{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Protecting industrial refrigeration assets is a critical infrastructure priority; unauthorized manipulation can lead to significant inventory loss and food safety hazards."
      },
      "name": "Industrial Control System Exposure and Manipulation",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1195",
        "attack.t1566",
        "impact",
        "initial access"
      ],
      "related": [
        {
          "hunt": "thermal-setpoint-manipulation-behavior",
          "reason": "Monitoring physical temperature deviations requires specialized OT data sources not currently available in this environment.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "This hunt pivots between external exposure, baseline User-Agent prevalence, and vulnerability context by joining endpoint inventory data. A single rule could alert on 'admin' path access, but cannot weigh the combined risk of internet exposure and firmware vulnerabilities on a specific asset.",
      "coverage": [
        {
          "stage": "exposure-of-industrial-controllers",
          "steps": [
            "exposed-controller-panels",
            "vulnerable-controllers"
          ],
          "status": "covered"
        },
        {
          "stage": "exploitation-and-authentication-bypass",
          "steps": [
            "rare-management-access",
            "triage-risk"
          ],
          "status": "covered"
        },
        {
          "stage": "manipulation-of-thermal-settings",
          "reason": "Not examined by this hunt; belongs to a separate hunt.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Exposure of Industrial Controllers",
            "slug": "exposure-of-industrial-controllers",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "Internet-accessible temperature controller panels",
              "Commercial refrigeration management interfaces",
              "Unpatched controller firmware",
              "Exposed electronic temperature controllers"
            ]
          },
          {
            "name": "Exploitation and Authentication Bypass",
            "slug": "exploitation-and-authentication-bypass",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "Authentication bypass attempts on management portals",
              "Arbitrary code injection payloads in HTTP requests",
              "Unauthorized access to controller web interfaces",
              "Logons from unexpected source IPs to OT management consoles"
            ]
          },
          {
            "name": "Manipulation of Thermal Settings",
            "slug": "manipulation-of-thermal-settings",
            "tactic": "impact",
            "techniques": [
              "T1496"
            ],
            "observables": [
              "Remote commands to alter temperature setpoints",
              "Forced activation of heating or defrost cycles via management APIs",
              "Loss of visibility into current temperature data (denial-of-view)",
              "Configuration changes to temperature logging parameters"
            ]
          }
        ],
        "summary": "Malicious actors are targeting industrial refrigeration and cold chain monitoring systems across the Healthcare, Food, and Transportation sectors by exploiting internet-exposed or unpatched electronic temperature controllers. Using authentication bypass and code injection, attackers remotely manipulate settings to trigger continuous heating or defrost cycles, leading to inventory loss, fire hazards, and loss of temperature visibility."
      },
      "severity": "medium",
      "rationale": "Prioritize internet-exposed assets identified via external scanning before searching for behavioral anomalies in HTTP traffic.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is targeting unpatched or internet-exposed industrial refrigeration controllers to bypass authentication and remotely manipulate thermal setpoints, potentially leading to equipment failure.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "analyst-scoping",
            "kind": "manual",
            "observed": "2024-01-01"
          },
          "type": "list[host]",
          "default": [],
          "description": "Optional list of hostnames to restrict the behavioral search; leave empty for whole-estate scan."
        },
        "lookback_days": {
          "from": {
            "ref": "hunt-standard",
            "kind": "manual",
            "observed": "2024-01-01"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "management_paths": {
          "from": {
            "ref": "cisa-advisory",
            "kind": "article",
            "observed": "2026-11-05"
          },
          "type": "list[path]",
          "default": [
            "/admin",
            "/config",
            "/setpoint",
            "/defrost",
            "/setup"
          ],
          "description": "URI paths commonly used by industrial controller management interfaces."
        },
        "controller_keywords": {
          "from": {
            "ref": "cisa-advisory",
            "kind": "article",
            "observed": "2026-11-05"
          },
          "type": "list[string]",
          "default": [
            "refrigeration",
            "temperature controller",
            "emerson",
            "carel",
            "dixon"
          ],
          "description": "Keywords identifying industrial controller interfaces."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.cisa.gov/resources-tools/resources/us-government-partners-urge-hardening-industrial-refrigeration-and-cold-chain-monitoring-systems",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.cisa.gov/resources-tools/resources/us-government-partners-urge-hardening-industrial-refrigeration-and-cold-chain-monitoring-systems",
          "name": "CISA Advisory: Hardening Industrial Refrigeration and Cold Chain Monitoring Systems"
        }
      ],
      "blind_spots": [
        {
          "id": "incomplete-ot-telemetry",
          "risk": "Successful authentication bypass followed by raw OT protocol manipulation would not be visible in HTTP logs.",
          "owner": "Network Engineering",
          "stage": "exploitation-and-authentication-bypass",
          "question": "Whether manipulation occurred via non-HTTP industrial protocols once the perimeter was breached.",
          "requires": "OT-aware protocol logging (Modbus, BACnet)",
          "remediation": "Deploy OT-aware IDS or enable protocol-level logging on OT gateways."
        },
        {
          "id": "external-scanning-latency",
          "risk": "Short-lived exposures might be missed by periodic third-party scans (Shodan/crt.sh).",
          "owner": "External Security Team",
          "stage": "exposure-of-industrial-controllers",
          "question": "Whether an asset was exposed and then removed between periodic scan intervals.",
          "requires": "Real-time external attack surface monitoring",
          "remediation": "Increase scanning frequency for subnets hosting OT infrastructure."
        }
      ]
    },
    "name": "Industrial Control System Exposure and Manipulation",
    "description": "This hunt identifies internet-accessible industrial refrigeration and cold-chain monitoring systems vulnerable to exploitation. It focuses on the discovery of exposed management panels via external scanning data, identifies rare or unauthorized access to management URI paths, and correlates these assets with known software vulnerabilities. The flow starts with an external exposure assessment, fans out to examine access prevalence and vulnerability status, and concludes with an agent-led triage of the risk factors."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "exposure-of-industrial-controllers",
            "steps": [
              "exposed-controller-panels",
              "vulnerable-controllers"
            ],
            "status": "covered"
          },
          {
            "stage": "exploitation-and-authentication-bypass",
            "steps": [
              "rare-management-access",
              "triage-risk"
            ],
            "status": "covered"
          },
          {
            "stage": "manipulation-of-thermal-settings",
            "reason": "Not examined by this hunt; belongs to a separate hunt.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary is targeting unpatched or internet-exposed industrial refrigeration controllers to bypass authentication and remotely manipulate thermal setpoints, potentially leading to equipment failure.",
        "blind_spots": [
          {
            "id": "incomplete-ot-telemetry",
            "risk": "Successful authentication bypass followed by raw OT protocol manipulation would not be visible in HTTP logs.",
            "owner": "Network Engineering",
            "stage": "exploitation-and-authentication-bypass",
            "question": "Whether manipulation occurred via non-HTTP industrial protocols once the perimeter was breached.",
            "requires": "OT-aware protocol logging (Modbus, BACnet)",
            "remediation": "Deploy OT-aware IDS or enable protocol-level logging on OT gateways."
          },
          {
            "id": "external-scanning-latency",
            "risk": "Short-lived exposures might be missed by periodic third-party scans (Shodan/crt.sh).",
            "owner": "External Security Team",
            "stage": "exposure-of-industrial-controllers",
            "question": "Whether an asset was exposed and then removed between periodic scan intervals.",
            "requires": "Real-time external attack surface monitoring",
            "remediation": "Increase scanning frequency for subnets hosting OT infrastructure."
          }
        ],
        "scoping_notes": "Prioritize internet-exposed assets identified via external scanning before searching for behavioral anomalies in HTTP traffic.",
        "beyond_detection": "This hunt pivots between external exposure, baseline User-Agent prevalence, and vulnerability context by joining endpoint inventory data. A single rule could alert on 'admin' path access, but cannot weigh the combined risk of internet exposure and firmware vulnerabilities on a specific asset."
      }
    },
    {
      "id": "exposed-controller-panels",
      "type": "query",
      "label": "Exposed controller panels via external scans",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT domain_or_ip, product, version, port, discovered_at FROM hb_exposed_assets WHERE (LOWER(product) LIKE '%refrigeration%' OR LOWER(product) LIKE '%temperature%' OR LOWER(product) LIKE '%emerson%' OR LOWER(product) LIKE '%carel%' OR LOWER(product) LIKE '%dixon%') AND discovered_at >= datetime('now', '-{{lookback_days}} days') AND '{{controller_keywords}}' != '' ORDER BY discovered_at DESC",
        "surface": "hb_exposed_assets",
        "description": "Identify internet-facing industrial controllers matching reported product keywords, accounting for vendor suffixes.",
        "expected_signal": "A list of IP addresses or domains hosting known controller interfaces. Silence suggests no known exposed assets matching the keywords were detected recently."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Exposed controller panels via external scans",
        "reads": [
          "domain_or_ip",
          "product",
          "version",
          "port",
          "discovered_at"
        ],
        "source": "hb_exposed_assets",
        "target": "endpoint",
        "content": "SELECT domain_or_ip, product, version, port, discovered_at FROM hb_exposed_assets WHERE (LOWER(product) LIKE '%refrigeration%' OR LOWER(product) LIKE '%temperature%' OR LOWER(product) LIKE '%emerson%' OR LOWER(product) LIKE '%carel%' OR LOWER(product) LIKE '%dixon%') AND discovered_at >= datetime('now', '-{{lookback_days}} days') AND '{{controller_keywords}}' != '' ORDER BY discovered_at DESC",
        "silence": "not_evidence_of_absence",
        "expected": "A list of IP addresses or domains hosting known controller interfaces. Silence suggests no known exposed assets matching the keywords were detected recently.",
        "verified": "dry-run",
        "verified_at": "2026-11-06"
      }
    },
    {
      "id": "rare-management-access",
      "type": "query",
      "label": "Rare User-Agent access to management paths",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "web",
        "content": "SELECT user_agent, url_path, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_http_activity WHERE (LOWER(url_path) LIKE '/admin%' OR LOWER(url_path) LIKE '/config%' OR LOWER(url_path) LIKE '/setpoint%' OR LOWER(url_path) LIKE '/defrost%' OR LOWER(url_path) LIKE '/setup%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND '{{management_paths}}' != '' GROUP BY user_agent, url_path HAVING host_count < 3 ORDER BY host_count ASC",
        "surface": "hb_http_activity",
        "description": "Stack-count User-Agents accessing sensitive management URIs, including nested sub-directories, to find anomalies.",
        "expected_signal": "User-Agents seen on only one or two hosts accessing controller paths. Silence indicates only common, known User-Agents are accessing these paths."
      },
      "parents": [
        {
          "id": "exposed-controller-panels"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare User-Agent access to management paths",
        "reads": [
          "user_agent",
          "device_hostname",
          "time",
          "url_path"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT user_agent, url_path, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_http_activity WHERE (LOWER(url_path) LIKE '/admin%' OR LOWER(url_path) LIKE '/config%' OR LOWER(url_path) LIKE '/setpoint%' OR LOWER(url_path) LIKE '/defrost%' OR LOWER(url_path) LIKE '/setup%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND '{{management_paths}}' != '' GROUP BY user_agent, url_path HAVING host_count < 3 ORDER BY host_count ASC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "User-Agents seen on only one or two hosts accessing controller paths. Silence indicates only common, known User-Agents are accessing these paths.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "user_agent",
            "url_path"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-11-06"
      }
    },
    {
      "id": "vulnerable-controllers",
      "type": "query",
      "label": "Known vulnerabilities on identified controllers",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT d.hostname, v.cve_uid, v.severity, v.affected_package_name FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid WHERE (LOWER(v.affected_package_name) LIKE '%refrigeration%' OR LOWER(v.affected_package_name) LIKE '%temperature%' OR LOWER(v.affected_package_name) LIKE '%emerson%' OR LOWER(v.affected_package_name) LIKE '%carel%' OR LOWER(v.affected_package_name) LIKE '%dixon%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || d.hostname || ',') > 0) AND v.collected_at >= datetime('now', '-{{lookback_days}} days') AND '{{controller_keywords}}' != '' ORDER BY v.severity_id DESC",
        "surface": "hb_vulnerability_finding",
        "description": "Cross-reference identified controller software with known CVEs by joining to device inventory for hostname context.",
        "expected_signal": "Vulnerability findings (CVEs) matching the controller keywords on relevant hosts. Matches prioritize hosts for behavioral review."
      },
      "parents": [
        {
          "id": "exposed-controller-panels"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Known vulnerabilities on identified controllers",
        "reads": [
          "device_uid",
          "cve_uid",
          "severity",
          "affected_package_name",
          "collected_at"
        ],
        "source": "hb_vulnerability_finding",
        "target": "endpoint",
        "content": "SELECT d.hostname, v.cve_uid, v.severity, v.affected_package_name FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid WHERE (LOWER(v.affected_package_name) LIKE '%refrigeration%' OR LOWER(v.affected_package_name) LIKE '%temperature%' OR LOWER(v.affected_package_name) LIKE '%emerson%' OR LOWER(v.affected_package_name) LIKE '%carel%' OR LOWER(v.affected_package_name) LIKE '%dixon%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || d.hostname || ',') > 0) AND v.collected_at >= datetime('now', '-{{lookback_days}} days') AND '{{controller_keywords}}' != '' ORDER BY v.severity_id DESC",
        "silence": "not_evidence_of_absence",
        "expected": "Vulnerability findings (CVEs) matching the controller keywords on relevant hosts. Matches prioritize hosts for behavioral review.",
        "verified": "dry-run",
        "verified_at": "2026-11-06"
      }
    },
    {
      "id": "triage-risk",
      "type": "analytic",
      "label": "Evaluate exposure and activity risk",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "web"
        ],
        "context": [
          "exposed-controller-panels",
          "rare-management-access",
          "vulnerable-controllers"
        ],
        "objective": "Determine if the combination of internet exposure, known vulnerabilities, and rare User-Agent access indicates an active authentication bypass or configuration manipulation on industrial refrigeration systems. Correlate the external IP addresses or domains from exposed-controller-panels with the internal hostnames seen in hb_http_activity and hb_vulnerability_finding to identify if exposed systems are showing suspicious activity.",
        "description": "Weigh the findings from exposure, prevalence, and vulnerability queries to identify active exploitation.",
        "max_iterations": 4,
        "expected_signal": "A per-host verdict citing specific vulnerabilities and suspicious HTTP access patterns.",
        "success_criteria": "A per-host verdict of malicious, suspicious, or benign, supported by row citations."
      },
      "parents": [
        {
          "id": "rare-management-access",
          "kind": "merge"
        },
        {
          "id": "vulnerable-controllers",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on triage result",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious for at least one host based on unauthorized access to a vulnerable controller interface",
        "condition": "the triage verdict is malicious for at least one host based on unauthorized access to a vulnerable controller interface",
        "blind_spot": "incomplete-ot-telemetry",
        "confidence": "high",
        "description": "Direct high-confidence findings to containment while routing uncertain cases for analyst review.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-risk"
        }
      ]
    },
    {
      "id": "isolate-controller",
      "type": "action",
      "label": "Isolate industrial controller",
      "config": {
        "target": "endpoint",
        "description": "Prevent further unauthorized manipulation by isolating the affected controller.",
        "instructions": "Isolate the controller at the network level to prevent further remote access. Contact OT operators to verify thermal stability.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Manual analyst review",
      "config": {
        "assignee": "analyst",
        "description": "Review findings and coordinate with OT teams for long-term remediation.",
        "instructions": "Review the agent's cited rows. Verify if the access patterns match known exploit payloads. Coordinate with OT maintenance to check for abnormal defrost cycle logs on the physical unit."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-controller"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Hunt close-out",
      "config": {
        "assignee": "analyst",
        "description": "Record findings and tune parameters to reduce future noise.",
        "instructions": "Document the investigation results. If exposure was found, ensure the assets are moved behind a firewall. Tune the controller keywords list based on observed benign false positives."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-review"
        }
      ]
    }
  ]
}