{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Endpoint credential harvesting is the precursor to lateral movement and ransomware; identifying these behaviors allows for eviction before the adversary expands their reach." }, "name": "Endpoint Credential Harvesting and Dumping", "type": "investigation", "labels": [ "hunt", "attack.t1003.001", "attack.t1003", "attack.t1555", "attack.t1078" ], "series": { "slug": "credential-theft-how-attackers-steal-use-stolen-credentials", "index": 2, "title": "Credential Theft: How Attackers Steal & Use Stolen Credentials", "total": 2 }, "related": [ { "hunt": "cloud-identity-anomaly-hunt", "reason": "This hunt focuses on the endpoint harvest phase; cloud credential abuse is covered separately.", "relation": "out-of-scope-alternative" }, { "hunt": "identity-authentication-account-abuse", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "Standard detections alert on static strings like mimikatz.exe. This hunt instead looks for any rare binary running from a user-writable path that touches browser profiles or invokes registry save commands, catching renamed or custom tools.", "coverage": [ { "stage": "infostealer-browser-harvesting", "steps": [ "lead-process-analysis", "browser-file-access" ], "status": "covered" }, { "stage": "lsass-memory-dumping", "steps": [ "lead-process-analysis" ], "status": "covered" }, { "stage": "registry-hive-extraction", "steps": [ "lead-process-analysis" ], "status": "covered" }, { "stage": "external-auth-spraying", "reason": "Belongs to another part of the 'Credential Theft: How Attackers Steal & Use Stolen Credentials' series.", "status": "out_of_scope" }, { "stage": "credential-stuffing-attempts", "reason": "Belongs to another part of the 'Credential Theft: How Attackers Steal & Use Stolen Credentials' series.", "status": "out_of_scope" }, { "stage": "account-takeover-anomalies", "reason": "Belongs to another part of the 'Credential Theft: How Attackers Steal & Use Stolen Credentials' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Password Spraying and Brute Force", "slug": "external-auth-spraying", "tactic": "credential-access", "techniques": [ "T1110.003", "T1110" ], "observables": [ "Single common password tested against many accounts", "Iterative password guessing against a single account", "Spikes in authentication failures (activity_id 5)", "Logins from unfamiliar IP addresses or geographic locations" ] }, { "name": "Credential Stuffing", "slug": "credential-stuffing-attempts", "tactic": "credential-access", "techniques": [ "T1110.004" ], "observables": [ "Authentication attempts using username/password pairs leaked in previous third-party breaches", "High volume of failed login attempts across diverse accounts" ] }, { "name": "Infostealer Data Collection", "slug": "infostealer-browser-harvesting", "tactic": "credential-access", "techniques": [ "T1555" ], "observables": [ "Access to browser profile directories (e.g., AppData\\Local\\Google\\Chrome\\User Data)", "Reading of 'Cookies' and 'Login Data' SQLite databases", "Exfiltration of harvested credentials to external C2 nodes", "Processes running from Temp or Downloads directories" ] }, { "name": "LSASS Credential Dumping", "slug": "lsass-memory-dumping", "tactic": "credential-access", "techniques": [ "T1003.001" ], "observables": [ "procdump -ma lsass.exe", "rundll32.exe C:\\Windows\\System32\\comsvcs.dll MiniDump", "Execution of Mimikatz or similar tools", "Creation of .dmp files containing LSASS memory" ] }, { "name": "Registry Hive Extraction", "slug": "registry-hive-extraction", "tactic": "credential-access", "techniques": [ "T1003" ], "observables": [ "reg.exe save HKLM\\SAM", "reg.exe save HKLM\\SYSTEM", "reg.exe save HKLM\\SECURITY", "esentutl.exe /y /vss /d", "Access to %SystemRoot%\\System32\\config" ] }, { "name": "Valid Account Abuse and Impossible Travel", "slug": "account-takeover-anomalies", "tactic": "initial-access", "techniques": [ "T1078" ], "observables": [ "Impossible travel (logins from distant locations in rapid succession)", "Logins that bypass MFA using stolen session tokens", "Unauthorized privilege changes or administrative role assignments", "MFA enrollments for new/unrecognized devices" ] } ], "summary": "This campaign involves the unauthorized acquisition of credentials via phishing, brute force, and infostealers to impersonate legitimate users. Attackers then perform credential dumping on compromised endpoints to harvest cached passwords and hashes, enabling lateral movement and full account takeover." }, "severity": "medium", "rationale": "Start with servers and workstations belonging to IT administrators or developers, as these are higher-value targets for credential harvesting.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is harvesting credentials from local browser stores, LSASS memory, or Registry hives to facilitate lateral movement, indicated by rare processes in user-writable paths performing sensitive file or memory access.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2024-09-10" }, "type": "list[host]", "default": [], "description": "Optional list of hostnames to focus the hunt; leave empty for the entire estate." }, "lookback_days": { "from": { "ref": "hunt-standard", "kind": "manual", "observed": "2024-01-01" }, "type": "number", "default": "14", "description": "Days of history to examine for harvesting behavior." }, "harvesting_targets": { "from": { "ref": "huntress-cred-theft", "kind": "article", "observed": "2024-09-10" }, "type": "list[string]", "default": [ "cookies", "login data", "web data", "local state", "key4.db", "logins.json" ], "description": "Common filenames for browser credential and session stores." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/credential-theft-expanding-your-reach", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/credential-theft-expanding-your-reach", "name": "Huntress \u2014 Credential Theft: How Attackers Steal & Use Stolen Credentials" } ], "blind_spots": [ { "id": "no-file-access-telemetry", "risk": "An attacker could harvest browser credentials without being detected by file activity queries, leaving only process-based indicators.", "stage": "infostealer-browser-harvesting", "question": "Are browser profiles being accessed on hosts where file telemetry is disabled?", "requires": "hb_file_activity with process context" }, { "id": "reflective-loading-blind-spot", "risk": "Advanced dumping techniques that avoid standard tools or common command-line strings like minidump will not be captured by process-based lead queries.", "stage": "lsass-memory-dumping", "question": "Is the attacker using reflective loading to dump memory without command-line artifacts?", "requires": "hb_module_activity and memory scanning" } ] }, "name": "Endpoint Credential Harvesting and Dumping", "description": "This hunt identifies the transition from initial execution to credential theft on Windows endpoints. It specifically targets infostealer behavior and standard credential dumping techniques. The hunt finds processes running from user-writable paths like Temp or Downloads and correlates them with access to browser credential stores and the use of LSASS or Registry dumping commands. By evaluating process rarity across the fleet alongside these behaviors, the hunt distinguishes between legitimate administrative tasks and malicious harvesting." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "credential-theft-how-attackers-steal-use-stolen-credentials", "index": 2, "title": "Credential Theft: How Attackers Steal & Use Stolen Credentials", "total": 2 }, "coverage": [ { "stage": "infostealer-browser-harvesting", "steps": [ "lead-process-analysis", "browser-file-access" ], "status": "covered" }, { "stage": "lsass-memory-dumping", "steps": [ "lead-process-analysis" ], "status": "covered" }, { "stage": "registry-hive-extraction", "steps": [ "lead-process-analysis" ], "status": "covered" }, { "stage": "external-auth-spraying", "reason": "Belongs to another part of the 'Credential Theft: How Attackers Steal & Use Stolen Credentials' series.", "status": "out_of_scope" }, { "stage": "credential-stuffing-attempts", "reason": "Belongs to another part of the 'Credential Theft: How Attackers Steal & Use Stolen Credentials' series.", "status": "out_of_scope" }, { "stage": "account-takeover-anomalies", "reason": "Belongs to another part of the 'Credential Theft: How Attackers Steal & Use Stolen Credentials' series.", "status": "out_of_scope" } ], "rationale": "An adversary is harvesting credentials from local browser stores, LSASS memory, or Registry hives to facilitate lateral movement, indicated by rare processes in user-writable paths performing sensitive file or memory access.", "blind_spots": [ { "id": "no-file-access-telemetry", "risk": "An attacker could harvest browser credentials without being detected by file activity queries, leaving only process-based indicators.", "stage": "infostealer-browser-harvesting", "question": "Are browser profiles being accessed on hosts where file telemetry is disabled?", "requires": "hb_file_activity with process context" }, { "id": "reflective-loading-blind-spot", "risk": "Advanced dumping techniques that avoid standard tools or common command-line strings like minidump will not be captured by process-based lead queries.", "stage": "lsass-memory-dumping", "question": "Is the attacker using reflective loading to dump memory without command-line artifacts?", "requires": "hb_module_activity and memory scanning" } ], "scoping_notes": "Start with servers and workstations belonging to IT administrators or developers, as these are higher-value targets for credential harvesting.", "beyond_detection": "Standard detections alert on static strings like mimikatz.exe. This hunt instead looks for any rare binary running from a user-writable path that touches browser profiles or invokes registry save commands, catching renamed or custom tools." } }, { "id": "lead-process-analysis", "type": "query", "label": "Identify suspicious process origins and dumping commands", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, user_name, time FROM hb_process_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_path) LIKE '%\\\\temp\\\\%' OR LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%' OR LOWER(process_path) LIKE '%\\\\downloads\\\\%' OR LOWER(process_cmd_line) LIKE '%lsass%' OR LOWER(process_cmd_line) LIKE '%comsvcs.dll%minidump%' OR (LOWER(process_name) = 'reg.exe' AND LOWER(process_cmd_line) LIKE '%save%') OR on_disk = 0)) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Find processes executing from user-writable paths, those using command-line arguments typical of credential dumping, or processes not present on disk.", "expected_signal": "A list of hosts and processes. Matches for LSASS or Registry saves are high-priority; matches from Temp paths require rarity analysis." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Identify suspicious process origins and dumping commands", "reads": [ "device_hostname", "process_name", "process_path", "process_cmd_line", "user_name", "time", "on_disk" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, user_name, time FROM hb_process_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_path) LIKE '%\\\\temp\\\\%' OR LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%' OR LOWER(process_path) LIKE '%\\\\downloads\\\\%' OR LOWER(process_cmd_line) LIKE '%lsass%' OR LOWER(process_cmd_line) LIKE '%comsvcs.dll%minidump%' OR (LOWER(process_name) = 'reg.exe' AND LOWER(process_cmd_line) LIKE '%save%') OR on_disk = 0)) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A list of hosts and processes. Matches for LSASS or Registry saves are high-priority; matches from Temp paths require rarity analysis.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "rare-process-baseline", "type": "query", "label": "Determine suspicious process prevalence", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT process_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\\\temp\\\\%' OR LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%' OR LOWER(process_path) LIKE '%\\\\downloads\\\\%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_name HAVING host_count < 5 ORDER BY host_count ASC", "surface": "hb_process_activity", "description": "Stack-count the processes found in suspicious paths to identify rare binaries that deviate from the fleet baseline.", "expected_signal": "Rare binaries seen on fewer than 5 hosts. Fleet-wide updaters are excluded, leaving transient or adversary-controlled tools." }, "parents": [ { "id": "lead-process-analysis" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Determine suspicious process prevalence", "reads": [ "process_name", "device_hostname", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT process_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\\\temp\\\\%' OR LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%' OR LOWER(process_path) LIKE '%\\\\downloads\\\\%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_name HAVING host_count < 5 ORDER BY host_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Rare binaries seen on fewer than 5 hosts. Fleet-wide updaters are excluded, leaving transient or adversary-controlled tools.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_name" ], "rare_below": 5 }, "verified_at": "2026-09-20" } }, { "id": "browser-file-access", "type": "query", "label": "Detect access to browser credential stores", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, process_name, file_path, file_name, activity_name, time FROM hb_file_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{harvesting_targets}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND NOT (LOWER(process_name) LIKE '%\\\\chrome.exe' OR LOWER(process_name) LIKE '%\\\\msedge.exe' OR LOWER(process_name) LIKE '%\\\\firefox.exe')) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Identify processes interacting with sensitive browser databases that contain cookies and passwords.", "expected_signal": "Any non-browser process reading these files is a high-confidence indicator of harvesting." }, "parents": [ { "id": "lead-process-analysis" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Detect access to browser credential stores", "reads": [ "device_hostname", "process_name", "file_path", "file_name", "activity_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, file_path, file_name, activity_name, time FROM hb_file_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{harvesting_targets}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND NOT (LOWER(process_name) LIKE '%\\\\chrome.exe' OR LOWER(process_name) LIKE '%\\\\msedge.exe' OR LOWER(process_name) LIKE '%\\\\firefox.exe')) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Any non-browser process reading these files is a high-confidence indicator of harvesting.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "agent-triage", "type": "analytic", "label": "Weigh harvesting evidence", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "lead-process-analysis", "rare-process-baseline", "browser-file-access" ], "objective": "Identify hosts where unauthorized processes are performing credential dumping or browser harvesting by correlating process origins, command lines, fleet rarity, and sensitive file access.", "description": "The agent assesses whether processes found in suspicious paths are performing unauthorized credential harvesting based on fleet prevalence and behavior.", "max_iterations": 4, "expected_signal": "A per-host verdict identifying malicious credential harvesting.", "success_criteria": "A per-host verdict of malicious, suspicious, or benign, citing the specific process and activity rows." }, "parents": [ { "id": "rare-process-baseline", "kind": "merge" }, { "id": "browser-file-access", "kind": "merge" } ] }, { "id": "decision-route", "type": "checkpoint", "label": "Route on harvesting verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the agent-triage verdict is malicious for at least one host based on rare processes accessing browser credentials or dumping memory", "condition": "the agent-triage verdict is malicious for at least one host based on rare processes accessing browser credentials or dumping memory", "blind_spot": "no-file-access-telemetry", "confidence": "high", "description": "Determine whether to proceed with immediate containment or manual analyst review.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "agent-triage" } ] }, { "id": "containment-action", "type": "action", "label": "Isolate host and revoke sessions", "config": { "target": "endpoint", "description": "Immediately stop credential exfiltration by isolating the affected host and revoking identity provider sessions.", "instructions": "Isolate the host from the network. Revoke all active session tokens for users logged into this machine in the identity provider.", "action_approval": "required" }, "parents": [ { "id": "decision-route", "branch": "on_supports" } ] }, { "id": "credential-review-task", "type": "task", "label": "Credential reset and investigation", "config": { "assignee": "analyst", "description": "An analyst verifies the agent findings and secures compromised accounts.", "instructions": "Review the cited rows. Confirm the suspicious process activity and force password resets for all accounts identified in the harvesting session. Check hb_network_connection for data exfiltration patterns." }, "parents": [ { "id": "decision-route", "branch": "default" }, { "id": "decision-route", "branch": "on_unavailable" }, { "id": "containment-action" } ] }, { "id": "close-out-task", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Finalize the hunt and record findings.", "instructions": "Record what was found, what was blocked, and whether any binaries should be promoted to the permanent blocklist." }, "parents": [ { "id": "decision-route", "branch": "on_refutes" }, { "id": "credential-review-task" } ] } ] }