{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Exploitation of public-facing software provides the primary entry point for intruders. Correlating unpatched vulnerabilities with proxy-based C2 and unusual research activity helps identify compromised servers before data exfiltration occurs."
      },
      "name": "Exploit and Multi-Hop Proxy C2",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1090.003"
      ],
      "related": [
        {
          "hunt": "tor-exit-node-connections",
          "reason": "That hunt uses IP intelligence for known Tor nodes, while this hunt focuses on behavioral port patterns and research activity.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "Standard alerts on common proxy ports often produce excessive noise from legitimate business tools. This hunt addresses that gap by scoping the data to known vulnerable hosts and using prevalence to isolate rare, per-host proxy traffic. It also monitors for specific research activity on the host itself\u2014an indicator of an attacker seeking technical context on their breach.",
      "coverage": [
        {
          "stage": "exploit-public-facing-application",
          "steps": [
            "unresolved-vulnerabilities"
          ],
          "status": "covered"
        },
        {
          "stage": "multi-hop-proxy-c2",
          "steps": [
            "rare-proxy-egress",
            "mitre-research-activity"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Exploitation of Public-Facing Application",
            "slug": "exploit-public-facing-application",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "vulnerable software components",
              "product versions",
              "CVE-YYYY-NNNNN",
              "ESA-2026-01",
              "vulnerability reports",
              "CVSS scores"
            ]
          },
          {
            "name": "Command and Control via Multi-hop Proxy",
            "slug": "multi-hop-proxy-c2",
            "tactic": "command-and-control",
            "techniques": [
              "T1090.003"
            ],
            "observables": [
              "CAPEC methodology",
              "multi-hop proxy chains",
              "onion routing",
              "Tor network traffic",
              "699.html",
              "513.html",
              "Elastic Crawler"
            ]
          }
        ],
        "summary": "This intrusion scenario involves the exploitation of vulnerabilities in public-facing applications to gain initial access, followed by the establishment of command and control using multi-hop proxies and onion routing. The activity is documented through an automated pipeline that uses AI to draft security advisories by mapping raw vulnerability data to the MITRE CWE and CAPEC catalogs."
      },
      "severity": "medium",
      "rationale": "The hunt begins by joining hb_vulnerability_finding and hb_devices to identify specific hostnames with unresolved critical vulnerabilities. For the parallel queries to work correctly, the analyst must copy the hostnames from this first step into the 'scope_hosts' parameter.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has exploited a critical vulnerability on a public-facing host and is masking command-and-control traffic through a multi-hop proxy or onion routing network.",
      "parameters": {
        "proxy_ports": {
          "type": "list[string]",
          "default": [
            "1080",
            "3128",
            "8080",
            "9001",
            "9050"
          ],
          "description": "Common egress ports used by proxies and Tor nodes."
        },
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Hosts to include in behavioral queries; paste hostnames from the scoping step here."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "research_paths": {
          "from": {
            "ref": "elastic-security-labs-automation",
            "kind": "article",
            "observed": "2026-06-23"
          },
          "type": "list[path]",
          "default": [
            "/data/definitions/699.html",
            "/data/definitions/513.html"
          ],
          "description": "MITRE CWE/CAPEC paths referenced in the report."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.elastic.co/security-labs/blog/security-advisory-automation-rag-elastic-agent-builder",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.elastic.co/security-labs/blog/security-advisory-automation-rag-elastic-agent-builder",
          "name": "From vulnerability report to CVE draft in minutes: how Elastic automated security advisories with AI"
        }
      ],
      "blind_spots": [
        {
          "id": "no-http-telemetry",
          "risk": "A server without HTTP logging prevents the hunt from seeing research activity, relying solely on rare egress patterns.",
          "stage": "multi-hop-proxy-c2",
          "question": "whether the attacker researched the vulnerability directly from the host",
          "requires": "hb_http_activity on all servers"
        },
        {
          "id": "unmanaged-devices",
          "risk": "The scoping step only sees devices that report to both the vulnerability scanner and the device inventory provider.",
          "stage": "exploit-public-facing-application",
          "question": "whether vulnerable unmanaged devices are present in the environment",
          "requires": "complete enrollment in hb_devices"
        }
      ]
    },
    "name": "Exploit and Multi-Hop Proxy C2",
    "description": "This hunt identifies internet-facing systems with unresolved high-severity vulnerabilities. It correlates these hosts with network behaviors indicative of multi-hop proxying. The hunt uses vulnerability findings as the lead to scope the investigation and then fans out to inspect egress port patterns and specific HTTP research indicators matching the MITRE documentation referenced in automated vulnerability research. An agent weighs these independent signals to determine if a vulnerable host has been compromised."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "exploit-public-facing-application",
            "steps": [
              "unresolved-vulnerabilities"
            ],
            "status": "covered"
          },
          {
            "stage": "multi-hop-proxy-c2",
            "steps": [
              "rare-proxy-egress",
              "mitre-research-activity"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary has exploited a critical vulnerability on a public-facing host and is masking command-and-control traffic through a multi-hop proxy or onion routing network.",
        "blind_spots": [
          {
            "id": "no-http-telemetry",
            "risk": "A server without HTTP logging prevents the hunt from seeing research activity, relying solely on rare egress patterns.",
            "stage": "multi-hop-proxy-c2",
            "question": "whether the attacker researched the vulnerability directly from the host",
            "requires": "hb_http_activity on all servers"
          },
          {
            "id": "unmanaged-devices",
            "risk": "The scoping step only sees devices that report to both the vulnerability scanner and the device inventory provider.",
            "stage": "exploit-public-facing-application",
            "question": "whether vulnerable unmanaged devices are present in the environment",
            "requires": "complete enrollment in hb_devices"
          }
        ],
        "scoping_notes": "The hunt begins by joining hb_vulnerability_finding and hb_devices to identify specific hostnames with unresolved critical vulnerabilities. For the parallel queries to work correctly, the analyst must copy the hostnames from this first step into the 'scope_hosts' parameter.",
        "beyond_detection": "Standard alerts on common proxy ports often produce excessive noise from legitimate business tools. This hunt addresses that gap by scoping the data to known vulnerable hosts and using prevalence to isolate rare, per-host proxy traffic. It also monitors for specific research activity on the host itself\u2014an indicator of an attacker seeking technical context on their breach."
      }
    },
    {
      "id": "unresolved-vulnerabilities",
      "type": "query",
      "label": "Unresolved critical vulnerabilities",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT d.hostname AS device_hostname, v.cve_uid, v.severity_id FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid WHERE v.status = 'UNRESOLVED' AND v.severity_id >= 4",
        "surface": "hb_vulnerability_finding",
        "description": "Identify potential beachheads by listing hostnames with unresolved critical vulnerabilities.",
        "expected_signal": "A list of vulnerable hostnames. These systems are the primary targets for exploitation and subsequent proxy activity."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Unresolved critical vulnerabilities",
        "reads": [
          "device_uid",
          "cve_uid",
          "severity_id",
          "status"
        ],
        "source": "hb_vulnerability_finding",
        "target": "endpoint",
        "content": "SELECT DISTINCT d.hostname AS device_hostname, v.cve_uid, v.severity_id FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid WHERE v.status = 'UNRESOLVED' AND v.severity_id >= 4",
        "silence": "not_evidence_of_absence",
        "expected": "A list of vulnerable hostnames. These systems are the primary targets for exploitation and subsequent proxy activity.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "rare-proxy-egress",
      "type": "query",
      "label": "Rare egress on proxy ports",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "network",
        "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, COUNT(DISTINCT device_hostname) AS host_count FROM hb_network_connection WHERE (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND direction = 'outbound' AND instr(',' || '{{proxy_ports}}' || ',', ',' || CAST(dst_endpoint_port AS TEXT) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_ip, dst_endpoint_port HAVING host_count <= 3",
        "surface": "hb_network_connection",
        "description": "Find hosts connecting to common proxy ports where the destination is rare across the fleet, suggesting private C2 infrastructure.",
        "expected_signal": "Connections to proxy ports from a small subset of the vulnerable estate. Silence means no proxy-like egress was observed."
      },
      "parents": [
        {
          "id": "unresolved-vulnerabilities"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare egress on proxy ports",
        "reads": [
          "device_hostname",
          "process_name",
          "dst_endpoint_ip",
          "dst_endpoint_port",
          "direction",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, COUNT(DISTINCT device_hostname) AS host_count FROM hb_network_connection WHERE (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND direction = 'outbound' AND instr(',' || '{{proxy_ports}}' || ',', ',' || CAST(dst_endpoint_port AS TEXT) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_ip, dst_endpoint_port HAVING host_count <= 3",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Connections to proxy ports from a small subset of the vulnerable estate. Silence means no proxy-like egress was observed.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "dst_endpoint_ip",
            "dst_endpoint_port"
          ],
          "rare_below": 4
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "mitre-research-activity",
      "type": "query",
      "label": "MITRE research activity",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, user_agent, time FROM hb_http_activity WHERE (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND LOWER(url_hostname) LIKE '%mitre.org%' AND (instr(',' || '{{research_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0 OR LOWER(url_path) LIKE '%/definitions/%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Detect requests to specific CWE and CAPEC pages originating from the server, which may indicate an attacker using interactive tools on the host.",
        "expected_signal": "HTTP requests from internal servers to MITRE documentation. This logic assumes the adversary is performing live research or using automated tools that fetch context directly from the host."
      },
      "parents": [
        {
          "id": "unresolved-vulnerabilities"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "MITRE research activity",
        "reads": [
          "device_hostname",
          "url_hostname",
          "url_path",
          "user_agent",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, user_agent, time FROM hb_http_activity WHERE (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND LOWER(url_hostname) LIKE '%mitre.org%' AND (instr(',' || '{{research_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0 OR LOWER(url_path) LIKE '%/definitions/%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "HTTP requests from internal servers to MITRE documentation. This logic assumes the adversary is performing live research or using automated tools that fetch context directly from the host.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "triage-verdict",
      "type": "analytic",
      "label": "Triage verdict",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network",
          "web"
        ],
        "context": [
          "unresolved-vulnerabilities",
          "rare-proxy-egress",
          "mitre-research-activity"
        ],
        "objective": "Identify hosts that are vulnerable AND exhibit either rare proxy egress or unusual HTTP research activity.",
        "description": "Evaluate if the combined indicators suggest a successful exploitation and active proxy-based C2.",
        "max_iterations": 3,
        "expected_signal": "A per-host verdict identifying systems that are both vulnerable and exhibiting suspicious network activity.",
        "success_criteria": "Verdicts citing specific hosts and evidence rows."
      },
      "parents": [
        {
          "id": "rare-proxy-egress",
          "kind": "merge"
        },
        {
          "id": "mitre-research-activity",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-verdict",
      "type": "checkpoint",
      "label": "Route verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious for at least one host",
        "condition": "the triage verdict is malicious for at least one host",
        "blind_spot": "no-http-telemetry",
        "confidence": "high",
        "description": "Route to isolation if the agent finds evidence of compromise.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-verdict"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate host",
      "config": {
        "target": "endpoint",
        "description": "Contain the suspected breach by isolating the affected host.",
        "instructions": "Isolate the endpoint and revoke any service account sessions originating from it.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "investigate-process",
      "type": "task",
      "label": "Investigate process",
      "config": {
        "assignee": "analyst",
        "description": "Analyze the process responsible for the proxy connections.",
        "instructions": "Review hb_process_activity for the process_name identified in the proxy egress query. Check for suspicious parent processes and associated file activity."
      },
      "parents": [
        {
          "id": "route-verdict",
          "branch": "default"
        },
        {
          "id": "route-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "remediate-vulnerability",
      "type": "task",
      "label": "Remediate vulnerability",
      "config": {
        "assignee": "analyst",
        "description": "Coordinate patching of the identified vulnerabilities.",
        "instructions": "Coordinate with the infrastructure team to patch the affected packages identified in the scoping step. Verify the fix using a subsequent hb_vulnerability_finding read."
      },
      "parents": [
        {
          "id": "route-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "investigate-process"
        }
      ]
    }
  ]
}