{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Adversaries convert single-server exploits into environment-wide compromises by pivoting to identity systems. Detecting this transition is essential for stopping an intrusion before it reaches its final objective."
      },
      "name": "Identity and Cloud Pivot from Web Exploits",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1098",
        "attack.t1078"
      ],
      "series": {
        "slug": "inside-the-modern-soc-defending-the-cross-environment-pivot",
        "index": 1,
        "title": "Inside the Modern SOC: Defending the Cross-Environment Pivot",
        "total": 2
      },
      "related": [
        {
          "hunt": "cloud-persistence-via-backdoor-user",
          "reason": "This hunt identifies the pivot; a following hunt should check for new users or keys created during the compromised session.",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A standard rule alerts on a specific CVE or a rare login. This hunt correlates the two: it asks if a rare administrative login occurred shortly after a known-vulnerable host initiated outbound network traffic to an identity provider.",
      "coverage": [
        {
          "stage": "initial-access-web-exploit",
          "steps": [
            "find-vulnerable-web-leads",
            "evaluate-exploit-risk"
          ],
          "status": "covered"
        },
        {
          "stage": "identity-account-manipulation",
          "steps": [
            "rare-administrative-logins"
          ],
          "status": "covered"
        },
        {
          "stage": "cloud-resource-reconfiguration",
          "steps": [
            "outbound-pivot-traffic",
            "triage-cross-environment-pivot"
          ],
          "status": "covered"
        },
        {
          "stage": "file-system-data-staging",
          "reason": "Belongs to another part of the 'Inside the Modern SOC: Defending the Cross-Environment Pivot' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "network-exfiltration-c2",
          "reason": "Belongs to another part of the 'Inside the Modern SOC: Defending the Cross-Environment Pivot' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Web Application Exploitation",
            "slug": "initial-access-web-exploit",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "exploitation of internet-facing web servers",
              "malicious http requests to public-facing applications"
            ]
          },
          {
            "name": "SaaS and Identity Manipulation",
            "slug": "identity-account-manipulation",
            "tactic": "privilege-escalation",
            "techniques": [
              "T1098"
            ],
            "observables": [
              "unfamiliar applications requesting elevated permissions",
              "permissions changes within SaaS applications",
              "OAuth or SAML authentication anomalies"
            ]
          },
          {
            "name": "Cloud Environment Provisioning",
            "slug": "cloud-resource-reconfiguration",
            "tactic": "persistence",
            "techniques": [
              "T1078"
            ],
            "observables": [
              "provisioning of cloud resources outside of normal activity",
              "reconfiguration of cloud assets by unusual administrator accounts"
            ]
          },
          {
            "name": "Data Staging for Exfiltration",
            "slug": "file-system-data-staging",
            "tactic": "collection",
            "techniques": [
              "T1074"
            ],
            "observables": [
              "staging of sensitive data in temporary or unusual directories",
              "unexpected file creation patterns on endpoints"
            ]
          },
          {
            "name": "Exfiltration over Command and Control",
            "slug": "network-exfiltration-c2",
            "tactic": "exfiltration",
            "techniques": [
              "T1041"
            ],
            "observables": [
              "new network connections between systems that rarely communicate",
              "data transfer to unfamiliar external IP addresses",
              "C2 communication over established protocols"
            ]
          }
        ],
        "summary": "Adversaries exploit internet-facing applications to gain a foothold before pivoting across cloud and SaaS environments using compromised credentials. The attack culminates in the staging of sensitive data on endpoints and exfiltration via command-and-control channels."
      },
      "severity": "medium",
      "rationale": "The lead query identifies all high-severity vulnerabilities in web services. Populating the scope_hosts parameter with the resulting hostnames allows the network query to filter specifically for traffic originating from those beachheads.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has exploited an internet-facing web server to establish a beachhead and is now manipulating cloud or SaaS identities to persist and reconfigure the environment.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "analyst-scoping",
            "kind": "manual",
            "observed": "2026-09-17"
          },
          "type": "list[host]",
          "default": [],
          "description": "Specific hostnames identified as vulnerable in the scoping step; leave empty to check the entire estate."
        },
        "lookback_days": {
          "from": {
            "ref": "unit42-cross-environment-pivot",
            "kind": "article",
            "observed": "2026-09-17"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine for authentication and network events."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://unit42.paloaltonetworks.com/soc-cross-environment-pivot/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://unit42.paloaltonetworks.com/soc-cross-environment-pivot/",
          "name": "Inside the Modern SOC: Defending the Cross-Environment Pivot"
        }
      ],
      "blind_spots": [
        {
          "id": "vulnerability-scan-staleness",
          "risk": "A server may appear vulnerable but have been remediated since the last scan read, leading to false scoping leads.",
          "stage": "initial-access-web-exploit",
          "question": "Was the server patched since the last scan was collected?",
          "requires": "hb_vulnerability_finding collection frequency"
        },
        {
          "id": "incomplete-auth-logs",
          "risk": "If a specific SaaS portal or cloud region is not reporting to the log aggregator, the pivot will remain invisible.",
          "stage": "identity-account-manipulation",
          "question": "Are all cloud console sign-ins captured in our telemetry?",
          "requires": "hb_auth_signin coverage for all identity providers"
        }
      ]
    },
    "name": "Identity and Cloud Pivot from Web Exploits",
    "description": "This hunt identifies the transition from external exploitation to cross-environment identity theft. It begins by identifying web servers with critical vulnerabilities and uses those findings as a gate to inspect authentication anomalies and outbound network activity. The hunt specifically looks for rare administrative logins and outbound traffic from vulnerable hosts to identity endpoints, correlating the host-level exposure with cloud-level account manipulation."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "inside-the-modern-soc-defending-the-cross-environment-pivot",
          "index": 1,
          "title": "Inside the Modern SOC: Defending the Cross-Environment Pivot",
          "total": 2
        },
        "coverage": [
          {
            "stage": "initial-access-web-exploit",
            "steps": [
              "find-vulnerable-web-leads",
              "evaluate-exploit-risk"
            ],
            "status": "covered"
          },
          {
            "stage": "identity-account-manipulation",
            "steps": [
              "rare-administrative-logins"
            ],
            "status": "covered"
          },
          {
            "stage": "cloud-resource-reconfiguration",
            "steps": [
              "outbound-pivot-traffic",
              "triage-cross-environment-pivot"
            ],
            "status": "covered"
          },
          {
            "stage": "file-system-data-staging",
            "reason": "Belongs to another part of the 'Inside the Modern SOC: Defending the Cross-Environment Pivot' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "network-exfiltration-c2",
            "reason": "Belongs to another part of the 'Inside the Modern SOC: Defending the Cross-Environment Pivot' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary has exploited an internet-facing web server to establish a beachhead and is now manipulating cloud or SaaS identities to persist and reconfigure the environment.",
        "blind_spots": [
          {
            "id": "vulnerability-scan-staleness",
            "risk": "A server may appear vulnerable but have been remediated since the last scan read, leading to false scoping leads.",
            "stage": "initial-access-web-exploit",
            "question": "Was the server patched since the last scan was collected?",
            "requires": "hb_vulnerability_finding collection frequency"
          },
          {
            "id": "incomplete-auth-logs",
            "risk": "If a specific SaaS portal or cloud region is not reporting to the log aggregator, the pivot will remain invisible.",
            "stage": "identity-account-manipulation",
            "question": "Are all cloud console sign-ins captured in our telemetry?",
            "requires": "hb_auth_signin coverage for all identity providers"
          }
        ],
        "scoping_notes": "The lead query identifies all high-severity vulnerabilities in web services. Populating the scope_hosts parameter with the resulting hostnames allows the network query to filter specifically for traffic originating from those beachheads.",
        "beyond_detection": "A standard rule alerts on a specific CVE or a rare login. This hunt correlates the two: it asks if a rare administrative login occurred shortly after a known-vulnerable host initiated outbound network traffic to an identity provider."
      }
    },
    {
      "id": "find-vulnerable-web-leads",
      "type": "query",
      "label": "Identify vulnerable web and gateway services",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_uid, cve_uid, severity, affected_package_name, affected_package_version, is_kev, is_exploit_available FROM hb_vulnerability_finding WHERE resource_type = 'device' AND severity_id >= 4 AND (LOWER(affected_package_name) LIKE '%apache%' OR LOWER(affected_package_name) LIKE '%nginx%' OR LOWER(affected_package_name) LIKE '%wordpress%' OR LOWER(affected_package_name) LIKE '%citrix%' OR LOWER(affected_package_name) LIKE '%fortinet%')",
        "surface": "hb_vulnerability_finding",
        "description": "Locate devices running web-facing or gateway services with critical vulnerabilities that serve as likely initial access points.",
        "expected_signal": "A list of hosts with high-severity vulnerabilities in web-facing software. Silence means no critical exposures were detected in the current inventory."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify vulnerable web and gateway services",
        "reads": [
          "device_uid",
          "cve_uid",
          "severity",
          "affected_package_name",
          "is_kev"
        ],
        "source": "hb_vulnerability_finding",
        "target": "endpoint",
        "content": "SELECT device_uid, cve_uid, severity, affected_package_name, affected_package_version, is_kev, is_exploit_available FROM hb_vulnerability_finding WHERE resource_type = 'device' AND severity_id >= 4 AND (LOWER(affected_package_name) LIKE '%apache%' OR LOWER(affected_package_name) LIKE '%nginx%' OR LOWER(affected_package_name) LIKE '%wordpress%' OR LOWER(affected_package_name) LIKE '%citrix%' OR LOWER(affected_package_name) LIKE '%fortinet%')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hosts with high-severity vulnerabilities in web-facing software. Silence means no critical exposures were detected in the current inventory.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "evaluate-exploit-risk",
      "type": "analytic",
      "label": "Assess exploit risk for scoping",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "network"
        ],
        "context": [
          "find-vulnerable-web-leads"
        ],
        "objective": "Review the vulnerabilities in find-vulnerable-web-leads. Determine if any hosts represent a high risk of current exploitation based on KEV status and severity.",
        "description": "Evaluate whether the identified vulnerabilities are actively being exploited (KEV) or have public exploit code available.",
        "max_iterations": 3,
        "expected_signal": "A risk assessment and a recommendation to proceed with the identity investigation.",
        "success_criteria": "A verdict on whether to proceed with expensive queries based on the risk of beachhead establishment."
      },
      "parents": [
        {
          "id": "find-vulnerable-web-leads"
        }
      ]
    },
    {
      "id": "gate-on-risk",
      "type": "checkpoint",
      "label": "Gate: Proceed with pivot hunt?",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the evaluate-exploit-risk verdict identifies at least one high-risk vulnerable host",
        "condition": "the evaluate-exploit-risk verdict identifies at least one high-risk vulnerable host",
        "blind_spot": "vulnerability-scan-staleness",
        "confidence": "high",
        "description": "Stop the hunt if no high-risk web servers are identified, saving resources and reducing noise.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "evaluate-exploit-risk"
        }
      ]
    },
    {
      "id": "rare-administrative-logins",
      "type": "query",
      "label": "Rare administrative logins to cloud consoles",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "identity",
        "content": "SELECT actor_user_name, dst_endpoint_name, auth_protocol, COUNT(*) as login_count, MIN(time) as first_login FROM hb_auth_signin WHERE status_id = 1 AND (LOWER(dst_endpoint_name) LIKE '%aws%' OR LOWER(dst_endpoint_name) LIKE '%azure%' OR LOWER(dst_endpoint_name) LIKE '%console%' OR LOWER(dst_endpoint_name) LIKE '%portal%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, dst_endpoint_name, auth_protocol HAVING login_count <= 5",
        "surface": "hb_auth_signin",
        "description": "Identify administrative sign-ins to cloud management planes that are rare for the user or protocol.",
        "expected_signal": "A list of rare sign-ins to cloud management consoles. Silence means no unusual administrative logins were detected in the window."
      },
      "parents": [
        {
          "id": "gate-on-risk",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare administrative logins to cloud consoles",
        "reads": [
          "actor_user_name",
          "dst_endpoint_name",
          "auth_protocol",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, dst_endpoint_name, auth_protocol, COUNT(*) as login_count, MIN(time) as first_login FROM hb_auth_signin WHERE status_id = 1 AND (LOWER(dst_endpoint_name) LIKE '%aws%' OR LOWER(dst_endpoint_name) LIKE '%azure%' OR LOWER(dst_endpoint_name) LIKE '%console%' OR LOWER(dst_endpoint_name) LIKE '%portal%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, dst_endpoint_name, auth_protocol HAVING login_count <= 5",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "A list of rare sign-ins to cloud management consoles. Silence means no unusual administrative logins were detected in the window.",
        "verified": "dry-run",
        "prevalence": {
          "by": "actor_user_name",
          "key": [
            "actor_user_name",
            "dst_endpoint_name"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "outbound-pivot-traffic",
      "type": "query",
      "label": "Outbound pivot traffic from vulnerable hosts",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "network",
        "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND dst_endpoint_port IN (443, 80) AND (LOWER(process_name) LIKE '%python%' OR LOWER(process_name) LIKE '%curl%' OR LOWER(process_name) LIKE '%powershell%') ORDER BY time DESC",
        "surface": "hb_network_connection",
        "description": "Find suspicious outbound connections from the specifically scoped vulnerable hosts to potential identity or C2 endpoints.",
        "expected_signal": "Outbound web traffic originating from vulnerable hosts via shell or scripting interpreters. Silence suggests no such automated pivot occurred."
      },
      "parents": [
        {
          "id": "gate-on-risk",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Outbound pivot traffic from vulnerable hosts",
        "reads": [
          "device_hostname",
          "process_name",
          "dst_endpoint_ip",
          "dst_endpoint_port",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND dst_endpoint_port IN (443, 80) AND (LOWER(process_name) LIKE '%python%' OR LOWER(process_name) LIKE '%curl%' OR LOWER(process_name) LIKE '%powershell%') ORDER BY time DESC",
        "silence": "not_evidence_of_absence",
        "expected": "Outbound web traffic originating from vulnerable hosts via shell or scripting interpreters. Silence suggests no such automated pivot occurred.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "triage-cross-environment-pivot",
      "type": "analytic",
      "label": "Correlate exploit and pivot activity",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "network"
        ],
        "context": [
          "evaluate-exploit-risk",
          "rare-administrative-logins",
          "outbound-pivot-traffic"
        ],
        "objective": "Determine if the rare logins or outbound traffic originate from or are correlated with the vulnerable hosts identified in the lead. Weigh the timing and the significance of the targeted cloud identities.",
        "description": "Connect the timing of the vulnerability with the rare administrative logins and outbound traffic to confirm a cross-environment pivot.",
        "max_iterations": 6,
        "expected_signal": "A confirmed attack path linking a vulnerable host to an identity manipulation event.",
        "success_criteria": "A per-host and per-user verdict citing the connection between the vulnerability and the subsequent identity behavior."
      },
      "parents": [
        {
          "id": "rare-administrative-logins",
          "kind": "merge"
        },
        {
          "id": "outbound-pivot-traffic",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-pivot-evidence",
      "type": "checkpoint",
      "label": "Route on pivot evidence",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious for at least one account-host correlation",
        "condition": "the triage verdict is malicious for at least one account-host correlation",
        "blind_spot": "incomplete-auth-logs",
        "confidence": "high",
        "description": "Action confirmed account compromises or route for manual analyst verification.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-cross-environment-pivot"
        }
      ]
    },
    {
      "id": "revoke-compromised-identity",
      "type": "action",
      "label": "Revoke compromised sessions",
      "config": {
        "target": "identity",
        "description": "Stop the adversary's access to the cloud management plane by terminating the compromised user session.",
        "instructions": "Revoke all active OAuth/SAML sessions and session cookies for the identified actor_user_name in the affected cloud provider console.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-pivot-evidence",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "verify-and-patch",
      "type": "task",
      "label": "Verify and patch beachhead",
      "config": {
        "assignee": "analyst",
        "description": "Confirm the scope of the intrusion on the web server and ensure the vulnerability is remediated.",
        "instructions": "Review the outbound network connections on the vulnerable hosts. Verify if any web shells were dropped. Coordinate the patching of the affected software packages identified in the lead."
      },
      "parents": [
        {
          "id": "route-on-pivot-evidence",
          "branch": "default"
        },
        {
          "id": "route-on-pivot-evidence",
          "branch": "on_unavailable"
        },
        {
          "id": "revoke-compromised-identity"
        }
      ]
    },
    {
      "id": "close-out-investigation",
      "type": "task",
      "label": "Close out investigation",
      "config": {
        "assignee": "analyst",
        "description": "Document the findings of the hunt and record any negative results for baseline history.",
        "instructions": "Log the vulnerable hosts that did not show pivot activity. If no pivot was found, recommend patching the identified CVEs and update the scoping parameters for the next monthly run."
      },
      "parents": [
        {
          "id": "gate-on-risk",
          "branch": "default"
        },
        {
          "id": "gate-on-risk",
          "branch": "on_unavailable"
        },
        {
          "id": "gate-on-risk",
          "branch": "on_refutes"
        },
        {
          "id": "route-on-pivot-evidence",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}