{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "The collapsing patch window creates a period of elevated risk where static rules are insufficient; hunting for behavioral indicators of exploitation on vulnerable assets provides a necessary adaptive control."
      },
      "name": "Exploitation and Obfuscated C2 in the Patch Window",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1090.003"
      ],
      "related": [
        {
          "hunt": "container-vulnerability-exploitation",
          "reason": "This hunt focuses on traditional web servers; containers require distinct logic on hb_software_inventory.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A static rule for web shells is prone to noise from administrative activity. This hunt adds the context of a confirmed vulnerable state and stack-counts outbound proxy traffic to isolate rare C2 patterns that simple rules miss.",
      "coverage": [
        {
          "stage": "initial-access-vulnerability-exploitation",
          "steps": [
            "vulnerable-internet-assets"
          ],
          "status": "covered"
        },
        {
          "stage": "execution-post-exploitation",
          "steps": [
            "web-shell-execution"
          ],
          "status": "covered"
        },
        {
          "stage": "c2-multi-hop-obfuscation",
          "steps": [
            "proxy-traffic-prevalence"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Exploitation of Public-Facing Applications",
            "slug": "initial-access-vulnerability-exploitation",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "HTTP requests targeting specific disclosed CVEs",
              "Anomalous HTTP/2 connection patterns (concurrent stream limits, request constraints)",
              "Automated vulnerability scanning from external IP addresses",
              "Rapid exploitation following public PoC disclosure"
            ]
          },
          {
            "name": "Post-Exploit Execution",
            "slug": "execution-post-exploitation",
            "tactic": "execution",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "Web server processes (e.g., w3wp.exe, httpd) spawning shell processes (cmd.exe, bash)",
              "In-memory execution or fileless code delivery",
              "Process spawning with unexpected integrity levels"
            ]
          },
          {
            "name": "Multi-hop Proxy C2",
            "slug": "c2-multi-hop-obfuscation",
            "tactic": "command-and-control",
            "techniques": [
              "T1090.003"
            ],
            "observables": [
              "Outbound connections to Tor exit nodes",
              "Communication with Operational Relay Box (ORB) networks",
              "DNS lookups for .onion or proxy-related domains",
              "Encrypted C2 traffic traversing multiple proxy layers"
            ]
          }
        ],
        "summary": "Adversaries leverage the shrinking window between vulnerability disclosure and patch deployment to exploit public-facing applications at internet scale. These campaigns often involve rapid, AI-assisted weaponization followed by command-and-control traffic routed through multi-hop proxies like Tor or ORB networks to obfuscate the origin of the attack."
      },
      "severity": "medium",
      "rationale": "Start with internet-facing assets identified by vulnerability scans. Priority is given to high-severity findings where an exploit is known to be available.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has exploited a critical vulnerability in a public-facing web application during the window before patching and is using a multi-hop proxy to mask command-and-control traffic.",
      "parameters": {
        "proxy_ports": {
          "from": {
            "ref": "T1090.003 common ports",
            "kind": "article",
            "observed": "2024-05-22"
          },
          "type": "list[string]",
          "default": [
            "9001",
            "9050",
            "1080",
            "8080"
          ],
          "description": "Ports commonly used by Tor or multi-hop proxy networks."
        },
        "scope_hosts": {
          "from": {
            "ref": "Analyst input from lead step",
            "kind": "manual",
            "observed": "2024-05-22"
          },
          "type": "list[host]",
          "default": [],
          "description": "Hostnames identified in the lead step; populate this to run behavioral queries on a specific scope."
        },
        "lookback_days": {
          "from": {
            "ref": "Default setting",
            "kind": "manual",
            "observed": "2024-05-22"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine for behavioral signals."
        },
        "shell_processes": {
          "from": {
            "ref": "Standard T1190 artifacts",
            "kind": "article",
            "observed": "2024-05-22"
          },
          "type": "list[string]",
          "default": [
            "cmd.exe",
            "powershell.exe",
            "sh",
            "bash",
            "zsh"
          ],
          "description": "Common shell binaries spawned by exploited web processes."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://azure.microsoft.com/en-us/blog/the-patch-window-is-collapsing-why-security-needs-a-new-control-plane/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://azure.microsoft.com/en-us/blog/the-patch-window-is-collapsing-why-security-needs-a-new-control-plane/",
          "name": "MSRC Blog: The patch window is collapsing"
        }
      ],
      "blind_spots": [
        {
          "id": "vulnerability-data-staleness",
          "risk": "The hunt might target systems already remediated but not yet updated in the inventory.",
          "stage": "initial-access-vulnerability-exploitation",
          "question": "whether the vulnerability finding is current or represents a previously patched state",
          "requires": "Real-time vulnerability scanning"
        },
        {
          "id": "proxy-port-ambiguity",
          "risk": "Common ports like 8080 are frequently used for both proxies and legitimate internal services, creating false positives.",
          "stage": "c2-multi-hop-obfuscation",
          "question": "whether traffic on proxy ports is legitimate administrative traffic or multi-hop C2",
          "requires": "Application layer protocol identification"
        }
      ]
    },
    "name": "Exploitation and Obfuscated C2 in the Patch Window",
    "description": "As the time between vulnerability disclosure and weaponization collapses, organizations face elevated risk during the remediation gap. This gated hunt first identifies internet-exposed systems with high-severity exploitable vulnerabilities. If the exposure is confirmed, the hunt fans out to identify behavioral artifacts: web server processes spawning command shells and rare outbound connections to proxy infrastructure. An agent then triages these signals together to identify active intrusions that bypassed initial network controls."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "initial-access-vulnerability-exploitation",
            "steps": [
              "vulnerable-internet-assets"
            ],
            "status": "covered"
          },
          {
            "stage": "execution-post-exploitation",
            "steps": [
              "web-shell-execution"
            ],
            "status": "covered"
          },
          {
            "stage": "c2-multi-hop-obfuscation",
            "steps": [
              "proxy-traffic-prevalence"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary has exploited a critical vulnerability in a public-facing web application during the window before patching and is using a multi-hop proxy to mask command-and-control traffic.",
        "blind_spots": [
          {
            "id": "vulnerability-data-staleness",
            "risk": "The hunt might target systems already remediated but not yet updated in the inventory.",
            "stage": "initial-access-vulnerability-exploitation",
            "question": "whether the vulnerability finding is current or represents a previously patched state",
            "requires": "Real-time vulnerability scanning"
          },
          {
            "id": "proxy-port-ambiguity",
            "risk": "Common ports like 8080 are frequently used for both proxies and legitimate internal services, creating false positives.",
            "stage": "c2-multi-hop-obfuscation",
            "question": "whether traffic on proxy ports is legitimate administrative traffic or multi-hop C2",
            "requires": "Application layer protocol identification"
          }
        ],
        "scoping_notes": "Start with internet-facing assets identified by vulnerability scans. Priority is given to high-severity findings where an exploit is known to be available.",
        "beyond_detection": "A static rule for web shells is prone to noise from administrative activity. This hunt adds the context of a confirmed vulnerable state and stack-counts outbound proxy traffic to isolate rare C2 patterns that simple rules miss."
      }
    },
    {
      "id": "vulnerable-internet-assets",
      "type": "query",
      "label": "Identify exploitable internet-facing assets",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT d.hostname AS device_hostname, v.cve_uid, v.severity, v.affected_package_name FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid WHERE v.severity_id >= 4 AND v.is_exploit_available = 'TRUE' AND v.status != 'suppressed'",
        "surface": "hb_vulnerability_finding",
        "description": "Find systems with critical vulnerabilities where an exploit is known to be available, providing the lead for behavioral analysis.",
        "expected_signal": "A list of hostnames and their critical CVEs. Silence suggests no current high-risk exploitable surface in the vulnerability inventory."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify exploitable internet-facing assets",
        "reads": [
          "device_uid",
          "cve_uid",
          "severity",
          "severity_id",
          "is_exploit_available",
          "status",
          "hostname"
        ],
        "source": "hb_vulnerability_finding",
        "target": "endpoint",
        "content": "SELECT DISTINCT d.hostname AS device_hostname, v.cve_uid, v.severity, v.affected_package_name FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid WHERE v.severity_id >= 4 AND v.is_exploit_available = 'TRUE' AND v.status != 'suppressed'",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames and their critical CVEs. Silence suggests no current high-risk exploitable surface in the vulnerability inventory.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "assess-exposure",
      "type": "analytic",
      "label": "Assess exposure risk",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "vulnerable-internet-assets"
        ],
        "objective": "Determine if any discovered vulnerability on internet-facing hosts represents an immediate risk that warrants behavioral monitoring.",
        "description": "Evaluate whether the scoped vulnerabilities represent a critical enough risk to proceed with expensive behavioral queries.",
        "max_iterations": 3,
        "expected_signal": "A summary of high-risk assets and a decision to proceed or stop.",
        "success_criteria": "A verdict citing specific vulnerable hosts that require follow-up."
      },
      "parents": [
        {
          "id": "vulnerable-internet-assets"
        }
      ]
    },
    {
      "id": "gate-on-exposure",
      "type": "checkpoint",
      "label": "Gate on identified risk",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the assess-exposure verdict confirms at least one high-risk vulnerable host is present",
        "condition": "the assess-exposure verdict confirms at least one high-risk vulnerable host is present",
        "blind_spot": "vulnerability-data-staleness",
        "confidence": "high",
        "description": "Ensure expensive behavioral queries are only run when critical exposure is confirmed.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "assess-exposure"
        }
      ]
    },
    {
      "id": "web-shell-execution",
      "type": "query",
      "label": "Web server shell spawning",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%w3wp.exe' OR LOWER(parent_process_name) LIKE '%httpd' OR LOWER(parent_process_name) LIKE '%nginx' OR LOWER(parent_process_name) LIKE '%apache2') AND (instr(',' || '{{shell_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{shell_processes}}' || ',', ',' || replace(LOWER(process_name), rtrim(LOWER(process_name), replace(LOWER(process_name), '\\', '')), '') || ',') > 0 OR instr(',' || '{{shell_processes}}' || ',', ',' || replace(LOWER(process_name), rtrim(LOWER(process_name), replace(LOWER(process_name), '/', '')), '') || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Identify web server processes spawning interactive shells, a hallmark of successful T1190 exploitation.",
        "expected_signal": "A web server (w3wp, nginx, apache) spawning a shell process. This is high-confidence evidence of exploitation."
      },
      "parents": [
        {
          "id": "gate-on-exposure",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Web server shell spawning",
        "reads": [
          "device_hostname",
          "process_name",
          "process_cmd_line",
          "parent_process_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%w3wp.exe' OR LOWER(parent_process_name) LIKE '%httpd' OR LOWER(parent_process_name) LIKE '%nginx' OR LOWER(parent_process_name) LIKE '%apache2') AND (instr(',' || '{{shell_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{shell_processes}}' || ',', ',' || replace(LOWER(process_name), rtrim(LOWER(process_name), replace(LOWER(process_name), '\\', '')), '') || ',') > 0 OR instr(',' || '{{shell_processes}}' || ',', ',' || replace(LOWER(process_name), rtrim(LOWER(process_name), replace(LOWER(process_name), '/', '')), '') || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A web server (w3wp, nginx, apache) spawning a shell process. This is high-confidence evidence of exploitation.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "proxy-traffic-prevalence",
      "type": "query",
      "label": "Rare outbound proxy connections",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "network",
        "content": "SELECT dst_endpoint_ip, dst_endpoint_port, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_network_connection WHERE instr(',' || '{{proxy_ports}}' || ',', ',' || CAST(dst_endpoint_port AS TEXT) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_ip, dst_endpoint_port HAVING host_count <= 3",
        "surface": "hb_network_connection",
        "description": "Find rare outbound connections to proxy or ORB ports from the scoped vulnerable hosts.",
        "expected_signal": "Proxy ports reached by a small number of hosts in the scoped environment. Silence suggests no obvious multi-hop C2 via standard proxy ports."
      },
      "parents": [
        {
          "id": "gate-on-exposure",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare outbound proxy connections",
        "reads": [
          "dst_endpoint_ip",
          "dst_endpoint_port",
          "device_hostname",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT dst_endpoint_ip, dst_endpoint_port, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_network_connection WHERE instr(',' || '{{proxy_ports}}' || ',', ',' || CAST(dst_endpoint_port AS TEXT) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_ip, dst_endpoint_port HAVING host_count <= 3",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Proxy ports reached by a small number of hosts in the scoped environment. Silence suggests no obvious multi-hop C2 via standard proxy ports.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "dst_endpoint_ip",
            "dst_endpoint_port"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "triage-behavior",
      "type": "analytic",
      "label": "Triage behavior and exposure",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "assess-exposure",
          "web-shell-execution",
          "proxy-traffic-prevalence"
        ],
        "objective": "Determine if any host shows evidence of post-exploitation execution or rare outbound proxy communication within the context of known vulnerabilities.",
        "description": "Correlate the vulnerability context with process and network signals to identify confirmed intrusions.",
        "max_iterations": 5,
        "expected_signal": "A per-host verdict citing evidence of exploitation or C2.",
        "success_criteria": "A per-host verdict (malicious | suspicious | benign) citing specific process or network rows."
      },
      "parents": [
        {
          "id": "web-shell-execution",
          "kind": "merge"
        },
        {
          "id": "proxy-traffic-prevalence",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route based on behavioral triage",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage-behavior verdict is malicious for at least one host",
        "condition": "the triage-behavior verdict is malicious for at least one host",
        "blind_spot": "proxy-port-ambiguity",
        "confidence": "high",
        "description": "Direct the hunt to containment if malicious behavior is confirmed, or to manual review otherwise.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-behavior"
        }
      ]
    },
    {
      "id": "isolate-and-remediate",
      "type": "action",
      "label": "Isolate compromised web server",
      "config": {
        "target": "endpoint",
        "description": "Immediately contain the host showing evidence of exploitation to prevent lateral movement.",
        "instructions": "Isolate the identified host using the endpoint agent. Collect process memory and web server logs for forensic analysis before patching.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "manual-review",
      "type": "task",
      "label": "Manual forensic review",
      "config": {
        "assignee": "analyst",
        "description": "Review the context of suspicious alerts to confirm or tune the behavioral queries.",
        "instructions": "Examine the command lines of spawned shells. Verify if outbound proxy connections are related to administrative tools or known C2 frameworks."
      },
      "parents": [
        {
          "id": "gate-on-exposure",
          "branch": "default"
        },
        {
          "id": "gate-on-exposure",
          "branch": "on_unavailable"
        },
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "isolate-and-remediate"
        }
      ]
    },
    {
      "id": "no-exposure-close-out",
      "type": "task",
      "label": "Close out: No critical exposure",
      "config": {
        "assignee": "analyst",
        "description": "Document that no critical exploitable vulnerability was found on internet-facing assets.",
        "instructions": "Record the negative result. Note that while no exploitable vulnerabilities were identified today, the patch window remains a critical gap for future disclosures."
      },
      "parents": [
        {
          "id": "gate-on-exposure",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}