{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The use of AI to generate troubleshooting scripts and iterative malware versions allows attackers to bypass static signatures. A behavioral hunt for these specific trial-and-error patterns\u2014rare iterative naming and repetitive VSS attempts\u2014is required to detect this evolving Latin American threat." }, "name": "Endpoint AI-Assisted Scripting and Credential Dumping", "type": "investigation", "labels": [ "hunt", "attack.t1566.001", "attack.t1059.003", "attack.t1059.006", "attack.t1003.002", "attack.t1003.003", "attack.t1572", "attack.t1090", "attack.t1568.002" ], "related": [ { "hunt": "generic-vss-abuse-detection", "reason": "General shadow copy abuse is covered by broad behavioral rules; this hunt focuses on the correlation with AI-characteristic naming and DuckDNS infra.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A standard rule alerts on ntdsutil. This hunt is required to correlate that sensitive action with a preceding chain of numbered binaries (socktz_v8), DuckDNS traffic, and AI-driven troubleshooting suffixes across three distinct surfaces.", "coverage": [ { "stage": "initial-access-phishing-resume", "reason": "Requires email logs or web-mail forensic artifacts not available in the hb_ surfaces.", "status": "not_visible" }, { "stage": "ai-assisted-script-execution", "steps": [ "rare-iterative-script-execution" ], "status": "covered" }, { "stage": "credential-access-directory-dumping", "steps": [ "credential-dumping-behavior" ], "status": "covered" }, { "stage": "c2-and-proxy-tunneling", "steps": [ "dns-traffic-to-duckdns", "connections-to-attacker-infra" ], "status": "covered" } ], "scenario": { "stages": [ { "name": "Job-themed Phishing", "slug": "initial-access-phishing-resume", "tactic": "initial-access", "techniques": [ "T1566.001" ], "observables": [ "Resume-themed phishing email attachments", "Compromised WordPress sites hosting installers" ] }, { "name": "AI-Generated Iterative Script Execution", "slug": "ai-assisted-script-execution", "tactic": "execution", "techniques": [ "T1059.003", "T1059.006" ], "observables": [ "Numbered batch scripts (e.g., iterative collection scripts)", "Filenames with '_output' suffix", "exploit_creative.py", "exploit_careful.py", "rce_focused.py", "Permissions checks in batch scripts" ] }, { "name": "Credential and Active Directory Dumping", "slug": "credential-access-directory-dumping", "tactic": "credential-access", "techniques": [ "T1003.002", "T1003.003" ], "observables": [ "Shadow copy creation across multiple drives", "Dumping Security Account Manager (SAM) registry hive", "NTDS.dit file access and copying" ] }, { "name": "Proxy Tunneling and C2 Infrastructure", "slug": "c2-and-proxy-tunneling", "tactic": "command-and-control", "techniques": [ "T1572", "T1090", "T1568.002" ], "observables": [ "socktz_v1.exe through socktz_v9.exe", "m-doxa-apodo.duckdns.org", "m-doxa-geo.duckdns.org", "m-doxa-intel.duckdns.org", "m-doxa-vacunas.duckdns.org", "62.171.185.97", "167.148.195.53", "178.128.87.160", "NextChat interface on TCP port 3000", "Multi-SAN TLS certificates (SHA256: 4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5)" ] } ], "summary": "Threat actors targeting Latin American government and financial sectors are utilizing commercial LLMs to generate iterative batch and Python scripts for data collection and exfiltration. The campaigns, tracked as CL-CRI-1131 and CL-CRI-1163, rely on custom Go-based SOCKS5 proxies (SockTz) and self-hosted NextChat instances for orchestration, often revealing their operations through poor operational security and predictable file naming conventions." }, "severity": "high", "rationale": "Focus specifically on Windows Domain Controllers and servers running critical services like JBoss or WordPress, as targeted in the campaign. The first scoping query narrows the estate before behavioral triggers run.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder is using AI-generated scripts with iterative naming conventions to facilitate credential dumping and proxy tunneling across target organizations in Latin America.", "parameters": { "c2_ips": { "from": { "ref": "unit42", "kind": "article", "observed": "2026-09-03" }, "type": "list[ip]", "default": [ "62.171.185.97", "165.22.184.26", "178.128.87.160", "167.148.195.53" ], "description": "Attacker-controlled infrastructure IPs." }, "scope_hosts": { "from": { "ref": "analyst-input", "kind": "manual" }, "type": "list[host]", "default": [], "description": "Hosts to narrow the hunt; leave empty for fleet-wide." }, "lookback_days": { "from": { "ref": "default", "kind": "manual", "observed": "2026-09-03" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "duckdns_domains": { "from": { "ref": "unit42", "kind": "article", "observed": "2026-09-03" }, "type": "list[domain]", "default": [ "m-doxa-apodo.duckdns.org", "m-doxa-geo.duckdns.org", "m-doxa-intel.duckdns.org", "m-doxa-vacunas.duckdns.org" ], "description": "DuckDNS subdomains used by the CL-CRI-1131 cluster." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "name": "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America" } ], "blind_spots": [ { "id": "no-endpoint-coverage", "risk": "The attackers targeted vulnerable web servers specifically; without an agent, the SockTz execution is invisible.", "owner": "Infrastructure Team", "stage": "ai-assisted-script-execution", "question": "Are iterative scripts running on unmanaged WordPress/JBoss hosts?", "requires": "Endpoint agent on all internet-facing servers", "remediation": "Audit and enroll all internet-facing assets into the EDR fleet." }, { "id": "short-dns-retention", "risk": "Attackers establish infrastructure months before the final dump; if logs have rotated, only the execution phase is visible.", "owner": "Security Engineering", "stage": "c2-and-proxy-tunneling", "question": "Was the infrastructure established in February visible during this hunt?", "requires": "hb_dns_activity with 90+ days retention", "remediation": "Increase DNS log retention to cover a 90-day window." } ] }, "name": "Endpoint AI-Assisted Scripting and Credential Dumping", "description": "This hunt identifies multi-stage intrusions where attackers leverage AI to generate troubleshooting and execution scripts. It follows the attack chain from early infrastructure setup and DuckDNS resolutions to the characteristic behavioral patterns of iterative script naming (v1-v9) and trial-and-error credential dumping via volume shadow copies. The hunt uses a phased approach to correlate infrastructure leads with rare endpoint execution behaviors." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "coverage": [ { "stage": "initial-access-phishing-resume", "reason": "Requires email logs or web-mail forensic artifacts not available in the hb_ surfaces.", "status": "not_visible" }, { "stage": "ai-assisted-script-execution", "steps": [ "rare-iterative-script-execution" ], "status": "covered" }, { "stage": "credential-access-directory-dumping", "steps": [ "credential-dumping-behavior" ], "status": "covered" }, { "stage": "c2-and-proxy-tunneling", "steps": [ "dns-traffic-to-duckdns", "connections-to-attacker-infra" ], "status": "covered" } ], "rationale": "An intruder is using AI-generated scripts with iterative naming conventions to facilitate credential dumping and proxy tunneling across target organizations in Latin America.", "blind_spots": [ { "id": "no-endpoint-coverage", "risk": "The attackers targeted vulnerable web servers specifically; without an agent, the SockTz execution is invisible.", "owner": "Infrastructure Team", "stage": "ai-assisted-script-execution", "question": "Are iterative scripts running on unmanaged WordPress/JBoss hosts?", "requires": "Endpoint agent on all internet-facing servers", "remediation": "Audit and enroll all internet-facing assets into the EDR fleet." }, { "id": "short-dns-retention", "risk": "Attackers establish infrastructure months before the final dump; if logs have rotated, only the execution phase is visible.", "owner": "Security Engineering", "stage": "c2-and-proxy-tunneling", "question": "Was the infrastructure established in February visible during this hunt?", "requires": "hb_dns_activity with 90+ days retention", "remediation": "Increase DNS log retention to cover a 90-day window." } ], "scoping_notes": "Focus specifically on Windows Domain Controllers and servers running critical services like JBoss or WordPress, as targeted in the campaign. The first scoping query narrows the estate before behavioral triggers run.", "beyond_detection": "A standard rule alerts on ntdsutil. This hunt is required to correlate that sensitive action with a preceding chain of numbered binaries (socktz_v8), DuckDNS traffic, and AI-driven troubleshooting suffixes across three distinct surfaces." } }, { "id": "scoping-windows-servers", "type": "query", "label": "Scope Windows Servers and Domain Controllers", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT device_hostname, package_name FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%windows%server%' OR LOWER(package_name) LIKE '%active%directory%')", "surface": "hb_software_inventory", "description": "Identify high-value targets such as Domain Controllers where NTDS.dit theft is the primary goal.", "expected_signal": "A list of hostnames representing the server estate. The analyst uses these to populate scope_hosts." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope Windows Servers and Domain Controllers", "reads": [ "device_hostname", "package_name" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT DISTINCT device_hostname, package_name FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%windows%server%' OR LOWER(package_name) LIKE '%active%directory%')", "silence": "not_evidence_of_absence", "expected": "A list of hostnames representing the server estate. The analyst uses these to populate scope_hosts.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "dns-traffic-to-duckdns", "type": "query", "label": "DNS Traffic to m-doxa Domains", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, time FROM hb_dns_activity WHERE (instr(',' || '{{duckdns_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE 'm-doxa-%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_dns_activity", "description": "Identify hosts resolving the campaign-specific dynamic DNS naming scheme.", "expected_signal": "Direct matches for the DuckDNS subdomains used by the attacker." }, "parents": [ { "id": "scoping-windows-servers" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "DNS Traffic to m-doxa Domains", "reads": [ "device_hostname", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, time FROM hb_dns_activity WHERE (instr(',' || '{{duckdns_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE 'm-doxa-%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Direct matches for the DuckDNS subdomains used by the attacker.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "connections-to-attacker-infra", "type": "query", "label": "Connections to Staging and AI Infrastructure", "config": { "dsl": "sqlite", "role": "triage", "source": "network", "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE (instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 OR dst_endpoint_port = 3000) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_network_connection", "description": "Find network traffic to reported IPs, focusing on port 3000 which hosts the attacker's NextChat AI interface.", "expected_signal": "Connections to port 3000 or the listed C2 IPs, confirming engagement with attacker infrastructure." }, "parents": [ { "id": "scoping-windows-servers" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Connections to Staging and AI Infrastructure", "reads": [ "device_hostname", "dst_endpoint_ip", "dst_endpoint_port", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE (instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 OR dst_endpoint_port = 3000) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Connections to port 3000 or the listed C2 IPs, confirming engagement with attacker infrastructure.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "agent-infra-triage", "type": "analytic", "label": "Infrastructure Phase Triage", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "dns-traffic-to-duckdns", "connections-to-attacker-infra" ], "objective": "Identify hosts demonstrating early infrastructure matches and determine if any resolve the campaign subdomains.", "description": "Evaluate whether the early infrastructure matches justify a deeper search for behavioural artifacts.", "max_iterations": 4, "expected_signal": "Verdicts identifying which hosts demonstrate suspicious network and DNS patterns.", "success_criteria": "A verdict of malicious | suspicious | benign per host based on DuckDNS and NextChat patterns." }, "parents": [ { "id": "dns-traffic-to-duckdns", "kind": "merge" }, { "id": "connections-to-attacker-infra", "kind": "merge" } ] }, { "id": "rare-iterative-script-execution", "type": "query", "label": "Rare AI-Characteristic Script Execution", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_name) AS script_name, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS run_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%socktz%' OR LOWER(process_name) LIKE '%_output%' OR LOWER(process_name) LIKE '%_creative%' OR LOWER(process_name) LIKE '%_careful%' OR LOWER(process_name) LIKE '%_focused%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY script_name HAVING host_count <= 3 ORDER BY host_count ASC", "surface": "hb_process_activity", "description": "Stack-count processes with iterative names (v1-v9) or AI-characteristic suffixes across the fleet.", "expected_signal": "Binaries or scripts with campaign-specific naming that are rare across the estate." }, "parents": [ { "id": "agent-infra-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare AI-Characteristic Script Execution", "reads": [ "process_name", "device_hostname", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_name) AS script_name, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS run_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%socktz%' OR LOWER(process_name) LIKE '%_output%' OR LOWER(process_name) LIKE '%_creative%' OR LOWER(process_name) LIKE '%_careful%' OR LOWER(process_name) LIKE '%_focused%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY script_name HAVING host_count <= 3 ORDER BY host_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Binaries or scripts with campaign-specific naming that are rare across the estate.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_name" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "credential-dumping-behavior", "type": "query", "label": "Trial-and-Error Credential Dumping", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%shadow%create%' OR LOWER(process_cmd_line) LIKE '%ntdsutil%' OR (LOWER(process_cmd_line) LIKE '%reg%save%' AND (LOWER(process_cmd_line) LIKE '%sam%' OR LOWER(process_cmd_line) LIKE '%system%'))) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify repeated attempts to dump the SAM registry hive or NTDS.dit file using shadow copies.", "expected_signal": "Commands creating volume shadow copies or saving critical registry hives, especially on servers scoped earlier." }, "parents": [ { "id": "agent-infra-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Trial-and-Error Credential Dumping", "reads": [ "device_hostname", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%shadow%create%' OR LOWER(process_cmd_line) LIKE '%ntdsutil%' OR (LOWER(process_cmd_line) LIKE '%reg%save%' AND (LOWER(process_cmd_line) LIKE '%sam%' OR LOWER(process_cmd_line) LIKE '%system%'))) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Commands creating volume shadow copies or saving critical registry hives, especially on servers scoped earlier.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "agent-synthesis-triage", "type": "analytic", "label": "Final Attack Chain Synthesis", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "agent-infra-triage", "rare-iterative-script-execution", "credential-dumping-behavior" ], "objective": "Determine if the hosts demonstrating early infrastructure leads are also the ones running rare iterative scripts and attempting VSS-based credential theft.", "description": "Synthesize infrastructure leads with iterative naming and credential dumping behaviors to confirm an intrusion.", "max_iterations": 6, "expected_signal": "High-confidence verdicts citing the complete path from C2 connection to AD database theft.", "success_criteria": "A final verdict citing specific process names, command lines, and infrastructure connections." }, "parents": [ { "id": "rare-iterative-script-execution", "kind": "merge" }, { "id": "credential-dumping-behavior", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on Synthesis Verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the agent-synthesis-triage verdict is malicious for at least one host", "condition": "the agent-synthesis-triage verdict is malicious for at least one host", "blind_spot": "no-endpoint-coverage", "confidence": "high", "description": "Route the response based on whether a full AI-assisted attack chain is confirmed.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "agent-synthesis-triage" } ] }, { "id": "isolate-infected-host", "type": "action", "label": "Isolate Endpoint", "config": { "target": "endpoint", "description": "Immediately contain the host to prevent the exfiltration of the Active Directory database.", "instructions": "Isolate the host using the EDR. Preserve the SockTz binary and any numbered batch scripts for further analysis.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-forensic-review", "type": "task", "label": "Analyst Forensic Review", "config": { "assignee": "analyst", "description": "Identify the phishing vector and confirm any LLM-related history.", "instructions": "Examine hb_file_activity for resume-themed files (e.g., resume.pdf, cv.zip) around the time of the initial SockTz execution. Review browser logs for connections to port 3000." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-infected-host" } ] }, { "id": "hunt-close-out", "type": "task", "label": "Hunt Close-out", "config": { "assignee": "analyst", "description": "Record findings and document any visibility gaps for future improvement.", "instructions": "Summarize the hosts identified. Record whether the DuckDNS naming scheme matched the m-doxa- standard. Update the C2 list if new IPs were discovered during forensic review." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-forensic-review" } ] } ] }