{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Edge AI environments hold high-value proprietary model weights and sensitive local data; a negative result for artifact poisoning and exfiltration provides confidence in the integrity of these autonomous systems."
      },
      "name": "Edge AI Artifact Integrity and Data Exfiltration",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1195",
        "attack.t1204.002",
        "attack.t1528",
        "attack.t1552",
        "attack.t1090.003",
        "attack.t1041"
      ],
      "related": [
        {
          "hunt": "ai-agent-autonomous-execution-hijack",
          "reason": "This hunt focuses on data exfiltration; lateral movement via hijacked agent tool calls is a separate behavioral chain.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A single rule may find a known prompt injection keyword, but this hunt correlates those signals with supply-chain artifact changes and memory-resident code execution on the specific nodes running AI software, providing a context-aware view of a complex attack chain.",
      "coverage": [
        {
          "stage": "supply-chain-compromise-artifacts",
          "steps": [
            "model-artifact-tampering"
          ],
          "status": "covered"
        },
        {
          "stage": "malicious-model-manipulation",
          "steps": [
            "prompt-injection-signals"
          ],
          "status": "covered"
        },
        {
          "stage": "sensitive-asset-theft",
          "steps": [
            "injected-processes"
          ],
          "status": "covered"
        },
        {
          "stage": "obfuscated-c2-and-exfiltration",
          "steps": [
            "bulk-exfiltration"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Supply chain compromise of AI artifacts",
            "slug": "supply-chain-compromise-artifacts",
            "tactic": "initial-access",
            "techniques": [
              "T1195"
            ],
            "observables": [
              "Malicious firmware updates",
              "Tampered model weights",
              "Unsigned binaries in model distribution channels",
              "Poisoned model artifacts in local storage"
            ]
          },
          {
            "name": "Model behavior manipulation via poisoned input",
            "slug": "malicious-model-manipulation",
            "tactic": "execution",
            "techniques": [
              "T1204.002"
            ],
            "observables": [
              "Prompt injection payloads in HTTP requests",
              "Poisoned retrieval documents (RAG)",
              "Malicious agent instructions",
              "Unsafe tool calls initiated by AI agents"
            ]
          },
          {
            "name": "Theft of sensitive AI assets and credentials",
            "slug": "sensitive-asset-theft",
            "tactic": "credential-access",
            "techniques": [
              "T1528",
              "T1552"
            ],
            "observables": [
              "Theft of decrypted model weights from memory or GPU buffers",
              "Access to credentials stored in local environment",
              "Unprotected accelerator path access (GPU/NPU drivers)",
              "Modification of retrieval indexes"
            ]
          },
          {
            "name": "Obfuscated C2 and asset exfiltration",
            "slug": "obfuscated-c2-and-exfiltration",
            "tactic": "command-and-control",
            "techniques": [
              "T1090.003",
              "T1041"
            ],
            "observables": [
              "Tor network traffic to .onion domains",
              "Multi-hop proxy connections (ngrok, tunneling)",
              "Bulk exfiltration of large model weight files",
              "DNS queries for hidden services"
            ]
          }
        ],
        "summary": "Edge AI environments are targeted by compromising the supply chain of model weights and firmware, followed by runtime manipulation via prompt injection or poisoned retrieval data. Attackers then leverage access to the local infrastructure to steal decrypted credentials, model IP, and sensitive data, exfiltrating these assets through multi-hop proxies like Tor to evade detection in disconnected or sovereign environments."
      },
      "severity": "medium",
      "rationale": "The hunt should focus on devices identified as AI edge nodes, such as medical imaging gateways or industrial controllers with dedicated NPUs/GPUs.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has compromised the Edge AI supply chain to poison model artifacts, then manipulated those models via prompt injection to exfiltrate sensitive weights and credentials over high-volume network channels.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Specific hostnames to focus the hunt on; leave empty to use results from the scoping step."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "model_file_paths": {
          "type": "list[path]",
          "default": [
            "/opt/ai/model.bin",
            "/var/lib/ollama/weights.pt",
            "C:\\\\ProgramData\\\\AI-Models\\\\config.json"
          ],
          "description": "Specific high-value AI model weight or configuration paths to monitor."
        },
        "ai_software_keywords": {
          "type": "list[string]",
          "default": [
            "pytorch",
            "tensorflow",
            "ollama",
            "cuda",
            "npu",
            "tensorrt",
            "llama",
            "onnx"
          ],
          "description": "Keywords to identify AI-related software packages on edge devices."
        },
        "injection_signatures": {
          "type": "list[string]",
          "default": [
            "ignore prior instructions",
            "system prompt",
            "dan mode",
            "jailbreak",
            "developer mode"
          ],
          "description": "Common keywords used in prompt injection attacks."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.microsoft.com/en-us/security/blog/2026/09/04/secure-edge-ai-customer-owned-environments/",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.microsoft.com/en-us/security/blog/2026/09/04/secure-edge-ai-customer-owned-environments/",
          "name": "How to secure edge AI in customer-owned environments"
        }
      ],
      "blind_spots": [
        {
          "id": "missing-flow-data",
          "risk": "Exfiltration volume cannot be accurately assessed if only the primary interface is logged.",
          "stage": "obfuscated-c2-and-exfiltration",
          "question": "Was data exfiltrated via a management or secondary interface not monitored by flow logs?",
          "requires": "hb_network_connection with byte counts from all secondary interfaces"
        },
        {
          "id": "http-body-blindness",
          "risk": "Many prompt injections are delivered in JSON bodies; if only URL components are visible, the attack will be missed.",
          "stage": "malicious-model-manipulation",
          "question": "Did the prompt injection occur in the POST body rather than the URL?",
          "requires": "Full HTTP POST body logging"
        }
      ]
    },
    "name": "Edge AI Artifact Integrity and Data Exfiltration",
    "description": "This hunt examines the end-to-end lifecycle of an Edge AI compromise using a phased approach. It first identifies hosts running AI workloads and searches for evidence of model artifact tampering and prompt injection attempts. The second phase investigates follow-on activity, specifically focusing on memory-resident (fileless) code execution and large-scale outbound data transfers that suggest the exfiltration of proprietary model weights or local credentials. An agent correlates the early manipulation with the eventual exfiltration to provide a high-confidence verdict."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "supply-chain-compromise-artifacts",
            "steps": [
              "model-artifact-tampering"
            ],
            "status": "covered"
          },
          {
            "stage": "malicious-model-manipulation",
            "steps": [
              "prompt-injection-signals"
            ],
            "status": "covered"
          },
          {
            "stage": "sensitive-asset-theft",
            "steps": [
              "injected-processes"
            ],
            "status": "covered"
          },
          {
            "stage": "obfuscated-c2-and-exfiltration",
            "steps": [
              "bulk-exfiltration"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary has compromised the Edge AI supply chain to poison model artifacts, then manipulated those models via prompt injection to exfiltrate sensitive weights and credentials over high-volume network channels.",
        "blind_spots": [
          {
            "id": "missing-flow-data",
            "risk": "Exfiltration volume cannot be accurately assessed if only the primary interface is logged.",
            "stage": "obfuscated-c2-and-exfiltration",
            "question": "Was data exfiltrated via a management or secondary interface not monitored by flow logs?",
            "requires": "hb_network_connection with byte counts from all secondary interfaces"
          },
          {
            "id": "http-body-blindness",
            "risk": "Many prompt injections are delivered in JSON bodies; if only URL components are visible, the attack will be missed.",
            "stage": "malicious-model-manipulation",
            "question": "Did the prompt injection occur in the POST body rather than the URL?",
            "requires": "Full HTTP POST body logging"
          }
        ],
        "scoping_notes": "The hunt should focus on devices identified as AI edge nodes, such as medical imaging gateways or industrial controllers with dedicated NPUs/GPUs.",
        "beyond_detection": "A single rule may find a known prompt injection keyword, but this hunt correlates those signals with supply-chain artifact changes and memory-resident code execution on the specific nodes running AI software, providing a context-aware view of a complex attack chain."
      }
    },
    {
      "id": "identify-ai-hosts",
      "type": "query",
      "label": "Identify Edge AI infrastructure",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (instr(',' || '{{ai_software_keywords}}' || ',', ',' || LOWER(package_name) || ',') > 0) AND asset_scope = 'endpoint'",
        "surface": "hb_software_inventory",
        "description": "Identify hosts that have AI-related software or drivers installed to define the hunt scope.",
        "expected_signal": "A list of hostnames identified as Edge AI nodes. Silence means no hosts match the criteria."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify Edge AI infrastructure",
        "reads": [
          "device_hostname",
          "package_name",
          "package_version",
          "asset_scope"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (instr(',' || '{{ai_software_keywords}}' || ',', ',' || LOWER(package_name) || ',') > 0) AND asset_scope = 'endpoint'",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames identified as Edge AI nodes. Silence means no hosts match the criteria.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "model-artifact-tampering",
      "type": "query",
      "label": "Monitor sensitive AI model files",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, file_path, process_name, activity_name, time FROM hb_file_activity WHERE instr(',' || '{{model_file_paths}}' || ',', ',' || file_path || ',') > 0 AND activity_id IN (1, 3) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_file_activity",
        "description": "Find recent modifications to sensitive AI model weights or configurations on identified hosts.",
        "expected_signal": "Modifications to protected AI model files on edge nodes. Silence means no tracked files were modified."
      },
      "parents": [
        {
          "id": "identify-ai-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Monitor sensitive AI model files",
        "reads": [
          "device_hostname",
          "file_path",
          "process_name",
          "activity_id",
          "activity_name",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, file_path, process_name, activity_name, time FROM hb_file_activity WHERE instr(',' || '{{model_file_paths}}' || ',', ',' || file_path || ',') > 0 AND activity_id IN (1, 3) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Modifications to protected AI model files on edge nodes. Silence means no tracked files were modified.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "prompt-injection-signals",
      "type": "query",
      "label": "Identify prompt injection signatures",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "web",
        "content": "SELECT device_hostname, url_query, http_method, src_endpoint_ip, time FROM hb_http_activity WHERE instr(',' || '{{injection_signatures}}' || ',', ',' || LOWER(url_query) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Find HTTP requests targeting AI service endpoints that contain known prompt injection keywords.",
        "expected_signal": "Inbound HTTP traffic containing injection payloads. Silence proves absence only for the tracked signatures."
      },
      "parents": [
        {
          "id": "identify-ai-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Identify prompt injection signatures",
        "reads": [
          "device_hostname",
          "url_query",
          "http_method",
          "src_endpoint_ip",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_query, http_method, src_endpoint_ip, time FROM hb_http_activity WHERE instr(',' || '{{injection_signatures}}' || ',', ',' || LOWER(url_query) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Inbound HTTP traffic containing injection payloads. Silence proves absence only for the tracked signatures.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "agent-early-triage",
      "type": "analytic",
      "label": "Evaluate early manipulation",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network",
          "web"
        ],
        "context": [
          "model-artifact-tampering",
          "prompt-injection-signals"
        ],
        "objective": "Determine if any host shows evidence of model poisoning followed by malicious instruction inputs.",
        "description": "Correlate artifact modifications and injection attempts to determine if an AI service is under active manipulation.",
        "max_iterations": 3,
        "expected_signal": "A per-host verdict on whether the combination of file changes and HTTP signals indicates a successful manipulation or poisoning.",
        "success_criteria": "A verdict of malicious | suspicious | benign per host, citing specific HTTP and file events."
      },
      "parents": [
        {
          "id": "model-artifact-tampering",
          "kind": "merge"
        },
        {
          "id": "prompt-injection-signals",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "injected-processes",
      "type": "query",
      "label": "Identify fileless code execution",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE on_disk = 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Find processes with on_disk=0 on Edge AI hosts, indicating potential memory-resident theft of decrypted assets.",
        "expected_signal": "Running processes with no binary on disk, common in weight theft scenarios. Silence proves absence of simple fileless execution."
      },
      "parents": [
        {
          "id": "agent-early-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Identify fileless code execution",
        "reads": [
          "device_hostname",
          "process_name",
          "process_cmd_line",
          "user_name",
          "on_disk",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE on_disk = 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Running processes with no binary on disk, common in weight theft scenarios. Silence proves absence of simple fileless execution.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "bulk-exfiltration",
      "type": "query",
      "label": "Detect massive outbound transfers",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, SUM(traffic_bytes) AS total_bytes FROM hb_network_connection WHERE direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip HAVING total_bytes > 500000000 ORDER BY total_bytes DESC",
        "surface": "hb_network_connection",
        "description": "Find large outbound network connections from AI hosts that suggest exfiltration of massive model weights.",
        "expected_signal": "Hosts sending more than 500MB to a single destination IP. Silence proves no bulk transfer occurred during the window."
      },
      "parents": [
        {
          "id": "agent-early-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Detect massive outbound transfers",
        "reads": [
          "device_hostname",
          "dst_endpoint_ip",
          "traffic_bytes",
          "direction",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, SUM(traffic_bytes) AS total_bytes FROM hb_network_connection WHERE direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip HAVING total_bytes > 500000000 ORDER BY total_bytes DESC",
        "silence": "evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Hosts sending more than 500MB to a single destination IP. Silence proves no bulk transfer occurred during the window.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "dst_endpoint_ip"
          ],
          "rare_below": 2
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "agent-final-assessment",
      "type": "analytic",
      "label": "Final assessment of attack chain",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network",
          "web"
        ],
        "context": [
          "agent-early-triage",
          "injected-processes",
          "bulk-exfiltration"
        ],
        "objective": "Determine if any host shows an end-to-end compromise from model manipulation to exfiltration.",
        "description": "Correlate early-stage manipulation with follow-on fileless execution and bulk exfiltration.",
        "max_iterations": 4,
        "expected_signal": "A final verdict linking artifact poisoning, prompt injection, and exfiltration.",
        "success_criteria": "A final verdict citing the linkage between manipulation signals and exfiltration volume."
      },
      "parents": [
        {
          "id": "injected-processes",
          "kind": "merge"
        },
        {
          "id": "bulk-exfiltration",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "decision-route",
      "type": "checkpoint",
      "label": "Route on final assessment",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the final assessment verdict is malicious for exfiltration on at least one host",
        "condition": "the final assessment verdict is malicious for exfiltration on at least one host",
        "blind_spot": "missing-flow-data",
        "confidence": "high",
        "description": "Route to containment if exfiltration of AI assets is confirmed.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "agent-final-assessment"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate Edge AI Node",
      "config": {
        "target": "endpoint",
        "description": "Contain the host to prevent further exfiltration of model IP.",
        "instructions": "Isolate the identified host to stop active data exfiltration and preserve memory for analysis.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "decision-route",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst review of AI compromise",
      "config": {
        "assignee": "analyst",
        "description": "Review the correlated evidence to confirm the manipulation and exfiltration attempt.",
        "instructions": "Verify if the modified model files match known-good vendor hashes and review the prompt injection strings found in the HTTP logs."
      },
      "parents": [
        {
          "id": "decision-route",
          "branch": "default"
        },
        {
          "id": "decision-route",
          "branch": "on_unavailable"
        },
        {
          "id": "decision-route",
          "branch": "on_refutes"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Hunt close-out",
      "config": {
        "assignee": "analyst",
        "description": "Record findings and update baselines for legitimate AI data movements.",
        "instructions": "Document the findings and update any legitimate bulk transfer destination IPs to the trusted baseline."
      },
      "parents": [
        {
          "id": "analyst-review"
        }
      ]
    }
  ]
}