{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Identity-led breaches, such as the 2024 Snowflake intrusions, bypass traditional perimeters. This hunt provides the business with the assurance that its employee credentials are not currently available in the criminal 'stealer' economy, or identifies them for immediate rotation if they are."
      },
      "name": "External Identity Exposure and Credential Leaks",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1555",
        "attack.t1195",
        "attack.t1133",
        "attack.t1078.004",
        "credential access",
        "impact",
        "initial access",
        "lateral movement",
        "hudsonrock"
      ],
      "series": {
        "slug": "introducing-sekoia-digital-risk-track-identity-led-breaches",
        "index": 1,
        "title": "Introducing Sekoia Digital Risk: Track Identity-Led Breaches",
        "total": 2
      },
      "related": [
        {
          "hunt": "identity-led-initial-access-detection",
          "reason": "This hunt identifies the exposure; the follow-on hunt monitors for the actual login attempt and initial cloud enumeration.",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        },
        "hudsonrock": {
          "name": "hudsonrock",
          "category": "siem",
          "huntbase": {
            "product": "hudsonrock"
          }
        }
      },
      "analysis": "A rule fires on a known bad IP; the hunt finds the 'unlocked doors'\u2014valid credentials already in circulation\u2014by correlating external exposure telemetry with a behavioral baseline of host sign-ins. An analyst weighs whether a rare login source matches an identity compromise reported in criminal markets.",
      "coverage": [
        {
          "stage": "infostealer-credential-harvesting",
          "steps": [
            "find-active-corporate-hosts",
            "rare-authentication-patterns",
            "domain-exposure-lookup"
          ],
          "status": "covered"
        },
        {
          "stage": "identity-led-initial-access",
          "reason": "Belongs to a separate hunt focusing on the sign-in event and subsequent MFA fatigue or session replay.",
          "status": "out_of_scope"
        },
        {
          "stage": "internal-credential-discovery",
          "reason": "Belongs to another part of the 'Introducing Sekoia Digital Risk: Track Identity-Led Breaches' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "unauthorised-cloud-resource-access",
          "reason": "Belongs to another part of the 'Introducing Sekoia Digital Risk: Track Identity-Led Breaches' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "data-exfiltration-and-extortion",
          "reason": "Belongs to another part of the 'Introducing Sekoia Digital Risk: Track Identity-Led Breaches' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Infostealer Harvesting from Personal Devices",
            "slug": "infostealer-credential-harvesting",
            "tactic": "initial-access",
            "techniques": [
              "T1555",
              "T1195"
            ],
            "observables": [
              "Lumma malware",
              "RedLine malware",
              "Vidar malware",
              "Raccoon malware",
              "personal devices",
              "contractor laptops",
              "browser saved credentials",
              "session cookies",
              "Telegram channels"
            ]
          },
          {
            "name": "Initial Access via Stolen Identity",
            "slug": "identity-led-initial-access",
            "tactic": "initial-access",
            "techniques": [
              "T1133",
              "T1190"
            ],
            "observables": [
              "Snowflake login",
              "Okta service account",
              "valid session cookie replay",
              "MFA push notifications",
              "push notification fatigue",
              "non-compliant device sign-in",
              "external contractor credentials"
            ]
          },
          {
            "name": "Internal Credential and Secret Discovery",
            "slug": "internal-credential-discovery",
            "tactic": "credential-access",
            "techniques": [
              "T1555"
            ],
            "observables": [
              "hard-coded admin credentials",
              "internal network shares",
              "support case files",
              "customer session tokens",
              "browser-synced credentials"
            ]
          },
          {
            "name": "Lateral Movement to Cloud Services",
            "slug": "unauthorised-cloud-resource-access",
            "tactic": "lateral-movement",
            "techniques": [
              "T1133"
            ],
            "observables": [
              "AWS console access",
              "Google Workspace",
              "Slack workspace connections",
              "bug bounty systems"
            ]
          },
          {
            "name": "Data Exfiltration and Ransom Extortion",
            "slug": "data-exfiltration-and-extortion",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "1.3 TB data theft",
              "Snowflake database records",
              "ShinyHunters extortion",
              "Ticketmaster listing",
              "hundreds of millions of records"
            ]
          }
        ],
        "summary": "Threat actors leverage infostealer malware (Lumma, RedLine, Vidar) to harvest credentials and session cookies from personal or contractor devices, which are later sold via access brokers and Telegram channels. These stolen identities are used to bypass MFA via session replay or fatigue attacks to gain access to corporate cloud platforms like Snowflake, AWS, and Slack for large-scale data exfiltration and extortion."
      },
      "severity": "high",
      "rationale": "Start by identifying the workstations that record the highest volume of corporate logons. Focus especially on hosts belonging to contractors or departments known to use personal devices.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "Adversaries are using corporate credentials harvested from unmanaged personal devices by infostealers to bypass authentication controls and gain initial access to cloud resources.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "scoping-output",
            "kind": "manual",
            "observed": "2024-01-01"
          },
          "type": "list[host]",
          "default": [],
          "description": "Hostnames to focus on; leave empty to hunt across all hosts reporting corporate logons."
        },
        "lookback_days": {
          "from": {
            "ref": "hunt-standard",
            "kind": "manual",
            "observed": "2024-01-01"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "target_domain": {
          "from": {
            "ref": "organization-config",
            "kind": "manual",
            "observed": "2024-01-01"
          },
          "type": "string",
          "default": "example.com",
          "description": "Corporate domain to scope the identity search."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.sekoia.com/blog/with-sekoia-intelligence-we-gave-you-half-the-picture-heres-the-other-half",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.sekoia.com/blog/with-sekoia-intelligence-we-gave-you-half-the-picture-heres-the-other-half",
          "name": "Sekoia \u2014 Introducing Sekoia Digital Risk"
        }
      ],
      "blind_spots": [
        {
          "id": "unmanaged-endpoint-blind-spot",
          "risk": "While we see the corporate logon from the beachhead, we remain blind to the source infection on the unmanaged device that led to the compromise.",
          "stage": "infostealer-credential-harvesting",
          "question": "Exactly how the infection occurred and what other non-corporate passwords were stolen",
          "requires": "Endpoint telemetry from the user's personal/home machine"
        },
        {
          "id": "external-telemetry-blind-spot",
          "risk": "There is a window of latency between the initial leak in a private criminal channel and its visibility in monitoring platforms, during which the attacker can act.",
          "stage": "infostealer-credential-harvesting",
          "question": "Whether a credential has been stolen but not yet indexed by Hudson Rock or Flare",
          "requires": "Real-time access to the specific Telegram channel where the log was first leaked"
        }
      ]
    },
    "name": "External Identity Exposure and Credential Leaks",
    "description": "An agent weighs the intersection of these surfaces to find 'unlocked doors' before they are exploited at scale. The hunt identifies compromised corporate identities by correlating external exposure data from infostealer logs with anomalous internal sign-in behavior. Inspired by the Snowflake and CircleCI breaches, the hunt first identifies active workstations used by corporate identities, then fans out to check for domain-wide exposure in criminal markets (via Hudson Rock) alongside a search for rare authentication patterns from those same workstations."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "introducing-sekoia-digital-risk-track-identity-led-breaches",
          "index": 1,
          "title": "Introducing Sekoia Digital Risk: Track Identity-Led Breaches",
          "total": 2
        },
        "coverage": [
          {
            "stage": "infostealer-credential-harvesting",
            "steps": [
              "find-active-corporate-hosts",
              "rare-authentication-patterns",
              "domain-exposure-lookup"
            ],
            "status": "covered"
          },
          {
            "stage": "identity-led-initial-access",
            "reason": "Belongs to a separate hunt focusing on the sign-in event and subsequent MFA fatigue or session replay.",
            "status": "out_of_scope"
          },
          {
            "stage": "internal-credential-discovery",
            "reason": "Belongs to another part of the 'Introducing Sekoia Digital Risk: Track Identity-Led Breaches' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "unauthorised-cloud-resource-access",
            "reason": "Belongs to another part of the 'Introducing Sekoia Digital Risk: Track Identity-Led Breaches' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "data-exfiltration-and-extortion",
            "reason": "Belongs to another part of the 'Introducing Sekoia Digital Risk: Track Identity-Led Breaches' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "Adversaries are using corporate credentials harvested from unmanaged personal devices by infostealers to bypass authentication controls and gain initial access to cloud resources.",
        "blind_spots": [
          {
            "id": "unmanaged-endpoint-blind-spot",
            "risk": "While we see the corporate logon from the beachhead, we remain blind to the source infection on the unmanaged device that led to the compromise.",
            "stage": "infostealer-credential-harvesting",
            "question": "Exactly how the infection occurred and what other non-corporate passwords were stolen",
            "requires": "Endpoint telemetry from the user's personal/home machine"
          },
          {
            "id": "external-telemetry-blind-spot",
            "risk": "There is a window of latency between the initial leak in a private criminal channel and its visibility in monitoring platforms, during which the attacker can act.",
            "stage": "infostealer-credential-harvesting",
            "question": "Whether a credential has been stolen but not yet indexed by Hudson Rock or Flare",
            "requires": "Real-time access to the specific Telegram channel where the log was first leaked"
          }
        ],
        "scoping_notes": "Start by identifying the workstations that record the highest volume of corporate logons. Focus especially on hosts belonging to contractors or departments known to use personal devices.",
        "beyond_detection": "A rule fires on a known bad IP; the hunt finds the 'unlocked doors'\u2014valid credentials already in circulation\u2014by correlating external exposure telemetry with a behavioral baseline of host sign-ins. An analyst weighs whether a rare login source matches an identity compromise reported in criminal markets."
      }
    },
    {
      "id": "find-active-corporate-hosts",
      "type": "query",
      "label": "Identify active corporate workstations",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "identity",
        "content": "SELECT DISTINCT device_hostname FROM hb_auth_signin WHERE LOWER(actor_user_name) LIKE '%@{{target_domain}}' AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_auth_signin",
        "description": "Identify which workstations are actively recording corporate domain logons to scope the subsequent behavioral analysis.",
        "expected_signal": "A list of hostnames. These are the devices analysts should prioritize for the scope_hosts parameter in the fan-out."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify active corporate workstations",
        "reads": [
          "device_hostname",
          "actor_user_name",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT DISTINCT device_hostname FROM hb_auth_signin WHERE LOWER(actor_user_name) LIKE '%@{{target_domain}}' AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames. These are the devices analysts should prioritize for the scope_hosts parameter in the fan-out.",
        "verified": "dry-run",
        "verified_at": "2026-10-13"
      }
    },
    {
      "id": "rare-authentication-patterns",
      "type": "query",
      "label": "Find rare authentication sources",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "identity",
        "content": "SELECT device_hostname, actor_user_name, src_endpoint_ip, src_location_country, COUNT(*) AS login_count, MIN(time) AS first_seen FROM hb_auth_signin WHERE LOWER(actor_user_name) LIKE '%@{{target_domain}}' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, actor_user_name, src_endpoint_ip HAVING login_count < 10",
        "surface": "hb_auth_signin",
        "description": "Stack-count source IPs per user on the scoped hosts to find anomalous logins that might indicate stolen credential or session usage.",
        "expected_signal": "Login events from source IPs seen rarely across the scoped fleet, potentially indicating attacker infrastructure."
      },
      "parents": [
        {
          "id": "find-active-corporate-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Find rare authentication sources",
        "reads": [
          "device_hostname",
          "actor_user_name",
          "src_endpoint_ip",
          "src_location_country",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT device_hostname, actor_user_name, src_endpoint_ip, src_location_country, COUNT(*) AS login_count, MIN(time) AS first_seen FROM hb_auth_signin WHERE LOWER(actor_user_name) LIKE '%@{{target_domain}}' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, actor_user_name, src_endpoint_ip HAVING login_count < 10",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Login events from source IPs seen rarely across the scoped fleet, potentially indicating attacker infrastructure.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "src_endpoint_ip"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-13"
      }
    },
    {
      "id": "domain-exposure-lookup",
      "type": "query",
      "label": "Check for domain-wide identity leaks",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "hudsonrock",
        "content": "SELECT domain, total_stealers, last_employee_compromised, stealer_families, employees_urls FROM hudsonrock_search_by_domain WHERE domain = '{{target_domain}}'",
        "product": "hudsonrock",
        "surface": "hudsonrock_search_by_domain",
        "extension": "hudsonrock",
        "description": "Identify if corporate credentials for the domain have recently appeared in stealer logs indexed by Hudson Rock.",
        "expected_signal": "A summary of recent compromises, listing stealer families (Lumma, RedLine) and counts. Silence means no indexed exposure for this domain in the Hudson Rock archive."
      },
      "parents": [
        {
          "id": "find-active-corporate-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Check for domain-wide identity leaks",
        "reads": [
          "domain",
          "total_stealers",
          "last_employee_compromised",
          "stealer_families",
          "employees_urls"
        ],
        "source": "hudsonrock_search_by_domain",
        "target": "hudsonrock",
        "content": "SELECT domain, total_stealers, last_employee_compromised, stealer_families, employees_urls FROM hudsonrock_search_by_domain WHERE domain = '{{target_domain}}'",
        "silence": "not_evidence_of_absence",
        "expected": "A summary of recent compromises, listing stealer families (Lumma, RedLine) and counts. Silence means no indexed exposure for this domain in the Hudson Rock archive.",
        "verified": "dry-run",
        "verified_at": "2026-10-13",
        "target_extension": "hudsonrock"
      }
    },
    {
      "id": "triage-verdict",
      "type": "analytic",
      "label": "Weigh exposure and sign-in behavior",
      "config": {
        "cite": "required",
        "tools": [
          "hudsonrock",
          "identity"
        ],
        "context": [
          "find-active-corporate-hosts",
          "rare-authentication-patterns",
          "domain-exposure-lookup"
        ],
        "objective": "Determine which users from rare-authentication-patterns correlate with the exposure levels and stealer families identified in domain-exposure-lookup.",
        "description": "Correlate the external compromise data with internal rare sign-in patterns to find high-confidence identity compromises.",
        "max_iterations": 4,
        "expected_signal": "A per-identity verdict identifying users showing both external exposure and internal behavioral anomalies.",
        "success_criteria": "A per-host and per-user verdict citing specific rare IPs and the exposure timeframe."
      },
      "parents": [
        {
          "id": "rare-authentication-patterns",
          "kind": "merge"
        },
        {
          "id": "domain-exposure-lookup",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict identifies at least one corporate identity showing both external exposure in stealer logs and anomalous sign-in behavior",
        "condition": "the triage verdict identifies at least one corporate identity showing both external exposure in stealer logs and anomalous sign-in behavior",
        "blind_spot": "external-telemetry-blind-spot",
        "confidence": "high",
        "description": "Direct the hunt to containment or review based on the severity of the findings.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-verdict"
        }
      ]
    },
    {
      "id": "revoke-identity-sessions",
      "type": "action",
      "label": "Revoke sessions and reset credentials",
      "config": {
        "target": "identity",
        "description": "Contain the risk by immediately revoking access for compromised identities found in the hunt.",
        "instructions": "Revoke all active browser and OAuth sessions for the confirmed identities. Trigger a forced password reset and require an MFA re-enrollment.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "manual-analyst-review",
      "type": "task",
      "label": "Examine post-login activity",
      "config": {
        "assignee": "analyst",
        "description": "Review internal logs for the compromised identities to determine if any unauthorized actions were performed before containment.",
        "instructions": "Use hb_cloud_api_activity and hb_auth_signin to trace the actions of the compromised identities. Look for mass data access (S3/SharePoint) or modification of IAM policies."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "revoke-identity-sessions"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out hunt",
      "config": {
        "assignee": "analyst",
        "description": "Document findings and update the behavioral baseline.",
        "instructions": "Record the identities found and the specific stealer families involved. Recommend security policy updates such as requiring managed devices for all administrative cloud access."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "manual-analyst-review"
        }
      ]
    }
  ]
}