{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Ransomware operators are increasingly prioritizing the systematic impairment of EDR to evade detection. A negative result provides the business with confidence that security agents remain operational across the estate." }, "name": "EDR Impairment and RMM-Driven Ransomware Execution", "type": "investigation", "labels": [ "hunt", "attack.t1562.001", "attack.t1059.001", "attack.t1070.001", "attack.t1195.002", "attack.t1486", "credential access", "defense evasion", "execution", "exfiltration", "impact", "initial access", "lateral movement", "persistence" ], "series": { "slug": "ir-trends-q3-2026-actors-impersonate-it-help-desks-in-vishing-attacks-as-ransomware-activity-inc", "index": 2, "title": "IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases", "total": 3 }, "related": [ { "hunt": "vishing-rmm-initial-access", "reason": "The initial social engineering via vishing belongs to a hunt focused on identity and RMM session initiation.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple rule may fire on taskkill, but this hunt correlates termination attempts with driver load counts (BYOVD) and application installations, providing a complete picture of the attack chain that individual rules miss.", "coverage": [ { "stage": "rmm-dropper-execution", "steps": [ "rmm-msi-deployment" ], "status": "covered" }, { "stage": "defense-evasion-edr-impairment", "steps": [ "edr-termination-lead", "driver-load-stacking" ], "status": "covered" }, { "stage": "vishing-rmm-access", "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.", "status": "out_of_scope" }, { "stage": "edge-vulnerability-exploitation", "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.", "status": "out_of_scope" }, { "stage": "persistence-web-shell-accounts", "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.", "status": "out_of_scope" }, { "stage": "lateral-movement-discovery", "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.", "status": "out_of_scope" }, { "stage": "credential-access-ai-secrets", "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.", "status": "out_of_scope" }, { "stage": "exfiltration-over-c2", "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.", "status": "out_of_scope" }, { "stage": "data-encryption-for-impact", "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "IT help desk vishing and remote assistance", "slug": "vishing-rmm-access", "tactic": "initial-access", "techniques": [ "T1566", "T1133" ], "observables": [ "Microsoft Quick Assist", "IT help desk impersonation", "vishing calls" ] }, { "name": "Exploitation of Cisco IOS XE management interface", "slug": "edge-vulnerability-exploitation", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "CVE-2023-20198", "web-based management interface access" ] }, { "name": "Web shell implant and privileged account creation", "slug": "persistence-web-shell-accounts", "tactic": "persistence", "techniques": [ "T1505.003", "T1133" ], "observables": [ "BadCandy web shell", "privilege 15 command", "local user creation on network device" ] }, { "name": "RMM deployment and MSI installation", "slug": "rmm-dropper-execution", "tactic": "execution", "techniques": [ "T1059.001" ], "observables": [ "MeshAgent", "PowerShell", "MSI package", "remote IP download" ] }, { "name": "EDR killing via BYOVD and task termination", "slug": "defense-evasion-edr-impairment", "tactic": "defense-evasion", "techniques": [ "T1562.001", "T1070.001" ], "observables": [ "taskkill.exe", "cscm.exe", "sfc.exe", "BYOVD", "vulnerable drivers", "Windows Defender real-time protection disabled", "event logs cleared" ] }, { "name": "Network discovery and lateral movement", "slug": "lateral-movement-discovery", "tactic": "lateral-movement", "techniques": [ "T1021.002", "T1021.001" ], "observables": [ "PsExec.exe", "MSTSC", "IP scan", "Microsoft Terminal Services Client" ] }, { "name": "macOS keychain scraping for AI credentials", "slug": "credential-access-ai-secrets", "tactic": "credential-access", "techniques": [ "T1003" ], "observables": [ "macOS keychain", "Anthropic Claude Code secrets", "credential scraping scripts" ] }, { "name": "Data exfiltration via Rclone", "slug": "exfiltration-over-c2", "tactic": "exfiltration", "techniques": [ "T1567.002", "T1041" ], "observables": [ "Rclone", "multi-day exfiltration" ] }, { "name": "Ransomware encryption", "slug": "data-encryption-for-impact", "tactic": "impact", "techniques": [ "T1486" ], "observables": [ "VYPR", "Interlock", "ransom note" ] } ], "summary": "Threat actors utilized vishing to impersonate IT help desks and establish remote sessions via Microsoft Quick Assist, or exploited CVE-2023-20198 on Cisco IOS XE edge devices to gain entry. Post-compromise, they deployed RMM tools and vulnerable drivers to terminate EDR systems (BYOVD) before conducting multi-day data exfiltration via Rclone and deploying ransomware variants like VYPR and Interlock." }, "severity": "critical", "rationale": "The analyst focuses on high-value endpoints where the adversary might have cleared security logs. Prioritize servers and workstations showing recent administrative tool usage or PowerShell activity.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has established a foothold and is systematically disabling security controls via process termination and Bring Your Own Vulnerable Driver (BYOVD) techniques to facilitate ransomware execution via RMM tools.", "parameters": { "rmm_tools": { "from": { "ref": "https://blog.talosintelligence.com/ir-trends-q3-2026/", "kind": "article", "observed": "2026-10-29" }, "type": "list[string]", "default": [ "meshagent", "rclone", "psexec", "quickassist" ], "description": "Keywords for remote monitoring and administrative tools used in ransomware campaigns." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "The list of hosts discovered in the lead query to scope the parallel queries." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "security_processes": { "from": { "ref": "https://blog.talosintelligence.com/ir-trends-q3-2026/", "kind": "article", "observed": "2026-10-29" }, "type": "list[string]", "default": [ "cscm.exe", "sfc.exe", "msmpeng.exe", "msascuil.exe" ], "description": "Process names of security agents and system integrity tools targeted for termination." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://blog.talosintelligence.com/ir-trends-q3-2026/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://blog.talosintelligence.com/ir-trends-q3-2026/", "name": "Cisco Talos \u2014 IR trends Q3 2026: Actors impersonate IT help desks" } ], "blind_spots": [ { "id": "endpoint-visibility-gap", "risk": "If an actor disables the security agent and its logging before BYOVD begins, the later stages remain invisible.", "stage": "defense-evasion-edr-impairment", "question": "Was Windows Defender disabled before telemetry could be forwarded?", "requires": "hb_device_config_state with tamper protection status" }, { "id": "event-log-clearing", "risk": "Interlock actors are known to clear logs; if logs are not centralized, the lead query will return zero rows even if an intrusion occurred.", "stage": "defense-evasion-edr-impairment", "question": "Were local event logs cleared to hinder analysis?", "requires": "off-device log forwarding (SIEM)" } ] }, "name": "EDR Impairment and RMM-Driven Ransomware Execution", "description": "This hunt targets the execution and defense evasion stages observed in Q3 2026 ransomware campaigns, such as VYPR and Interlock. It identifies the direct impairment of security agents like Cisco Secure Endpoint and the Windows System File Checker (sfc.exe). The hunt corroborates these leads by detecting kernel driver stacking\u2014a signature of BYOVD experimentation\u2014and the deployment of RMM tools used for PowerShell-based MSI installations. An agent weighs the combined evidence of control disruption and suspicious deployment to identify hosts at immediate risk of impact." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "ir-trends-q3-2026-actors-impersonate-it-help-desks-in-vishing-attacks-as-ransomware-activity-inc", "index": 2, "title": "IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases", "total": 3 }, "coverage": [ { "stage": "rmm-dropper-execution", "steps": [ "rmm-msi-deployment" ], "status": "covered" }, { "stage": "defense-evasion-edr-impairment", "steps": [ "edr-termination-lead", "driver-load-stacking" ], "status": "covered" }, { "stage": "vishing-rmm-access", "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.", "status": "out_of_scope" }, { "stage": "edge-vulnerability-exploitation", "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.", "status": "out_of_scope" }, { "stage": "persistence-web-shell-accounts", "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.", "status": "out_of_scope" }, { "stage": "lateral-movement-discovery", "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.", "status": "out_of_scope" }, { "stage": "credential-access-ai-secrets", "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.", "status": "out_of_scope" }, { "stage": "exfiltration-over-c2", "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.", "status": "out_of_scope" }, { "stage": "data-encryption-for-impact", "reason": "Belongs to another part of the 'IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases' series.", "status": "out_of_scope" } ], "rationale": "An adversary has established a foothold and is systematically disabling security controls via process termination and Bring Your Own Vulnerable Driver (BYOVD) techniques to facilitate ransomware execution via RMM tools.", "blind_spots": [ { "id": "endpoint-visibility-gap", "risk": "If an actor disables the security agent and its logging before BYOVD begins, the later stages remain invisible.", "stage": "defense-evasion-edr-impairment", "question": "Was Windows Defender disabled before telemetry could be forwarded?", "requires": "hb_device_config_state with tamper protection status" }, { "id": "event-log-clearing", "risk": "Interlock actors are known to clear logs; if logs are not centralized, the lead query will return zero rows even if an intrusion occurred.", "stage": "defense-evasion-edr-impairment", "question": "Were local event logs cleared to hinder analysis?", "requires": "off-device log forwarding (SIEM)" } ], "scoping_notes": "The analyst focuses on high-value endpoints where the adversary might have cleared security logs. Prioritize servers and workstations showing recent administrative tool usage or PowerShell activity.", "beyond_detection": "A simple rule may fire on taskkill, but this hunt correlates termination attempts with driver load counts (BYOVD) and application installations, providing a complete picture of the attack chain that individual rules miss." } }, { "id": "edr-termination-lead", "type": "query", "label": "Security process termination attempts", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE ((activity_id = 2 AND (instr(',' || '{{security_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_name) LIKE '%\\\\cscm.exe' OR LOWER(process_name) LIKE '%\\\\sfc.exe' OR LOWER(process_name) LIKE '%\\\\msmpeng.exe' OR LOWER(process_name) LIKE '%\\\\msascuil.exe')) OR (LOWER(process_name) LIKE '%\\\\taskkill.exe' AND (LOWER(process_cmd_line) LIKE '%/f%' OR LOWER(process_cmd_line) LIKE '%/im%'))) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "The query identifies where the adversary terminated security agents or system integrity tools, a primary indicator of defense evasion.", "expected_signal": "Rows showing the termination of Cisco Secure Endpoint (cscm.exe) or the Windows Defender process. Silence suggests no direct process-level impairment of these targets occurred." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Security process termination attempts", "reads": [ "device_hostname", "process_name", "process_cmd_line", "parent_process_name", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE ((activity_id = 2 AND (instr(',' || '{{security_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_name) LIKE '%\\\\cscm.exe' OR LOWER(process_name) LIKE '%\\\\sfc.exe' OR LOWER(process_name) LIKE '%\\\\msmpeng.exe' OR LOWER(process_name) LIKE '%\\\\msascuil.exe')) OR (LOWER(process_name) LIKE '%\\\\taskkill.exe' AND (LOWER(process_cmd_line) LIKE '%/f%' OR LOWER(process_cmd_line) LIKE '%/im%'))) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Rows showing the termination of Cisco Secure Endpoint (cscm.exe) or the Windows Defender process. Silence suggests no direct process-level impairment of these targets occurred.", "verified": "dry-run", "verified_at": "2026-10-30" } }, { "id": "driver-load-stacking", "type": "query", "label": "Kernel driver load stacking", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, driver_path, driver_signature_subject, COUNT(*) OVER (PARTITION BY device_hostname) AS load_count, time FROM hb_kernel_extension_activity WHERE activity_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY load_count DESC", "surface": "hb_kernel_extension_activity", "description": "The hunt identifies hosts where the adversary loaded an unusually high number of drivers, indicating a BYOVD attack.", "expected_signal": "A single host with more than 3 unique driver loads in a short window, particularly with non-standard signers. This aligns with VYPR BYOVD tactics." }, "parents": [ { "id": "edr-termination-lead" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Kernel driver load stacking", "reads": [ "device_hostname", "driver_path", "driver_signature_subject", "time" ], "source": "hb_kernel_extension_activity", "target": "endpoint", "content": "SELECT device_hostname, driver_path, driver_signature_subject, COUNT(*) OVER (PARTITION BY device_hostname) AS load_count, time FROM hb_kernel_extension_activity WHERE activity_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY load_count DESC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A single host with more than 3 unique driver loads in a short window, particularly with non-standard signers. This aligns with VYPR BYOVD tactics.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "driver_path" ], "rare_below": 3 }, "verified_at": "2026-10-30" } }, { "id": "rmm-msi-deployment", "type": "query", "label": "RMM and MSI activity via PowerShell", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, message, package_calling_process, time FROM hb_application_lifecycle WHERE (instr(',' || '{{rmm_tools}}' || ',', ',' || LOWER(message) || ',') > 0 OR LOWER(message) LIKE '%.msi%') AND (LOWER(package_calling_process) LIKE '%\\\\powershell.exe' OR LOWER(package_calling_process) LIKE '%\\\\pwsh.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_application_lifecycle", "description": "The query detects the adversary installing RMM packages or MSI files via PowerShell, as seen in the VYPR campaign.", "expected_signal": "The query finds evidence of the adversary installing MeshAgent or similar RMM tools via PowerShell commands. Silence proves only that no MSI lifecycle events matched the keywords." }, "parents": [ { "id": "edr-termination-lead" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "RMM and MSI activity via PowerShell", "reads": [ "device_hostname", "message", "package_calling_process", "time" ], "source": "hb_application_lifecycle", "target": "endpoint", "content": "SELECT device_hostname, message, package_calling_process, time FROM hb_application_lifecycle WHERE (instr(',' || '{{rmm_tools}}' || ',', ',' || LOWER(message) || ',') > 0 OR LOWER(message) LIKE '%.msi%') AND (LOWER(package_calling_process) LIKE '%\\\\powershell.exe' OR LOWER(package_calling_process) LIKE '%\\\\pwsh.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "The query finds evidence of the adversary installing MeshAgent or similar RMM tools via PowerShell commands. Silence proves only that no MSI lifecycle events matched the keywords.", "verified": "dry-run", "verified_at": "2026-10-30" } }, { "id": "triage-impairment", "type": "analytic", "label": "Weigh impairment and deployment", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "edr-termination-lead", "driver-load-stacking", "rmm-msi-deployment" ], "objective": "Identify hosts where the adversary impaired security controls immediately prior to or alongside the deployment of RMM tools or multiple kernel drivers.", "description": "The hunt assesses whether the observed process terminations, driver stacking, and RMM activity indicate an active ransomware intrusion.", "max_iterations": 5, "expected_signal": "A malicious verdict for any host showing both EDR termination and subsequent RMM or driver activity.", "success_criteria": "A per-host verdict citing the specific process terminated and the count of unique drivers loaded." }, "parents": [ { "id": "driver-load-stacking", "kind": "merge" }, { "id": "rmm-msi-deployment", "kind": "merge" } ] }, { "id": "route-verdict", "type": "checkpoint", "label": "Route on impairment verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one host based on EDR termination and RMM deployment", "condition": "the triage verdict is malicious for at least one host based on EDR termination and RMM deployment", "blind_spot": "endpoint-visibility-gap", "confidence": "high", "description": "The analyst isolates hosts where impairment is confirmed and suspicious software is present.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-impairment" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "The analyst isolates hosts where impairment is confirmed to prevent further lateral movement or ransomware execution.", "instructions": "Isolate the host immediately to prevent the adversary from moving laterally or executing ransomware. Do not reboot, as this may trigger automated ransomware encryption routines.", "action_approval": "required" }, "parents": [ { "id": "route-verdict", "branch": "on_supports" } ] }, { "id": "forensic-review", "type": "task", "label": "Forensic review of drivers and RMM", "config": { "assignee": "analyst", "description": "The analyst verifies the provenance of the identified drivers and RMM software.", "instructions": "Examine the hashes of the loaded drivers. Cross-reference them with databases of known vulnerable drivers (e.g., loldrivers.io). Review the source of any MeshAgent or MSI packages found." }, "parents": [ { "id": "route-verdict", "branch": "default" }, { "id": "route-verdict", "branch": "on_unavailable" }, { "id": "route-verdict", "branch": "on_refutes" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close-out and reporting", "config": { "assignee": "analyst", "description": "The analyst documents findings and updates defensive controls.", "instructions": "Record all identified malicious files and driver hashes. Ensure any service gaps identified are reported for policy review." }, "parents": [ { "id": "forensic-review" } ] } ] }