{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "The exposure of intermediate CA private keys enables server impersonation and bypasses PKI-based security controls; verifying the integrity of the trust store is a required hygiene task."
      },
      "name": "eMudhra Compromised Certificate and Go Runtime Audit",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1195",
        "attack.t1190",
        "attack.t1553.002",
        "defense evasion",
        "initial access"
      ],
      "related": [
        {
          "hunt": "go-runtime-vulnerability-audit",
          "reason": "A broader audit of Go runtime vulnerabilities would overlap but lacks the specific focus on certificate compromise.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "This is a hunt because a single detection rule cannot correlate a static trust anchor with the version of a specific runtime engine and the behavior of signed module loads. It requires pivoting between the trust store, software inventory, and execution telemetry.",
      "coverage": [
        {
          "stage": "compromised-ca-trust",
          "steps": [
            "cert-store-discovery",
            "cert-file-discovery"
          ],
          "status": "covered"
        },
        {
          "stage": "vulnerable-application-inventory",
          "steps": [
            "vulnerable-go-prevalence"
          ],
          "status": "covered"
        },
        {
          "stage": "signed-code-execution",
          "steps": [
            "lead-signed-code"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Trust in Compromised CA Certificates",
            "slug": "compromised-ca-trust",
            "tactic": "initial-access",
            "techniques": [
              "T1195",
              "T1553.002"
            ],
            "observables": [
              "E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838",
              "98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B",
              "42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493",
              "432EC25F0D28DE9006D97BF752F17BBB2CD41F669933FCB072D9A1148D0261F3",
              "CB6E15165AC802E9B3F993F16C25D41F4E81C21EBDE71AE1B012AC00BF9C7C3F",
              "0164D7CEAE5BB909C272AF151FF44B1177AE9B47D9424B94F1D9558C30934D19",
              "9E39DE2881273ACC225A149C72BA3E0F51424963669AB633EE1DC7DF5DB067B4",
              "4B2460A466F95FD40113BCDCCA2CEB29B3B093921DE45474DA7DF48874C630b1",
              "c7c41efe92d825f05eae841a4a82c1",
              "6cada367fb1c100088120ea202d568",
              "a4aee678f23362b4c0e460b772f214",
              "8009928a64107601af05fa2f19f109",
              "296926c227a3a1526392b19482a504",
              "588b2e3c2bb8cda13e1a1209254321",
              "7818933f8f85b4619a2b35fba83d0a",
              "544b7f922c31ae220a4a922916f6e6",
              "emSign Root TLS CA - G3",
              "emSign Root CS CA - G3"
            ]
          },
          {
            "name": "Vulnerable Software and Runtimes",
            "slug": "vulnerable-application-inventory",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "CVE-2026-111943",
              "go < 1.27.3",
              "go < 1.26.10"
            ]
          },
          {
            "name": "Execution of Malicious Signed Code",
            "slug": "signed-code-execution",
            "tactic": "defense-evasion",
            "techniques": [
              "T1553.002",
              "T1204.002"
            ],
            "observables": [
              "EM OV CS CA - G3B",
              "EM OV CS CA - G3C",
              "eMudhra BV",
              "eMudhra Inc"
            ]
          }
        ],
        "summary": "eMudhra mistakenly issued eight intermediate CA certificates with weak P-384 private keys that had as little as 3-8 bits of entropy, making them trivial for attackers to recover. Adversaries can leverage these recovered keys to perform Man-in-the-Middle (MitM) impersonation of web services or sign malicious software that appears legitimate to systems that have not yet updated their trust stores or Go runtime environments."
      },
      "severity": "high",
      "rationale": "Focus on developer workstations, build servers, and container hosts where Go runtimes and code signatures are most prevalent.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary impersonates a trusted service or signs a malicious binary using a compromised eMudhra intermediate certificate in an environment that lacks strict revocation checking or runs a vulnerable Go runtime.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Hosts identified in the lead step as running eMudhra-signed code."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of historical activity to examine."
        },
        "emudhra_hashes": {
          "from": {
            "ref": "https://blog.talosintelligence.com/compromised-intermediate-certificates/",
            "kind": "article",
            "observed": "2026-10-21"
          },
          "type": "list[hash]",
          "default": [
            "e7568fe6e12331f4fd7de61da4c7559d0f8eb192a218d4741a3ba75184333838",
            "98b896625c0c230adeec3eb2cf6aad5001ecf9156a68644e82374ce5833bc25b",
            "42c4accd12c4f59597925e1a08a7a90102608543809308d50ec427e118ba1493",
            "432ec25f0d28de9006d97bf752f17bbb2cd41f669933fcb072d9a1148d0261f3",
            "cb6e15165ac802e9b3f993f16c25d41f4e81c21ebde71ae1b012ac00bf9c7c3f",
            "0164d7ceae5bb909c272af151ff44b1177ae9b47d9424b94f1d9558c30934d19",
            "9e39de2881273acc225a149c72ba3e0f51424963669ab633ee1dc7df5db067b4",
            "4b2460a466f95fd40113bcdcca2ceb29b3b093921de45474da7df48874c630b1"
          ],
          "description": "SHA-256 hashes of the compromised intermediate certificates."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://blog.talosintelligence.com/compromised-intermediate-certificates/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://blog.talosintelligence.com/compromised-intermediate-certificates/",
          "name": "Cisco Talos \u2014 Compromised eMudhra intermediate certificates"
        }
      ],
      "blind_spots": [
        {
          "id": "module-visibility-gap",
          "risk": "Malicious code signed by eMudhra could execute in container environments without triggering the lead query.",
          "stage": "signed-code-execution",
          "question": "Are compromised binaries running on container hosts without module-level auditing?",
          "requires": "hb_module_activity on all linux/container hosts"
        },
        {
          "id": "cert-host-mapping-gap",
          "risk": "The current schema for hb_certificates lacks a direct host column, requiring an agent or analyst to correlate certificates to individual devices via secondary fields like owner.",
          "stage": "compromised-ca-trust",
          "question": "Which specific host trusts a certificate identified in the global scan?",
          "requires": "hb_certificates with device_hostname column"
        }
      ]
    },
    "name": "eMudhra Compromised Certificate and Go Runtime Audit",
    "description": "This hunt identifies exposure to eight compromised eMudhra intermediate certificates whose private keys were generated with insufficient entropy. The hunt first finds hosts executing code signed by eMudhra. If it finds such activity, the hunt fans out to identify vulnerable Go runtimes (CVE-2026-111943) that ignore revocation and scans for certificate files matching known compromised fingerprints. An agent then weighs the combination of trust anchors and execution context to help an analyst decide on remediation."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "compromised-ca-trust",
            "steps": [
              "cert-store-discovery",
              "cert-file-discovery"
            ],
            "status": "covered"
          },
          {
            "stage": "vulnerable-application-inventory",
            "steps": [
              "vulnerable-go-prevalence"
            ],
            "status": "covered"
          },
          {
            "stage": "signed-code-execution",
            "steps": [
              "lead-signed-code"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary impersonates a trusted service or signs a malicious binary using a compromised eMudhra intermediate certificate in an environment that lacks strict revocation checking or runs a vulnerable Go runtime.",
        "blind_spots": [
          {
            "id": "module-visibility-gap",
            "risk": "Malicious code signed by eMudhra could execute in container environments without triggering the lead query.",
            "stage": "signed-code-execution",
            "question": "Are compromised binaries running on container hosts without module-level auditing?",
            "requires": "hb_module_activity on all linux/container hosts"
          },
          {
            "id": "cert-host-mapping-gap",
            "risk": "The current schema for hb_certificates lacks a direct host column, requiring an agent or analyst to correlate certificates to individual devices via secondary fields like owner.",
            "stage": "compromised-ca-trust",
            "question": "Which specific host trusts a certificate identified in the global scan?",
            "requires": "hb_certificates with device_hostname column"
          }
        ],
        "scoping_notes": "Focus on developer workstations, build servers, and container hosts where Go runtimes and code signatures are most prevalent.",
        "beyond_detection": "This is a hunt because a single detection rule cannot correlate a static trust anchor with the version of a specific runtime engine and the behavior of signed module loads. It requires pivoting between the trust store, software inventory, and execution telemetry."
      }
    },
    {
      "id": "lead-signed-code",
      "type": "query",
      "label": "Modules signed by eMudhra",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, module_path, module_signature_subject, module_signature_status, time FROM hb_module_activity WHERE (LOWER(module_signature_subject) LIKE '%emudhra%' OR LOWER(module_signature_subject) LIKE '%emsign%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_module_activity",
        "description": "Identify hosts running modules or drivers signed by eMudhra as a primary indicator of exposure.",
        "expected_signal": "Rows indicate a host loaded code signed by the affected CA. Silence means no such modules were observed."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Modules signed by eMudhra",
        "reads": [
          "device_hostname",
          "process_name",
          "module_path",
          "module_signature_subject",
          "module_signature_status",
          "time"
        ],
        "source": "hb_module_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, module_path, module_signature_subject, module_signature_status, time FROM hb_module_activity WHERE (LOWER(module_signature_subject) LIKE '%emudhra%' OR LOWER(module_signature_subject) LIKE '%emsign%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Rows indicate a host loaded code signed by the affected CA. Silence means no such modules were observed.",
        "verified": "dry-run",
        "verified_at": "2026-10-22"
      }
    },
    {
      "id": "lead-agent",
      "type": "analytic",
      "label": "Evaluate lead activity",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint"
        ],
        "context": [
          "lead-signed-code"
        ],
        "objective": "Determine which hosts are actively running binaries signed by eMudhra and summarize their context.",
        "description": "Identify specific hosts for further investigation based on module load events.",
        "max_iterations": 3,
        "expected_signal": "A list of hosts exhibiting eMudhra-signed code activity.",
        "success_criteria": "A per-host verdict on whether suspicious code execution is present."
      },
      "parents": [
        {
          "id": "lead-signed-code"
        }
      ]
    },
    {
      "id": "gate-decision",
      "type": "checkpoint",
      "label": "Gate on signer activity",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "The lead-agent identified at least one host running code signed by eMudhra.",
        "condition": "The lead-agent identified at least one host running code signed by eMudhra.",
        "blind_spot": "module-visibility-gap",
        "confidence": "high",
        "description": "Decide whether to proceed to expensive software and store scans based on behavioral leads.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "lead-agent"
        }
      ]
    },
    {
      "id": "vulnerable-go-prevalence",
      "type": "query",
      "label": "Vulnerable Go versions baseline",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT package_version, COUNT(DISTINCT device_hostname) AS host_count FROM hb_software_inventory WHERE LOWER(package_name) = 'go' AND (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) GROUP BY package_version HAVING host_count < 10",
        "surface": "hb_software_inventory",
        "description": "Stack-count Go installations to find rare or vulnerable versions that might ignore eMudhra revocation.",
        "expected_signal": "Rare versions of the Go runtime across the fleet. Silence means Go is either not present or uniform."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Vulnerable Go versions baseline",
        "reads": [
          "package_version",
          "device_hostname"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT package_version, COUNT(DISTINCT device_hostname) AS host_count FROM hb_software_inventory WHERE LOWER(package_name) = 'go' AND (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) GROUP BY package_version HAVING host_count < 10",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "14d",
          "compare": "first_seen"
        },
        "expected": "Rare versions of the Go runtime across the fleet. Silence means Go is either not present or uniform.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "package_version"
          ],
          "rare_below": 10
        },
        "verified_at": "2026-10-22"
      }
    },
    {
      "id": "cert-store-discovery",
      "type": "query",
      "label": "Discovery of compromised CAs in stores",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT subject, issuer, common_name, fingerprint_sha1, location, owner FROM hb_certificates WHERE (LOWER(subject) LIKE '%emudhra%' OR LOWER(issuer) LIKE '%emudhra%')",
        "surface": "hb_certificates",
        "description": "Identify global presence of compromised eMudhra certificates in fleet trust stores.",
        "expected_signal": "A list of eMudhra certificates currently trusted. Silence proves no matching certificates are in known stores."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Discovery of compromised CAs in stores",
        "reads": [
          "subject",
          "issuer",
          "common_name",
          "fingerprint_sha1",
          "location",
          "owner"
        ],
        "source": "hb_certificates",
        "target": "endpoint",
        "content": "SELECT subject, issuer, common_name, fingerprint_sha1, location, owner FROM hb_certificates WHERE (LOWER(subject) LIKE '%emudhra%' OR LOWER(issuer) LIKE '%emudhra%')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of eMudhra certificates currently trusted. Silence proves no matching certificates are in known stores.",
        "verified": "dry-run",
        "verified_at": "2026-10-22"
      }
    },
    {
      "id": "cert-file-discovery",
      "type": "query",
      "label": "Prevalence of certificate files",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, file_path, file_hash_sha256, time FROM hb_file_activity WHERE instr(',' || '{{emudhra_hashes}}' || ',', ',' || LOWER(file_hash_sha256) || ',') > 0 AND (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_file_activity",
        "description": "Detect individual certificate files dropped on disk that match the compromised SHA-256 fingerprints.",
        "expected_signal": "Matches indicate the presence of a compromised certificate on a specific host. Silence proves no matching file hashes were logged."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Prevalence of certificate files",
        "reads": [
          "device_hostname",
          "file_path",
          "file_hash_sha256",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, file_path, file_hash_sha256, time FROM hb_file_activity WHERE instr(',' || '{{emudhra_hashes}}' || ',', ',' || LOWER(file_hash_sha256) || ',') > 0 AND (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "evidence_of_absence",
        "expected": "Matches indicate the presence of a compromised certificate on a specific host. Silence proves no matching file hashes were logged.",
        "verified": "dry-run",
        "verified_at": "2026-10-22"
      }
    },
    {
      "id": "triage-agent",
      "type": "analytic",
      "label": "Weigh combined exposure",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint"
        ],
        "context": [
          "lead-agent",
          "vulnerable-go-prevalence",
          "cert-store-discovery",
          "cert-file-discovery"
        ],
        "objective": "Assess each host based on the presence of eMudhra-signed code, vulnerable Go versions, and trusted certificates. Correlate certificates found in hb_certificates (which lacks device_hostname) with the scoped hosts by joining on the owner field (which may contain a local username) or comparing fingerprints against matches in cert-file-discovery.",
        "description": "Correlate behavioral leads with software vulnerability and trust anchor presence to assess per-host risk.",
        "max_iterations": 6,
        "expected_signal": "A risk assessment for each investigated host.",
        "success_criteria": "A per-host verdict of vulnerable_and_active, vulnerable_only, or benign citing specific rows."
      },
      "parents": [
        {
          "id": "vulnerable-go-prevalence",
          "kind": "merge"
        },
        {
          "id": "cert-store-discovery",
          "kind": "merge"
        },
        {
          "id": "cert-file-discovery",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-decision",
      "type": "checkpoint",
      "label": "Route on triage verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "The triage-agent identifies a host with both a trusted eMudhra CA and either an eMudhra-signed module or a vulnerable Go runtime.",
        "condition": "The triage-agent identifies a host with both a trusted eMudhra CA and either an eMudhra-signed module or a vulnerable Go runtime.",
        "blind_spot": "cert-host-mapping-gap",
        "confidence": "high",
        "description": "Initiate remediation for high-risk hosts where compromised code or vulnerable runtimes coincide with trust anchors.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-agent"
        }
      ]
    },
    {
      "id": "mitigate-trust",
      "type": "action",
      "label": "Targeted remediation",
      "config": {
        "target": "endpoint",
        "description": "Initiate removal of the compromised certificate and review affected software.",
        "instructions": "Review the host and prepare to remove the specific eMudhra intermediate certificates from the trusted root and intermediate stores via group policy or endpoint script. Prioritize review for any active eMudhra-signed modules.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-decision",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst review and tuning",
      "config": {
        "assignee": "analyst",
        "description": "Verify the agent verdict and document any necessary tuning or remediation notes.",
        "instructions": "Review the triage results. Verify that any flagged Go versions are indeed outdated. Confirm whether eMudhra-signed modules are authorized business software or fraudulent. Document the remediation outcome."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "default"
        },
        {
          "id": "gate-decision",
          "branch": "on_unavailable"
        },
        {
          "id": "route-decision",
          "branch": "default"
        },
        {
          "id": "route-decision",
          "branch": "on_unavailable"
        },
        {
          "id": "route-decision",
          "branch": "on_refutes"
        },
        {
          "id": "mitigate-trust"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Record a negative result when no exposure is detected.",
        "instructions": "Record that no eMudhra-signed modules or matching certificate hashes were found. Schedule a re-run for 30 days."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}