{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "The Falcon framework targets government and defense sectors for intelligence collection. Negative results confirm that the estate is not currently reporting this specific behavioral pattern or malicious extension."
      },
      "name": "Falcon Browser Compromise and Extension Persistence",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1176",
        "attack.t1071.001",
        "attack.t1566",
        "attack.t1190",
        "command and control",
        "execution",
        "initial access",
        "persistence"
      ],
      "series": {
        "slug": "the-xg-files-falcon-c2-flying-under-the-browser-radar",
        "index": 1,
        "title": "The XG Files: Falcon C2 Flying Under The (Browser) Radar",
        "total": 2
      },
      "related": [
        {
          "hunt": "falcon-antino-host-persistence",
          "reason": "This hunt targets the browser-based persistence; the Antino implant uses standard Windows persistence mechanisms and is a separate stage.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "This hunt uses a robust behavioral lead (HTTP /config/ POST patterns) to gate expensive extension inventory and file searches. This correlation between network behavior and file-level extension activity is more resilient than a single rule matching a static extension ID.",
      "coverage": [
        {
          "stage": "initial-access-web-compromise",
          "steps": [
            "http-config-path-lead"
          ],
          "status": "covered"
        },
        {
          "stage": "browser-extension-persistence",
          "steps": [
            "find-falcon-extension-id",
            "extension-file-activity"
          ],
          "status": "covered"
        },
        {
          "stage": "falcon-browser-c2",
          "steps": [
            "http-config-path-lead"
          ],
          "status": "covered"
        },
        {
          "stage": "antino-implant-delivery",
          "reason": "Belongs to another part of the 'The XG Files: Falcon C2 Flying Under The (Browser) Radar' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "antino-host-persistence",
          "reason": "Belongs to another part of the 'The XG Files: Falcon C2 Flying Under The (Browser) Radar' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "antino-onedrive-c2",
          "reason": "Belongs to another part of the 'The XG Files: Falcon C2 Flying Under The (Browser) Radar' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Strategic Web Compromise",
            "slug": "initial-access-web-compromise",
            "tactic": "initial-access",
            "techniques": [
              "T1190",
              "T1566"
            ],
            "observables": [
              "fonts.tarotfree101.top",
              "fonts.chrorne.com",
              "robot.avbliud.com",
              "victim_common.js",
              "victim.js"
            ]
          },
          {
            "name": "Software Extension Persistence",
            "slug": "browser-extension-persistence",
            "tactic": "persistence",
            "techniques": [
              "T1176"
            ],
            "observables": [
              "mbidcmlcbgbphpoacojjbmfpohcimjji",
              "Hm_lvt_$",
              "Hm_lvt__",
              "background.js",
              "content-script.js",
              "analytics-core.js",
              "offscreen.html",
              "page.html",
              "sandbox.html"
            ]
          },
          {
            "name": "Falcon Browser-Based C2",
            "slug": "falcon-browser-c2",
            "tactic": "command-and-control",
            "techniques": [
              "T1071.001"
            ],
            "observables": [
              "/config/",
              "/config/*/hta",
              "/config/*/html",
              "/config/*/wscript",
              "port 443",
              "port 8080",
              "WebSocket connection"
            ]
          },
          {
            "name": "Antino Payload Execution",
            "slug": "antino-implant-delivery",
            "tactic": "execution",
            "techniques": [
              "T1218",
              "T1574.002"
            ],
            "observables": [
              "flashcenter_pp_ax_install_en.exe",
              "microsoft-flash.com",
              "wps-cn.com"
            ]
          },
          {
            "name": "Endpoint Persistence and Execution",
            "slug": "antino-host-persistence",
            "tactic": "persistence",
            "techniques": [
              "T1547.001",
              "T1059.001"
            ],
            "observables": [
              "Registry Run keys",
              "PowerShell commands"
            ]
          },
          {
            "name": "Exfiltration via OneDrive C2",
            "slug": "antino-onedrive-c2",
            "tactic": "command-and-control",
            "techniques": [
              "T1071.001",
              "T1041"
            ],
            "observables": [
              "Microsoft OneDrive API",
              "window.fetch",
              "xmlhttprequest.open"
            ]
          }
        ],
        "summary": "Falcon C2 (aka XG) is a browser-centric threat framework that compromises government web applications to inject malicious JavaScript and install rogue browser extensions. These extensions facilitate credential and email theft while acting as a delivery mechanism for the Antino implant, which establishes persistence on the host and utilizes Microsoft OneDrive as an obfuscated C2 channel."
      },
      "severity": "high",
      "rationale": "Target all corporate and administrative endpoints. Prioritize hosts that access government portals or webmail. Use the lookback period to cover the initial compromise and follow-on C2 phases.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has established persistence via a malicious browser extension and is using it to communicate with a C2 framework via specific /config/ path structures and POST requests.",
      "parameters": {
        "c2_domains": {
          "from": {
            "ref": "unit42-falcon-c2",
            "kind": "article",
            "observed": "2026-11-11"
          },
          "type": "list[domain]",
          "default": [
            "fonts.tarotfree101.top",
            "fonts.chrorne.com",
            "robot.avbliud.com"
          ],
          "description": "Known C2 domains associated with the Falcon framework."
        },
        "scope_hosts": {
          "from": {
            "ref": "analyst-scoping",
            "kind": "manual",
            "observed": "2026-11-11"
          },
          "type": "list[host]",
          "default": [],
          "description": "Optional list of hosts to narrow the expensive queries; leave empty for fleet-wide."
        },
        "extension_id": {
          "from": {
            "ref": "unit42-falcon-c2",
            "kind": "article",
            "observed": "2026-11-11"
          },
          "type": "string",
          "default": "mbidcmlcbgbphpoacojjbmfpohcimjji",
          "description": "The Chrome extension ID for the Falcon implant."
        },
        "lookback_days": {
          "from": {
            "ref": "standard-retention",
            "kind": "manual",
            "observed": "2026-11-11"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine for network and file activity."
        },
        "extension_files": {
          "from": {
            "ref": "unit42-falcon-c2",
            "kind": "article",
            "observed": "2026-11-11"
          },
          "type": "list[string]",
          "default": [
            "analytics-core.js",
            "background.js",
            "content-script.js",
            "offscreen.js",
            "page.js",
            "sandbox.js"
          ],
          "description": "Specific filenames within the Falcon extension package."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/",
          "name": "Unit 42 \u2014 The XG Files: Falcon C2 Flying Under The (Browser) Radar"
        }
      ],
      "blind_spots": [
        {
          "id": "limited-network-visibility",
          "risk": "Adversaries using encrypted channels without a proxy or TLS offload will not show path-level indicators in hb_http_activity.",
          "stage": "falcon-browser-c2",
          "question": "Whether the /config/ URI paths are visible within encrypted WebSocket traffic.",
          "requires": "TLS inspection on port 443"
        },
        {
          "id": "limited-telemetry-retention",
          "risk": "Persistence established before the lookback window will not show the installation or initial configuration activity.",
          "stage": "initial-access-web-compromise",
          "question": "Whether the initial extension sideload occurred outside the 14-day window.",
          "requires": "Enhanced log retention for HTTP and File events"
        }
      ]
    },
    "name": "Falcon Browser Compromise and Extension Persistence",
    "description": "This hunt identifies the Falcon (XG) browser-based C2 framework by searching for its characteristic /config/ URL patterns and rare POST traffic using Baidu-mimicking tracking markers. When a behavioral match is found, the hunt gates more expensive inventory and file telemetry searches to locate the specific malicious Chrome extension and its core JavaScript components within browser profile directories. This gated approach prioritizes robust behavioral indicators over static extension IDs while ensuring file-level corroboration within the user's extension folder."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "the-xg-files-falcon-c2-flying-under-the-browser-radar",
          "index": 1,
          "title": "The XG Files: Falcon C2 Flying Under The (Browser) Radar",
          "total": 2
        },
        "coverage": [
          {
            "stage": "initial-access-web-compromise",
            "steps": [
              "http-config-path-lead"
            ],
            "status": "covered"
          },
          {
            "stage": "browser-extension-persistence",
            "steps": [
              "find-falcon-extension-id",
              "extension-file-activity"
            ],
            "status": "covered"
          },
          {
            "stage": "falcon-browser-c2",
            "steps": [
              "http-config-path-lead"
            ],
            "status": "covered"
          },
          {
            "stage": "antino-implant-delivery",
            "reason": "Belongs to another part of the 'The XG Files: Falcon C2 Flying Under The (Browser) Radar' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "antino-host-persistence",
            "reason": "Belongs to another part of the 'The XG Files: Falcon C2 Flying Under The (Browser) Radar' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "antino-onedrive-c2",
            "reason": "Belongs to another part of the 'The XG Files: Falcon C2 Flying Under The (Browser) Radar' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary has established persistence via a malicious browser extension and is using it to communicate with a C2 framework via specific /config/ path structures and POST requests.",
        "blind_spots": [
          {
            "id": "limited-network-visibility",
            "risk": "Adversaries using encrypted channels without a proxy or TLS offload will not show path-level indicators in hb_http_activity.",
            "stage": "falcon-browser-c2",
            "question": "Whether the /config/ URI paths are visible within encrypted WebSocket traffic.",
            "requires": "TLS inspection on port 443"
          },
          {
            "id": "limited-telemetry-retention",
            "risk": "Persistence established before the lookback window will not show the installation or initial configuration activity.",
            "stage": "initial-access-web-compromise",
            "question": "Whether the initial extension sideload occurred outside the 14-day window.",
            "requires": "Enhanced log retention for HTTP and File events"
          }
        ],
        "scoping_notes": "Target all corporate and administrative endpoints. Prioritize hosts that access government portals or webmail. Use the lookback period to cover the initial compromise and follow-on C2 phases.",
        "beyond_detection": "This hunt uses a robust behavioral lead (HTTP /config/ POST patterns) to gate expensive extension inventory and file searches. This correlation between network behavior and file-level extension activity is more resilient than a single rule matching a static extension ID."
      }
    },
    {
      "id": "http-config-path-lead",
      "type": "query",
      "label": "Identify Falcon Behavioral HTTP Activity",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, http_method, url_query, COUNT(*) AS requests, MIN(time) AS first_seen FROM hb_http_activity WHERE (LOWER(url_path) LIKE '/config/%' OR instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0) AND (LOWER(http_method) = 'post' OR LOWER(url_query) LIKE '%hm_lvt_%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3, 4, 5 HAVING COUNT(DISTINCT device_hostname) <= 5 ORDER BY requests DESC",
        "surface": "hb_http_activity",
        "description": "Establish a behavioral lead by finding rare POST requests or Baidu-mimicking query parameters directed at /config/ paths or known C2 domains.",
        "expected_signal": "Rare HTTP POSTs to /config/ paths or query parameters mimicking Baidu analytics. Silence indicates no active framework-style communication was captured during the window."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Identify Falcon Behavioral HTTP Activity",
        "reads": [
          "device_hostname",
          "url_hostname",
          "url_path",
          "http_method",
          "url_query",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, http_method, url_query, COUNT(*) AS requests, MIN(time) AS first_seen FROM hb_http_activity WHERE (LOWER(url_path) LIKE '/config/%' OR instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0) AND (LOWER(http_method) = 'post' OR LOWER(url_query) LIKE '%hm_lvt_%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3, 4, 5 HAVING COUNT(DISTINCT device_hostname) <= 5 ORDER BY requests DESC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Rare HTTP POSTs to /config/ paths or query parameters mimicking Baidu analytics. Silence indicates no active framework-style communication was captured during the window.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "url_hostname",
            "url_path"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-11-12"
      }
    },
    {
      "id": "assess-http-lead",
      "type": "analytic",
      "label": "Assess HTTP Lead",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "web"
        ],
        "context": [
          "http-config-path-lead"
        ],
        "objective": "Determine if the identified HTTP POSTs or query parameters match the Falcon (XG) command-and-control behavior.",
        "description": "Evaluate if the captured network patterns align with the Falcon framework's reported C2 structures.",
        "max_iterations": 3,
        "expected_signal": "A verdict on whether the network traffic represents a credible threat lead.",
        "success_criteria": "A clear determination of malicious | suspicious | benign for the network activity."
      },
      "parents": [
        {
          "id": "http-config-path-lead"
        }
      ]
    },
    {
      "id": "gate-on-http",
      "type": "checkpoint",
      "label": "Gate on HTTP Behavior",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the assess-http-lead verdict confirms Falcon-like network communication",
        "condition": "the assess-http-lead verdict confirms Falcon-like network communication",
        "blind_spot": "limited-network-visibility",
        "confidence": "high",
        "description": "Open the expensive extension and file searches only when suspicious network behavior is confirmed.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "assess-http-lead"
        }
      ]
    },
    {
      "id": "find-falcon-extension-id",
      "type": "query",
      "label": "Search for Falcon Extension ID",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, package_name, package_uid, package_version FROM hb_software_inventory WHERE (LOWER(package_uid) = '{{extension_id}}' OR LOWER(package_name) LIKE '%falcon%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "surface": "hb_software_inventory",
        "description": "Check the software inventory for the specific malicious extension ID on hosts showing network leads.",
        "expected_signal": "Specific hits for the Falcon extension ID. Silence proves it is not currently registered in the managed inventory."
      },
      "parents": [
        {
          "id": "gate-on-http",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Search for Falcon Extension ID",
        "reads": [
          "device_hostname",
          "package_name",
          "package_uid"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT device_hostname, package_name, package_uid, package_version FROM hb_software_inventory WHERE (LOWER(package_uid) = '{{extension_id}}' OR LOWER(package_name) LIKE '%falcon%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "silence": "not_evidence_of_absence",
        "expected": "Specific hits for the Falcon extension ID. Silence proves it is not currently registered in the managed inventory.",
        "verified": "dry-run",
        "verified_at": "2026-11-12"
      }
    },
    {
      "id": "extension-file-activity",
      "type": "query",
      "label": "Monitor Extension File Activity",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_hostname, file_path, file_name, process_name, time FROM hb_file_activity WHERE instr(',' || '{{extension_files}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND LOWER(file_path) LIKE '%\\\\extensions\\\\%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_file_activity",
        "description": "Search for core extension filenames within browser profile directories to identify sideloaded or manual installations.",
        "expected_signal": "Touches on core JS files within legitimate extension directories. Silence suggests the extension files are not being accessed or do not exist in the common paths."
      },
      "parents": [
        {
          "id": "gate-on-http",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Monitor Extension File Activity",
        "reads": [
          "device_hostname",
          "file_name",
          "file_path",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, file_path, file_name, process_name, time FROM hb_file_activity WHERE instr(',' || '{{extension_files}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND LOWER(file_path) LIKE '%\\\\extensions\\\\%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Touches on core JS files within legitimate extension directories. Silence suggests the extension files are not being accessed or do not exist in the common paths.",
        "verified": "dry-run",
        "verified_at": "2026-11-12"
      }
    },
    {
      "id": "final-triage",
      "type": "analytic",
      "label": "Final Triage and Correlation",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "web"
        ],
        "context": [
          "assess-http-lead",
          "find-falcon-extension-id",
          "extension-file-activity"
        ],
        "objective": "Analyze whether the network behavior, extension inventory, and file activity together indicate a Falcon compromise on the host.",
        "description": "Combine the behavioral network lead with the extension presence findings to reach a definitive verdict.",
        "max_iterations": 5,
        "expected_signal": "A per-host verdict citing cumulative evidence.",
        "success_criteria": "A final verdict citing specific rows from all three surfaces."
      },
      "parents": [
        {
          "id": "find-falcon-extension-id",
          "kind": "merge"
        },
        {
          "id": "extension-file-activity",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on Verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the final-triage verdict is malicious for at least one host",
        "condition": "the final-triage verdict is malicious for at least one host",
        "blind_spot": "limited-telemetry-retention",
        "confidence": "high",
        "description": "Direct confirmed compromises to containment and indeterminate results to manual review.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "final-triage"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate Host",
      "config": {
        "target": "endpoint",
        "description": "Contain the browser-based threat by isolating the endpoint from the network.",
        "instructions": "Isolate the host immediately. Remove the malicious browser extension and its associated files. Collect browser local storage and cookies to verify the presence of Hm_lvt markers.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst Review",
      "config": {
        "assignee": "analyst",
        "description": "Verify the findings manually to confirm the strategic web compromise source.",
        "instructions": "Review all cited HTTP and file activity. Confirm the /config/ POST requests are unauthorized and correlate with browser-based file touches."
      },
      "parents": [
        {
          "id": "gate-on-http",
          "branch": "default"
        },
        {
          "id": "gate-on-http",
          "branch": "on_unavailable"
        },
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close Out",
      "config": {
        "assignee": "analyst",
        "description": "Record results and suggest tuning for the behavioral lead query.",
        "instructions": "Document findings and false positives. If the network behavioral query was confirmed malicious, recommend promotion to a standing detection rule."
      },
      "parents": [
        {
          "id": "gate-on-http",
          "branch": "on_refutes"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-review"
        }
      ]
    }
  ]
}