{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "This hunt identifies the end-to-end lifecycle of an endpoint intrusion by correlating persistence via RMM tools and rare accounts with high-impact credential dumping and backup destruction." }, "name": "Endpoint Intrusion and Impact Chain", "type": "investigation", "labels": [ "hunt", "attack.t1059.001", "attack.t1133", "attack.t1136.001", "attack.t1003.001", "attack.t1490", "collection", "credential access", "execution", "impact", "initial access", "persistence" ], "series": { "slug": "reports-of-siem-s-death-have-been-greatly-exaggerated", "index": 2, "title": "Reports of SIEM's Death Have Been Greatly Exaggerated", "total": 2 }, "related": [ { "hunt": "active-directory-lateral-movement", "reason": "Once an endpoint intrusion is confirmed, the next logical step is to hunt for lateral movement using the compromised credentials.", "relation": "follows" }, { "hunt": "identity-cloud-access-anomalies", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single rule might catch 'vssadmin delete', but it lacks the context of an unauthorized RMM tool or a rare account creation. This hunt uses a phased approach to build the full context of an intrusion, allowing for high-confidence response actions like host isolation.", "coverage": [ { "stage": "execution-encoded-powershell", "steps": [ "suspicious-script-blocks" ], "status": "covered" }, { "stage": "persistence-unauthorized-rmm-and-admins", "steps": [ "scoping-rmm-presence", "rare-account-creation" ], "status": "covered" }, { "stage": "credential-access-lsass-dumping", "steps": [ "lsass-memory-access" ], "status": "covered" }, { "stage": "impact-shadow-copy-deletion", "steps": [ "shadow-copy-deletion" ], "status": "covered" }, { "stage": "initial-access-vpn-abuse", "reason": "Belongs to another part of the \"Reports of SIEM's Death Have Been Greatly Exaggerated\" series.", "status": "out_of_scope" }, { "stage": "collection-inbox-forwarding", "reason": "Belongs to another part of the \"Reports of SIEM's Death Have Been Greatly Exaggerated\" series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "VPN and Identity Abuse", "slug": "initial-access-vpn-abuse", "tactic": "initial-access", "techniques": [ "T1133", "T1110.004" ], "observables": [ "VPN login from an unusual country", "Credential stuffing attempts", "Service account logging into VPN", "MFA prompt bombing (MFA fatigue)" ] }, { "name": "Encoded PowerShell Execution", "slug": "execution-encoded-powershell", "tactic": "execution", "techniques": [ "T1059.001" ], "observables": [ "Encoded PowerShell commands", "powershell.exe -enc", "powershell.exe -EncodedCommand" ] }, { "name": "Persistence via RMM and New Admins", "slug": "persistence-unauthorized-rmm-and-admins", "tactic": "persistence", "techniques": [ "T1133", "T1136.001" ], "observables": [ "ScreenConnect execution", "New domain admin account creation", "New local administrator account creation" ] }, { "name": "LSASS Memory Dumping", "slug": "credential-access-lsass-dumping", "tactic": "credential-access", "techniques": [ "T1003.001" ], "observables": [ "Mimikatz execution", "LSASS process memory access", "dbghelp.dll loading from uncommon locations" ] }, { "name": "Email Collection via Inbox Rules", "slug": "collection-inbox-forwarding", "tactic": "collection", "techniques": [ "T1114.003" ], "observables": [ "Microsoft 365 inbox rule forwarding mail to outside address", "New-InboxRule cmdlet usage" ] }, { "name": "Inhibit System Recovery", "slug": "impact-shadow-copy-deletion", "tactic": "impact", "techniques": [ "T1490" ], "observables": [ "Shadow copies getting wiped", "vssadmin delete shadows" ] } ], "summary": "This article outlines common attacker behaviors observed across endpoint and identity planes, including credential stuffing against VPNs, the use of encoded PowerShell for execution, and persistence via unauthorized RMM tools like ScreenConnect. The intrusion culminates in credential theft via LSASS dumping and the destruction of system recovery options like volume shadow copies to maximize impact." }, "severity": "medium", "rationale": "Focus on workstations and servers with internet-facing RMM software; prioritize accounts with local or domain administrator privileges.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has gained a foothold using unauthorized remote management software or encoded scripts and is now attempting to dump credentials and inhibit system recovery.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2024-10-29" }, "type": "list[host]", "default": [], "description": "Optional list of hosts to focus the hunt on; leave empty to scan the whole estate." }, "rmm_keywords": { "from": { "ref": "huntress-rmm-list", "kind": "article", "observed": "2024-10-29" }, "type": "list[string]", "default": [ "screenconnect", "anydesk", "teamviewer", "connectwise", "logmein", "atera" ], "description": "Common RMM tool names used for unauthorized persistence." }, "lookback_days": { "from": { "ref": "default-retention", "kind": "manual", "observed": "2024-10-29" }, "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/reports-that-siem-is-dead-are-exaggerated", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/reports-that-siem-is-dead-are-exaggerated", "name": "Huntress \u2014 Reports of SIEM's Death Have Been Greatly Exaggerated" } ], "blind_spots": [ { "id": "missing-process-telemetry", "risk": "An adversary may rename vssadmin.exe or use a custom tool to evade simple string-match rules.", "owner": "IT Operations", "stage": "impact-shadow-copy-deletion", "question": "whether shadow copies were wiped using renamed system tools or API calls", "requires": "hb_process_activity with full command line auditing", "remediation": "Deploy and verify EDR coverage across the full server estate." }, { "id": "lsass-access-noise", "risk": "Legitimate security agents and diagnostic tools regularly access LSASS, which can create false positives if not baselined.", "owner": "SOC Lead", "stage": "credential-access-lsass-dumping", "question": "whether LSASS access was for malicious dumping or benign monitoring", "requires": "hb_resource_activity", "remediation": "Maintain a list of approved security agent binaries that are allowed to access LSASS." } ] }, "name": "Endpoint Intrusion and Impact Chain", "description": "This hunt identifies the transition from a suspicious endpoint foothold to high-impact post-exploitation. It first identifies systems running unauthorized remote management (RMM) tools or experiencing rare account creations. It then pivots to look for follow-on actions like LSASS memory access and volume shadow copy deletion on those same systems. By correlating early-stage persistence with late-stage impact tradecraft, an analyst can distinguish an active intrusion from routine maintenance." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "reports-of-siem-s-death-have-been-greatly-exaggerated", "index": 2, "title": "Reports of SIEM's Death Have Been Greatly Exaggerated", "total": 2 }, "coverage": [ { "stage": "execution-encoded-powershell", "steps": [ "suspicious-script-blocks" ], "status": "covered" }, { "stage": "persistence-unauthorized-rmm-and-admins", "steps": [ "scoping-rmm-presence", "rare-account-creation" ], "status": "covered" }, { "stage": "credential-access-lsass-dumping", "steps": [ "lsass-memory-access" ], "status": "covered" }, { "stage": "impact-shadow-copy-deletion", "steps": [ "shadow-copy-deletion" ], "status": "covered" }, { "stage": "initial-access-vpn-abuse", "reason": "Belongs to another part of the \"Reports of SIEM's Death Have Been Greatly Exaggerated\" series.", "status": "out_of_scope" }, { "stage": "collection-inbox-forwarding", "reason": "Belongs to another part of the \"Reports of SIEM's Death Have Been Greatly Exaggerated\" series.", "status": "out_of_scope" } ], "rationale": "An intruder has gained a foothold using unauthorized remote management software or encoded scripts and is now attempting to dump credentials and inhibit system recovery.", "blind_spots": [ { "id": "missing-process-telemetry", "risk": "An adversary may rename vssadmin.exe or use a custom tool to evade simple string-match rules.", "owner": "IT Operations", "stage": "impact-shadow-copy-deletion", "question": "whether shadow copies were wiped using renamed system tools or API calls", "requires": "hb_process_activity with full command line auditing", "remediation": "Deploy and verify EDR coverage across the full server estate." }, { "id": "lsass-access-noise", "risk": "Legitimate security agents and diagnostic tools regularly access LSASS, which can create false positives if not baselined.", "owner": "SOC Lead", "stage": "credential-access-lsass-dumping", "question": "whether LSASS access was for malicious dumping or benign monitoring", "requires": "hb_resource_activity", "remediation": "Maintain a list of approved security agent binaries that are allowed to access LSASS." } ], "scoping_notes": "Focus on workstations and servers with internet-facing RMM software; prioritize accounts with local or domain administrator privileges.", "beyond_detection": "A single rule might catch 'vssadmin delete', but it lacks the context of an unauthorized RMM tool or a rare account creation. This hunt uses a phased approach to build the full context of an intrusion, allowing for high-confidence response actions like host isolation." } }, { "id": "scoping-rmm-presence", "type": "query", "label": "Hosts with RMM software", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, vendor_name, package_version FROM hb_software_inventory WHERE (instr(',' || '{{rmm_keywords}}' || ',', ',' || LOWER(package_name) || ',') > 0 OR instr(',' || '{{rmm_keywords}}' || ',', ',' || LOWER(vendor_name) || ',') > 0)", "surface": "hb_software_inventory", "description": "Identify hosts that have remote management tools installed, which can serve as unauthorized persistence mechanisms.", "expected_signal": "A list of hosts and the specific RMM software found. This narrows the hunt to systems with external access capabilities." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Hosts with RMM software", "reads": [ "device_hostname", "package_name", "vendor_name", "package_version" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, vendor_name, package_version FROM hb_software_inventory WHERE (instr(',' || '{{rmm_keywords}}' || ',', ',' || LOWER(package_name) || ',') > 0 OR instr(',' || '{{rmm_keywords}}' || ',', ',' || LOWER(vendor_name) || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "A list of hosts and the specific RMM software found. This narrows the hunt to systems with external access capabilities.", "verified": "dry-run", "verified_at": "2026-10-31" } }, { "id": "suspicious-script-blocks", "type": "query", "label": "Suspicious PowerShell script blocks", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, script_content, actor_user_name, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%virtualalloc%' OR LOWER(script_content) LIKE '%marshal%' OR LOWER(script_content) LIKE '%reflectiveload%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_script_activity", "description": "Find script blocks containing keywords associated with memory manipulation or reflective loading.", "expected_signal": "Scripts that attempt to execute code in memory, often bypassing command-line detection." }, "parents": [ { "id": "scoping-rmm-presence" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Suspicious PowerShell script blocks", "reads": [ "device_hostname", "script_content", "actor_user_name", "time" ], "source": "hb_script_activity", "target": "endpoint", "content": "SELECT device_hostname, script_content, actor_user_name, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%virtualalloc%' OR LOWER(script_content) LIKE '%marshal%' OR LOWER(script_content) LIKE '%reflectiveload%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Scripts that attempt to execute code in memory, often bypassing command-line detection.", "verified": "dry-run", "verified_at": "2026-10-31" } }, { "id": "rare-account-creation", "type": "query", "label": "Rare account creations", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT user_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_account_change WHERE activity_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY user_name HAVING host_count <= 2", "surface": "hb_account_change", "description": "Stack-count account creation events across the fleet to find accounts created on only a few hosts.", "expected_signal": "New accounts that appear on only 1 or 2 systems, highlighting potential unauthorized persistence." }, "parents": [ { "id": "scoping-rmm-presence" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare account creations", "reads": [ "user_name", "device_hostname", "time" ], "source": "hb_account_change", "target": "endpoint", "content": "SELECT user_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_account_change WHERE activity_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY user_name HAVING host_count <= 2", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "New accounts that appear on only 1 or 2 systems, highlighting potential unauthorized persistence.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "user_name" ], "rare_below": 3 }, "verified_at": "2026-10-31" } }, { "id": "early-triage-agent", "type": "analytic", "label": "Evaluate early foothold signs", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "scoping-rmm-presence", "suspicious-script-blocks", "rare-account-creation" ], "objective": "Determine if any single host shows a combination of unauthorized RMM software, suspicious script blocks, and rare account creations that indicate an active foothold.", "description": "Analyze whether the RMM presence, suspicious scripts, and rare accounts suggest a compromised host.", "max_iterations": 3, "expected_signal": "A per-host verdict of suspicious or benign for the initial access phase.", "success_criteria": "A verdict per host citing the specific rows from the script and account queries." }, "parents": [ { "id": "suspicious-script-blocks", "kind": "merge" }, { "id": "rare-account-creation", "kind": "merge" } ] }, { "id": "lsass-memory-access", "type": "query", "label": "LSASS memory access", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, actor_process_name, object_name, access_mask, time FROM hb_resource_activity WHERE object_type = 'Process' AND (LOWER(object_name) LIKE '%\\\\lsass.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_resource_activity", "description": "Identify processes requesting access to LSASS, which is typical for credential dumping.", "expected_signal": "An actor process opening a handle to LSASS. Non-system processes in this role are highly suspicious." }, "parents": [ { "id": "early-triage-agent" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "LSASS memory access", "reads": [ "device_hostname", "actor_process_name", "object_name", "access_mask", "time" ], "source": "hb_resource_activity", "target": "endpoint", "content": "SELECT device_hostname, actor_process_name, object_name, access_mask, time FROM hb_resource_activity WHERE object_type = 'Process' AND (LOWER(object_name) LIKE '%\\\\lsass.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "An actor process opening a handle to LSASS. Non-system processes in this role are highly suspicious.", "verified": "dry-run", "verified_at": "2026-10-31" } }, { "id": "shadow-copy-deletion", "type": "query", "label": "Shadow copy deletion", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%vssadmin%' AND LOWER(process_cmd_line) LIKE '%delete%' AND LOWER(process_cmd_line) LIKE '%shadow%') OR (LOWER(process_cmd_line) LIKE '%wmic%' AND LOWER(process_cmd_line) LIKE '%shadowcopy%' AND LOWER(process_cmd_line) LIKE '%delete%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Detect the use of system tools to delete volume shadow copies, preventing system recovery.", "expected_signal": "Commands used to wipe backups. Silence is evidence of absence for these specific commands." }, "parents": [ { "id": "early-triage-agent" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Shadow copy deletion", "reads": [ "device_hostname", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%vssadmin%' AND LOWER(process_cmd_line) LIKE '%delete%' AND LOWER(process_cmd_line) LIKE '%shadow%') OR (LOWER(process_cmd_line) LIKE '%wmic%' AND LOWER(process_cmd_line) LIKE '%shadowcopy%' AND LOWER(process_cmd_line) LIKE '%delete%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "Commands used to wipe backups. Silence is evidence of absence for these specific commands.", "verified": "dry-run", "verified_at": "2026-10-31" } }, { "id": "follow-on-agent", "type": "analytic", "label": "Correlate full intrusion chain", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "early-triage-agent", "lsass-memory-access", "shadow-copy-deletion" ], "objective": "Review the findings from the early triage agent and the follow-on impact queries. Identify any host that has both a suspected foothold and evidence of LSASS access or shadow copy deletion.", "description": "Connect early-stage foothold findings with late-stage impact evidence to confirm a multi-stage intrusion.", "max_iterations": 6, "expected_signal": "A high-confidence verdict on the intrusion state per host.", "success_criteria": "A per-host verdict of malicious, suspicious, or benign, with a detailed timeline citing the evidence from both phases." }, "parents": [ { "id": "lsass-memory-access", "kind": "merge" }, { "id": "shadow-copy-deletion", "kind": "merge" } ] }, { "id": "route-on-intrusion", "type": "checkpoint", "label": "Route on intrusion verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the follow-on-agent verdict is malicious for at least one host and includes both foothold and impact indicators", "condition": "the follow-on-agent verdict is malicious for at least one host and includes both foothold and impact indicators", "blind_spot": "missing-process-telemetry", "confidence": "high", "description": "Direct the response based on the confirmed presence of a multi-stage intrusion.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "follow-on-agent" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Sever the adversary's connection and prevent further data destruction.", "instructions": "Isolate the host from the network immediately. Lock any newly created accounts identified in the triage steps.", "action_approval": "required" }, "parents": [ { "id": "route-on-intrusion", "branch": "on_supports" } ] }, { "id": "analyst-triage", "type": "task", "label": "Detailed analyst review", "config": { "assignee": "analyst", "description": "Verify the automated findings and determine the scope of the compromise.", "instructions": "Verify the legitimacy of the RMM tool and the new accounts. Check for any lateral movement from the compromised system using identity and network logs." }, "parents": [ { "id": "route-on-intrusion", "branch": "default" }, { "id": "route-on-intrusion", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Hunt close-out", "config": { "assignee": "analyst", "description": "Document findings and tune sensors if the activity was benign.", "instructions": "If the activity was legitimate administrative work, document the exception and consider tuning the detection candidate query. If unauthorized RMM was found but no intrusion, address it as a policy violation." }, "parents": [ { "id": "route-on-intrusion", "branch": "on_refutes" } ] } ] }