{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Exploitation of core runtimes like Node.js and kernel-level vulnerabilities represents a high-impact risk for initial access and privilege escalation; a negative result over the estate confirms security baseline integrity."
      },
      "name": "Exploitation of Core Services and Kernel Vulnerabilities",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1068",
        "initial access",
        "privilege escalation"
      ],
      "related": [
        {
          "hunt": "container-escape-via-kernel-vulnerability",
          "reason": "While this hunt looks for kernel rhashtable errors, a dedicated escape hunt would focus on process activity crossing namespace boundaries.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "This hunt pivots from software inventory to three distinct telemetry surfaces (HTTP, Network, Syslog), using stack-counting to identify rare behavioral anomalies that a single rule on a CVE finding or a generic kernel panic would miss.",
      "coverage": [
        {
          "stage": "initial-access-exploit-public-application",
          "steps": [
            "vulnerable-software-scoping",
            "scanner-confirmed-vulnerabilities",
            "nodejs-http-instability",
            "libcurl-network-anomalies"
          ],
          "status": "covered"
        },
        {
          "stage": "privilege-escalation-linux-kernel-exploit",
          "steps": [
            "vulnerable-software-scoping",
            "scanner-confirmed-vulnerabilities",
            "kernel-log-anomalies"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Exploitation of Public-Facing Application",
            "slug": "initial-access-exploit-public-application",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "CVE-2026-56848 (Node.js heap-use-after-free via HTTP/2)",
              "CVE-2026-9545 (curl SSL session reuse with impostor host)",
              "CVE-2026-13608 (curl)",
              "Node.js versions 22.x, 24.x, and 26.x",
              "curl",
              "llama.cpp",
              "vLLM",
              "HTTP/2 traffic triggering nghttp2_session_mem_send re-entrancy"
            ]
          },
          {
            "name": "Linux Kernel Privilege Escalation",
            "slug": "privilege-escalation-linux-kernel-exploit",
            "tactic": "privilege-escalation",
            "techniques": [
              "T1068"
            ],
            "observables": [
              "CVE-2026-64563 (Linux kernel rhashtable stale pointer dereference)",
              "rhashtable_walk_start_check restart path",
              "rhashtable_walk_next stale pointer dereference",
              "Linux kernel panic or rhashtable error messages"
            ]
          }
        ],
        "summary": "Microsoft's FORGE Lab identified and helped remediate multiple critical vulnerabilities in the Linux kernel and open-source runtimes like Node.js and curl using AI-driven agentic discovery. These flaws, including a heap-use-after-free in Node.js (CVE-2026-56848) and a stale pointer dereference in the Linux kernel (CVE-2026-64563), allow for initial access via web exploitation and subsequent local privilege escalation."
      },
      "severity": "high",
      "rationale": "Focus on internet-facing Linux servers and application clusters where Node.js is the primary runtime. Developer workstations running llama.cpp or heavy curl automation should also be included in the scope.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An attacker is exploiting vulnerabilities in Node.js HTTP/2 (CVE-2026-56848) or the Linux kernel rhashtable (CVE-2026-64563) to gain initial access or elevate privileges, as evidenced by service instability or specific kernel errors.",
      "parameters": {
        "cve_ids": {
          "from": {
            "ref": "msrc-blog-2026-10-07",
            "kind": "article",
            "observed": "2026-10-07"
          },
          "type": "list[string]",
          "default": [
            "CVE-2026-56848",
            "CVE-2026-64563",
            "CVE-2026-9545",
            "CVE-2026-13608"
          ],
          "description": "CVE identifiers associated with the research."
        },
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "List of hostnames to focus the hunt on, typically populated from the scoping result."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine for behavioral logs."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.microsoft.com/en-us/security/blog/2026/10/07/3-lessons-from-frontier-ai-vulnerability-research/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.microsoft.com/en-us/security/blog/2026/10/07/3-lessons-from-frontier-ai-vulnerability-research/",
          "name": "Microsoft Security Blog: 3 lessons from frontier AI vulnerability research"
        }
      ],
      "blind_spots": [
        {
          "id": "no-kernel-log-visibility",
          "risk": "A host that does not forward kernel logs will show silence even if exploited, leading to a false negative.",
          "owner": "Infrastructure Team",
          "stage": "privilege-escalation-linux-kernel-exploit",
          "question": "Can we see rhashtable errors on all Linux hosts?",
          "requires": "hb_syslog with kernel facility",
          "remediation": "Enable kernel logging and rsyslog forwarding for all production Kubernetes nodes."
        },
        {
          "id": "tls-termination-blindness",
          "risk": "If the proxy handles errors or masks them, we lose the primary signal of heap-use-after-free exploitation.",
          "owner": "WAF Team",
          "stage": "initial-access-exploit-public-application",
          "question": "Does the reverse proxy log 5xx errors from the backend Node.js app?",
          "requires": "hb_http_activity with status codes",
          "remediation": "Ensure back-end server status codes are preserved in the proxy access logs."
        }
      ]
    },
    "name": "Exploitation of Core Services and Kernel Vulnerabilities",
    "description": "This hunt targets critical vulnerabilities discovered by Microsoft FORGE Lab affecting core application runtimes and the Linux kernel. The flow identifies hosts running vulnerable versions of Node.js (specifically major versions 22, 24, and 26) and curl, then corroborates this inventory against known vulnerability findings, server-side HTTP instability, client-side network anomalies from libcurl, and specific kernel log patterns indicative of exploitation. An agent weighs these independent signals to identify confirmed compromises."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "initial-access-exploit-public-application",
            "steps": [
              "vulnerable-software-scoping",
              "scanner-confirmed-vulnerabilities",
              "nodejs-http-instability",
              "libcurl-network-anomalies"
            ],
            "status": "covered"
          },
          {
            "stage": "privilege-escalation-linux-kernel-exploit",
            "steps": [
              "vulnerable-software-scoping",
              "scanner-confirmed-vulnerabilities",
              "kernel-log-anomalies"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An attacker is exploiting vulnerabilities in Node.js HTTP/2 (CVE-2026-56848) or the Linux kernel rhashtable (CVE-2026-64563) to gain initial access or elevate privileges, as evidenced by service instability or specific kernel errors.",
        "blind_spots": [
          {
            "id": "no-kernel-log-visibility",
            "risk": "A host that does not forward kernel logs will show silence even if exploited, leading to a false negative.",
            "owner": "Infrastructure Team",
            "stage": "privilege-escalation-linux-kernel-exploit",
            "question": "Can we see rhashtable errors on all Linux hosts?",
            "requires": "hb_syslog with kernel facility",
            "remediation": "Enable kernel logging and rsyslog forwarding for all production Kubernetes nodes."
          },
          {
            "id": "tls-termination-blindness",
            "risk": "If the proxy handles errors or masks them, we lose the primary signal of heap-use-after-free exploitation.",
            "owner": "WAF Team",
            "stage": "initial-access-exploit-public-application",
            "question": "Does the reverse proxy log 5xx errors from the backend Node.js app?",
            "requires": "hb_http_activity with status codes",
            "remediation": "Ensure back-end server status codes are preserved in the proxy access logs."
          }
        ],
        "scoping_notes": "Focus on internet-facing Linux servers and application clusters where Node.js is the primary runtime. Developer workstations running llama.cpp or heavy curl automation should also be included in the scope.",
        "beyond_detection": "This hunt pivots from software inventory to three distinct telemetry surfaces (HTTP, Network, Syslog), using stack-counting to identify rare behavioral anomalies that a single rule on a CVE finding or a generic kernel panic would miss."
      }
    },
    {
      "id": "vulnerable-software-scoping",
      "type": "query",
      "label": "Scoping vulnerable Node.js and curl versions",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE ( (LOWER(package_name) IN ('node', 'nodejs') AND (package_version LIKE '22.%' OR package_version LIKE '24.%' OR package_version LIKE '26.%')) OR (LOWER(package_name) IN ('curl', 'libcurl', 'llama.cpp')) )",
        "surface": "hb_software_inventory",
        "description": "Identify hosts running Node.js versions 22.x, 24.x, or 26.x and libcurl to narrow the behavioral search.",
        "expected_signal": "A list of hosts running vulnerable versions of Node.js or curl. Silence means no such software is inventoried."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Scoping vulnerable Node.js and curl versions",
        "reads": [
          "device_hostname",
          "package_name",
          "package_version"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE ( (LOWER(package_name) IN ('node', 'nodejs') AND (package_version LIKE '22.%' OR package_version LIKE '24.%' OR package_version LIKE '26.%')) OR (LOWER(package_name) IN ('curl', 'libcurl', 'llama.cpp')) )",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hosts running vulnerable versions of Node.js or curl. Silence means no such software is inventoried.",
        "verified": "dry-run",
        "verified_at": "2026-10-08"
      }
    },
    {
      "id": "scanner-confirmed-vulnerabilities",
      "type": "query",
      "label": "Existing vulnerability findings",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_uid, resource_uid, cve_uid, severity, first_seen FROM hb_vulnerability_finding WHERE instr(',' || '{{cve_ids}}' || ',', ',' || cve_uid || ',') > 0 AND status != 'suppressed'",
        "surface": "hb_vulnerability_finding",
        "description": "Prioritize hosts where scanners have already flagged the specific CVEs named in the research.",
        "expected_signal": "Confirmed findings for the target CVEs. This provides a high-confidence starting point for the behavioral triage."
      },
      "parents": [
        {
          "id": "vulnerable-software-scoping"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Existing vulnerability findings",
        "reads": [
          "device_uid",
          "resource_uid",
          "cve_uid",
          "severity",
          "first_seen"
        ],
        "source": "hb_vulnerability_finding",
        "target": "endpoint",
        "content": "SELECT device_uid, resource_uid, cve_uid, severity, first_seen FROM hb_vulnerability_finding WHERE instr(',' || '{{cve_ids}}' || ',', ',' || cve_uid || ',') > 0 AND status != 'suppressed'",
        "silence": "not_evidence_of_absence",
        "expected": "Confirmed findings for the target CVEs. This provides a high-confidence starting point for the behavioral triage.",
        "verified": "dry-run",
        "verified_at": "2026-10-08"
      }
    },
    {
      "id": "nodejs-http-instability",
      "type": "query",
      "label": "Node.js server-side errors",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "web",
        "content": "SELECT device_hostname, url_path, status_code, user_agent, COUNT(*) AS error_count FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND status_code >= 500 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_path, status_code, user_agent",
        "surface": "hb_http_activity",
        "description": "Identify potential heap-use-after-free exploitation in Node.js causing application-level crashes (5xx errors).",
        "expected_signal": "Spikes in 500 errors on systems identified as running vulnerable Node.js versions."
      },
      "parents": [
        {
          "id": "vulnerable-software-scoping"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Node.js server-side errors",
        "reads": [
          "device_hostname",
          "url_path",
          "status_code",
          "user_agent",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_path, status_code, user_agent, COUNT(*) AS error_count FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND status_code >= 500 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_path, status_code, user_agent",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Spikes in 500 errors on systems identified as running vulnerable Node.js versions.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "url_path",
            "status_code"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-08"
      }
    },
    {
      "id": "libcurl-network-anomalies",
      "type": "query",
      "label": "Libcurl outbound anomalies",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "network",
        "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, COUNT(*) AS connection_count FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_name) LIKE '%curl%' OR LOWER(process_name) LIKE '%llama.cpp%') AND direction = 'outbound' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port",
        "surface": "hb_network_connection",
        "description": "Monitor for libcurl processes communicating with rare external hosts, potentially indicating session reuse exploitation.",
        "expected_signal": "Outbound connections from curl-related processes to rare destination IPs not seen elsewhere in the fleet."
      },
      "parents": [
        {
          "id": "vulnerable-software-scoping"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Libcurl outbound anomalies",
        "reads": [
          "device_hostname",
          "process_name",
          "dst_endpoint_ip",
          "dst_endpoint_port",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, COUNT(*) AS connection_count FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_name) LIKE '%curl%' OR LOWER(process_name) LIKE '%llama.cpp%') AND direction = 'outbound' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "new_this_window"
        },
        "expected": "Outbound connections from curl-related processes to rare destination IPs not seen elsewhere in the fleet.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "dst_endpoint_ip"
          ],
          "rare_below": 2
        },
        "verified_at": "2026-10-08"
      }
    },
    {
      "id": "kernel-log-anomalies",
      "type": "query",
      "label": "Kernel rhashtable errors",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, syslog_tag, message, time FROM hb_syslog WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(message) LIKE '%rhashtable_walk_next%' OR LOWER(message) LIKE '%stale pointer%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_syslog",
        "description": "Find specific kernel error strings related to the rhashtable stale pointer dereference (CVE-2026-64563).",
        "expected_signal": "Syslog entries capturing kernel crashes or errors mentioning rhashtable functions. Absence means no such errors were logged."
      },
      "parents": [
        {
          "id": "vulnerable-software-scoping"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Kernel rhashtable errors",
        "reads": [
          "device_hostname",
          "syslog_tag",
          "message",
          "time"
        ],
        "source": "hb_syslog",
        "target": "endpoint",
        "content": "SELECT device_hostname, syslog_tag, message, time FROM hb_syslog WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(message) LIKE '%rhashtable_walk_next%' OR LOWER(message) LIKE '%stale pointer%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Syslog entries capturing kernel crashes or errors mentioning rhashtable functions. Absence means no such errors were logged.",
        "verified": "dry-run",
        "verified_at": "2026-10-08"
      }
    },
    {
      "id": "triage-evidence",
      "type": "analytic",
      "label": "Correlate exploitation signals",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network",
          "web"
        ],
        "context": [
          "vulnerable-software-scoping",
          "scanner-confirmed-vulnerabilities",
          "nodejs-http-instability",
          "libcurl-network-anomalies",
          "kernel-log-anomalies"
        ],
        "objective": "Determine if any host shows evidence of active exploitation of the Node.js or Linux kernel vulnerabilities based on the correlated evidence.",
        "description": "Synthesize the vulnerable software inventory, scanner findings, and log anomalies to determine exploitation.",
        "max_iterations": 6,
        "expected_signal": "A verdict of 'compromised' for hosts showing both vulnerable software and matching behavioral anomalies.",
        "success_criteria": "A per-host verdict of malicious, suspicious, or benign citing specific log rows and software versions."
      },
      "parents": [
        {
          "id": "scanner-confirmed-vulnerabilities",
          "kind": "merge"
        },
        {
          "id": "nodejs-http-instability",
          "kind": "merge"
        },
        {
          "id": "libcurl-network-anomalies",
          "kind": "merge"
        },
        {
          "id": "kernel-log-anomalies",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "routing-decision",
      "type": "checkpoint",
      "label": "Route on triage verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "The triage-evidence verdict is malicious for at least one host",
        "condition": "The triage-evidence verdict is malicious for at least one host",
        "blind_spot": "no-kernel-log-visibility",
        "confidence": "high",
        "description": "Route to containment for malicious verdicts or further analyst review for suspicious findings.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-evidence"
        }
      ]
    },
    {
      "id": "contain-and-isolate",
      "type": "action",
      "label": "Isolate host and revoke credentials",
      "config": {
        "target": "endpoint",
        "description": "Prevent lateral movement and further exploitation once compromise is identified.",
        "instructions": "Isolate the identified host from the network and revoke any application-level API tokens used by the vulnerable service.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "routing-decision",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-manual-review",
      "type": "task",
      "label": "Analyst manual review",
      "config": {
        "assignee": "analyst",
        "description": "Verify suspicious findings and confirm the root cause of service instability.",
        "instructions": "Review the hb_syslog and hb_http_activity rows; for Node.js findings, check for repetitive patterns in the url_path that might indicate an exploit payload."
      },
      "parents": [
        {
          "id": "routing-decision",
          "branch": "default"
        },
        {
          "id": "routing-decision",
          "branch": "on_unavailable"
        },
        {
          "id": "contain-and-isolate"
        }
      ]
    },
    {
      "id": "close-out-benign",
      "type": "task",
      "label": "Close out hunt",
      "config": {
        "assignee": "analyst",
        "description": "Record results and update the patching queue for vulnerable assets.",
        "instructions": "Document any identified vulnerable systems that were not compromised and ensure they are prioritized for patching Node.js and the Linux kernel."
      },
      "parents": [
        {
          "id": "routing-decision",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-manual-review"
        }
      ]
    }
  ]
}