Identity and Cloud Pivot from Web Exploits

Source

---
analysis: 'A standard rule alerts on a specific CVE or a rare login. This hunt correlates
  the two: it asks if a rare administrative login occurred shortly after a known-vulnerable
  host initiated outbound network traffic to an identity provider.'
blind_spots:
- id: vulnerability-scan-staleness
  question: Was the server patched since the last scan was collected?
  requires: hb_vulnerability_finding collection frequency
  risk: A server may appear vulnerable but have been remediated since the last scan
    read, leading to false scoping leads.
  stage: initial-access-web-exploit
- id: incomplete-auth-logs
  question: Are all cloud console sign-ins captured in our telemetry?
  requires: hb_auth_signin coverage for all identity providers
  risk: If a specific SaaS portal or cloud region is not reporting to the log aggregator,
    the pivot will remain invisible.
  stage: identity-account-manipulation
coverage:
- stage: initial-access-web-exploit
  status: covered
  steps:
  - find-vulnerable-web-leads
  - evaluate-exploit-risk
- stage: identity-account-manipulation
  status: covered
  steps:
  - rare-administrative-logins
- stage: cloud-resource-reconfiguration
  status: covered
  steps:
  - outbound-pivot-traffic
  - triage-cross-environment-pivot
- reason: 'Belongs to another part of the ''Inside the Modern SOC: Defending the Cross-Environment
    Pivot'' series.'
  stage: file-system-data-staging
  status: out_of_scope
- reason: 'Belongs to another part of the ''Inside the Modern SOC: Defending the Cross-Environment
    Pivot'' series.'
  stage: network-exfiltration-c2
  status: out_of_scope
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: keep-as-periodic-hunt
  justification: Adversaries convert single-server exploits into environment-wide
    compromises by pivoting to identity systems. Detecting this transition is essential
    for stopping an intrusion before it reaches its final objective.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An adversary has exploited an internet-facing web server to establish
  a beachhead and is now manipulating cloud or SaaS identities to persist and reconfigure
  the environment.
labels:
- hunt
- attack.t1190
- attack.t1098
- attack.t1078
name: Identity and Cloud Pivot from Web Exploits
parameters:
  lookback_days:
    default: '14'
    description: Days of history to examine for authentication and network events.
    from:
      kind: article
      observed: '2026-09-17'
      ref: unit42-cross-environment-pivot
    type: number
  scope_hosts:
    default: []
    description: Specific hostnames identified as vulnerable in the scoping step;
      leave empty to check the entire estate.
    from:
      kind: manual
      observed: '2026-09-17'
      ref: analyst-scoping
    type: list[host]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://unit42.paloaltonetworks.com/soc-cross-environment-pivot/
    gates:
    - dry-run
    - lint
    model: hb_google/gemini-3-flash-preview
rationale: The lead query identifies all high-severity vulnerabilities in web services.
  Populating the scope_hosts parameter with the resulting hostnames allows the network
  query to filter specifically for traffic originating from those beachheads.
references:
- name: 'Inside the Modern SOC: Defending the Cross-Environment Pivot'
  url: https://unit42.paloaltonetworks.com/soc-cross-environment-pivot/
related:
- hunt: cloud-persistence-via-backdoor-user
  reason: This hunt identifies the pivot; a following hunt should check for new users
    or keys created during the compromised session.
  relation: follows
scenario:
  stages:
  - name: Web Application Exploitation
    observables:
    - exploitation of internet-facing web servers
    - malicious http requests to public-facing applications
    slug: initial-access-web-exploit
    tactic: initial-access
    techniques:
    - T1190
  - name: SaaS and Identity Manipulation
    observables:
    - unfamiliar applications requesting elevated permissions
    - permissions changes within SaaS applications
    - OAuth or SAML authentication anomalies
    slug: identity-account-manipulation
    tactic: privilege-escalation
    techniques:
    - T1098
  - name: Cloud Environment Provisioning
    observables:
    - provisioning of cloud resources outside of normal activity
    - reconfiguration of cloud assets by unusual administrator accounts
    slug: cloud-resource-reconfiguration
    tactic: persistence
    techniques:
    - T1078
  - name: Data Staging for Exfiltration
    observables:
    - staging of sensitive data in temporary or unusual directories
    - unexpected file creation patterns on endpoints
    slug: file-system-data-staging
    tactic: collection
    techniques:
    - T1074
  - name: Exfiltration over Command and Control
    observables:
    - new network connections between systems that rarely communicate
    - data transfer to unfamiliar external IP addresses
    - C2 communication over established protocols
    slug: network-exfiltration-c2
    tactic: exfiltration
    techniques:
    - T1041
  summary: Adversaries exploit internet-facing applications to gain a foothold before
    pivoting across cloud and SaaS environments using compromised credentials. The
    attack culminates in the staging of sensitive data on endpoints and exfiltration
    via command-and-control channels.
series:
  index: 1
  slug: inside-the-modern-soc-defending-the-cross-environment-pivot
  title: 'Inside the Modern SOC: Defending the Cross-Environment Pivot'
  total: 2
severity: medium
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  identity:
    category: identity
    name: Identity / sign-in telemetry
    telemetry:
    - identity
  network:
    category: network
    name: Network telemetry
    telemetry:
    - network
tlp: clear
type: investigation
---


# Identity and Cloud Pivot from Web Exploits

This hunt identifies the transition from external exploitation to cross-environment identity theft. It begins by identifying web servers with critical vulnerabilities and uses those findings as a gate to inspect authentication anomalies and outbound network activity. The hunt specifically looks for rare administrative logins and outbound traffic from vulnerable hosts to identity endpoints, correlating the host-level exposure with cloud-level account manipulation.

## find-vulnerable-web-leads
<!-- Identify vulnerable web and gateway services -->
Locate devices running web-facing or gateway services with critical vulnerabilities that serve as likely initial access points.

```sqlite target=endpoint role=scoping
~~~yaml
expected: A list of hosts with high-severity vulnerabilities in web-facing software.
  Silence means no critical exposures were detected in the current inventory.
reads:
- device_uid
- cve_uid
- severity
- affected_package_name
- is_kev
silence: not_evidence_of_absence
source: hb_vulnerability_finding
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_uid, cve_uid, severity, affected_package_name, affected_package_version, is_kev, is_exploit_available FROM hb_vulnerability_finding WHERE resource_type = 'device' AND severity_id >= 4 AND (LOWER(affected_package_name) LIKE '%apache%' OR LOWER(affected_package_name) LIKE '%nginx%' OR LOWER(affected_package_name) LIKE '%wordpress%' OR LOWER(affected_package_name) LIKE '%citrix%' OR LOWER(affected_package_name) LIKE '%fortinet%')
```

## evaluate-exploit-risk
<!-- Assess exploit risk for scoping -->
```agent target=hunter
cite: required
context:
- find-vulnerable-web-leads
max_iterations: 3
objective: Review the vulnerabilities in find-vulnerable-web-leads. Determine if any
  hosts represent a high risk of current exploitation based on KEV status and severity.
success_criteria: A verdict on whether to proceed with expensive queries based on
  the risk of beachhead establishment.
tools:
- endpoint
- identity
- network
```

## gate-on-risk
<!-- Gate: Proceed with pivot hunt? -->
if~: "the evaluate-exploit-risk verdict identifies at least one high-risk vulnerable host" (confidence: high, judge=hunter)
then: → parallel-pivot-investigation
indeterminate: → close-out-investigation
unavailable: → close-out-investigation (blind_spot: vulnerability-scan-staleness)
else: → close-out-investigation

## parallel-pivot-investigation
<!-- Investigate identity and network pivots -->
parallel:
- → rare-administrative-logins
- → outbound-pivot-traffic
join: → triage-cross-environment-pivot

## rare-administrative-logins
<!-- Rare administrative logins to cloud consoles -->
Identify administrative sign-ins to cloud management planes that are rare for the user or protocol.

```sqlite target=identity role=baseline params=(lookback_days=lookback_days)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: A list of rare sign-ins to cloud management consoles. Silence means no unusual
  administrative logins were detected in the window.
prevalence:
  by: actor_user_name
  key:
  - actor_user_name
  - dst_endpoint_name
  rare_below: 5
reads:
- actor_user_name
- dst_endpoint_name
- auth_protocol
- time
silence: not_evidence_of_absence
source: hb_auth_signin
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT actor_user_name, dst_endpoint_name, auth_protocol, COUNT(*) as login_count, MIN(time) as first_login FROM hb_auth_signin WHERE status_id = 1 AND (LOWER(dst_endpoint_name) LIKE '%aws%' OR LOWER(dst_endpoint_name) LIKE '%azure%' OR LOWER(dst_endpoint_name) LIKE '%console%' OR LOWER(dst_endpoint_name) LIKE '%portal%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, dst_endpoint_name, auth_protocol HAVING login_count <= 5
```

## outbound-pivot-traffic
<!-- Outbound pivot traffic from vulnerable hosts -->
Find suspicious outbound connections from the specifically scoped vulnerable hosts to potential identity or C2 endpoints.

```sqlite target=network role=enrichment params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: Outbound web traffic originating from vulnerable hosts via shell or scripting
  interpreters. Silence suggests no such automated pivot occurred.
reads:
- device_hostname
- process_name
- dst_endpoint_ip
- dst_endpoint_port
- time
silence: not_evidence_of_absence
source: hb_network_connection
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND dst_endpoint_port IN (443, 80) AND (LOWER(process_name) LIKE '%python%' OR LOWER(process_name) LIKE '%curl%' OR LOWER(process_name) LIKE '%powershell%') ORDER BY time DESC
```

## triage-cross-environment-pivot
<!-- Correlate exploit and pivot activity -->
```agent target=hunter
cite: required
context:
- evaluate-exploit-risk
- rare-administrative-logins
- outbound-pivot-traffic
max_iterations: 6
objective: Determine if the rare logins or outbound traffic originate from or are
  correlated with the vulnerable hosts identified in the lead. Weigh the timing and
  the significance of the targeted cloud identities.
success_criteria: A per-host and per-user verdict citing the connection between the
  vulnerability and the subsequent identity behavior.
tools:
- endpoint
- identity
- network
```

## route-on-pivot-evidence
<!-- Route on pivot evidence -->
if~: "the triage verdict is malicious for at least one account-host correlation" (confidence: high, judge=hunter)
then: → revoke-compromised-identity
indeterminate: → verify-and-patch
unavailable: → verify-and-patch (blind_spot: incomplete-auth-logs)
else: → close-out-investigation

## revoke-compromised-identity
<!-- Revoke compromised sessions -->
```action target=identity
~~~yaml
approval: required
~~~
Revoke all active OAuth/SAML sessions and session cookies for the identified actor_user_name in the affected cloud provider console.
```
→ verify-and-patch

## verify-and-patch
<!-- Verify and patch beachhead -->
```manual target=analyst
Review the outbound network connections on the vulnerable hosts. Verify if any web shells were dropped. Coordinate the patching of the affected software packages identified in the lead.
```
→ end

## close-out-investigation
<!-- Close out investigation -->
```manual target=analyst
Log the vulnerable hosts that did not show pivot activity. If no pivot was found, recommend patching the identified CVEs and update the scoping parameters for the next monthly run.
```
→ end