{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Credential-based attacks start 70 percent of breaches and bypass traditional firewalls. Monitoring the authentication plane is essential for identifying intruders who appear as authorized users."
      },
      "name": "Identity Authentication and Account Abuse",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1110.003",
        "attack.t1110.004",
        "attack.t1078",
        "attack.t1090.003",
        "attack.t1110"
      ],
      "series": {
        "slug": "credential-theft-how-attackers-steal-use-stolen-credentials",
        "index": 1,
        "title": "Credential Theft: How Attackers Steal & Use Stolen Credentials",
        "total": 2
      },
      "related": [
        {
          "hunt": "lsass-memory-dumping-on-endpoints",
          "reason": "This hunt focuses on the use of stolen credentials; the endpoint-based dumping of those credentials is a separate behavioral stage.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A simple detection rule flags volume-based failure spikes; this hunt correlates those spikes with successful logons, user IP diversity, and sensitive system access to find the low signal takeover that volume rules miss.",
      "coverage": [
        {
          "stage": "external-auth-spraying",
          "steps": [
            "detect-spraying-and-stuffing"
          ],
          "status": "covered"
        },
        {
          "stage": "credential-stuffing-attempts",
          "steps": [
            "detect-spraying-and-stuffing"
          ],
          "status": "covered"
        },
        {
          "stage": "account-takeover-anomalies",
          "steps": [
            "detect-anomalous-successful-logons",
            "triage-identity-abuse"
          ],
          "status": "covered"
        },
        {
          "stage": "infostealer-browser-harvesting",
          "reason": "Belongs to another part of the 'Credential Theft: How Attackers Steal & Use Stolen Credentials' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "lsass-memory-dumping",
          "reason": "Belongs to another part of the 'Credential Theft: How Attackers Steal & Use Stolen Credentials' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "registry-hive-extraction",
          "reason": "Belongs to another part of the 'Credential Theft: How Attackers Steal & Use Stolen Credentials' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Password Spraying and Brute Force",
            "slug": "external-auth-spraying",
            "tactic": "credential-access",
            "techniques": [
              "T1110.003",
              "T1110"
            ],
            "observables": [
              "Single common password tested against many accounts",
              "Iterative password guessing against a single account",
              "Spikes in authentication failures (activity_id 5)",
              "Logins from unfamiliar IP addresses or geographic locations"
            ]
          },
          {
            "name": "Credential Stuffing",
            "slug": "credential-stuffing-attempts",
            "tactic": "credential-access",
            "techniques": [
              "T1110.004"
            ],
            "observables": [
              "Authentication attempts using username/password pairs leaked in previous third-party breaches",
              "High volume of failed login attempts across diverse accounts"
            ]
          },
          {
            "name": "Infostealer Data Collection",
            "slug": "infostealer-browser-harvesting",
            "tactic": "credential-access",
            "techniques": [
              "T1555"
            ],
            "observables": [
              "Access to browser profile directories (e.g., AppData\\Local\\Google\\Chrome\\User Data)",
              "Reading of 'Cookies' and 'Login Data' SQLite databases",
              "Exfiltration of harvested credentials to external C2 nodes",
              "Processes running from Temp or Downloads directories"
            ]
          },
          {
            "name": "LSASS Credential Dumping",
            "slug": "lsass-memory-dumping",
            "tactic": "credential-access",
            "techniques": [
              "T1003.001"
            ],
            "observables": [
              "procdump -ma lsass.exe",
              "rundll32.exe C:\\Windows\\System32\\comsvcs.dll MiniDump",
              "Execution of Mimikatz or similar tools",
              "Creation of .dmp files containing LSASS memory"
            ]
          },
          {
            "name": "Registry Hive Extraction",
            "slug": "registry-hive-extraction",
            "tactic": "credential-access",
            "techniques": [
              "T1003"
            ],
            "observables": [
              "reg.exe save HKLM\\SAM",
              "reg.exe save HKLM\\SYSTEM",
              "reg.exe save HKLM\\SECURITY",
              "esentutl.exe /y /vss /d",
              "Access to %SystemRoot%\\System32\\config"
            ]
          },
          {
            "name": "Valid Account Abuse and Impossible Travel",
            "slug": "account-takeover-anomalies",
            "tactic": "initial-access",
            "techniques": [
              "T1078"
            ],
            "observables": [
              "Impossible travel (logins from distant locations in rapid succession)",
              "Logins that bypass MFA using stolen session tokens",
              "Unauthorized privilege changes or administrative role assignments",
              "MFA enrollments for new/unrecognized devices"
            ]
          }
        ],
        "summary": "This campaign involves the unauthorized acquisition of credentials via phishing, brute force, and infostealers to impersonate legitimate users. Attackers then perform credential dumping on compromised endpoints to harvest cached passwords and hashes, enabling lateral movement and full account takeover."
      },
      "severity": "medium",
      "rationale": "Focus on high-value identity infrastructure such as domain controllers, AD FS servers, and cloud identity proxies. Widen the lookback to 30 days if slow-and-low spraying is suspected.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An intruder is testing passwords against identity providers to gain initial access or using stolen session tokens to bypass MFA and access internal resources.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "hunt-designer",
            "kind": "manual",
            "observed": "2026-09-10"
          },
          "type": "list[host]",
          "default": [],
          "description": "List of hostnames identified in the scoping step to focus the authentication analysis."
        },
        "lookback_days": {
          "from": {
            "ref": "hunt-designer",
            "kind": "manual",
            "observed": "2026-09-10"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine for authentication patterns."
        },
        "suspicious_ips": {
          "from": {
            "ref": "hunt-designer",
            "kind": "manual",
            "observed": "2026-09-10"
          },
          "type": "list[ip]",
          "default": [],
          "description": "Known-malicious or suspicious IPs from external intelligence to prioritize."
        },
        "spray_threshold": {
          "from": {
            "ref": "hunt-designer",
            "kind": "manual",
            "observed": "2026-09-10"
          },
          "type": "number",
          "default": "10",
          "description": "Minimum number of unique accounts targeted by a single source IP to qualify as spraying."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.huntress.com/blog/credential-theft-expanding-your-reach",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.huntress.com/blog/credential-theft-expanding-your-reach",
          "name": "Huntress \u2014 Credential Theft: How Attackers Steal & Use Stolen Credentials"
        }
      ],
      "blind_spots": [
        {
          "id": "missing-auth-telemetry",
          "risk": "A successful takeover of a standalone SaaS account using stolen credentials would be invisible.",
          "owner": "Cloud Operations",
          "stage": "external-auth-spraying",
          "question": "whether the attacker successfully logged into an application not covered by the current log ingestion",
          "requires": "Unified logging (hb_auth_signin) for all critical SaaS and cloud providers.",
          "remediation": "Integrate all business-critical SaaS platforms into the centralized identity provider or SIEM."
        },
        {
          "id": "unreliable-session-context",
          "risk": "The hunt may misinterpret session reuse as a legitimate return visit if auth_protocol metadata is missing.",
          "owner": "Identity Engineering",
          "stage": "account-takeover-anomalies",
          "question": "whether a successful logon used a password or a stolen session cookie",
          "requires": "Authentication logs that distinguish between password-based and token-based logins.",
          "remediation": "Enable advanced identity logging to capture session token usage details."
        }
      ]
    },
    "name": "Identity Authentication and Account Abuse",
    "description": "This hunt examines the authentication plane for signs of high-volume credential testing and subsequent account takeover. It starts by identifying hosts running identity-related software or browsers to scope the estate, then analyzes authentication failures for spraying patterns and successful logons for anomalous behavior, such as multiple source IPs per user or access to sensitive systems. An agent triages the combined evidence to distinguish legitimate remote access from active compromise."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "credential-theft-how-attackers-steal-use-stolen-credentials",
          "index": 1,
          "title": "Credential Theft: How Attackers Steal & Use Stolen Credentials",
          "total": 2
        },
        "coverage": [
          {
            "stage": "external-auth-spraying",
            "steps": [
              "detect-spraying-and-stuffing"
            ],
            "status": "covered"
          },
          {
            "stage": "credential-stuffing-attempts",
            "steps": [
              "detect-spraying-and-stuffing"
            ],
            "status": "covered"
          },
          {
            "stage": "account-takeover-anomalies",
            "steps": [
              "detect-anomalous-successful-logons",
              "triage-identity-abuse"
            ],
            "status": "covered"
          },
          {
            "stage": "infostealer-browser-harvesting",
            "reason": "Belongs to another part of the 'Credential Theft: How Attackers Steal & Use Stolen Credentials' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "lsass-memory-dumping",
            "reason": "Belongs to another part of the 'Credential Theft: How Attackers Steal & Use Stolen Credentials' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "registry-hive-extraction",
            "reason": "Belongs to another part of the 'Credential Theft: How Attackers Steal & Use Stolen Credentials' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An intruder is testing passwords against identity providers to gain initial access or using stolen session tokens to bypass MFA and access internal resources.",
        "blind_spots": [
          {
            "id": "missing-auth-telemetry",
            "risk": "A successful takeover of a standalone SaaS account using stolen credentials would be invisible.",
            "owner": "Cloud Operations",
            "stage": "external-auth-spraying",
            "question": "whether the attacker successfully logged into an application not covered by the current log ingestion",
            "requires": "Unified logging (hb_auth_signin) for all critical SaaS and cloud providers.",
            "remediation": "Integrate all business-critical SaaS platforms into the centralized identity provider or SIEM."
          },
          {
            "id": "unreliable-session-context",
            "risk": "The hunt may misinterpret session reuse as a legitimate return visit if auth_protocol metadata is missing.",
            "owner": "Identity Engineering",
            "stage": "account-takeover-anomalies",
            "question": "whether a successful logon used a password or a stolen session cookie",
            "requires": "Authentication logs that distinguish between password-based and token-based logins.",
            "remediation": "Enable advanced identity logging to capture session token usage details."
          }
        ],
        "scoping_notes": "Focus on high-value identity infrastructure such as domain controllers, AD FS servers, and cloud identity proxies. Widen the lookback to 30 days if slow-and-low spraying is suspected.",
        "beyond_detection": "A simple detection rule flags volume-based failure spikes; this hunt correlates those spikes with successful logons, user IP diversity, and sensitive system access to find the low signal takeover that volume rules miss."
      }
    },
    {
      "id": "identify-identity-assets",
      "type": "query",
      "label": "Identify identity-sensitive assets",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%active directory%' OR LOWER(package_name) LIKE '%chrome%' OR LOWER(package_name) LIKE '%firefox%' OR LOWER(package_name) LIKE '%edge%'",
        "surface": "hb_software_inventory",
        "description": "Locate hosts running Active Directory components, domain services, or common browsers where credentials may be dumped or used.",
        "expected_signal": "A list of hostnames. These are the assets where credential-based lateral movement is most impactful. Use these to fill the scope_hosts parameter."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify identity-sensitive assets",
        "reads": [
          "device_hostname",
          "package_name",
          "package_version"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%active directory%' OR LOWER(package_name) LIKE '%chrome%' OR LOWER(package_name) LIKE '%firefox%' OR LOWER(package_name) LIKE '%edge%'",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames. These are the assets where credential-based lateral movement is most impactful. Use these to fill the scope_hosts parameter.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "detect-spraying-and-stuffing",
      "type": "query",
      "label": "Detect credential spraying and stuffing",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "identity",
        "content": "SELECT src_endpoint_ip, COUNT(DISTINCT actor_user_name) AS unique_accounts, COUNT(*) AS total_failures, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_auth_signin WHERE status_id = 2 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{suspicious_ips}}' = '' OR instr(',' || '{{suspicious_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) GROUP BY src_endpoint_ip HAVING unique_accounts >= {{spray_threshold}}",
        "surface": "hb_auth_signin",
        "description": "Identify source IPs that target a high volume of accounts with failed authentication attempts.",
        "expected_signal": "Source IPs hitting many unique usernames. A high unique_account count suggests spraying; high failure counts against a single user suggest brute force."
      },
      "parents": [
        {
          "id": "identify-identity-assets"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Detect credential spraying and stuffing",
        "reads": [
          "src_endpoint_ip",
          "actor_user_name",
          "status_id",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT src_endpoint_ip, COUNT(DISTINCT actor_user_name) AS unique_accounts, COUNT(*) AS total_failures, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_auth_signin WHERE status_id = 2 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{suspicious_ips}}' = '' OR instr(',' || '{{suspicious_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) GROUP BY src_endpoint_ip HAVING unique_accounts >= {{spray_threshold}}",
        "silence": "not_evidence_of_absence",
        "expected": "Source IPs hitting many unique usernames. A high unique_account count suggests spraying; high failure counts against a single user suggest brute force.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "detect-anomalous-successful-logons",
      "type": "query",
      "label": "Detect anomalous successful logons",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, dst_endpoint_name, COUNT(*) AS login_count, MIN(time) AS first_login FROM hb_auth_signin WHERE status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_name || ',') > 0) GROUP BY actor_user_name, src_endpoint_ip, dst_endpoint_name ORDER BY login_count DESC",
        "surface": "hb_auth_signin",
        "description": "Find successful logons that deviate from normal patterns, particularly targeting assets identified in scoping.",
        "expected_signal": "Successful logons to sensitive hosts or users with high source IP diversity. Cross-referencing these source IPs with the spraying results reveals account takeover."
      },
      "parents": [
        {
          "id": "identify-identity-assets"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Detect anomalous successful logons",
        "reads": [
          "actor_user_name",
          "src_endpoint_ip",
          "dst_endpoint_name",
          "status_id",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, dst_endpoint_name, COUNT(*) AS login_count, MIN(time) AS first_login FROM hb_auth_signin WHERE status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_name || ',') > 0) GROUP BY actor_user_name, src_endpoint_ip, dst_endpoint_name ORDER BY login_count DESC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Successful logons to sensitive hosts or users with high source IP diversity. Cross-referencing these source IPs with the spraying results reveals account takeover.",
        "verified": "dry-run",
        "prevalence": {
          "by": "src_endpoint_ip",
          "key": [
            "actor_user_name"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "triage-identity-abuse",
      "type": "analytic",
      "label": "Triage identity abuse",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "identify-identity-assets",
          "detect-spraying-and-stuffing",
          "detect-anomalous-successful-logons"
        ],
        "objective": "Determine if any successful logons were preceded by spraying from the same IP, or if users exhibit impossible travel or access to sensitive scoped hosts from suspicious origins.",
        "description": "Correlate failed authentication leads with successful logon anomalies to confirm account compromise.",
        "max_iterations": 5,
        "expected_signal": "A per-user and per-IP verdict citing rows from both spraying and success queries.",
        "success_criteria": "A verdict of malicious | suspicious | benign for each identified actor, citing specific rows."
      },
      "parents": [
        {
          "id": "detect-spraying-and-stuffing",
          "kind": "merge"
        },
        {
          "id": "detect-anomalous-successful-logons",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage-identity-abuse verdict is malicious for at least one user",
        "condition": "the triage-identity-abuse verdict is malicious for at least one user",
        "blind_spot": "missing-auth-telemetry",
        "confidence": "high",
        "description": "Direct the workflow to containment if a compromise is confirmed.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-identity-abuse"
        }
      ]
    },
    {
      "id": "isolate-compromised-identity",
      "type": "action",
      "label": "Isolate compromised identity",
      "config": {
        "target": "identity",
        "description": "Revoke attacker access immediately to prevent further lateral movement.",
        "instructions": "Suspend the identified user account in the identity provider and revoke all active session tokens to invalidate any stolen cookies.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "manual-review",
      "type": "task",
      "label": "Manual review",
      "config": {
        "assignee": "analyst",
        "description": "Perform an analyst check of the findings and look for post-compromise activity.",
        "instructions": "Review the successful logons for malicious users. Examine process and file activity on the targeted hosts (scope_hosts) originating from those users to identify lateral movement or data staging."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-compromised-identity"
        }
      ]
    },
    {
      "id": "remediation-and-closeout",
      "type": "task",
      "label": "Remediation and closeout",
      "config": {
        "assignee": "analyst",
        "description": "Finalize the hunt and address structural identity risks.",
        "instructions": "Document the findings and IPs. Identify any accounts that successfully authenticated without MFA and coordinate with the identity team to enforce phishing-resistant MFA controls."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "manual-review"
        }
      ]
    }
  ]
}