--- analysis: A simple rule for unsigned drivers would fire too often on development tools. This hunt combines that signal with the lead (credential theft) and the aftermath (mass file activity) to provide the necessary context for high-confidence host isolation. blind_spots: - id: kernel-visibility-gap question: Was every driver load event captured and signature verified? requires: hb_kernel_extension_activity with consistent cross-platform signature status risk: Some EDR versions may fail to report kernel loads once they are actively being impaired, leading to a silent failure in the hunt. stage: evasion-vulnerable-driver-edr-killer - id: process-on-disk-evasion question: Was the infostealer running purely in memory? requires: hb_process_activity with on_disk = 0 tracking risk: If an infostealer is injected into a legitimate process, the file activity lead might only attribute the access to the legitimate process name. stage: credential-access-password-stores coverage: - stage: credential-access-password-stores status: covered steps: - credential-store-access - stage: evasion-vulnerable-driver-edr-killer status: covered steps: - driver-load-check - stage: impact-ransomware-data-exfiltration status: covered steps: - high-volume-file-activity - reason: 'Belongs to another part of the ''The SMB cybersecurity squeeze: AI agents at work, old attacks in overdrive'' series.' stage: phishing-ai-enhanced-social-engineering status: out_of_scope - reason: 'Belongs to another part of the ''The SMB cybersecurity squeeze: AI agents at work, old attacks in overdrive'' series.' stage: initial-access-malicious-ai-skills status: out_of_scope - reason: 'Belongs to another part of the ''The SMB cybersecurity squeeze: AI agents at work, old attacks in overdrive'' series.' stage: exploit-public-facing-rapid-cve status: out_of_scope - reason: 'Belongs to another part of the ''The SMB cybersecurity squeeze: AI agents at work, old attacks in overdrive'' series.' stage: execution-indirect-prompt-injection status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: Ransomware remains the highest risk to SMBs, and 'BYOVD' (Bring Your Own Vulnerable Driver) is a primary method used to disable the protection these companies rely on. This hunt catches the transition from theft to impact. methodology: model-assisted trigger: intel-report hypothesis: An adversary is stealing credentials from browser stores and attempting to disable security controls using vulnerable drivers before launching a high-volume ransomware or exfiltration attack. labels: - hunt - attack.t1555 - attack.t1562.001 - attack.t1486 - attack.t1041 - credential access - defense evasion - execution - impact - initial access name: EDR Impairment and Ransomware Impact parameters: credential_files: default: - login data - cookies - logins.json - key4.db description: Browser credential and session filenames targeted by infostealers. from: kind: article observed: '2026-09-21' ref: eset-smb-2026 type: list[string] lookback_days: default: '14' description: Days of historical telemetry to examine. from: kind: manual observed: '2024-01-01' ref: standard-hunt-period type: number scope_hosts: default: [] description: List of hostnames identified in the lead query to narrow subsequent searches. from: kind: manual observed: '2024-01-01' ref: analyst-pivot type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.welivesecurity.com/en/business-security/smb-cybersecurity-squeeze-ai-agents-work-old-attacks-overdrive/ gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: The lead query identifies hosts where non-browser processes access browser credential stores. These hosts should be provided in the scope_hosts parameter for the parallel checks to focus on likely compromised endpoints. references: - name: 'The SMB cybersecurity squeeze: AI agents at work, old attacks in overdrive' url: https://www.welivesecurity.com/en/business-security/smb-cybersecurity-squeeze-ai-agents-work-old-attacks-overdrive/ related: - hunt: phishing-ai-enhanced-social-engineering reason: The initial access via AI-enhanced phishing is handled in a separate hunt in this series. relation: out-of-scope-alternative - hunt: ai-agent-social-engineering-access relation: follows scenario: stages: - name: AI-Enhanced Phishing and ClickFix observables: - QR codes in phishing emails - Fake AI troubleshooting error messages - AI-generated lures with high click-through rates - ClickFix prompts asking users to paste commands slug: phishing-ai-enhanced-social-engineering tactic: initial-access techniques: - T1566 - name: AI Agent Supply Chain Compromise observables: - Installation of malicious 'skills' from public repositories - Malicious MCP (Model Context Protocol) server connections - AI agent 'rug pull' behavior where a tool morphs into an infostealer slug: initial-access-malicious-ai-skills tactic: initial-access techniques: - T1195 - name: Rapid Vulnerability Exploitation observables: - Exploitation of known vulnerabilities on or before disclosure day - Scanning for vulnerable software libraries invented by LLM hallucinations slug: exploit-public-facing-rapid-cve tactic: initial-access techniques: - T1190 - name: Indirect Prompt Injection and Terminal Execution observables: - EchoLeak-style data exposure in Microsoft 365 Copilot - Users pasting commands into terminals following ClickFix lures - Malicious instructions retrieved by agents from webpages or emails slug: execution-indirect-prompt-injection tactic: execution techniques: - T1203 - name: Credential Theft via Infostealer observables: - Access to browser password databases - Phishing-as-a-service kits capturing login credentials - Infostealer malware execution slug: credential-access-password-stores tactic: credential-access techniques: - T1555 - name: EDR Impairment via Vulnerable Drivers observables: - Loading of known vulnerable drivers (BYOVD) - Tools designed to kill EDR processes - Abuse of legitimate drivers to gain kernel-level access slug: evasion-vulnerable-driver-edr-killer tactic: defense-evasion techniques: - T1562.001 - name: Data Encryption and Exfiltration observables: - PromptLock ransomware execution - Encryption of files on local or shared drives - Exfiltration of sensitive data via AI agent tools - C2 traffic to attacker-controlled domains slug: impact-ransomware-data-exfiltration tactic: impact techniques: - T1486 - T1041 summary: AI agents are being compromised via malicious supply chain skills and indirect prompt injection, while traditional threats like phishing and vulnerability exploitation are accelerated by AI-driven automation. Adversaries are increasingly using 'Bring Your Own Vulnerable Driver' (BYOVD) techniques to disable EDR tools before deploying ransomware or exfiltrating credentials. series: index: 2 slug: the-smb-cybersecurity-squeeze-ai-agents-at-work-old-attacks-in-overdrive title: 'The SMB cybersecurity squeeze: AI agents at work, old attacks in overdrive' total: 2 severity: medium targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # EDR Impairment and Ransomware Impact This hunt targets the late-stage progression of an intrusion in an SMB environment. It starts by identifying suspicious access to browser credential stores, then fans out to detect the loading of unsigned or revoked kernel drivers used for EDR impairment. Simultaneously, it baselines file activity to find rare processes performing mass encryption or renaming. An agent weighs these signals to identify coordinated impact attempts. ## credential-store-access Identify potential infostealer activity by finding non-browser processes reading password files. ```sqlite target=endpoint role=scoping params=(lookback_days=lookback_days, credential_files=credential_files) ~~~yaml expected: Rows show processes like cmd.exe or unknown binaries reading browser databases. Silence suggests no such direct access was recorded. reads: - activity_id - actor_user_name - device_hostname - file_name - file_path - process_name - time silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-09-29' ~~~ SELECT device_hostname, actor_user_name, process_name, file_name, file_path, time FROM hb_file_activity WHERE instr(',' || '{{credential_files}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND activity_id = 2 AND (LOWER(process_name) NOT LIKE '%\\chrome.exe' AND LOWER(process_name) NOT LIKE '%\\msedge.exe' AND LOWER(process_name) NOT LIKE '%\\firefox.exe') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## parallel-check parallel: - → driver-load-check - → high-volume-file-activity join: → triage-impact ## driver-load-check Detect the BYOVD technique used to kill security software by loading vulnerable drivers. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: A list of unsigned or untrusted drivers. Silence is a strong indicator that no standard BYOVD tool was loaded. reads: - device_hostname - driver_path - driver_signature_status - driver_signature_subject - driver_signed - time silence: not_evidence_of_absence source: hb_kernel_extension_activity verified: dry-run verified_at: '2026-09-29' ~~~ SELECT device_hostname, driver_path, driver_signature_subject, driver_signed, time FROM hb_kernel_extension_activity WHERE (driver_signed = 'false' OR LOWER(driver_signature_status) != 'valid') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## high-volume-file-activity Identify the final ransomware or exfiltration stage where a rare process touches many files. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A process rare across the fleet modifying a large number of files on a single host. Silence means no mass modification occurred during the window. prevalence: by: device_hostname key: - process_name rare_below: 4 reads: - activity_id - device_hostname - process_name - time silence: evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-09-29' ~~~ SELECT process_name, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS total_events, MIN(time) AS first_seen FROM hb_file_activity WHERE activity_id IN (3, 5) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_name HAVING hosts <= 3 AND total_events > 50 ORDER BY hosts ASC ``` ## triage-impact ```agent target=hunter cite: required context: - credential-store-access - driver-load-check - high-volume-file-activity max_iterations: 4 objective: Determine if any host shows a sequence of credential theft followed by suspicious driver loading and finally high-volume file modifications. Cite the specific process names and driver paths found in all three steps. success_criteria: A malicious | suspicious | benign verdict per host with supporting row citations. tools: - endpoint ``` ## route-verdict if~: "the triage verdict is malicious for at least one host involving driver loading and mass file activity" (confidence: high, judge=hunter) then: → isolate-endpoint indeterminate: → forensic-review unavailable: → forensic-review (blind_spot: kernel-visibility-gap) else: → forensic-review ## isolate-endpoint ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host immediately via the EDR console. Preserve the endpoint state for forensic memory collection, focusing on the malicious driver. ``` → forensic-review ## forensic-review ```manual target=analyst Review the cited driver paths and file activities. Check the process_cmd_line for the processes touching credential stores to find where they were launched from. ``` → hunt-closeout ## hunt-closeout ```manual target=analyst Record the findings. If driver loading was not visible on some OS versions, document this as a telemetry gap for the platform team. ``` → end