--- analysis: A simple detection rule on 'certutil.exe' or 'powershell.exe' frequency is too noisy for production environments. This hunt uses a phased approach to baseline rare native behavior and then correlates it with specific file-system impact across two distinct telemetry surfaces to identify genuine attacks. blind_spots: - id: no-file-entropy question: whether modified files are actually encrypted or just compressed/updated requires: file content entropy analysis risk: Legitimate archival or software updates may trigger the mass file activity count, leading to false positives. stage: ransomware-impact-and-encryption - id: wmi-consumer-persistence question: whether a WMI persistence mechanism is present but dormant requires: wmi_cli_event_consumers surface risk: The hunt only sees WMI when it executes a process; a registered event consumer waiting for a trigger will be missed. stage: native-execution-via-powershell-and-wmi coverage: - stage: native-execution-via-powershell-and-wmi status: covered steps: - lotl-execution-wmi-ps - stage: stealthy-proxy-execution-lolbins status: covered steps: - lolbin-proxy-execution - stage: data-theft-and-exfiltration status: covered steps: - data-staging-prep - stage: ransomware-impact-and-encryption status: covered steps: - ransomware-mass-file-activity - reason: Belongs to another part of the '10 Endpoint Security Trends and Tips for 2027 | Huntress' series. stage: initial-access-and-identity-compromise status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: Adversaries now rely heavily on built-in tools (LotL) to bypass signature-based EDR. This hunt proactively searches for the transition from stealthy execution to high-impact ransomware behavior, providing coverage against multi-stage extortion threats. methodology: model-assisted trigger: intel-report hypothesis: An adversary is establishing a foothold using native Windows utilities (LotL) and signed binaries to evade detection before pivoting to data staging and mass file encryption. labels: - hunt - attack.t1041 - attack.t1047 - attack.t1059.001 - attack.t1218 - attack.t1486 - defense evasion - execution - exfiltration - impact - initial access name: Endpoint Living-Off-the-Land and Ransomware Defense parameters: lolbin_list: default: - mshta.exe - certutil.exe - bitsadmin.exe - cscript.exe - wscript.exe - scrcons.exe - bash.exe - pcalua.exe - hh.exe description: Trusted Windows binaries often abused to proxy execution. from: kind: manual observed: '2024-05-20' ref: LOLBAS Project type: list[string] lookback_days: default: '14' description: Days of history to examine. type: number scope_hosts: default: [] description: Optional list of hostnames to focus on. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.huntress.com/blog/endpoint-security-trends gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Focus on file servers and workstations in finance or engineering departments. Exclude backup servers from the mass file activity count to reduce noise. references: - name: "Huntress \u2014 10 Endpoint Security Trends and Tips for 2027" url: https://www.huntress.com/blog/endpoint-security-trends related: - hunt: initial-access-and-identity-compromise reason: This hunt focuses on post-compromise endpoint behavior; initial access via phishing is handled in the identity series. relation: out-of-scope-alternative - hunt: identity-cloud-access-monitoring relation: follows scenario: stages: - name: Initial Access and Identity Compromise observables: - Phished credentials - Abuse of remote management tools (RMM) - Exploitation of internet-facing vulnerabilities - Compromised API keys and service tokens - MFA fatigue (repeated authentication failures/requests) slug: initial-access-and-identity-compromise tactic: initial-access techniques: - T1566 - T1195 - T1190 - name: Native Execution via PowerShell and WMI observables: - Unusual PowerShell scripts launched by non-admin users - WMI commands for remote execution or persistence - Execution of commands via wmic.exe or scrcons.exe slug: native-execution-via-powershell-and-wmi tactic: execution techniques: - T1059.001 - T1047 - name: Stealthy Proxy Execution (LOLBins) observables: - Signed Windows binaries (LOLBins) used for malicious execution - Subtle clues like unusual command-line arguments for trusted utilities slug: stealthy-proxy-execution-lolbins tactic: defense-evasion techniques: - T1218 - name: Data Theft and Exfiltration observables: - Staging of data in temp directories - High-volume outbound network traffic to unrecognized IPs - Connections from IoT/OT devices to critical assets slug: data-theft-and-exfiltration tactic: exfiltration techniques: - T1041 - name: Ransomware Impact and Encryption observables: - Massive file renaming or extension changes (e.g., .encrypted, .ransom) - Rapid modification/deletion of files across shares slug: ransomware-impact-and-encryption tactic: impact techniques: - T1486 summary: Attackers utilize phishing, supply-chain compromise, or the exploitation of public-facing applications to gain a foothold before pivoting to identity-based attacks like MFA fatigue. Once inside, they move laterally and execute commands using native tools like PowerShell and WMI to avoid detection, eventually culminating in data exfiltration and multi-layered ransomware extortion. series: index: 2 slug: 10-endpoint-security-trends-and-tips-for-2027-huntress title: 10 Endpoint Security Trends and Tips for 2027 | Huntress total: 2 severity: medium targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # Endpoint Living-Off-the-Land and Ransomware Defense This hunt follows the progression from stealthy native execution to high-impact ransomware behavior. It first baselines execution patterns for WMI, PowerShell, and common LOLBins to identify outliers. It then correlates these anomalies with late-stage indicators: the creation of compressed archives in user-writable paths and high-frequency file operations that signify encryption. By linking these phases, the hunt distinguishes legitimate administrative work from the coordinated stages of a ransomware intrusion. ## scope-windows-hosts Identify active Windows endpoints for targeted analysis. ```sqlite target=endpoint role=scoping params=(lookback_days=lookback_days) ~~~yaml expected: A list of active Windows machines. Silence means no Windows devices are reporting. reads: - hostname - device_uid - os_version - platform - lifecycle_state - time silence: not_evidence_of_absence source: hb_devices verified: dry-run verified_at: '2026-10-15' ~~~ SELECT hostname, device_uid, os_version FROM hb_devices WHERE LOWER(platform) = 'windows' AND lifecycle_state = 'active' AND time >= datetime('now', '-{{lookback_days}} days') ``` ## early-stage-execution-fanout parallel: - → lotl-execution-wmi-ps - → lolbin-proxy-execution join: → agent-early-triage ## lotl-execution-wmi-ps Identify rare or unusual command lines from native execution engines. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Rare command lines involving WMI for remote tasks or unusual PowerShell execution. Rows are baselined by frequency. prevalence: by: device_hostname key: - process_cmd_line rare_below: 3 reads: - device_hostname - process_name - process_cmd_line - user_name - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-10-15' ~~~ SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%\\powershell.exe' OR LOWER(process_name) LIKE '%\\wmic.exe' OR LOWER(process_name) LIKE '%\\scrcons.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## lolbin-proxy-execution Detect use of trusted binaries to execute code or download malicious payloads. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts, lolbin_list=lolbin_list) ~~~yaml expected: A signed binary performing an out-of-character task, such as mshta.exe accessing a URL or certutil.exe decoding a file. reads: - device_hostname - process_name - process_cmd_line - parent_process_name - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-10-15' ~~~ SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE instr(',' || '{{lolbin_list}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## agent-early-triage ```agent target=hunter cite: required context: - lotl-execution-wmi-ps - lolbin-proxy-execution max_iterations: 3 objective: Identify hosts where PowerShell, WMI, or LOLBin execution deviates significantly from standard administration. Prioritize those with obfuscated command lines or network-facing parent processes. success_criteria: A list of hosts flagged as suspicious or malicious based on native tool abuse. tools: - endpoint ``` ## impact-evidence-fanout parallel: - → data-staging-prep - → ransomware-mass-file-activity join: → agent-follow-on-analysis ## data-staging-prep Identify archive creation in public or temporary directories used for data theft. ```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Compressed archives created in non-admin writable paths. Silence suggests no staging occurred. reads: - device_hostname - process_name - file_path - file_name - activity_id - time silence: evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-10-15' ~~~ SELECT device_hostname, process_name, file_path, file_name, time FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%\\users\\public\\%' OR LOWER(file_path) LIKE '%\\temp\\%' OR LOWER(file_path) LIKE '%\\appdata\\local\\temp\\%') AND (LOWER(file_name) LIKE '%.zip' OR LOWER(file_name) LIKE '%.7z' OR LOWER(file_name) LIKE '%.rar' OR LOWER(file_name) LIKE '%.tar') AND activity_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## ransomware-mass-file-activity Detect rapid file modification, creation, or renaming indicating ransomware impact. ```sqlite target=endpoint role=triage params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: A single process modifying or creating over 100 files in a short window. Silence proves absence of rapid mass-file changes. reads: - device_hostname - process_name - activity_id - time silence: evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-10-15' ~~~ SELECT device_hostname, process_name, COUNT(*) as file_count, MIN(time) as first_op, MAX(time) as last_op FROM hb_file_activity WHERE activity_id IN (1, 3, 4, 5) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name HAVING file_count > 100 ``` ## agent-follow-on-analysis ```agent target=hunter cite: required context: - agent-early-triage - data-staging-prep - ransomware-mass-file-activity max_iterations: 4 objective: Determine if the native tools identified in the early stage are directly responsible for the staging or mass file modifications observed later. Weigh the intent and impact per host. success_criteria: A per-host verdict of malicious | suspicious | benign, citing the specific process names and file paths involved. tools: - endpoint ``` ## route-on-verdict if~: "the agent-follow-on-analysis verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → isolate-and-contain indeterminate: → analyst-forensic-review unavailable: → analyst-forensic-review (blind_spot: no-file-entropy) else: → close-out ## isolate-and-contain ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the identified host from the network immediately. Terminate the process identified as performing mass file operations. Collect the memory and process tree for forensic analysis. ``` → analyst-forensic-review ## analyst-forensic-review ```manual target=analyst Review the command lines flagged in the early stage. Confirm if the files modified in the impact stage have been encrypted or are legitimate administrative backups. Check for lateral movement from the beachhead. ``` → close-out ## close-out ```manual target=analyst Document any benign-but-rare administrative tools identified. If a breach was confirmed, ensure the incident is logged in the IR tracker. Update the scope_hosts parameter if specific hosts need re-monitoring. ``` → end