{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Identity compromise is a primary driver for data exfiltration. Confirming mailbox integrity after auth anomalies provides high assurance." }, "name": "Identity and Cloud Access Anomalies", "type": "investigation", "labels": [ "hunt", "attack.t1133", "attack.t1110.004", "attack.t1114.003", "attack.t1003.001", "attack.t1490", "collection", "credential access", "execution", "impact", "initial access", "persistence" ], "series": { "slug": "reports-of-siem-s-death-have-been-greatly-exaggerated", "index": 1, "title": "Reports of SIEM's Death Have Been Greatly Exaggerated", "total": 2 }, "related": [ { "hunt": "persistence-unauthorized-rmm-and-admins", "reason": "This hunt focus on exfiltration; RMM persistence belongs to a sibling hunt.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A single rule might detect an inbox rule creation, but it cannot contextualize it with preceding MFA fatigue or follow-on endpoint sabotage. This hunt connects the chain.", "coverage": [ { "stage": "initial-access-vpn-abuse", "steps": [ "auth-anomaly-lead", "geographic-rarity" ], "status": "covered" }, { "stage": "collection-inbox-forwarding", "steps": [ "mailbox-rule-forwarding" ], "status": "covered" }, { "stage": "credential-access-lsass-dumping", "steps": [ "endpoint-impact-check" ], "status": "covered" }, { "stage": "impact-shadow-copy-deletion", "steps": [ "endpoint-impact-check" ], "status": "covered" }, { "stage": "execution-encoded-powershell", "reason": "Belongs to another part of the \"Reports of SIEM's Death Have Been Greatly Exaggerated\" series.", "status": "out_of_scope" }, { "stage": "persistence-unauthorized-rmm-and-admins", "reason": "Belongs to another part of the \"Reports of SIEM's Death Have Been Greatly Exaggerated\" series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "VPN and Identity Abuse", "slug": "initial-access-vpn-abuse", "tactic": "initial-access", "techniques": [ "T1133", "T1110.004" ], "observables": [ "VPN login from an unusual country", "Credential stuffing attempts", "Service account logging into VPN", "MFA prompt bombing (MFA fatigue)" ] }, { "name": "Encoded PowerShell Execution", "slug": "execution-encoded-powershell", "tactic": "execution", "techniques": [ "T1059.001" ], "observables": [ "Encoded PowerShell commands", "powershell.exe -enc", "powershell.exe -EncodedCommand" ] }, { "name": "Persistence via RMM and New Admins", "slug": "persistence-unauthorized-rmm-and-admins", "tactic": "persistence", "techniques": [ "T1133", "T1136.001" ], "observables": [ "ScreenConnect execution", "New domain admin account creation", "New local administrator account creation" ] }, { "name": "LSASS Memory Dumping", "slug": "credential-access-lsass-dumping", "tactic": "credential-access", "techniques": [ "T1003.001" ], "observables": [ "Mimikatz execution", "LSASS process memory access", "dbghelp.dll loading from uncommon locations" ] }, { "name": "Email Collection via Inbox Rules", "slug": "collection-inbox-forwarding", "tactic": "collection", "techniques": [ "T1114.003" ], "observables": [ "Microsoft 365 inbox rule forwarding mail to outside address", "New-InboxRule cmdlet usage" ] }, { "name": "Inhibit System Recovery", "slug": "impact-shadow-copy-deletion", "tactic": "impact", "techniques": [ "T1490" ], "observables": [ "Shadow copies getting wiped", "vssadmin delete shadows" ] } ], "summary": "This article outlines common attacker behaviors observed across endpoint and identity planes, including credential stuffing against VPNs, the use of encoded PowerShell for execution, and persistence via unauthorized RMM tools like ScreenConnect. The intrusion culminates in credential theft via LSASS dumping and the destruction of system recovery options like volume shadow copies to maximize impact." }, "severity": "medium", "rationale": "Focus on users with administrative roles. Use hostnames from the lead query to scope the endpoint impact check.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder gained access via credential stuffing or MFA fatigue and established email collection or inhibited system recovery.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-defined", "kind": "manual", "observed": "2025-01-20" }, "type": "list[host]", "default": [], "description": "Limit search to specific hostnames identified in the lead." }, "scope_users": { "from": { "ref": "analyst-defined", "kind": "manual", "observed": "2025-01-20" }, "type": "list[string]", "default": [], "description": "Usernames identified in the lead to focus follow-on queries." }, "lookback_days": { "from": { "ref": "analyst-defined", "kind": "manual", "observed": "2025-01-20" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "mfa_failure_threshold": { "from": { "ref": "analyst-defined", "kind": "manual", "observed": "2025-01-20" }, "type": "number", "default": "5", "description": "Number of authentication failures to flag potential MFA fatigue or stuffing." }, "rare_country_threshold": { "from": { "ref": "analyst-defined", "kind": "manual", "observed": "2025-01-20" }, "type": "number", "default": "2", "description": "Threshold for users per country to be considered rare." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/reports-that-siem-is-dead-are-exaggerated", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/reports-that-siem-is-dead-are-exaggerated", "name": "Huntress \u2014 Reports of SIEM's Death Have Been Greatly Exaggerated" } ], "blind_spots": [ { "id": "no-geo-enrichment", "risk": "If the identity provider does not provide geolocation, the rarity check returns no signal.", "owner": "Identity Provider Admin", "stage": "initial-access-vpn-abuse", "question": "whether a login comes from a rare country", "requires": "src_location_country in hb_auth_signin", "remediation": "Enable geolocation logs at the source." }, { "id": "cloud-api-retention-limit", "risk": "Adversaries establishing long-term persistence will be missing from current logs.", "owner": "Security Operations", "stage": "collection-inbox-forwarding", "question": "whether a rule was created before the lookback window", "requires": "hb_cloud_api_activity retention > 30 days", "remediation": "Extend audit log retention." } ] }, "name": "Identity and Cloud Access Anomalies", "description": "This hunt detects accounts under brute-force or MFA fatigue pressure and links them to rare geographic logins and unauthorized inbox forwarding. It connects identity compromise to data collection by joining authentication telemetry with cloud API logs. The flow evaluates authentication anomalies alongside geographic rarity and endpoint impact indicators like LSASS memory access or system recovery inhibition." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "reports-of-siem-s-death-have-been-greatly-exaggerated", "index": 1, "title": "Reports of SIEM's Death Have Been Greatly Exaggerated", "total": 2 }, "coverage": [ { "stage": "initial-access-vpn-abuse", "steps": [ "auth-anomaly-lead", "geographic-rarity" ], "status": "covered" }, { "stage": "collection-inbox-forwarding", "steps": [ "mailbox-rule-forwarding" ], "status": "covered" }, { "stage": "credential-access-lsass-dumping", "steps": [ "endpoint-impact-check" ], "status": "covered" }, { "stage": "impact-shadow-copy-deletion", "steps": [ "endpoint-impact-check" ], "status": "covered" }, { "stage": "execution-encoded-powershell", "reason": "Belongs to another part of the \"Reports of SIEM's Death Have Been Greatly Exaggerated\" series.", "status": "out_of_scope" }, { "stage": "persistence-unauthorized-rmm-and-admins", "reason": "Belongs to another part of the \"Reports of SIEM's Death Have Been Greatly Exaggerated\" series.", "status": "out_of_scope" } ], "rationale": "An intruder gained access via credential stuffing or MFA fatigue and established email collection or inhibited system recovery.", "blind_spots": [ { "id": "no-geo-enrichment", "risk": "If the identity provider does not provide geolocation, the rarity check returns no signal.", "owner": "Identity Provider Admin", "stage": "initial-access-vpn-abuse", "question": "whether a login comes from a rare country", "requires": "src_location_country in hb_auth_signin", "remediation": "Enable geolocation logs at the source." }, { "id": "cloud-api-retention-limit", "risk": "Adversaries establishing long-term persistence will be missing from current logs.", "owner": "Security Operations", "stage": "collection-inbox-forwarding", "question": "whether a rule was created before the lookback window", "requires": "hb_cloud_api_activity retention > 30 days", "remediation": "Extend audit log retention." } ], "scoping_notes": "Focus on users with administrative roles. Use hostnames from the lead query to scope the endpoint impact check.", "beyond_detection": "A single rule might detect an inbox rule creation, but it cannot contextualize it with preceding MFA fatigue or follow-on endpoint sabotage. This hunt connects the chain." } }, { "id": "auth-anomaly-lead", "type": "query", "label": "Authentication Anomaly Lead", "config": { "dsl": "sqlite", "role": "scoping", "source": "identity", "content": "SELECT LOWER(actor_user_name) AS user, COUNT(CASE WHEN activity_id = 5 THEN 1 END) AS failures, COUNT(CASE WHEN activity_id = 1 AND (LOWER(actor_user_name) LIKE '%svc-%' OR LOWER(actor_user_name) LIKE '%service%') THEN 1 END) AS service_logons, MIN(time) AS first_attempt, MAX(time) AS last_attempt FROM hb_auth_signin WHERE time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(actor_user_name) HAVING failures >= {{mfa_failure_threshold}} OR service_logons > 0 ORDER BY failures DESC", "surface": "hb_auth_signin", "description": "Identify users with high failure rates or service accounts logging into interactive services.", "expected_signal": "Rows identify users targeted by brute-force or service accounts acting as users. Silence suggests no detected identity-level hammering." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Authentication Anomaly Lead", "reads": [ "actor_user_name", "activity_id", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT LOWER(actor_user_name) AS user, COUNT(CASE WHEN activity_id = 5 THEN 1 END) AS failures, COUNT(CASE WHEN activity_id = 1 AND (LOWER(actor_user_name) LIKE '%svc-%' OR LOWER(actor_user_name) LIKE '%service%') THEN 1 END) AS service_logons, MIN(time) AS first_attempt, MAX(time) AS last_attempt FROM hb_auth_signin WHERE time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(actor_user_name) HAVING failures >= {{mfa_failure_threshold}} OR service_logons > 0 ORDER BY failures DESC", "silence": "not_evidence_of_absence", "expected": "Rows identify users targeted by brute-force or service accounts acting as users. Silence suggests no detected identity-level hammering.", "verified": "dry-run", "verified_at": "2026-10-31" } }, { "id": "geographic-rarity", "type": "query", "label": "Geographic Rarity Check", "config": { "dsl": "sqlite", "role": "baseline", "source": "identity", "content": "SELECT src_location_country, COUNT(DISTINCT actor_user_name) AS distinct_users, MIN(time) AS first_seen FROM hb_auth_signin WHERE activity_id = 1 AND ('{{scope_users}}' = '' OR instr(',' || '{{scope_users}}' || ',', ',' || LOWER(actor_user_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_location_country HAVING distinct_users <= {{rare_country_threshold}}", "surface": "hb_auth_signin", "description": "Identify logins from countries that are rare for the organization or identified users.", "expected_signal": "A list of countries associated with very few users, suggesting attacker infrastructure." }, "parents": [ { "id": "auth-anomaly-lead" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Geographic Rarity Check", "reads": [ "src_location_country", "actor_user_name", "activity_id", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT src_location_country, COUNT(DISTINCT actor_user_name) AS distinct_users, MIN(time) AS first_seen FROM hb_auth_signin WHERE activity_id = 1 AND ('{{scope_users}}' = '' OR instr(',' || '{{scope_users}}' || ',', ',' || LOWER(actor_user_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_location_country HAVING distinct_users <= {{rare_country_threshold}}", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A list of countries associated with very few users, suggesting attacker infrastructure.", "verified": "dry-run", "prevalence": { "by": "actor_user_name", "key": [ "src_location_country" ], "rare_below": 3 }, "verified_at": "2026-10-31" } }, { "id": "mailbox-rule-forwarding", "type": "query", "label": "Mailbox Rule Forwarding", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT time, actor_user_name, api_operation, target_modified_property_new_values FROM hb_cloud_api_activity WHERE provider = 'm365' AND LOWER(api_operation) IN ('new-inboxrule', 'set-inboxrule') AND (instr(LOWER(target_modified_property_new_values), 'forwardto') > 0 OR instr(LOWER(target_modified_property_new_values), 'redirectto') > 0) AND ('{{scope_users}}' = '' OR instr(',' || '{{scope_users}}' || ',', ',' || LOWER(actor_user_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_cloud_api_activity", "description": "Search for Microsoft 365 inbox rule creations that redirect mail to external recipients.", "expected_signal": "Cloud API records of users modifying inbox rules to redirect email. Silence is evidence of absence if logs are complete." }, "parents": [ { "id": "auth-anomaly-lead" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Mailbox Rule Forwarding", "reads": [ "time", "actor_user_name", "api_operation", "target_modified_property_new_values", "provider" ], "source": "hb_cloud_api_activity", "target": "endpoint", "content": "SELECT time, actor_user_name, api_operation, target_modified_property_new_values FROM hb_cloud_api_activity WHERE provider = 'm365' AND LOWER(api_operation) IN ('new-inboxrule', 'set-inboxrule') AND (instr(LOWER(target_modified_property_new_values), 'forwardto') > 0 OR instr(LOWER(target_modified_property_new_values), 'redirectto') > 0) AND ('{{scope_users}}' = '' OR instr(',' || '{{scope_users}}' || ',', ',' || LOWER(actor_user_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "Cloud API records of users modifying inbox rules to redirect email. Silence is evidence of absence if logs are complete.", "verified": "dry-run", "verified_at": "2026-10-31" } }, { "id": "endpoint-impact-check", "type": "query", "label": "Endpoint Impact Check", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%vssadmin%delete%shadows%' OR LOWER(process_cmd_line) LIKE '%wbadmin%delete%catalog%' OR LOWER(process_cmd_line) LIKE '%bcdedit%/set%recoveryenabled%no%' OR LOWER(process_name) LIKE '%mimikatz%' OR LOWER(process_name) LIKE '%procdump%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Check for LSASS memory access or recovery inhibition on the scoped hosts.", "expected_signal": "Any row indicates an attempt to sabotage recovery or dump credentials on a host involved in the authentication anomalies." }, "parents": [ { "id": "auth-anomaly-lead" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Endpoint Impact Check", "reads": [ "device_hostname", "process_cmd_line", "user_name", "process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%vssadmin%delete%shadows%' OR LOWER(process_cmd_line) LIKE '%wbadmin%delete%catalog%' OR LOWER(process_cmd_line) LIKE '%bcdedit%/set%recoveryenabled%no%' OR LOWER(process_name) LIKE '%mimikatz%' OR LOWER(process_name) LIKE '%procdump%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Any row indicates an attempt to sabotage recovery or dump credentials on a host involved in the authentication anomalies.", "verified": "dry-run", "verified_at": "2026-10-31" } }, { "id": "triage-compromise", "type": "analytic", "label": "Triage Identity Compromise", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "auth-anomaly-lead", "geographic-rarity", "mailbox-rule-forwarding", "endpoint-impact-check" ], "objective": "Determine if any user account has been compromised by linking VPN/auth patterns with inbox rule modifications and endpoint impact signs.", "description": "Analyze authentication leads, geographic rarity, and mailbox modifications to determine if an account is compromised.", "max_iterations": 6, "expected_signal": "A triage report with verdicts and citations.", "success_criteria": "A per-user verdict citing rows from all surfaces." }, "parents": [ { "id": "geographic-rarity", "kind": "merge" }, { "id": "mailbox-rule-forwarding", "kind": "merge" }, { "id": "endpoint-impact-check", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on Verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one account", "condition": "the triage verdict is malicious for at least one account", "blind_spot": "no-geo-enrichment", "confidence": "high", "description": "Direct response based on the compromise verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-compromise" } ] }, { "id": "contain-account", "type": "action", "label": "Contain Identity", "config": { "target": "identity", "description": "Contain the compromise and remove the malicious persistence.", "instructions": "Revoke active sessions, reset passwords for compromised accounts, and delete the unauthorized inbox rules.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "manual-review", "type": "task", "label": "Analyst Manual Review", "config": { "assignee": "analyst", "description": "Verify containment and check for lateral movement.", "instructions": "Review the full cloud API history for other unauthorized changes such as Entra ID app registrations. Confirm malicious rules are deleted." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "contain-account" } ] }, { "id": "close-out", "type": "task", "label": "Hunt Close-out", "config": { "assignee": "analyst", "description": "Document outcome.", "instructions": "Record confirmed indicator domains from the rules. Note whether the MFA failure threshold requires tuning." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "manual-review" } ] } ] }