{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "The November 2026 update addresses over 1,300 vulnerabilities, including multiple high-severity RCEs and EoPs. Verifying the absence of behavioral exploitation signs is critical for prioritizing remediation."
      },
      "name": "Endpoint Exploit and Service Crash Monitoring",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1566",
        "attack.t1068",
        "attack.t1021.001",
        "execution",
        "initial access",
        "lateral movement",
        "privilege escalation"
      ],
      "related": [
        {
          "hunt": "azure-grafana-ssrf-monitoring",
          "reason": "Azure Managed Grafana exploitation (CVE-2026-114160) requires cloud API activity monitoring, which is out of scope for this endpoint-focused behavioral hunt.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A single detection rule might alert on a known shell spawn from spoolsv.exe, but this hunt connects unpatched vulnerability state to stability signals (crashes) and then to execution, providing the full context required to distinguish an exploit from general system instability.",
      "coverage": [
        {
          "stage": "client-side-exploitation",
          "steps": [
            "crash-prevalence"
          ],
          "status": "covered"
        },
        {
          "stage": "remote-service-exploitation",
          "steps": [
            "anomalous-child-processes",
            "crash-prevalence"
          ],
          "status": "covered"
        },
        {
          "stage": "local-privilege-escalation",
          "steps": [
            "service-instability"
          ],
          "status": "covered"
        },
        {
          "stage": "identity-infrastructure-compromise",
          "steps": [
            "suspicious-logons"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Client-Side Initial Access",
            "slug": "client-side-exploitation",
            "tactic": "initial-access",
            "techniques": [
              "T1190",
              "T1566"
            ],
            "observables": [
              "outlook.exe",
              "winword.exe",
              "excel.exe",
              "CVE-2026-124194",
              "CVE-2026-110043",
              "CVE-2026-110047",
              "CVE-2026-118292"
            ]
          },
          {
            "name": "Exploitation of Remote Services",
            "slug": "remote-service-exploitation",
            "tactic": "execution",
            "techniques": [
              "T1190",
              "T1210"
            ],
            "observables": [
              "mqsvc.exe",
              "spoolsv.exe",
              "srvnet.sys",
              "Port 1801",
              "Port 445",
              "CVE-2026-109459",
              "CVE-2026-113825",
              "CVE-2026-118207"
            ]
          },
          {
            "name": "Local Privilege Escalation",
            "slug": "local-privilege-escalation",
            "tactic": "privilege-escalation",
            "techniques": [
              "T1068"
            ],
            "observables": [
              "msiexec.exe",
              "spoolsv.exe",
              "AppXDeploymentServer",
              "CVE-2026-105501",
              "CVE-2026-113752",
              "CVE-2026-116714"
            ]
          },
          {
            "name": "Identity and Infrastructure Compromise",
            "slug": "identity-infrastructure-compromise",
            "tactic": "lateral-movement",
            "techniques": [
              "T1021.001"
            ],
            "observables": [
              "Active Directory Domain Services",
              "Azure Managed Grafana",
              "CVE-2026-118146",
              "CVE-2026-118148",
              "CVE-2026-114160"
            ]
          }
        ],
        "summary": "The November 2026 Microsoft security update addresses over 1300 vulnerabilities, including critical remote code execution (RCE) flaws in Office, Exchange, and core Windows services like MSMQ and SMB. A spoofing vulnerability in Outlook is being exploited in the wild, while critical authorization bypasses in Active Directory and Azure Managed Grafana pose significant infrastructure risks."
      },
      "severity": "high",
      "rationale": "The hunt starts with systems reporting the specific November 2026 CVEs in hb_vulnerability_finding. Prioritize servers running MSMQ (Port 1801) or hosting critical Office workloads.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is exploiting unpatched November 2026 vulnerabilities to gain access or elevate privileges, causing service crashes followed by anomalous child processes or suspicious RDP logins.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Optional host filter; leave empty for whole fleet."
        },
        "critical_apps": {
          "type": "list[path]",
          "default": [
            "outlook.exe",
            "winword.exe",
            "excel.exe",
            "mqsvc.exe",
            "spoolsv.exe",
            "msiexec.exe"
          ],
          "description": "Process names vulnerable to RCE or privilege escalation."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine for behavior."
        },
        "vulnerable_cves": {
          "from": {
            "ref": "https://blog.talosintelligence.com/microsoft-patch-tuesday-for-november-2026/",
            "kind": "article",
            "observed": "2026-11-11"
          },
          "type": "list[string]",
          "default": [
            "CVE-2026-109459",
            "CVE-2026-124194",
            "CVE-2026-118146",
            "CVE-2026-113752",
            "CVE-2026-105501",
            "CVE-2026-116714"
          ],
          "description": "CVE identifiers from the November 2026 update."
        },
        "post_exploit_binaries": {
          "type": "list[path]",
          "default": [
            "cmd.exe",
            "powershell.exe",
            "bitsadmin.exe",
            "certutil.exe",
            "schtasks.exe"
          ],
          "description": "Common shell and LOLBin executables used after exploitation."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://blog.talosintelligence.com/microsoft-patch-tuesday-for-november-2026/",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://blog.talosintelligence.com/microsoft-patch-tuesday-for-november-2026/",
          "name": "Microsoft Patch Tuesday for November 2026 \u2014 Snort rules and prominent vulnerabilities"
        }
      ],
      "blind_spots": [
        {
          "id": "telemetry-gaps",
          "risk": "A host without an agent provides no crash or process telemetry, making it a blind spot for behavioral analysis.",
          "question": "whether unmanaged hosts are vulnerable and exploited",
          "requires": "Complete endpoint agent coverage"
        },
        {
          "id": "msmq-rpc-visibility",
          "risk": "General socket monitoring on Port 1801 shows connectivity but not the specific MSMQ operations that would indicate a heap overflow exploit.",
          "stage": "remote-service-exploitation",
          "question": "whether exploitation is occurring via specific MSMQ RPC calls",
          "requires": "hb_network_connection with rpc_interface_uuid"
        }
      ]
    },
    "name": "Endpoint Exploit and Service Crash Monitoring",
    "description": "This hunt targets critical vulnerabilities disclosed in the November 2026 Patch Tuesday update. It monitors for evidence of exploitation in two primary phases: early signals of instability (application crashes and service state changes) and follow-on malicious activity (unauthorized shell execution and lateral movement). The hunt uses a phased flow to connect the presence of unpatched software with behavioral indicators of compromise, allowing an agent to weigh the full attack chain."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "client-side-exploitation",
            "steps": [
              "crash-prevalence"
            ],
            "status": "covered"
          },
          {
            "stage": "remote-service-exploitation",
            "steps": [
              "anomalous-child-processes",
              "crash-prevalence"
            ],
            "status": "covered"
          },
          {
            "stage": "local-privilege-escalation",
            "steps": [
              "service-instability"
            ],
            "status": "covered"
          },
          {
            "stage": "identity-infrastructure-compromise",
            "steps": [
              "suspicious-logons"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary is exploiting unpatched November 2026 vulnerabilities to gain access or elevate privileges, causing service crashes followed by anomalous child processes or suspicious RDP logins.",
        "blind_spots": [
          {
            "id": "telemetry-gaps",
            "risk": "A host without an agent provides no crash or process telemetry, making it a blind spot for behavioral analysis.",
            "question": "whether unmanaged hosts are vulnerable and exploited",
            "requires": "Complete endpoint agent coverage"
          },
          {
            "id": "msmq-rpc-visibility",
            "risk": "General socket monitoring on Port 1801 shows connectivity but not the specific MSMQ operations that would indicate a heap overflow exploit.",
            "stage": "remote-service-exploitation",
            "question": "whether exploitation is occurring via specific MSMQ RPC calls",
            "requires": "hb_network_connection with rpc_interface_uuid"
          }
        ],
        "scoping_notes": "The hunt starts with systems reporting the specific November 2026 CVEs in hb_vulnerability_finding. Prioritize servers running MSMQ (Port 1801) or hosting critical Office workloads.",
        "beyond_detection": "A single detection rule might alert on a known shell spawn from spoolsv.exe, but this hunt connects unpatched vulnerability state to stability signals (crashes) and then to execution, providing the full context required to distinguish an exploit from general system instability."
      }
    },
    {
      "id": "vulnerable-inventory",
      "type": "query",
      "label": "Identify unpatched hosts",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_uid, cve_uid, severity, first_seen FROM hb_vulnerability_finding WHERE instr(',' || '{{vulnerable_cves}}' || ',', ',' || cve_uid || ',') > 0",
        "surface": "hb_vulnerability_finding",
        "description": "Scope the hunt to hosts reporting the targeted November 2026 CVEs.",
        "expected_signal": "A list of vulnerable devices. Absence does not mean they are safe, only that they have been scanned and reported."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify unpatched hosts",
        "reads": [
          "cve_uid",
          "device_uid",
          "first_seen",
          "severity"
        ],
        "source": "hb_vulnerability_finding",
        "target": "endpoint",
        "content": "SELECT device_uid, cve_uid, severity, first_seen FROM hb_vulnerability_finding WHERE instr(',' || '{{vulnerable_cves}}' || ',', ',' || cve_uid || ',') > 0",
        "silence": "not_evidence_of_absence",
        "expected": "A list of vulnerable devices. Absence does not mean they are safe, only that they have been scanned and reported.",
        "verified": "dry-run",
        "verified_at": "2026-11-11"
      }
    },
    {
      "id": "crash-prevalence",
      "type": "query",
      "label": "Rare application crashes",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT app_name, device_hostname, exception_code, COUNT(*) AS crash_count, MIN(time) AS first_crash FROM hb_application_error WHERE time >= datetime('now', '-{{lookback_days}} days') AND instr(',' || '{{critical_apps}}' || ',', ',' || LOWER(app_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY app_name, device_hostname",
        "surface": "hb_application_error",
        "description": "Find rare crashes in vulnerable applications that may indicate memory-corruption exploit attempts.",
        "expected_signal": "Rare crashes (low host count) for vulnerable services like mqsvc.exe or spoolsv.exe."
      },
      "parents": [
        {
          "id": "vulnerable-inventory"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare application crashes",
        "reads": [
          "app_name",
          "device_hostname",
          "exception_code",
          "time"
        ],
        "source": "hb_application_error",
        "target": "endpoint",
        "content": "SELECT app_name, device_hostname, exception_code, COUNT(*) AS crash_count, MIN(time) AS first_crash FROM hb_application_error WHERE time >= datetime('now', '-{{lookback_days}} days') AND instr(',' || '{{critical_apps}}' || ',', ',' || LOWER(app_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY app_name, device_hostname",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Rare crashes (low host count) for vulnerable services like mqsvc.exe or spoolsv.exe.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "app_name"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-11-11"
      }
    },
    {
      "id": "service-instability",
      "type": "query",
      "label": "Service state changes",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, service_name, service_state, time FROM hb_service_activity WHERE time >= datetime('now', '-{{lookback_days}} days') AND instr(',' || '{{critical_apps}}' || ',', ',' || LOWER(service_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "surface": "hb_service_activity",
        "description": "Monitor for unexpected stops or crashes in critical Windows services targeted by privilege escalation CVEs.",
        "expected_signal": "Service stops occurring near crash events or suspicious software installation logs."
      },
      "parents": [
        {
          "id": "vulnerable-inventory"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Service state changes",
        "reads": [
          "device_hostname",
          "service_name",
          "service_state",
          "time"
        ],
        "source": "hb_service_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, service_name, service_state, time FROM hb_service_activity WHERE time >= datetime('now', '-{{lookback_days}} days') AND instr(',' || '{{critical_apps}}' || ',', ',' || LOWER(service_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "silence": "not_evidence_of_absence",
        "expected": "Service stops occurring near crash events or suspicious software installation logs.",
        "verified": "dry-run",
        "verified_at": "2026-11-11"
      }
    },
    {
      "id": "early-triage",
      "type": "analytic",
      "label": "Early stage read",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "vulnerable-inventory",
          "crash-prevalence",
          "service-instability"
        ],
        "objective": "Determine if the crashes and service instability on vulnerable hosts align with the exploitation of November 2026 vulnerabilities.",
        "description": "Evaluate if observed crashes and service events indicate likely exploitation of the unpatched estate.",
        "max_iterations": 4,
        "expected_signal": "A list of hosts exhibiting high-priority instability signs.",
        "success_criteria": "A per-host verdict of instability vs. exploitation attempt."
      },
      "parents": [
        {
          "id": "crash-prevalence",
          "kind": "merge"
        },
        {
          "id": "service-instability",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "anomalous-child-processes",
      "type": "query",
      "label": "Anomalous child processes",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, parent_process_name, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE time >= datetime('now', '-{{lookback_days}} days') AND instr(',' || '{{critical_apps}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 AND instr(',' || '{{post_exploit_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "surface": "hb_process_activity",
        "description": "Detect shells or LOLBins launched by vulnerable services, indicative of successful code execution.",
        "expected_signal": "System services or Office apps spawning shells. This is high-confidence evidence of exploitation."
      },
      "parents": [
        {
          "id": "early-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Anomalous child processes",
        "reads": [
          "device_hostname",
          "parent_process_name",
          "process_cmd_line",
          "process_name",
          "time",
          "user_name"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, parent_process_name, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE time >= datetime('now', '-{{lookback_days}} days') AND instr(',' || '{{critical_apps}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 AND instr(',' || '{{post_exploit_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "silence": "not_evidence_of_absence",
        "expected": "System services or Office apps spawning shells. This is high-confidence evidence of exploitation.",
        "verified": "dry-run",
        "verified_at": "2026-11-11"
      }
    },
    {
      "id": "suspicious-logons",
      "type": "query",
      "label": "Suspicious RDP sign-ins",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "identity",
        "content": "SELECT device_hostname, dst_endpoint_hostname, actor_user_name, logon_type, src_endpoint_ip, time FROM hb_auth_signin WHERE time >= datetime('now', '-{{lookback_days}} days') AND logon_type IN ('Remote Interactive', 'Network') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0 OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_hostname || ',') > 0)",
        "surface": "hb_auth_signin",
        "description": "Identify lateral movement originating from or targeting likely beachheads.",
        "expected_signal": "New or unexpected sign-ins involving hosts that previously showed exploitation signals."
      },
      "parents": [
        {
          "id": "early-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Suspicious RDP sign-ins",
        "reads": [
          "actor_user_name",
          "device_hostname",
          "dst_endpoint_hostname",
          "logon_type",
          "src_endpoint_ip",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT device_hostname, dst_endpoint_hostname, actor_user_name, logon_type, src_endpoint_ip, time FROM hb_auth_signin WHERE time >= datetime('now', '-{{lookback_days}} days') AND logon_type IN ('Remote Interactive', 'Network') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0 OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_hostname || ',') > 0)",
        "silence": "not_evidence_of_absence",
        "expected": "New or unexpected sign-ins involving hosts that previously showed exploitation signals.",
        "verified": "dry-run",
        "verified_at": "2026-11-11"
      }
    },
    {
      "id": "full-chain-analysis",
      "type": "analytic",
      "label": "Follow-on stage read",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "early-triage",
          "anomalous-child-processes",
          "suspicious-logons"
        ],
        "objective": "Evaluate the combined evidence of unpatched vulnerabilities, service crashes, anomalous processes, and sign-in activity to confirm successful exploitation.",
        "description": "Correlate early instability with follow-on execution to reach a final verdict.",
        "max_iterations": 6,
        "expected_signal": "A comprehensive verdict for the entire attack chain.",
        "success_criteria": "A final verdict of malicious | suspicious for any host with confirmed follow-on activity."
      },
      "parents": [
        {
          "id": "anomalous-child-processes",
          "kind": "merge"
        },
        {
          "id": "suspicious-logons",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the full-chain-analysis verdict is malicious for at least one host",
        "condition": "the full-chain-analysis verdict is malicious for at least one host",
        "blind_spot": "telemetry-gaps",
        "confidence": "high",
        "description": "Route to containment or review based on the agent's full-chain analysis.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "full-chain-analysis"
        }
      ]
    },
    {
      "id": "contain-host",
      "type": "action",
      "label": "Isolate compromised host",
      "config": {
        "target": "endpoint",
        "description": "Halt the attack and prevent further lateral movement.",
        "instructions": "Isolate the host via the EDR and capture a memory dump for forensic analysis.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst triage and close-out",
      "config": {
        "assignee": "analyst",
        "description": "Manually confirm the threat chain and document findings.",
        "instructions": "Review the full-chain analysis; confirm if the service crashes were related to the unpatched CVEs and subsequent behavior."
      },
      "parents": [
        {
          "id": "route",
          "branch": "default"
        },
        {
          "id": "route",
          "branch": "on_unavailable"
        },
        {
          "id": "contain-host"
        }
      ]
    },
    {
      "id": "patch-verification",
      "type": "task",
      "label": "Patching verification",
      "config": {
        "assignee": "analyst",
        "description": "Ensure all identified vulnerable systems are patched to prevent re-exploitation.",
        "instructions": "Confirm that the November 2026 security updates are applied to all systems listed in the initial scoping query."
      },
      "parents": [
        {
          "id": "route",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-review"
        }
      ]
    }
  ]
}