{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Third-party breaches and infostealer activity provide early warning of targeted account takeover. Correlating external intel with internal authentication and network behavior is critical for protecting corporate data assets." }, "name": "Identity Breach and Account Abuse", "type": "investigation", "labels": [ "hunt", "attack.t1041", "attack.t1566", "exfiltration", "initial access", "haveibeenpwned", "hudsonrock" ], "related": [ { "hunt": "infostealer-infection-remediation", "reason": "This hunt focuses on the identity impact; a related hunt focuses on cleaning the infected unmanaged machines themselves.", "relation": "alternative" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] }, "hudsonrock": { "name": "hudsonrock", "category": "siem", "huntbase": { "product": "hudsonrock" } }, "haveibeenpwned": { "name": "haveibeenpwned", "category": "siem", "huntbase": { "product": "haveibeenpwned" } } }, "analysis": "A standard detection rule alerts on a single bad IP or a password spray. This hunt correlates external exposure (infostealer token theft) with internal behavioral anomalies across three surfaces, requiring an agent to weigh the coincidence of the leak against active usage patterns.", "coverage": [ { "stage": "data-exfiltration", "steps": [ "detect-data-exfiltration" ], "status": "covered" }, { "stage": "phishing-follow-on", "steps": [ "detect-phishing-interaction" ], "status": "covered" }, { "stage": "external-identity-exposure", "steps": [ "check-hibp", "check-hudsonrock" ], "status": "covered" }, { "stage": "account-misuse-and-recovery", "steps": [ "detect-anomalous-logins", "remediate-compromised-accounts" ], "status": "covered" } ], "scenario": { "stages": [ { "name": "Data Exfiltration Over C2", "slug": "data-exfiltration", "tactic": "exfiltration", "techniques": [ "T1041" ], "observables": [ "large data volumes", "exfiltrated data", "access to sensitive information" ] }, { "name": "Follow-on Phishing Attempts", "slug": "phishing-follow-on", "tactic": "initial-access", "techniques": [ "T1566" ], "observables": [ "unsolicited breach notification email", "links in these messages", "targeted phishing calls" ] }, { "name": "External Identity Exposure", "slug": "external-identity-exposure", "tactic": "initial-access", "techniques": [ "T1566" ], "observables": [ "leaked usernames and passwords", "exposed email addresses", "exposed phone numbers", "government ID exposure" ] }, { "name": "Account Misuse and Remediation", "slug": "account-misuse-and-recovery", "tactic": "initial-access", "techniques": [ "T1566" ], "observables": [ "suspicious activity on affected accounts", "password reset events", "enabling two-factor authentication (2FA)" ] } ], "summary": "The campaign involves the large-scale exfiltration of sensitive organizational and personal data, which is subsequently leveraged by adversaries for targeted phishing and credential misuse. Defenders must identify exposure via external breach intelligence and monitor for anomalous sign-ins or remediation actions like emergency password resets." }, "severity": "medium", "rationale": "Focus internal behavioral queries on hosts that have reported active status within the lookback window. Prioritize accounts belonging to users in high-privilege departments such as IT, HR, or Finance.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "Adversaries are leveraging corporate credentials exposed in third-party data breaches to bypass authentication, propagate phishing lures, and exfiltrate data from internal endpoints.", "parameters": { "scope_hosts": { "from": { "ref": "scoping-query", "kind": "manual", "observed": "2024-05-20" }, "type": "list[host]", "default": [], "description": "Optional list of hostnames to focus the internal corroboration steps." }, "lookback_days": { "from": { "ref": "hunt-standard", "kind": "manual", "observed": "2024-05-20" }, "type": "number", "default": "14", "description": "Days of history to examine for internal behavioral anomalies." }, "corporate_domains": { "from": { "ref": "internal-policy", "kind": "manual", "observed": "2024-05-20" }, "type": "list[string]", "default": [ "example.com" ], "description": "Corporate email domains to check against external breach databases." }, "high_risk_identities": { "from": { "ref": "weigh-external-exposure", "kind": "manual", "observed": "2024-05-20" }, "type": "list[string]", "default": [], "description": "List of compromised identities identified in the first phase. Leave empty to run the hunt for all users on scoped hosts." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.welivesecurity.com/en/how-to/what-to-do-when-a-data-breach-notice-tells-you-almost-nothing/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.welivesecurity.com/en/how-to/what-to-do-when-a-data-breach-notice-tells-you-almost-nothing/", "name": "ESET Research \u2014 What to do when a data breach notice tells you almost nothing" } ], "blind_spots": [ { "id": "ssl-inspection-gap", "risk": "Phishing interaction remains unconfirmed without path context; we can see the domain but not whether a credential form was submitted.", "owner": "Network Engineering", "stage": "phishing-follow-on", "question": "What full URI paths were visited on suspected phishing domains?", "requires": "SSL decryption for hb_http_activity", "remediation": "Deploy endpoint-based HTTP inspection or enable corporate proxy SSL decryption." }, { "id": "mfa-telemetry-gap", "risk": "Inability to distinguish between simple password reuse and sophisticated session hijacking via infostealer logs.", "owner": "Identity Engineering", "stage": "account-misuse-and-recovery", "question": "Was the anomalous login successful because MFA was bypassed or because a session token was stolen?", "requires": "hb_auth_signin with full MFA event details", "remediation": "Enable and export full conditional access and MFA logs to the centralized log pool." } ] }, "name": "Identity Breach and Account Abuse", "description": "This phased hunt identifies corporate identities compromised in external breaches and infostealer activity, then monitors those specific accounts for anomalous internal behavior. By correlating external intelligence with authentication, web, and network telemetry, the hunt distinguishes between simple credential exposure and active account weaponization." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "coverage": [ { "stage": "data-exfiltration", "steps": [ "detect-data-exfiltration" ], "status": "covered" }, { "stage": "phishing-follow-on", "steps": [ "detect-phishing-interaction" ], "status": "covered" }, { "stage": "external-identity-exposure", "steps": [ "check-hibp", "check-hudsonrock" ], "status": "covered" }, { "stage": "account-misuse-and-recovery", "steps": [ "detect-anomalous-logins", "remediate-compromised-accounts" ], "status": "covered" } ], "rationale": "Adversaries are leveraging corporate credentials exposed in third-party data breaches to bypass authentication, propagate phishing lures, and exfiltrate data from internal endpoints.", "blind_spots": [ { "id": "ssl-inspection-gap", "risk": "Phishing interaction remains unconfirmed without path context; we can see the domain but not whether a credential form was submitted.", "owner": "Network Engineering", "stage": "phishing-follow-on", "question": "What full URI paths were visited on suspected phishing domains?", "requires": "SSL decryption for hb_http_activity", "remediation": "Deploy endpoint-based HTTP inspection or enable corporate proxy SSL decryption." }, { "id": "mfa-telemetry-gap", "risk": "Inability to distinguish between simple password reuse and sophisticated session hijacking via infostealer logs.", "owner": "Identity Engineering", "stage": "account-misuse-and-recovery", "question": "Was the anomalous login successful because MFA was bypassed or because a session token was stolen?", "requires": "hb_auth_signin with full MFA event details", "remediation": "Enable and export full conditional access and MFA logs to the centralized log pool." } ], "scoping_notes": "Focus internal behavioral queries on hosts that have reported active status within the lookback window. Prioritize accounts belonging to users in high-privilege departments such as IT, HR, or Finance.", "beyond_detection": "A standard detection rule alerts on a single bad IP or a password spray. This hunt correlates external exposure (infostealer token theft) with internal behavioral anomalies across three surfaces, requiring an agent to weigh the coincidence of the leak against active usage patterns." } }, { "id": "scope-active-devices", "type": "query", "label": "Scope active managed devices", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT hostname AS device_hostname FROM hb_devices WHERE (lifecycle_state = 'active' OR lifecycle_state = 'running') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_devices", "description": "Identify recently active hosts to focus the internal behavioral queries.", "expected_signal": "A list of hostnames that have reported inventory recently. Silence means no active devices are reporting." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope active managed devices", "reads": [ "hostname", "lifecycle_state", "time" ], "source": "hb_devices", "target": "endpoint", "content": "SELECT DISTINCT hostname AS device_hostname FROM hb_devices WHERE (lifecycle_state = 'active' OR lifecycle_state = 'running') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A list of hostnames that have reported inventory recently. Silence means no active devices are reporting.", "verified": "dry-run", "verified_at": "2026-10-14" } }, { "id": "check-hibp", "type": "query", "label": "Public data breach exposure", "config": { "dsl": "sqlite", "role": "enrichment", "source": "haveibeenpwned", "content": "SELECT account, name AS breach_name, data_classes FROM hibp_breached_account WHERE instr(',' || '{{corporate_domains}}' || ',', ',' || LOWER(SUBSTR(account, INSTR(account, '@') + 1)) || ',') > 0", "product": "haveibeenpwned", "surface": "hibp_breached_account", "extension": "haveibeenpwned", "description": "Check if corporate accounts appear in public data breaches listed by HaveIBeenPwned.", "expected_signal": "Corporate accounts found in third-party breaches. Silence confirms no corporate identities are present in the HIBP snapshot." }, "parents": [ { "id": "scope-active-devices" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Public data breach exposure", "reads": [ "account", "data_classes", "name" ], "source": "hibp_breached_account", "target": "haveibeenpwned", "content": "SELECT account, name AS breach_name, data_classes FROM hibp_breached_account WHERE instr(',' || '{{corporate_domains}}' || ',', ',' || LOWER(SUBSTR(account, INSTR(account, '@') + 1)) || ',') > 0", "silence": "not_evidence_of_absence", "expected": "Corporate accounts found in third-party breaches. Silence confirms no corporate identities are present in the HIBP snapshot.", "verified": "dry-run", "verified_at": "2026-10-14", "target_extension": "haveibeenpwned" } }, { "id": "check-hudsonrock", "type": "query", "label": "Infostealer identity leaks", "config": { "dsl": "sqlite", "role": "enrichment", "source": "hudsonrock", "content": "SELECT email, computer_name, date_compromised, malware_path FROM hudsonrock_search_by_email WHERE instr(',' || '{{corporate_domains}}' || ',', ',' || LOWER(SUBSTR(email, INSTR(email, '@') + 1)) || ',') > 0", "product": "hudsonrock", "surface": "hudsonrock_search_by_email", "extension": "hudsonrock", "description": "Identify corporate users whose credentials were stolen by stealer malware as recorded by Hudson Rock.", "expected_signal": "Corporate accounts compromised by infostealers. Silence means no credentials from these domains were found in the malware database." }, "parents": [ { "id": "scope-active-devices" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Infostealer identity leaks", "reads": [ "computer_name", "date_compromised", "email", "malware_path" ], "source": "hudsonrock_search_by_email", "target": "hudsonrock", "content": "SELECT email, computer_name, date_compromised, malware_path FROM hudsonrock_search_by_email WHERE instr(',' || '{{corporate_domains}}' || ',', ',' || LOWER(SUBSTR(email, INSTR(email, '@') + 1)) || ',') > 0", "silence": "not_evidence_of_absence", "expected": "Corporate accounts compromised by infostealers. Silence means no credentials from these domains were found in the malware database.", "verified": "dry-run", "verified_at": "2026-10-14", "target_extension": "hudsonrock" } }, { "id": "weigh-external-exposure", "type": "analytic", "label": "Weigh external exposure risk", "config": { "cite": "required", "tools": [ "endpoint", "haveibeenpwned", "hudsonrock", "identity", "network", "web" ], "context": [ "check-hibp", "check-hudsonrock" ], "objective": "Categorize the exposure for corporate identities: distinguish between static historical leaks and high-risk infostealer compromises that may indicate active token theft.", "description": "Prioritize exposed identities based on the recency and severity of the leak.", "max_iterations": 3, "expected_signal": "A list of high-risk corporate accounts for the follow-on behavioral phase.", "success_criteria": "A per-account risk verdict citing the intelligence source and the type of data leaked. The analyst will use this list to populate the high_risk_identities parameter." }, "parents": [ { "id": "check-hibp", "kind": "merge" }, { "id": "check-hudsonrock", "kind": "merge" } ] }, { "id": "detect-anomalous-logins", "type": "query", "label": "Anomalous logins for high-risk identities", "config": { "dsl": "sqlite", "role": "baseline", "source": "identity", "content": "SELECT actor_user_name, src_endpoint_ip, src_location_country, device_hostname, COUNT(*) as login_count, MIN(time) as first_seen FROM hb_auth_signin WHERE status_id = 1 AND ('{{high_risk_identities}}' = '' OR instr(',' || '{{high_risk_identities}}' || ',', ',' || actor_user_name || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, src_endpoint_ip, src_location_country, device_hostname HAVING login_count < 5 ORDER BY login_count ASC", "surface": "hb_auth_signin", "description": "Find successful sign-ins from rare source IP addresses specifically for the corporate identities flagged in the intelligence phase.", "expected_signal": "Successful logins from unusual IPs or locations for high-risk accounts. Silence proves no rare successful authentications occurred for these users." }, "parents": [ { "id": "weigh-external-exposure" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Anomalous logins for high-risk identities", "reads": [ "actor_user_name", "device_hostname", "src_endpoint_ip", "src_location_country", "status_id", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT actor_user_name, src_endpoint_ip, src_location_country, device_hostname, COUNT(*) as login_count, MIN(time) as first_seen FROM hb_auth_signin WHERE status_id = 1 AND ('{{high_risk_identities}}' = '' OR instr(',' || '{{high_risk_identities}}' || ',', ',' || actor_user_name || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, src_endpoint_ip, src_location_country, device_hostname HAVING login_count < 5 ORDER BY login_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Successful logins from unusual IPs or locations for high-risk accounts. Silence proves no rare successful authentications occurred for these users.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "actor_user_name", "src_endpoint_ip" ], "rare_below": 5 }, "verified_at": "2026-10-14" } }, { "id": "detect-phishing-interaction", "type": "query", "label": "Phishing interaction for high-risk users", "config": { "dsl": "sqlite", "role": "triage", "source": "web", "content": "SELECT device_hostname, actor_user_name, url_hostname, url_path, user_agent, time FROM hb_http_activity WHERE (LOWER(url_full) LIKE '%login%' OR LOWER(url_full) LIKE '%office%' OR LOWER(url_full) LIKE '%verify%') AND ('{{high_risk_identities}}' = '' OR instr(',' || '{{high_risk_identities}}' || ',', ',' || actor_user_name || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_http_activity", "description": "Identify web requests containing credential harvesting lures from the compromised users identified earlier.", "expected_signal": "HTTP interaction with potential phishing URLs by compromised users. Silence confirms no such lures were visited by these specific accounts." }, "parents": [ { "id": "weigh-external-exposure" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Phishing interaction for high-risk users", "reads": [ "actor_user_name", "device_hostname", "time", "url_full", "url_hostname", "url_path", "user_agent" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, actor_user_name, url_hostname, url_path, user_agent, time FROM hb_http_activity WHERE (LOWER(url_full) LIKE '%login%' OR LOWER(url_full) LIKE '%office%' OR LOWER(url_full) LIKE '%verify%') AND ('{{high_risk_identities}}' = '' OR instr(',' || '{{high_risk_identities}}' || ',', ',' || actor_user_name || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "HTTP interaction with potential phishing URLs by compromised users. Silence confirms no such lures were visited by these specific accounts.", "verified": "dry-run", "verified_at": "2026-10-14" } }, { "id": "detect-data-exfiltration", "type": "query", "label": "Data exfiltration from compromised accounts", "config": { "dsl": "sqlite", "role": "enrichment", "source": "network", "content": "SELECT device_hostname, user_name, dst_endpoint_ip, SUM(traffic_bytes) as total_bytes FROM hb_network_connection WHERE state_kind = 'log' AND direction = 'outbound' AND ('{{high_risk_identities}}' = '' OR instr(',' || '{{high_risk_identities}}' || ',', ',' || user_name || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, user_name, dst_endpoint_ip HAVING total_bytes > 50000000 ORDER BY total_bytes DESC", "surface": "hb_network_connection", "description": "Identify large outbound data transfers originating from the identities previously flagged for high-risk exposure.", "expected_signal": "Outbound sessions exceeding 50MB originating from high-risk users. Silence means no such data transfers were recorded for these accounts." }, "parents": [ { "id": "weigh-external-exposure" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Data exfiltration from compromised accounts", "reads": [ "device_hostname", "direction", "dst_endpoint_ip", "state_kind", "time", "traffic_bytes", "user_name" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, user_name, dst_endpoint_ip, SUM(traffic_bytes) as total_bytes FROM hb_network_connection WHERE state_kind = 'log' AND direction = 'outbound' AND ('{{high_risk_identities}}' = '' OR instr(',' || '{{high_risk_identities}}' || ',', ',' || user_name || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, user_name, dst_endpoint_ip HAVING total_bytes > 50000000 ORDER BY total_bytes DESC", "silence": "not_evidence_of_absence", "expected": "Outbound sessions exceeding 50MB originating from high-risk users. Silence means no such data transfers were recorded for these accounts.", "verified": "dry-run", "verified_at": "2026-10-14" } }, { "id": "final-correlative-analysis", "type": "analytic", "label": "Final correlative analysis", "config": { "cite": "required", "tools": [ "endpoint", "haveibeenpwned", "hudsonrock", "identity", "network", "web" ], "context": [ "weigh-external-exposure", "detect-anomalous-logins", "detect-phishing-interaction", "detect-data-exfiltration" ], "objective": "Analyze the timing and nature of external breach reports against the internal behavioral anomalies (logins, phishing, exfiltration) to determine if a credential has been successfully weaponized.", "description": "Determine if the coincidental external exposure matches internal signs of identity theft or follow-on abuse.", "max_iterations": 6, "expected_signal": "A unified verdict for each exposed account based on both the intelligence and behavioral phases.", "success_criteria": "A per-identity verdict of malicious | suspicious | benign citing rows from internal and external phases." }, "parents": [ { "id": "detect-anomalous-logins", "kind": "merge" }, { "id": "detect-phishing-interaction", "kind": "merge" }, { "id": "detect-data-exfiltration", "kind": "merge" } ] }, { "id": "route-by-verdict", "type": "checkpoint", "label": "Route by verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the final correlative analysis verdict is malicious for at least one account", "condition": "the final correlative analysis verdict is malicious for at least one account", "blind_spot": "mfa-telemetry-gap", "confidence": "high", "description": "Direct the hunt to containment or manual impact review based on the agent's confidence.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "final-correlative-analysis" } ] }, { "id": "remediate-compromised-accounts", "type": "action", "label": "Remediate compromised accounts", "config": { "target": "identity", "description": "Secure the affected identities to stop active abuse immediately.", "instructions": "Revoke all active sessions and OAuth tokens for the malicious identities. Force a password reset and verify current MFA enrollment status for any unauthorized methods added during the period of compromise.", "action_approval": "required" }, "parents": [ { "id": "route-by-verdict", "branch": "on_supports" } ] }, { "id": "analyst-impact-review", "type": "task", "label": "Analyst impact review", "config": { "assignee": "analyst", "description": "Verify the extent of the data impact and check for follow-on persistence.", "instructions": "Review the data exfiltration and phishing interaction results for the compromised accounts. Pivot to hb_cloud_api_activity to determine which sensitive files or resources were accessed during the anomalous sessions identified by the hunt." }, "parents": [ { "id": "route-by-verdict", "branch": "default" }, { "id": "route-by-verdict", "branch": "on_unavailable" }, { "id": "remediate-compromised-accounts" } ] }, { "id": "close-out-and-tune", "type": "task", "label": "Close out and tune", "config": { "assignee": "analyst", "description": "Document findings and update watchlists for long-term monitoring.", "instructions": "Document the identities remediated and any malicious infrastructure found. Update internal blocklists with source IPs from anomalous logins and refine the corporate domain monitoring in external intel providers." }, "parents": [ { "id": "route-by-verdict", "branch": "on_refutes" }, { "id": "analyst-impact-review" } ] } ] }