{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Identity is the new perimeter; protecting credentials is as critical as protecting local files. This hunt detects the bridge from endpoint vulnerability to cloud compromise, addressing the high-risk trends of phished credentials and token theft." }, "name": "Identity and Cloud Access Monitoring", "type": "investigation", "labels": [ "hunt", "attack.t1566", "attack.t1195", "attack.t1190", "attack.t1041", "defense evasion", "execution", "exfiltration", "impact", "initial access" ], "series": { "slug": "10-endpoint-security-trends-and-tips-for-2027-huntress", "index": 1, "title": "10 Endpoint Security Trends and Tips for 2027 | Huntress", "total": 2 }, "related": [ { "hunt": "powershell-wmi-lotl-execution", "reason": "This hunt focuses on identity compromise; the subsequent LotL endpoint execution is handled in a separate hunt.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A standard rule flags MFA failures; this hunt correlates those failures with known vulnerable beachheads and subsequent rare cloud API actions, providing the cross-surface context a single rule lacks.", "coverage": [ { "stage": "initial-access-and-identity-compromise", "steps": [ "find-vulnerable-hosts", "check-mfa-fatigue", "rare-cloud-credential-ops" ], "status": "covered" }, { "stage": "native-execution-via-powershell-and-wmi", "reason": "Covered by the LotL execution hunt in this series.", "status": "out_of_scope" }, { "stage": "stealthy-proxy-execution-lolbins", "reason": "Covered by the Lolbins hunt in this series.", "status": "out_of_scope" }, { "stage": "data-theft-and-exfiltration", "reason": "Requires network flow bytes or specialized SaaS data-access logs not examined here.", "status": "not_visible" }, { "stage": "ransomware-impact-and-encryption", "reason": "Belongs to another part of the '10 Endpoint Security Trends and Tips for 2027 | Huntress' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Initial Access and Identity Compromise", "slug": "initial-access-and-identity-compromise", "tactic": "initial-access", "techniques": [ "T1566", "T1195", "T1190" ], "observables": [ "Phished credentials", "Abuse of remote management tools (RMM)", "Exploitation of internet-facing vulnerabilities", "Compromised API keys and service tokens", "MFA fatigue (repeated authentication failures/requests)" ] }, { "name": "Native Execution via PowerShell and WMI", "slug": "native-execution-via-powershell-and-wmi", "tactic": "execution", "techniques": [ "T1059.001", "T1047" ], "observables": [ "Unusual PowerShell scripts launched by non-admin users", "WMI commands for remote execution or persistence", "Execution of commands via wmic.exe or scrcons.exe" ] }, { "name": "Stealthy Proxy Execution (LOLBins)", "slug": "stealthy-proxy-execution-lolbins", "tactic": "defense-evasion", "techniques": [ "T1218" ], "observables": [ "Signed Windows binaries (LOLBins) used for malicious execution", "Subtle clues like unusual command-line arguments for trusted utilities" ] }, { "name": "Data Theft and Exfiltration", "slug": "data-theft-and-exfiltration", "tactic": "exfiltration", "techniques": [ "T1041" ], "observables": [ "Staging of data in temp directories", "High-volume outbound network traffic to unrecognized IPs", "Connections from IoT/OT devices to critical assets" ] }, { "name": "Ransomware Impact and Encryption", "slug": "ransomware-impact-and-encryption", "tactic": "impact", "techniques": [ "T1486" ], "observables": [ "Massive file renaming or extension changes (e.g., .encrypted, .ransom)", "Rapid modification/deletion of files across shares" ] } ], "summary": "Attackers utilize phishing, supply-chain compromise, or the exploitation of public-facing applications to gain a foothold before pivoting to identity-based attacks like MFA fatigue. Once inside, they move laterally and execute commands using native tools like PowerShell and WMI to avoid detection, eventually culminating in data exfiltration and multi-layered ransomware extortion." }, "severity": "medium", "rationale": "The hunt uses critical vulnerabilities joined with internet-exposed asset data as the primary scoping lead. If the estate has a strong patching posture, widen the scope to include medium-severity vulnerabilities.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has gained initial access via phished credentials or a public-facing vulnerability and is now attempting to abuse cloud identities, evidenced by MFA fatigue patterns and rare credential-related API operations.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2024-01-01" }, "type": "list[host]", "default": [], "description": "Optional list of hostnames to focus the search; leave empty for the entire estate." }, "lookback_days": { "from": { "ref": "incident-standard-window", "kind": "manual", "observed": "2024-01-01" }, "type": "number", "default": "14", "description": "Days of history to examine for authentication failures and API calls." }, "mfa_failure_threshold": { "from": { "ref": "standard-baseline", "kind": "manual", "observed": "2024-01-01" }, "type": "number", "default": "15", "description": "Minimum authentication failures per user/IP to flag as a potential MFA fatigue attempt." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/endpoint-security-trends", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/endpoint-security-trends", "name": "Huntress \u2014 10 Endpoint Security Trends and Tips for 2027" } ], "blind_spots": [ { "id": "no-cloud-telemetry", "risk": "Identity abuse in unmonitored tenants will be invisible, leaving a persistence gap.", "stage": "initial-access-and-identity-compromise", "question": "whether the attacker accessed a cloud tenant not enrolled in monitoring", "requires": "hb_cloud_api_activity" }, { "id": "mfa-success-correlation", "risk": "Without success correlation, we may miss the moment the user finally approved a fraudulent request.", "stage": "initial-access-and-identity-compromise", "question": "did an MFA fatigue burst end with a successful authentication", "requires": "OCSF status_detail for sign-ins" } ] }, "name": "Identity and Cloud Access Monitoring", "description": "This hunt centers on the article's focus on identity as the new perimeter. It identifies vulnerable entry points and correlates them with identity-based attacks. By monitoring for MFA fatigue (high-frequency sign-in failures) alongside rare cloud credential manipulations, the hunt finds attackers who have pivoted from endpoint compromise to cloud account takeover. The hunt flows through a scoping step for vulnerable assets, a fan-out of behavioral queries on authentication and cloud logs, and a final agent-led triage to confirm the compromise." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "10-endpoint-security-trends-and-tips-for-2027-huntress", "index": 1, "title": "10 Endpoint Security Trends and Tips for 2027 | Huntress", "total": 2 }, "coverage": [ { "stage": "initial-access-and-identity-compromise", "steps": [ "find-vulnerable-hosts", "check-mfa-fatigue", "rare-cloud-credential-ops" ], "status": "covered" }, { "stage": "native-execution-via-powershell-and-wmi", "reason": "Covered by the LotL execution hunt in this series.", "status": "out_of_scope" }, { "stage": "stealthy-proxy-execution-lolbins", "reason": "Covered by the Lolbins hunt in this series.", "status": "out_of_scope" }, { "stage": "data-theft-and-exfiltration", "reason": "Requires network flow bytes or specialized SaaS data-access logs not examined here.", "status": "not_visible" }, { "stage": "ransomware-impact-and-encryption", "reason": "Belongs to another part of the '10 Endpoint Security Trends and Tips for 2027 | Huntress' series.", "status": "out_of_scope" } ], "rationale": "An adversary has gained initial access via phished credentials or a public-facing vulnerability and is now attempting to abuse cloud identities, evidenced by MFA fatigue patterns and rare credential-related API operations.", "blind_spots": [ { "id": "no-cloud-telemetry", "risk": "Identity abuse in unmonitored tenants will be invisible, leaving a persistence gap.", "stage": "initial-access-and-identity-compromise", "question": "whether the attacker accessed a cloud tenant not enrolled in monitoring", "requires": "hb_cloud_api_activity" }, { "id": "mfa-success-correlation", "risk": "Without success correlation, we may miss the moment the user finally approved a fraudulent request.", "stage": "initial-access-and-identity-compromise", "question": "did an MFA fatigue burst end with a successful authentication", "requires": "OCSF status_detail for sign-ins" } ], "scoping_notes": "The hunt uses critical vulnerabilities joined with internet-exposed asset data as the primary scoping lead. If the estate has a strong patching posture, widen the scope to include medium-severity vulnerabilities.", "beyond_detection": "A standard rule flags MFA failures; this hunt correlates those failures with known vulnerable beachheads and subsequent rare cloud API actions, providing the cross-surface context a single rule lacks." } }, { "id": "find-vulnerable-hosts", "type": "query", "label": "Find vulnerable beachheads", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT v.device_uid, d.hostname, v.cve_uid, v.title, e.ip_address FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid JOIN hb_exposed_assets e ON d.ip_address = e.ip_address WHERE v.severity_id >= 4 AND v.status != 'suppressed' AND (LOWER(v.title) LIKE '%remote%' OR LOWER(v.title) LIKE '%execution%' OR LOWER(v.title) LIKE '%bypass%')", "surface": "hb_vulnerability_finding", "description": "Identify hosts with critical vulnerabilities that serve as likely entry points, prioritizing those with an active external exposure.", "expected_signal": "A list of hosts with unpatched critical vulnerabilities that are also exposed to the internet. Silence indicates no such high-risk vulnerabilities are currently indexed." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Find vulnerable beachheads", "reads": [ "device_uid", "cve_uid", "title", "severity_id", "status" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT v.device_uid, d.hostname, v.cve_uid, v.title, e.ip_address FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid JOIN hb_exposed_assets e ON d.ip_address = e.ip_address WHERE v.severity_id >= 4 AND v.status != 'suppressed' AND (LOWER(v.title) LIKE '%remote%' OR LOWER(v.title) LIKE '%execution%' OR LOWER(v.title) LIKE '%bypass%')", "silence": "not_evidence_of_absence", "expected": "A list of hosts with unpatched critical vulnerabilities that are also exposed to the internet. Silence indicates no such high-risk vulnerabilities are currently indexed.", "verified": "dry-run", "verified_at": "2026-10-15" } }, { "id": "check-mfa-fatigue", "type": "query", "label": "Monitor for MFA fatigue", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "identity", "content": "SELECT actor_user_name, src_endpoint_ip, device_hostname, COUNT(*) as failures, MIN(time) as first_attempt, MAX(time) as last_attempt FROM hb_auth_signin WHERE activity_id = 5 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || LOWER(device_hostname) || ',') > 0) GROUP BY actor_user_name, src_endpoint_ip, device_hostname HAVING failures >= {{mfa_failure_threshold}} ORDER BY failures DESC", "surface": "hb_auth_signin", "description": "Find users experiencing high volumes of sign-in failures, indicating an attacker attempting to bypass MFA via exhaustion.", "expected_signal": "Specific users or source IPs with failure counts above the threshold. Silence means no fatigue pattern was detected." }, "parents": [ { "id": "find-vulnerable-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Monitor for MFA fatigue", "reads": [ "actor_user_name", "src_endpoint_ip", "device_hostname", "activity_id", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT actor_user_name, src_endpoint_ip, device_hostname, COUNT(*) as failures, MIN(time) as first_attempt, MAX(time) as last_attempt FROM hb_auth_signin WHERE activity_id = 5 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || LOWER(device_hostname) || ',') > 0) GROUP BY actor_user_name, src_endpoint_ip, device_hostname HAVING failures >= {{mfa_failure_threshold}} ORDER BY failures DESC", "silence": "not_evidence_of_absence", "expected": "Specific users or source IPs with failure counts above the threshold. Silence means no fatigue pattern was detected.", "verified": "dry-run", "verified_at": "2026-10-15" } }, { "id": "rare-cloud-credential-ops", "type": "query", "label": "Rare cloud credential manipulation", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT api_operation, actor_user_name, cloud_account_uid, src_endpoint_ip, COUNT(*) as call_count, MIN(time) as first_seen FROM hb_cloud_api_activity WHERE (LOWER(api_operation) LIKE '%accesskey%' OR LOWER(api_operation) LIKE '%token%' OR LOWER(api_operation) LIKE '%policy%') AND activity_id IN (1, 3) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY api_operation, actor_user_name, cloud_account_uid, src_endpoint_ip HAVING call_count < 10 ORDER BY call_count ASC", "surface": "hb_cloud_api_activity", "description": "Find unusual API operations that create or update cloud identities and tokens, which suggests post-compromise persistence.", "expected_signal": "Low-frequency API calls that modify access controls or credentials. Silence means no unusual credential changes were seen." }, "parents": [ { "id": "find-vulnerable-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare cloud credential manipulation", "reads": [ "api_operation", "actor_user_name", "cloud_account_uid", "src_endpoint_ip", "activity_id", "time" ], "source": "hb_cloud_api_activity", "target": "endpoint", "content": "SELECT api_operation, actor_user_name, cloud_account_uid, src_endpoint_ip, COUNT(*) as call_count, MIN(time) as first_seen FROM hb_cloud_api_activity WHERE (LOWER(api_operation) LIKE '%accesskey%' OR LOWER(api_operation) LIKE '%token%' OR LOWER(api_operation) LIKE '%policy%') AND activity_id IN (1, 3) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY api_operation, actor_user_name, cloud_account_uid, src_endpoint_ip HAVING call_count < 10 ORDER BY call_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Low-frequency API calls that modify access controls or credentials. Silence means no unusual credential changes were seen.", "verified": "dry-run", "prevalence": { "by": "cloud_account_uid", "key": [ "api_operation", "actor_user_name" ], "rare_below": 3 }, "verified_at": "2026-10-15" } }, { "id": "identity-triage-agent", "type": "analytic", "label": "Triage identity compromise risk", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "find-vulnerable-hosts", "check-mfa-fatigue", "rare-cloud-credential-ops" ], "objective": "Determine if the pattern of MFA failures and rare cloud API calls indicates a successful identity takeover. Explicitly correlate the src_endpoint_ip from the MFA fatigue step with the network-accessible IPs of the vulnerable hosts found in the scoping step.", "description": "Synthesize the scoping vulnerabilities, authentication patterns, and cloud activity into a single verdict.", "max_iterations": 6, "expected_signal": "A per-host and per-user verdict on the likelihood of active compromise.", "success_criteria": "A verdict of malicious | suspicious | benign per host or user, citing specific rows for failures and API operations." }, "parents": [ { "id": "check-mfa-fatigue", "kind": "merge" }, { "id": "rare-cloud-credential-ops", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route based on risk", "config": { "fuzzy": true, "judge": "hunter", "question": "the identity-triage-agent verdict is malicious for at least one host or user", "condition": "the identity-triage-agent verdict is malicious for at least one host or user", "blind_spot": "no-cloud-telemetry", "confidence": "high", "description": "Direct the hunt to containment actions if high-confidence evidence of compromise is found.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "identity-triage-agent" } ] }, { "id": "contain-and-revoke", "type": "action", "label": "Contain and revoke", "config": { "target": "endpoint", "description": "Halt the attack by isolating the source endpoint and revoking compromised cloud credentials.", "instructions": "Isolate the compromised host identified in the triage. Revoke any cloud API keys, tokens, or sessions associated with the affected user that were created or active during the suspected compromise window.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "manual-analyst-review", "type": "task", "label": "Manual analyst review", "config": { "assignee": "analyst", "description": "Verify the automated triage results and perform a deeper audit of the user's cloud activity.", "instructions": "Review the rows cited by the triage agent. Audit all cloud API activity for the affected user over the lookback period to ensure no persistent backdoors (like new IAM roles or S3 bucket policies) were added." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "contain-and-revoke" } ] }, { "id": "close-out-hunt", "type": "task", "label": "Hunt close out", "config": { "assignee": "analyst", "description": "Finalize the hunt and record findings for tuning.", "instructions": "Document the findings and true positive rate. If the MFA fatigue query produced excessive noise, consider raising the threshold." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "manual-analyst-review" } ] } ] }