--- analysis: A standard detection rule alerts on a single bad IP or a password spray. This hunt correlates external exposure (infostealer token theft) with internal behavioral anomalies across three surfaces, requiring an agent to weigh the coincidence of the leak against active usage patterns. blind_spots: - id: ssl-inspection-gap owner: Network Engineering question: What full URI paths were visited on suspected phishing domains? remediation: Deploy endpoint-based HTTP inspection or enable corporate proxy SSL decryption. requires: SSL decryption for hb_http_activity risk: Phishing interaction remains unconfirmed without path context; we can see the domain but not whether a credential form was submitted. stage: phishing-follow-on - id: mfa-telemetry-gap owner: Identity Engineering question: Was the anomalous login successful because MFA was bypassed or because a session token was stolen? remediation: Enable and export full conditional access and MFA logs to the centralized log pool. requires: hb_auth_signin with full MFA event details risk: Inability to distinguish between simple password reuse and sophisticated session hijacking via infostealer logs. stage: account-misuse-and-recovery coverage: - stage: data-exfiltration status: covered steps: - detect-data-exfiltration - stage: phishing-follow-on status: covered steps: - detect-phishing-interaction - stage: external-identity-exposure status: covered steps: - check-hibp - check-hudsonrock - stage: account-misuse-and-recovery status: covered steps: - detect-anomalous-logins - remediate-compromised-accounts guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: Third-party breaches and infostealer activity provide early warning of targeted account takeover. Correlating external intel with internal authentication and network behavior is critical for protecting corporate data assets. methodology: model-assisted trigger: intel-report hypothesis: Adversaries are leveraging corporate credentials exposed in third-party data breaches to bypass authentication, propagate phishing lures, and exfiltrate data from internal endpoints. labels: - hunt - attack.t1041 - attack.t1566 - exfiltration - initial access - haveibeenpwned - hudsonrock name: Identity Breach and Account Abuse parameters: corporate_domains: default: - example.com description: Corporate email domains to check against external breach databases. from: kind: manual observed: '2024-05-20' ref: internal-policy type: list[string] high_risk_identities: default: [] description: List of compromised identities identified in the first phase. Leave empty to run the hunt for all users on scoped hosts. from: kind: manual observed: '2024-05-20' ref: weigh-external-exposure type: list[string] lookback_days: default: '14' description: Days of history to examine for internal behavioral anomalies. from: kind: manual observed: '2024-05-20' ref: hunt-standard type: number scope_hosts: default: [] description: Optional list of hostnames to focus the internal corroboration steps. from: kind: manual observed: '2024-05-20' ref: scoping-query type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.welivesecurity.com/en/how-to/what-to-do-when-a-data-breach-notice-tells-you-almost-nothing/ gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Focus internal behavioral queries on hosts that have reported active status within the lookback window. Prioritize accounts belonging to users in high-privilege departments such as IT, HR, or Finance. references: - name: "ESET Research \u2014 What to do when a data breach notice tells you almost\ \ nothing" url: https://www.welivesecurity.com/en/how-to/what-to-do-when-a-data-breach-notice-tells-you-almost-nothing/ related: - hunt: infostealer-infection-remediation reason: This hunt focuses on the identity impact; a related hunt focuses on cleaning the infected unmanaged machines themselves. relation: alternative scenario: stages: - name: Data Exfiltration Over C2 observables: - large data volumes - exfiltrated data - access to sensitive information slug: data-exfiltration tactic: exfiltration techniques: - T1041 - name: Follow-on Phishing Attempts observables: - unsolicited breach notification email - links in these messages - targeted phishing calls slug: phishing-follow-on tactic: initial-access techniques: - T1566 - name: External Identity Exposure observables: - leaked usernames and passwords - exposed email addresses - exposed phone numbers - government ID exposure slug: external-identity-exposure tactic: initial-access techniques: - T1566 - name: Account Misuse and Remediation observables: - suspicious activity on affected accounts - password reset events - enabling two-factor authentication (2FA) slug: account-misuse-and-recovery tactic: initial-access techniques: - T1566 summary: The campaign involves the large-scale exfiltration of sensitive organizational and personal data, which is subsequently leveraged by adversaries for targeted phishing and credential misuse. Defenders must identify exposure via external breach intelligence and monitor for anomalous sign-ins or remediation actions like emergency password resets. severity: medium targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint haveibeenpwned: category: siem huntbase: product: haveibeenpwned name: haveibeenpwned hudsonrock: category: siem huntbase: product: hudsonrock name: hudsonrock hunter: agent: true name: Hunt agent identity: category: identity name: Identity / sign-in telemetry telemetry: - identity network: category: network name: Network telemetry telemetry: - network web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # Identity Breach and Account Abuse This phased hunt identifies corporate identities compromised in external breaches and infostealer activity, then monitors those specific accounts for anomalous internal behavior. By correlating external intelligence with authentication, web, and network telemetry, the hunt distinguishes between simple credential exposure and active account weaponization. ## scope-active-devices Identify recently active hosts to focus the internal behavioral queries. ```sqlite target=endpoint role=scoping params=(lookback_days=lookback_days) ~~~yaml expected: A list of hostnames that have reported inventory recently. Silence means no active devices are reporting. reads: - hostname - lifecycle_state - time silence: not_evidence_of_absence source: hb_devices verified: dry-run verified_at: '2026-10-14' ~~~ SELECT DISTINCT hostname AS device_hostname FROM hb_devices WHERE (lifecycle_state = 'active' OR lifecycle_state = 'running') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## external-intel-fan-out parallel: - → check-hibp - → check-hudsonrock join: → weigh-external-exposure ## check-hibp Check if corporate accounts appear in public data breaches listed by HaveIBeenPwned. ```sqlite target=haveibeenpwned role=enrichment params=(corporate_domains=corporate_domains) ~~~yaml expected: Corporate accounts found in third-party breaches. Silence confirms no corporate identities are present in the HIBP snapshot. reads: - account - data_classes - name silence: not_evidence_of_absence source: hibp_breached_account verified: dry-run verified_at: '2026-10-14' ~~~ SELECT account, name AS breach_name, data_classes FROM hibp_breached_account WHERE instr(',' || '{{corporate_domains}}' || ',', ',' || LOWER(SUBSTR(account, INSTR(account, '@') + 1)) || ',') > 0 ``` ## check-hudsonrock Identify corporate users whose credentials were stolen by stealer malware as recorded by Hudson Rock. ```sqlite target=hudsonrock role=enrichment params=(corporate_domains=corporate_domains) ~~~yaml expected: Corporate accounts compromised by infostealers. Silence means no credentials from these domains were found in the malware database. reads: - computer_name - date_compromised - email - malware_path silence: not_evidence_of_absence source: hudsonrock_search_by_email verified: dry-run verified_at: '2026-10-14' ~~~ SELECT email, computer_name, date_compromised, malware_path FROM hudsonrock_search_by_email WHERE instr(',' || '{{corporate_domains}}' || ',', ',' || LOWER(SUBSTR(email, INSTR(email, '@') + 1)) || ',') > 0 ``` ## weigh-external-exposure ```agent target=hunter cite: required context: - check-hibp - check-hudsonrock max_iterations: 3 objective: 'Categorize the exposure for corporate identities: distinguish between static historical leaks and high-risk infostealer compromises that may indicate active token theft.' success_criteria: A per-account risk verdict citing the intelligence source and the type of data leaked. The analyst will use this list to populate the high_risk_identities parameter. tools: - endpoint - haveibeenpwned - hudsonrock - identity - network - web ``` ## internal-behavior-fan-out parallel: - → detect-anomalous-logins - → detect-phishing-interaction - → detect-data-exfiltration join: → final-correlative-analysis ## detect-anomalous-logins Find successful sign-ins from rare source IP addresses specifically for the corporate identities flagged in the intelligence phase. ```sqlite target=identity role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts, high_risk_identities=high_risk_identities) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Successful logins from unusual IPs or locations for high-risk accounts. Silence proves no rare successful authentications occurred for these users. prevalence: by: device_hostname key: - actor_user_name - src_endpoint_ip rare_below: 5 reads: - actor_user_name - device_hostname - src_endpoint_ip - src_location_country - status_id - time silence: not_evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-10-14' ~~~ SELECT actor_user_name, src_endpoint_ip, src_location_country, device_hostname, COUNT(*) as login_count, MIN(time) as first_seen FROM hb_auth_signin WHERE status_id = 1 AND ('{{high_risk_identities}}' = '' OR instr(',' || '{{high_risk_identities}}' || ',', ',' || actor_user_name || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, src_endpoint_ip, src_location_country, device_hostname HAVING login_count < 5 ORDER BY login_count ASC ``` ## detect-phishing-interaction Identify web requests containing credential harvesting lures from the compromised users identified earlier. ```sqlite target=web role=triage params=(lookback_days=lookback_days, scope_hosts=scope_hosts, high_risk_identities=high_risk_identities) ~~~yaml expected: HTTP interaction with potential phishing URLs by compromised users. Silence confirms no such lures were visited by these specific accounts. reads: - actor_user_name - device_hostname - time - url_full - url_hostname - url_path - user_agent silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-10-14' ~~~ SELECT device_hostname, actor_user_name, url_hostname, url_path, user_agent, time FROM hb_http_activity WHERE (LOWER(url_full) LIKE '%login%' OR LOWER(url_full) LIKE '%office%' OR LOWER(url_full) LIKE '%verify%') AND ('{{high_risk_identities}}' = '' OR instr(',' || '{{high_risk_identities}}' || ',', ',' || actor_user_name || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## detect-data-exfiltration Identify large outbound data transfers originating from the identities previously flagged for high-risk exposure. ```sqlite target=network role=enrichment params=(lookback_days=lookback_days, scope_hosts=scope_hosts, high_risk_identities=high_risk_identities) ~~~yaml expected: Outbound sessions exceeding 50MB originating from high-risk users. Silence means no such data transfers were recorded for these accounts. reads: - device_hostname - direction - dst_endpoint_ip - state_kind - time - traffic_bytes - user_name silence: not_evidence_of_absence source: hb_network_connection verified: dry-run verified_at: '2026-10-14' ~~~ SELECT device_hostname, user_name, dst_endpoint_ip, SUM(traffic_bytes) as total_bytes FROM hb_network_connection WHERE state_kind = 'log' AND direction = 'outbound' AND ('{{high_risk_identities}}' = '' OR instr(',' || '{{high_risk_identities}}' || ',', ',' || user_name || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, user_name, dst_endpoint_ip HAVING total_bytes > 50000000 ORDER BY total_bytes DESC ``` ## final-correlative-analysis ```agent target=hunter cite: required context: - weigh-external-exposure - detect-anomalous-logins - detect-phishing-interaction - detect-data-exfiltration max_iterations: 6 objective: Analyze the timing and nature of external breach reports against the internal behavioral anomalies (logins, phishing, exfiltration) to determine if a credential has been successfully weaponized. success_criteria: A per-identity verdict of malicious | suspicious | benign citing rows from internal and external phases. tools: - endpoint - haveibeenpwned - hudsonrock - identity - network - web ``` ## route-by-verdict if~: "the final correlative analysis verdict is malicious for at least one account" (confidence: high, judge=hunter) then: → remediate-compromised-accounts indeterminate: → analyst-impact-review unavailable: → analyst-impact-review (blind_spot: mfa-telemetry-gap) else: → close-out-and-tune ## remediate-compromised-accounts ```action target=identity ~~~yaml approval: required ~~~ Revoke all active sessions and OAuth tokens for the malicious identities. Force a password reset and verify current MFA enrollment status for any unauthorized methods added during the period of compromise. ``` → analyst-impact-review ## analyst-impact-review ```manual target=analyst Review the data exfiltration and phishing interaction results for the compromised accounts. Pivot to hb_cloud_api_activity to determine which sensitive files or resources were accessed during the anomalous sessions identified by the hunt. ``` → close-out-and-tune ## close-out-and-tune ```manual target=analyst Document the identities remediated and any malicious infrastructure found. Update internal blocklists with source IPs from anomalous logins and refine the corporate domain monitoring in external intel providers. ``` → end