--- analysis: A standard rule flags MFA failures; this hunt correlates those failures with known vulnerable beachheads and subsequent rare cloud API actions, providing the cross-surface context a single rule lacks. blind_spots: - id: no-cloud-telemetry question: whether the attacker accessed a cloud tenant not enrolled in monitoring requires: hb_cloud_api_activity risk: Identity abuse in unmonitored tenants will be invisible, leaving a persistence gap. stage: initial-access-and-identity-compromise - id: mfa-success-correlation question: did an MFA fatigue burst end with a successful authentication requires: OCSF status_detail for sign-ins risk: Without success correlation, we may miss the moment the user finally approved a fraudulent request. stage: initial-access-and-identity-compromise coverage: - stage: initial-access-and-identity-compromise status: covered steps: - find-vulnerable-hosts - check-mfa-fatigue - rare-cloud-credential-ops - reason: Covered by the LotL execution hunt in this series. stage: native-execution-via-powershell-and-wmi status: out_of_scope - reason: Covered by the Lolbins hunt in this series. stage: stealthy-proxy-execution-lolbins status: out_of_scope - reason: Requires network flow bytes or specialized SaaS data-access logs not examined here. stage: data-theft-and-exfiltration status: not_visible - reason: Belongs to another part of the '10 Endpoint Security Trends and Tips for 2027 | Huntress' series. stage: ransomware-impact-and-encryption status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: Identity is the new perimeter; protecting credentials is as critical as protecting local files. This hunt detects the bridge from endpoint vulnerability to cloud compromise, addressing the high-risk trends of phished credentials and token theft. methodology: model-assisted trigger: intel-report hypothesis: An adversary has gained initial access via phished credentials or a public-facing vulnerability and is now attempting to abuse cloud identities, evidenced by MFA fatigue patterns and rare credential-related API operations. labels: - hunt - attack.t1566 - attack.t1195 - attack.t1190 - attack.t1041 - defense evasion - execution - exfiltration - impact - initial access name: Identity and Cloud Access Monitoring parameters: lookback_days: default: '14' description: Days of history to examine for authentication failures and API calls. from: kind: manual observed: '2024-01-01' ref: incident-standard-window type: number mfa_failure_threshold: default: '15' description: Minimum authentication failures per user/IP to flag as a potential MFA fatigue attempt. from: kind: manual observed: '2024-01-01' ref: standard-baseline type: number scope_hosts: default: [] description: Optional list of hostnames to focus the search; leave empty for the entire estate. from: kind: manual observed: '2024-01-01' ref: analyst-scoping type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.huntress.com/blog/endpoint-security-trends gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: The hunt uses critical vulnerabilities joined with internet-exposed asset data as the primary scoping lead. If the estate has a strong patching posture, widen the scope to include medium-severity vulnerabilities. references: - name: "Huntress \u2014 10 Endpoint Security Trends and Tips for 2027" url: https://www.huntress.com/blog/endpoint-security-trends related: - hunt: powershell-wmi-lotl-execution reason: This hunt focuses on identity compromise; the subsequent LotL endpoint execution is handled in a separate hunt. relation: out-of-scope-alternative scenario: stages: - name: Initial Access and Identity Compromise observables: - Phished credentials - Abuse of remote management tools (RMM) - Exploitation of internet-facing vulnerabilities - Compromised API keys and service tokens - MFA fatigue (repeated authentication failures/requests) slug: initial-access-and-identity-compromise tactic: initial-access techniques: - T1566 - T1195 - T1190 - name: Native Execution via PowerShell and WMI observables: - Unusual PowerShell scripts launched by non-admin users - WMI commands for remote execution or persistence - Execution of commands via wmic.exe or scrcons.exe slug: native-execution-via-powershell-and-wmi tactic: execution techniques: - T1059.001 - T1047 - name: Stealthy Proxy Execution (LOLBins) observables: - Signed Windows binaries (LOLBins) used for malicious execution - Subtle clues like unusual command-line arguments for trusted utilities slug: stealthy-proxy-execution-lolbins tactic: defense-evasion techniques: - T1218 - name: Data Theft and Exfiltration observables: - Staging of data in temp directories - High-volume outbound network traffic to unrecognized IPs - Connections from IoT/OT devices to critical assets slug: data-theft-and-exfiltration tactic: exfiltration techniques: - T1041 - name: Ransomware Impact and Encryption observables: - Massive file renaming or extension changes (e.g., .encrypted, .ransom) - Rapid modification/deletion of files across shares slug: ransomware-impact-and-encryption tactic: impact techniques: - T1486 summary: Attackers utilize phishing, supply-chain compromise, or the exploitation of public-facing applications to gain a foothold before pivoting to identity-based attacks like MFA fatigue. Once inside, they move laterally and execute commands using native tools like PowerShell and WMI to avoid detection, eventually culminating in data exfiltration and multi-layered ransomware extortion. series: index: 1 slug: 10-endpoint-security-trends-and-tips-for-2027-huntress title: 10 Endpoint Security Trends and Tips for 2027 | Huntress total: 2 severity: medium targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent identity: category: identity name: Identity / sign-in telemetry telemetry: - identity tlp: clear type: investigation --- # Identity and Cloud Access Monitoring This hunt centers on the article's focus on identity as the new perimeter. It identifies vulnerable entry points and correlates them with identity-based attacks. By monitoring for MFA fatigue (high-frequency sign-in failures) alongside rare cloud credential manipulations, the hunt finds attackers who have pivoted from endpoint compromise to cloud account takeover. The hunt flows through a scoping step for vulnerable assets, a fan-out of behavioral queries on authentication and cloud logs, and a final agent-led triage to confirm the compromise. ## find-vulnerable-hosts Identify hosts with critical vulnerabilities that serve as likely entry points, prioritizing those with an active external exposure. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of hosts with unpatched critical vulnerabilities that are also exposed to the internet. Silence indicates no such high-risk vulnerabilities are currently indexed. reads: - device_uid - cve_uid - title - severity_id - status silence: not_evidence_of_absence source: hb_vulnerability_finding verified: dry-run verified_at: '2026-10-15' ~~~ SELECT v.device_uid, d.hostname, v.cve_uid, v.title, e.ip_address FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid JOIN hb_exposed_assets e ON d.ip_address = e.ip_address WHERE v.severity_id >= 4 AND v.status != 'suppressed' AND (LOWER(v.title) LIKE '%remote%' OR LOWER(v.title) LIKE '%execution%' OR LOWER(v.title) LIKE '%bypass%') ``` ## correlate-identity-evidence parallel: - → check-mfa-fatigue - → rare-cloud-credential-ops join: → identity-triage-agent ## check-mfa-fatigue Find users experiencing high volumes of sign-in failures, indicating an attacker attempting to bypass MFA via exhaustion. ```sqlite target=identity role=detection-candidate params=(lookback_days=lookback_days, mfa_failure_threshold=mfa_failure_threshold, scope_hosts=scope_hosts) ~~~yaml expected: Specific users or source IPs with failure counts above the threshold. Silence means no fatigue pattern was detected. reads: - actor_user_name - src_endpoint_ip - device_hostname - activity_id - time silence: not_evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-10-15' ~~~ SELECT actor_user_name, src_endpoint_ip, device_hostname, COUNT(*) as failures, MIN(time) as first_attempt, MAX(time) as last_attempt FROM hb_auth_signin WHERE activity_id = 5 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || LOWER(device_hostname) || ',') > 0) GROUP BY actor_user_name, src_endpoint_ip, device_hostname HAVING failures >= {{mfa_failure_threshold}} ORDER BY failures DESC ``` ## rare-cloud-credential-ops Find unusual API operations that create or update cloud identities and tokens, which suggests post-compromise persistence. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Low-frequency API calls that modify access controls or credentials. Silence means no unusual credential changes were seen. prevalence: by: cloud_account_uid key: - api_operation - actor_user_name rare_below: 3 reads: - api_operation - actor_user_name - cloud_account_uid - src_endpoint_ip - activity_id - time silence: not_evidence_of_absence source: hb_cloud_api_activity verified: dry-run verified_at: '2026-10-15' ~~~ SELECT api_operation, actor_user_name, cloud_account_uid, src_endpoint_ip, COUNT(*) as call_count, MIN(time) as first_seen FROM hb_cloud_api_activity WHERE (LOWER(api_operation) LIKE '%accesskey%' OR LOWER(api_operation) LIKE '%token%' OR LOWER(api_operation) LIKE '%policy%') AND activity_id IN (1, 3) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY api_operation, actor_user_name, cloud_account_uid, src_endpoint_ip HAVING call_count < 10 ORDER BY call_count ASC ``` ## identity-triage-agent ```agent target=hunter cite: required context: - find-vulnerable-hosts - check-mfa-fatigue - rare-cloud-credential-ops max_iterations: 6 objective: Determine if the pattern of MFA failures and rare cloud API calls indicates a successful identity takeover. Explicitly correlate the src_endpoint_ip from the MFA fatigue step with the network-accessible IPs of the vulnerable hosts found in the scoping step. success_criteria: A verdict of malicious | suspicious | benign per host or user, citing specific rows for failures and API operations. tools: - endpoint - identity ``` ## route-on-verdict if~: "the identity-triage-agent verdict is malicious for at least one host or user" (confidence: high, judge=hunter) then: → contain-and-revoke indeterminate: → manual-analyst-review unavailable: → manual-analyst-review (blind_spot: no-cloud-telemetry) else: → close-out-hunt ## contain-and-revoke ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the compromised host identified in the triage. Revoke any cloud API keys, tokens, or sessions associated with the affected user that were created or active during the suspected compromise window. ``` → manual-analyst-review ## manual-analyst-review ```manual target=analyst Review the rows cited by the triage agent. Audit all cloud API activity for the affected user over the lookback period to ensure no persistent backdoors (like new IAM roles or S3 bucket policies) were added. ``` → close-out-hunt ## close-out-hunt ```manual target=analyst Document the findings and true positive rate. If the MFA fatigue query produced excessive noise, consider raising the threshold. ``` → end