{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Reduced staffing during holiday periods increases the time from detection to response. This hunt proactively identifies the most dangerous access paths and enables immediate containment to maintain resilience."
      },
      "name": "External Access and Proxy-Based Command and Control",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1090.003",
        "attack.t1190",
        "attack.t1566"
      ],
      "related": [
        {
          "hunt": "suspicious-cloud-access-holiday-anomalies",
          "reason": "This hunt focuses on endpoints and vulnerabilities; a sibling hunt is needed for anomalous cloud console logins.",
          "relation": "sibling"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "Standard rules fire on specific Tor domains or ngrok indicators. This hunt pivots across vulnerability exposure (surface 1), rare phishing-style execution (surface 2), and anomalous proxy port egress (surface 3) to find intrusions that individual rules miss.",
      "coverage": [
        {
          "stage": "initial-access-phishing",
          "steps": [
            "detect-phishing-patterns"
          ],
          "status": "covered"
        },
        {
          "stage": "initial-access-exploit-public-app",
          "steps": [
            "identify-vulnerabilities",
            "evaluate-risk"
          ],
          "status": "covered"
        },
        {
          "stage": "c2-multi-hop-proxy",
          "steps": [
            "detect-proxy-connections"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Initial Access via Phishing",
            "slug": "initial-access-phishing",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "phishing email",
              "malicious links",
              "email attachments",
              "social engineering",
              "OAuth spam"
            ]
          },
          {
            "name": "Exploitation of Public-Facing Application",
            "slug": "initial-access-exploit-public-app",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "critical vulnerability",
              "unpatched internet-facing host",
              "web server exploitation",
              "open sockets",
              "exposed OpenSLP services"
            ]
          },
          {
            "name": "Command and Control via Multi-hop Proxy",
            "slug": "c2-multi-hop-proxy",
            "tactic": "command-and-control",
            "techniques": [
              "T1090.003"
            ],
            "observables": [
              "Tor traffic",
              "onion routing",
              "multi-hop proxies",
              "operational relay box (ORB) networks",
              "C2 traffic obfuscation"
            ]
          }
        ],
        "summary": "Organizations face increased risk during periods of reduced staffing when capacity for incident response and change management is limited. Adversaries exploit these windows using phishing or vulnerability exploitation, often masking their presence with multi-hop proxies to complicate detection and eviction."
      },
      "severity": "medium",
      "rationale": "The lead query identifies any host with a critical vulnerability. The gate ensures that deep behavioral queries only run when the organization's current operational capacity necessitates proactive intervention on high-risk assets.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary exploits unpatched internet-facing vulnerabilities or phishes users to establish multi-hop proxy C2, banking on reduced holiday staffing to delay detection and response.",
      "parameters": {
        "proxy_ports": {
          "type": "list[string]",
          "default": [
            "1080",
            "3128",
            "8080",
            "9001",
            "9050",
            "9150"
          ],
          "description": "Common proxy and Tor bridge ports."
        },
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "List of hostnames to narrow behavioral queries."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "phishing_parents": {
          "type": "list[string]",
          "default": [
            "outlook.exe",
            "chrome.exe",
            "msedge.exe",
            "winword.exe",
            "excel.exe",
            "powerpnt.exe"
          ],
          "description": "Common parent processes for phishing delivery."
        },
        "interpreter_children": {
          "type": "list[string]",
          "default": [
            "powershell.exe",
            "cmd.exe",
            "mshta.exe",
            "cscript.exe",
            "wscript.exe",
            "scrcons.exe"
          ],
          "description": "Common interpreters spawned by phishing entry points."
        },
        "critical_severity_threshold": {
          "type": "number",
          "default": "4",
          "description": "Minimum severity_id (4=High, 5=Critical) to trigger the hunt."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.huntress.com/blog/operational-resilience-reduced-staffing-risks",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.huntress.com/blog/operational-resilience-reduced-staffing-risks",
          "name": "Operational Resilience: IT Security Risks with Reduced Staffing"
        }
      ],
      "blind_spots": [
        {
          "id": "vulnerability-scan-staleness",
          "risk": "A scan that failed recently would show old data, leading the lead query to miss new exposures.",
          "stage": "initial-access-exploit-public-app",
          "question": "Are the vulnerability findings current or did a recent scan fail?",
          "requires": "hb_vulnerability_finding last_seen"
        },
        {
          "id": "proxy-obfuscation",
          "risk": "Adversaries often use HTTPS for proxy traffic. This hunt focuses on explicit proxy ports; traffic on 443 remains a blind spot without TLS fingerprinting.",
          "stage": "c2-multi-hop-proxy",
          "question": "Is C2 traffic being hidden behind common ports like 443?",
          "requires": "hb_network_connection destination_hostname"
        }
      ]
    },
    "name": "External Access and Proxy-Based Command and Control",
    "description": "Adversaries exploit reduced staffing levels during holidays to conduct stealthy intrusions. This hunt identifies critical unpatched vulnerabilities and uses an agent to evaluate their impact on the organization's external attack surface. If exposure is confirmed, it fans out to look for behavioral indicators of phishing execution and multi-hop proxy connections (Tor/ORBs) that bypass standard detection rules. An agent weighs the combined risk of exposure and suspicious activity to identify hosts that require immediate isolation during periods of reduced operational capacity."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "initial-access-phishing",
            "steps": [
              "detect-phishing-patterns"
            ],
            "status": "covered"
          },
          {
            "stage": "initial-access-exploit-public-app",
            "steps": [
              "identify-vulnerabilities",
              "evaluate-risk"
            ],
            "status": "covered"
          },
          {
            "stage": "c2-multi-hop-proxy",
            "steps": [
              "detect-proxy-connections"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary exploits unpatched internet-facing vulnerabilities or phishes users to establish multi-hop proxy C2, banking on reduced holiday staffing to delay detection and response.",
        "blind_spots": [
          {
            "id": "vulnerability-scan-staleness",
            "risk": "A scan that failed recently would show old data, leading the lead query to miss new exposures.",
            "stage": "initial-access-exploit-public-app",
            "question": "Are the vulnerability findings current or did a recent scan fail?",
            "requires": "hb_vulnerability_finding last_seen"
          },
          {
            "id": "proxy-obfuscation",
            "risk": "Adversaries often use HTTPS for proxy traffic. This hunt focuses on explicit proxy ports; traffic on 443 remains a blind spot without TLS fingerprinting.",
            "stage": "c2-multi-hop-proxy",
            "question": "Is C2 traffic being hidden behind common ports like 443?",
            "requires": "hb_network_connection destination_hostname"
          }
        ],
        "scoping_notes": "The lead query identifies any host with a critical vulnerability. The gate ensures that deep behavioral queries only run when the organization's current operational capacity necessitates proactive intervention on high-risk assets.",
        "beyond_detection": "Standard rules fire on specific Tor domains or ngrok indicators. This hunt pivots across vulnerability exposure (surface 1), rare phishing-style execution (surface 2), and anomalous proxy port egress (surface 3) to find intrusions that individual rules miss."
      }
    },
    {
      "id": "identify-vulnerabilities",
      "type": "query",
      "label": "Identify critical vulnerabilities",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_uid, cve_uid, title, severity_id, affected_package_name, last_seen FROM hb_vulnerability_finding WHERE severity_id >= {{critical_severity_threshold}} AND status != 'suppressed' AND last_seen >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_vulnerability_finding",
        "description": "Identify active critical vulnerabilities that could serve as initial access points during reduced staffing periods.",
        "expected_signal": "A list of hostnames with unpatched critical flaws. Silence means no critical vulnerabilities were reported in the window."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify critical vulnerabilities",
        "reads": [
          "device_uid",
          "cve_uid",
          "title",
          "severity_id",
          "status",
          "last_seen"
        ],
        "source": "hb_vulnerability_finding",
        "target": "endpoint",
        "content": "SELECT device_uid, cve_uid, title, severity_id, affected_package_name, last_seen FROM hb_vulnerability_finding WHERE severity_id >= {{critical_severity_threshold}} AND status != 'suppressed' AND last_seen >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames with unpatched critical flaws. Silence means no critical vulnerabilities were reported in the window.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "evaluate-risk",
      "type": "analytic",
      "label": "Evaluate exposure and impact",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "identify-vulnerabilities"
        ],
        "objective": "Review the identified vulnerabilities and decide if they represent a high-risk exposure path (e.g. exploitable, internet-facing, or widely distributed) that justifies running behavioral checks.",
        "description": "Determine if the identified vulnerabilities warrant the expense of a behavioral hunt based on current organizational risk appetite.",
        "max_iterations": 3,
        "expected_signal": "A verdict on whether to proceed with deep behavioral analysis.",
        "success_criteria": "A clear recommendation to continue to behavior analysis or end the hunt."
      },
      "parents": [
        {
          "id": "identify-vulnerabilities"
        }
      ]
    },
    {
      "id": "gate-on-lead",
      "type": "checkpoint",
      "label": "Gate: Proceed to behavior?",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the evaluate-risk verdict identifies high-impact exposure or unmitigated critical vulnerabilities",
        "condition": "the evaluate-risk verdict identifies high-impact exposure or unmitigated critical vulnerabilities",
        "blind_spot": "vulnerability-scan-staleness",
        "confidence": "high",
        "description": "Halt the hunt if no high-risk exposure is identified, preserving analyst and agent resources.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "evaluate-risk"
        }
      ]
    },
    {
      "id": "detect-phishing-patterns",
      "type": "query",
      "label": "Detect phishing execution patterns",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{phishing_parents}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 AND instr(',' || '{{interpreter_children}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Find instances where common productivity apps spawn interpreters, indicating potential phishing execution.",
        "expected_signal": "A parent-child process match. Silence indicates no common phishing execution chains were detected."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Detect phishing execution patterns",
        "reads": [
          "device_hostname",
          "process_name",
          "process_cmd_line",
          "parent_process_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{phishing_parents}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 AND instr(',' || '{{interpreter_children}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A parent-child process match. Silence indicates no common phishing execution chains were detected.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "detect-proxy-connections",
      "type": "query",
      "label": "Detect anomalous proxy connections",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, COUNT(*) AS connections, MIN(time) AS first_seen FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id = 1 AND instr(',' || '{{proxy_ports}}' || ',', ',' || CAST(dst_endpoint_port AS TEXT) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3 HAVING connections < 50",
        "surface": "hb_network_connection",
        "description": "Identify hosts connecting to common proxy or Tor infrastructure, which may indicate multi-hop C2.",
        "expected_signal": "Rare connections to proxy-associated ports. Silence means no direct proxy traffic was observed on those ports."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Detect anomalous proxy connections",
        "reads": [
          "device_hostname",
          "dst_endpoint_ip",
          "dst_endpoint_port",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, COUNT(*) AS connections, MIN(time) AS first_seen FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id = 1 AND instr(',' || '{{proxy_ports}}' || ',', ',' || CAST(dst_endpoint_port AS TEXT) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3 HAVING connections < 50",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Rare connections to proxy-associated ports. Silence means no direct proxy traffic was observed on those ports.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "dst_endpoint_ip",
            "dst_endpoint_port"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "triage-intrusion",
      "type": "analytic",
      "label": "Triage intrusion risk",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "evaluate-risk",
          "detect-phishing-patterns",
          "detect-proxy-connections"
        ],
        "objective": "Determine if any host with a critical vulnerability is also showing signs of phishing execution or multi-hop proxy C2. Use the first agent's assessment of exposure to weight the behavioral findings.",
        "description": "Correlate exposure risk with behavioral evidence to identify confirmed threats requiring immediate response.",
        "max_iterations": 5,
        "expected_signal": "A per-host verdict of malicious, suspicious, or benign.",
        "success_criteria": "A per-host verdict citing specific rows from the process and network surfaces."
      },
      "parents": [
        {
          "id": "detect-phishing-patterns",
          "kind": "merge"
        },
        {
          "id": "detect-proxy-connections",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-response",
      "type": "checkpoint",
      "label": "Route response",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage-intrusion verdict is malicious for at least one host",
        "condition": "the triage-intrusion verdict is malicious for at least one host",
        "blind_spot": "proxy-obfuscation",
        "confidence": "high",
        "description": "Automatically isolate high-confidence threats to mitigate impact during reduced staffing periods.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-intrusion"
        }
      ]
    },
    {
      "id": "isolate-endpoint",
      "type": "action",
      "label": "Isolate endpoint",
      "config": {
        "target": "endpoint",
        "description": "Neutralize the threat immediately when the security team is at reduced capacity.",
        "instructions": "Isolate the host to prevent lateral movement and further C2 communication while the analyst completes the investigation.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-response",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst review",
      "config": {
        "assignee": "analyst",
        "description": "Manually validate suspicious findings and confirm isolation actions.",
        "instructions": "Review the agent triage findings; prioritize hosts where critical vulnerabilities intersect with rare behavioral alerts. Confirm or revert isolation actions."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "default"
        },
        {
          "id": "gate-on-lead",
          "branch": "on_unavailable"
        },
        {
          "id": "route-response",
          "branch": "default"
        },
        {
          "id": "route-response",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-endpoint"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Finalize the hunt and record exposure findings for patching.",
        "instructions": "Document findings, update the risk profile for the remaining holiday period, and ensure vulnerable hosts identified in the lead are scheduled for patching."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "on_refutes"
        },
        {
          "id": "route-response",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-review"
        }
      ]
    }
  ]
}