Exploit and Multi-Hop Proxy C2

Source

---
analysis: "Standard alerts on common proxy ports often produce excessive noise from\
  \ legitimate business tools. This hunt addresses that gap by scoping the data to\
  \ known vulnerable hosts and using prevalence to isolate rare, per-host proxy traffic.\
  \ It also monitors for specific research activity on the host itself\u2014an indicator\
  \ of an attacker seeking technical context on their breach."
blind_spots:
- id: no-http-telemetry
  question: whether the attacker researched the vulnerability directly from the host
  requires: hb_http_activity on all servers
  risk: A server without HTTP logging prevents the hunt from seeing research activity,
    relying solely on rare egress patterns.
  stage: multi-hop-proxy-c2
- id: unmanaged-devices
  question: whether vulnerable unmanaged devices are present in the environment
  requires: complete enrollment in hb_devices
  risk: The scoping step only sees devices that report to both the vulnerability scanner
    and the device inventory provider.
  stage: exploit-public-facing-application
coverage:
- stage: exploit-public-facing-application
  status: covered
  steps:
  - unresolved-vulnerabilities
- stage: multi-hop-proxy-c2
  status: covered
  steps:
  - rare-proxy-egress
  - mitre-research-activity
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: keep-as-periodic-hunt
  justification: Exploitation of public-facing software provides the primary entry
    point for intruders. Correlating unpatched vulnerabilities with proxy-based C2
    and unusual research activity helps identify compromised servers before data exfiltration
    occurs.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An adversary has exploited a critical vulnerability on a public-facing
  host and is masking command-and-control traffic through a multi-hop proxy or onion
  routing network.
labels:
- hunt
- attack.t1190
- attack.t1090.003
name: Exploit and Multi-Hop Proxy C2
parameters:
  lookback_days:
    default: '14'
    description: Days of history to examine.
    type: number
  proxy_ports:
    default:
    - '1080'
    - '3128'
    - '8080'
    - '9001'
    - '9050'
    description: Common egress ports used by proxies and Tor nodes.
    type: list[string]
  research_paths:
    default:
    - /data/definitions/699.html
    - /data/definitions/513.html
    description: MITRE CWE/CAPEC paths referenced in the report.
    from:
      kind: article
      observed: '2026-06-23'
      ref: elastic-security-labs-automation
    type: list[path]
  scope_hosts:
    default: []
    description: Hosts to include in behavioral queries; paste hostnames from the
      scoping step here.
    type: list[host]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://www.elastic.co/security-labs/blog/security-advisory-automation-rag-elastic-agent-builder
    gates:
    - dry-run
    - lint
    model: hb_google/gemini-3-flash-preview
rationale: The hunt begins by joining hb_vulnerability_finding and hb_devices to identify
  specific hostnames with unresolved critical vulnerabilities. For the parallel queries
  to work correctly, the analyst must copy the hostnames from this first step into
  the 'scope_hosts' parameter.
references:
- name: 'From vulnerability report to CVE draft in minutes: how Elastic automated
    security advisories with AI'
  url: https://www.elastic.co/security-labs/blog/security-advisory-automation-rag-elastic-agent-builder
related:
- hunt: tor-exit-node-connections
  reason: That hunt uses IP intelligence for known Tor nodes, while this hunt focuses
    on behavioral port patterns and research activity.
  relation: out-of-scope-alternative
scenario:
  stages:
  - name: Exploitation of Public-Facing Application
    observables:
    - vulnerable software components
    - product versions
    - CVE-YYYY-NNNNN
    - ESA-2026-01
    - vulnerability reports
    - CVSS scores
    slug: exploit-public-facing-application
    tactic: initial-access
    techniques:
    - T1190
  - name: Command and Control via Multi-hop Proxy
    observables:
    - CAPEC methodology
    - multi-hop proxy chains
    - onion routing
    - Tor network traffic
    - 699.html
    - 513.html
    - Elastic Crawler
    slug: multi-hop-proxy-c2
    tactic: command-and-control
    techniques:
    - T1090.003
  summary: This intrusion scenario involves the exploitation of vulnerabilities in
    public-facing applications to gain initial access, followed by the establishment
    of command and control using multi-hop proxies and onion routing. The activity
    is documented through an automated pipeline that uses AI to draft security advisories
    by mapping raw vulnerability data to the MITRE CWE and CAPEC catalogs.
severity: medium
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  network:
    category: network
    name: Network telemetry
    telemetry:
    - network
  web:
    category: siem
    name: Web server / proxy logs
    telemetry:
    - network
tlp: clear
type: investigation
---


# Exploit and Multi-Hop Proxy C2

This hunt identifies internet-facing systems with unresolved high-severity vulnerabilities. It correlates these hosts with network behaviors indicative of multi-hop proxying. The hunt uses vulnerability findings as the lead to scope the investigation and then fans out to inspect egress port patterns and specific HTTP research indicators matching the MITRE documentation referenced in automated vulnerability research. An agent weighs these independent signals to determine if a vulnerable host has been compromised.

## unresolved-vulnerabilities
<!-- Unresolved critical vulnerabilities -->
Identify potential beachheads by listing hostnames with unresolved critical vulnerabilities.

```sqlite target=endpoint role=scoping
~~~yaml
expected: A list of vulnerable hostnames. These systems are the primary targets for
  exploitation and subsequent proxy activity.
reads:
- device_uid
- cve_uid
- severity_id
- status
silence: not_evidence_of_absence
source: hb_vulnerability_finding
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT DISTINCT d.hostname AS device_hostname, v.cve_uid, v.severity_id FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid WHERE v.status = 'UNRESOLVED' AND v.severity_id >= 4
```

## correlate-egress-indicators
<!-- Correlate egress and research indicators -->
parallel:
- → rare-proxy-egress
- → mitre-research-activity
join: → triage-verdict

## rare-proxy-egress
<!-- Rare egress on proxy ports -->
Find hosts connecting to common proxy ports where the destination is rare across the fleet, suggesting private C2 infrastructure.

```sqlite target=network role=baseline params=(lookback_days=lookback_days, proxy_ports=proxy_ports, scope_hosts=scope_hosts)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: Connections to proxy ports from a small subset of the vulnerable estate.
  Silence means no proxy-like egress was observed.
prevalence:
  by: device_hostname
  key:
  - dst_endpoint_ip
  - dst_endpoint_port
  rare_below: 4
reads:
- device_hostname
- process_name
- dst_endpoint_ip
- dst_endpoint_port
- direction
- time
silence: not_evidence_of_absence
source: hb_network_connection
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, COUNT(DISTINCT device_hostname) AS host_count FROM hb_network_connection WHERE (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND direction = 'outbound' AND instr(',' || '{{proxy_ports}}' || ',', ',' || CAST(dst_endpoint_port AS TEXT) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_ip, dst_endpoint_port HAVING host_count <= 3
```

## mitre-research-activity
<!-- MITRE research activity -->
Detect requests to specific CWE and CAPEC pages originating from the server, which may indicate an attacker using interactive tools on the host.

```sqlite target=web role=enrichment params=(lookback_days=lookback_days, research_paths=research_paths, scope_hosts=scope_hosts)
~~~yaml
expected: HTTP requests from internal servers to MITRE documentation. This logic assumes
  the adversary is performing live research or using automated tools that fetch context
  directly from the host.
reads:
- device_hostname
- url_hostname
- url_path
- user_agent
- time
silence: not_evidence_of_absence
source: hb_http_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, url_hostname, url_path, user_agent, time FROM hb_http_activity WHERE (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND LOWER(url_hostname) LIKE '%mitre.org%' AND (instr(',' || '{{research_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0 OR LOWER(url_path) LIKE '%/definitions/%') AND time >= datetime('now', '-{{lookback_days}} days')
```

## triage-verdict
<!-- Triage verdict -->
```agent target=hunter
cite: required
context:
- unresolved-vulnerabilities
- rare-proxy-egress
- mitre-research-activity
max_iterations: 3
objective: Identify hosts that are vulnerable AND exhibit either rare proxy egress
  or unusual HTTP research activity.
success_criteria: Verdicts citing specific hosts and evidence rows.
tools:
- endpoint
- network
- web
```

## route-verdict
<!-- Route verdict -->
if~: "the triage verdict is malicious for at least one host" (confidence: high, judge=hunter)
then: → isolate-host
indeterminate: → investigate-process
unavailable: → investigate-process (blind_spot: no-http-telemetry)
else: → remediate-vulnerability

## isolate-host
<!-- Isolate host -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the endpoint and revoke any service account sessions originating from it.
```
→ investigate-process

## investigate-process
<!-- Investigate process -->
```manual target=analyst
Review hb_process_activity for the process_name identified in the proxy egress query. Check for suspicious parent processes and associated file activity.
```
→ remediate-vulnerability

## remediate-vulnerability
<!-- Remediate vulnerability -->
```manual target=analyst
Coordinate with the infrastructure team to patch the affected packages identified in the scoping step. Verify the fix using a subsequent hb_vulnerability_finding read.
```
→ end