIKE '%doctype%' OR LOWER(url_query) LIKE '%xml%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_http_activity", "description": "Examine web traffic for XXE payload patterns targeting known commerce API paths.", "expected_signal": "Requests containing XML-specific keywords or entity definitions in the URL query parameters." }, "parents": [ { "id": "gate-vulnerability", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "HTTP exploitation probes", "reads": [ "device_hostname", "url_path", "url_query", "src_endpoint_ip", "status_code", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, url_path, url_query, src_endpoint_ip, status_code, time FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{commerce_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0) AND (LOWER(url_query) LIKE '%entity%' OR LOWER(url_query) LIKE '%doctype%' OR LOWER(url_query) LIKE '%xml%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Requests containing XML-specific keywords or entity definitions in the URL query parameters.", "verified": "dry-run", "verified_at": "2026-10-29" } }, { "id": "api-auth-stuffing", "type": "query", "label": "API credential stuffing patterns", "config": { "dsl": "sqlite", "role": "baseline", "source": "identity", "content": "SELECT device_hostname, src_endpoint_ip, COUNT(*) AS attempts, COUNT(DISTINCT actor_user_name) AS accounts, SUM(CASE WHEN status_id = 2 THEN 1 ELSE 0 END) AS fails, SUM(CASE WHEN status_id = 1 THEN 1 ELSE 0 END) AS successes FROM hb_auth_signin WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, src_endpoint_ip HAVING fails > 20 AND accounts > 5 ORDER BY fails DESC", "surface": "hb_auth_signin", "description": "Identify source IPs targeting commerce APIs with high failure rates followed by successful logins.", "expected_signal": "A single IP address attempting many accounts with high failure rates, indicating automated stuffing activity." }, "parents": [ { "id": "gate-vulnerability", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "API credential stuffing patterns", "reads": [ "device_hostname", "src_endpoint_ip", "actor_user_name", "status_id", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT device_hostname, src_endpoint_ip, COUNT(*) AS attempts, COUNT(DISTINCT actor_user_name) AS accounts, SUM(CASE WHEN status_id = 2 THEN 1 ELSE 0 END) AS fails, SUM(CASE WHEN status_id = 1 THEN 1 ELSE 0 END) AS successes FROM hb_auth_signin WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, src_endpoint_ip HAVING fails > 20 AND accounts > 5 ORDER BY fails DESC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "new_this_window" }, "expected": "A single IP address attempting many accounts with high failure rates, indicating automated stuffing activity.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "src_endpoint_ip" ], "rare_below": 5 }, "verified_at": "2026-10-29" } }, { "id": "js-file-modifications", "type": "query", "label": "JavaScript skimmer modifications", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, file_path, process_name, actor_user_name, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND LOWER(file_path) LIKE '%.js' AND (LOWER(process_name) LIKE '%httpd%' OR LOWER(process_name) LIKE '%nginx%' OR LOWER(process_name) LIKE '%php-fpm%' OR LOWER(process_name) LIKE '%apache%') AND activity_id IN (1, 3, 5) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Find unauthorized modifications to JS files on the web server, which indicates skimmer injection or backdoor persistence.", "expected_signal": "Web server processes modifying JavaScript files in the web root. Normal maintenance should use deployment accounts, not the server processes themselves." }, "parents": [ { "id": "gate-vulnerability", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "JavaScript skimmer modifications", "reads": [ "device_hostname", "file_path", "process_name", "actor_user_name", "activity_id", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_path, process_name, actor_user_name, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND LOWER(file_path) LIKE '%.js' AND (LOWER(process_name) LIKE '%httpd%' OR LOWER(process_name) LIKE '%nginx%' OR LOWER(process_name) LIKE '%php-fpm%' OR LOWER(process_name) LIKE '%apache%') AND activity_id IN (1, 3, 5) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Web server processes modifying JavaScript files in the web root. Normal maintenance should use deployment accounts, not the server processes themselves.", "verified": "dry-run", "verified_at": "2026-10-29" } }, { "id": "final-verdict", "type": "analytic", "label": "Final evidence triage", "config": { "cite": "required", "tools": [ "endpoint", "identity", "web" ], "context": [ "analyze-lead", "http-exploitation-probes", "api-auth-stuffing", "js-file-modifications" ], "objective": "Confirm if a vulnerable commerce server shows behavioral signs of active exploitation, account takeover, or skimmer persistence.", "description": "Consolidate results from exploitation probes, auth abuse, and file modifications to determine the scope and impact of an intrusion.", "max_iterations": 6, "expected_signal": "A per-host verdict of malicious | suspicious | benign.", "success_criteria": "A per-host verdict citing specific rows from the behavioral queries." }, "parents": [ { "id": "http-exploitation-probes", "kind": "merge" }, { "id": "api-auth-stuffing", "kind": "merge" }, { "id": "js-file-modifications", "kind": "merge" } ] }, { "id": "route-remediation", "type": "checkpoint", "label": "Route remediation", "config": { "fuzzy": true, "judge": "hunter", "question": "the final-verdict is malicious for at least one host, particularly involving confirmed skimmer injection or successful stuffing", "condition": "the final-verdict is malicious for at least one host, particularly involving confirmed skimmer injection or successful stuffing", "confidence": "high", "description": "Route to immediate isolation if a compromise is confirmed, otherwise to a manual review.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "final-verdict" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate commerce server", "config": { "target": "endpoint", "description": "Halt active data theft by isolating the compromised web server.", "instructions": "Isolate the identified host; remove the injected JavaScript scripts; revoke compromised application credentials.", "action_approval": "required" }, "parents": [ { "id": "route-remediation", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Detailed incident review", "config": { "assignee": "analyst", "description": "Perform manual verification of the fanned-out evidence and verify if any customer data was exfiltrated.", "instructions": "Review the identified HTTP payloads and skimmer scripts; identify which customer accounts were successfully stuffed; verify if payment card details were captured by the skimmer." }, "parents": [ { "id": "gate-vulnerability", "branch": "default" }, { "id": "gate-vulnerability", "branch": "on_unavailable" }, { "id": "route-remediation", "branch": "default" }, { "id": "route-remediation", "branch": "on_unavailable" }, { "id": "route-remediation", "branch": "on_refutes" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Record a negative result or close the hunt for non-vulnerable assets.", "instructions": "Record the examined systems; note any vulnerability remediation required; close the hunt for systems with no behavioral anomalies." }, "parents": [ { "id": "gate-vulnerability", "branch": "on_refutes" } ] } ] }