{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Identity is the primary attack surface in 2026; Business Email Compromise (BEC) costs organizations more than ransomware. Detecting the gap between a successful login and the abuse of SaaS configuration is the most effective way to prevent financial fraud."
      },
      "name": "Identity Compromise and SaaS Persistence",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1133",
        "attack.t1098",
        "attack.t1137",
        "attack.t1550.004",
        "credential access",
        "exfiltration",
        "impact",
        "initial access",
        "persistence"
      ],
      "series": {
        "slug": "what-cybersecurity-leaders-must-prioritize-in-2027",
        "index": 2,
        "title": "What Cybersecurity Leaders Must Prioritize in 2027",
        "total": 2
      },
      "related": [
        {
          "hunt": "m365-oauth-app-audit",
          "reason": "Focuses purely on historical OAuth app audits rather than active login correlations.",
          "relation": "sibling"
        },
        {
          "hunt": "ai-social-engineering-ransomware-ops",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A simple rule may fire on 'Inbox Rule Created', but this hunt pivots between the authentication context (proxy, MFA status) and the rarity of the login location, reducing noise and providing the 'why' behind the alert.",
      "coverage": [
        {
          "stage": "identity-theft-and-mfa-bypass",
          "steps": [
            "lead-suspicious-logins",
            "rare-login-locations"
          ],
          "status": "covered"
        },
        {
          "stage": "bec-and-cloud-infrastructure-abuse",
          "steps": [
            "saas-persistence-indicators"
          ],
          "status": "covered"
        },
        {
          "stage": "ai-powered-social-engineering",
          "reason": "Belongs to another part of the 'What Cybersecurity Leaders Must Prioritize in 2027' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "rmm-platform-hijacking",
          "reason": "Belongs to another part of the 'What Cybersecurity Leaders Must Prioritize in 2027' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "data-staging-and-exfiltration",
          "reason": "Belongs to another part of the 'What Cybersecurity Leaders Must Prioritize in 2027' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "ransomware-encryption-and-extortion",
          "reason": "Belongs to another part of the 'What Cybersecurity Leaders Must Prioritize in 2027' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "AI-Powered Social Engineering and Loaders",
            "slug": "ai-powered-social-engineering",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "hyper-personalized phishing emails",
              "ClickFix lures",
              "fake CAPTCHA flows",
              "AI-assisted smishing and vishing",
              "malicious loader execution"
            ]
          },
          {
            "name": "Abuse of Trusted RMM Tools",
            "slug": "rmm-platform-hijacking",
            "tactic": "persistence",
            "techniques": [
              "T1133",
              "T1190"
            ],
            "observables": [
              "ScreenConnect hijacking",
              "unusual process chains originating from RMM tools",
              "misuse of sanctioned IT management software"
            ]
          },
          {
            "name": "Identity Compromise and MFA Bypass",
            "slug": "identity-theft-and-mfa-bypass",
            "tactic": "credential-access",
            "techniques": [
              "T1133"
            ],
            "observables": [
              "session token theft",
              "MFA bypass",
              "impossible travel logins",
              "suspicious login footprints"
            ]
          },
          {
            "name": "BEC and Cloud Application Abuse",
            "slug": "bec-and-cloud-infrastructure-abuse",
            "tactic": "persistence",
            "techniques": [
              "T1133"
            ],
            "observables": [
              "suspicious inbox rules",
              "rogue OAuth app registration",
              "interception of financial communications"
            ]
          },
          {
            "name": "Pre-Ransomware Data Exfiltration",
            "slug": "data-staging-and-exfiltration",
            "tactic": "exfiltration",
            "techniques": [
              "T1041"
            ],
            "observables": [
              "data staging",
              "exfiltration over existing C2 channels prior to encryption"
            ]
          },
          {
            "name": "Ransomware Encryption",
            "slug": "ransomware-encryption-and-extortion",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "data encryption",
              "ransomware canaries",
              "multi-extortion negotiation notices"
            ]
          }
        ],
        "summary": "In 2026, attackers are increasingly leveraging AI-powered phishing and the hijacking of trusted RMM tools like ScreenConnect to establish stealthy persistence. These campaigns often transition to identity-centric attacks, bypassing MFA via session theft and manipulating cloud environments through BEC flows, ultimately culminating in data exfiltration and multi-extortion ransomware."
      },
      "severity": "medium",
      "rationale": "Prioritize users with 'privileged' roles or those in finance/HR departments. Focus on the last 14 days to capture active BEC campaigns.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has bypassed MFA via session hijacking or proxy usage and is establishing persistence through malicious inbox rules or unauthorized OAuth applications in a SaaS environment.",
      "parameters": {
        "target_users": {
          "type": "list[string]",
          "default": [],
          "description": "Specific usernames to focus on; leave empty to hunt across the whole estate."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Number of days of history to examine for suspicious activity."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.huntress.com/blog/what-does-the-future-hold-for-todays-cybersecurity-leaders",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.huntress.com/blog/what-does-the-future-hold-for-todays-cybersecurity-leaders",
          "name": "Huntress \u2014 What Cybersecurity Leaders Must Prioritize in 2027"
        }
      ],
      "blind_spots": [
        {
          "id": "proxy-data-missing",
          "risk": "Attackers can hide their source IP without detection if the IDP does not provide proxy intelligence.",
          "owner": "Identity Engineering",
          "stage": "identity-theft-and-mfa-bypass",
          "question": "whether a login originated from an anonymizing proxy",
          "requires": "is_proxy field populated by the identity provider (e.g., Okta)",
          "remediation": "Enable IP threat intelligence and proxy detection within the IDP settings."
        },
        {
          "id": "m365-log-latency",
          "risk": "A 24-hour log delay means an attacker can exfiltrate data and establish persistence before the hunt even sees the API call.",
          "owner": "Security Operations",
          "stage": "bec-and-cloud-infrastructure-abuse",
          "question": "how quickly persistence can be established after a compromise",
          "requires": "Real-time hb_cloud_api_activity for M365",
          "remediation": "Move M365 log ingestion to a high-priority stream (e.g., Office 365 Management Activity API directly)."
        }
      ]
    },
    "name": "Identity Compromise and SaaS Persistence",
    "description": "This hunt identifies successful logins that bypass security controls (proxies, MFA failure) and correlates them with downstream SaaS persistence mechanisms. It uses three telemetry surfaces\u2014identity logs, API activity, and geolocational stack-counting\u2014to separate legitimate remote work from Business Email Compromise (BEC). The agent weighs the login context against the creation of inbox rules or OAuth grants to confirm active account takeover."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "what-cybersecurity-leaders-must-prioritize-in-2027",
          "index": 2,
          "title": "What Cybersecurity Leaders Must Prioritize in 2027",
          "total": 2
        },
        "coverage": [
          {
            "stage": "identity-theft-and-mfa-bypass",
            "steps": [
              "lead-suspicious-logins",
              "rare-login-locations"
            ],
            "status": "covered"
          },
          {
            "stage": "bec-and-cloud-infrastructure-abuse",
            "steps": [
              "saas-persistence-indicators"
            ],
            "status": "covered"
          },
          {
            "stage": "ai-powered-social-engineering",
            "reason": "Belongs to another part of the 'What Cybersecurity Leaders Must Prioritize in 2027' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "rmm-platform-hijacking",
            "reason": "Belongs to another part of the 'What Cybersecurity Leaders Must Prioritize in 2027' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "data-staging-and-exfiltration",
            "reason": "Belongs to another part of the 'What Cybersecurity Leaders Must Prioritize in 2027' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "ransomware-encryption-and-extortion",
            "reason": "Belongs to another part of the 'What Cybersecurity Leaders Must Prioritize in 2027' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary has bypassed MFA via session hijacking or proxy usage and is establishing persistence through malicious inbox rules or unauthorized OAuth applications in a SaaS environment.",
        "blind_spots": [
          {
            "id": "proxy-data-missing",
            "risk": "Attackers can hide their source IP without detection if the IDP does not provide proxy intelligence.",
            "owner": "Identity Engineering",
            "stage": "identity-theft-and-mfa-bypass",
            "question": "whether a login originated from an anonymizing proxy",
            "requires": "is_proxy field populated by the identity provider (e.g., Okta)",
            "remediation": "Enable IP threat intelligence and proxy detection within the IDP settings."
          },
          {
            "id": "m365-log-latency",
            "risk": "A 24-hour log delay means an attacker can exfiltrate data and establish persistence before the hunt even sees the API call.",
            "owner": "Security Operations",
            "stage": "bec-and-cloud-infrastructure-abuse",
            "question": "how quickly persistence can be established after a compromise",
            "requires": "Real-time hb_cloud_api_activity for M365",
            "remediation": "Move M365 log ingestion to a high-priority stream (e.g., Office 365 Management Activity API directly)."
          }
        ],
        "scoping_notes": "Prioritize users with 'privileged' roles or those in finance/HR departments. Focus on the last 14 days to capture active BEC campaigns.",
        "beyond_detection": "A simple rule may fire on 'Inbox Rule Created', but this hunt pivots between the authentication context (proxy, MFA status) and the rarity of the login location, reducing noise and providing the 'why' behind the alert."
      }
    },
    {
      "id": "lead-suspicious-logins",
      "type": "query",
      "label": "Successful logins via proxies or without MFA",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, src_location_country, src_location_city, mfa, is_proxy, time FROM hb_auth_signin WHERE status_id = 1 AND (is_proxy = 'true' OR mfa = 'false') AND ('{{target_users}}' = '' OR instr(',' || '{{target_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_auth_signin",
        "description": "Identify initial access leads where authentication succeeded but bypassed typical security postures.",
        "expected_signal": "Rows identify users and IPs that authenticated through known proxies or without MFA. Silence indicates no obvious bypasses in the monitored telemetry."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Successful logins via proxies or without MFA",
        "reads": [
          "actor_user_name",
          "src_endpoint_ip",
          "src_location_country",
          "src_location_city",
          "mfa",
          "is_proxy",
          "time",
          "status_id"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, src_location_country, src_location_city, mfa, is_proxy, time FROM hb_auth_signin WHERE status_id = 1 AND (is_proxy = 'true' OR mfa = 'false') AND ('{{target_users}}' = '' OR instr(',' || '{{target_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Rows identify users and IPs that authenticated through known proxies or without MFA. Silence indicates no obvious bypasses in the monitored telemetry.",
        "verified": "dry-run",
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "rare-login-locations",
      "type": "query",
      "label": "Stack-count login locations per user",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "identity",
        "content": "SELECT actor_user_name, src_location_country, src_location_city, COUNT(DISTINCT src_endpoint_ip) AS unique_ips, MIN(time) AS first_login, MAX(time) AS last_login FROM hb_auth_signin WHERE status_id = 1 AND ('{{target_users}}' = '' OR instr(',' || '{{target_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, src_location_country, src_location_city HAVING unique_ips < 3 ORDER BY unique_ips ASC",
        "surface": "hb_auth_signin",
        "description": "Highlight 'impossible travel' or unusual login origins by identifying locations seen on fewer than three IPs per user.",
        "expected_signal": "Rare combinations of user and location. A single row for a user in a new country is a strong indicator of session theft or unauthorized access."
      },
      "parents": [
        {
          "id": "lead-suspicious-logins"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Stack-count login locations per user",
        "reads": [
          "actor_user_name",
          "src_location_country",
          "src_location_city",
          "src_endpoint_ip",
          "status_id",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, src_location_country, src_location_city, COUNT(DISTINCT src_endpoint_ip) AS unique_ips, MIN(time) AS first_login, MAX(time) AS last_login FROM hb_auth_signin WHERE status_id = 1 AND ('{{target_users}}' = '' OR instr(',' || '{{target_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, src_location_country, src_location_city HAVING unique_ips < 3 ORDER BY unique_ips ASC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Rare combinations of user and location. A single row for a user in a new country is a strong indicator of session theft or unauthorized access.",
        "verified": "dry-run",
        "prevalence": {
          "by": "src_endpoint_ip",
          "key": [
            "actor_user_name",
            "src_location_country"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "saas-persistence-indicators",
      "type": "query",
      "label": "Malicious configuration changes in M365/Workspace",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT actor_user_name, api_operation, resource_name, src_endpoint_ip, time FROM hb_cloud_api_activity WHERE (LOWER(api_operation) LIKE '%inboxrule%' OR LOWER(api_operation) LIKE '%consent%' OR LOWER(api_operation) LIKE '%oauth2permissiongrant%') AND ('{{target_users}}' = '' OR instr(',' || '{{target_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_cloud_api_activity",
        "description": "Detect the technical aftermath of a successful login: inbox rule creation and OAuth app consent.",
        "expected_signal": "API calls that create persistence or allow data exfiltration. Common legitimate rules for folders should be manually filtered by the agent."
      },
      "parents": [
        {
          "id": "lead-suspicious-logins"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Malicious configuration changes in M365/Workspace",
        "reads": [
          "actor_user_name",
          "api_operation",
          "resource_name",
          "src_endpoint_ip",
          "time"
        ],
        "source": "hb_cloud_api_activity",
        "target": "endpoint",
        "content": "SELECT actor_user_name, api_operation, resource_name, src_endpoint_ip, time FROM hb_cloud_api_activity WHERE (LOWER(api_operation) LIKE '%inboxrule%' OR LOWER(api_operation) LIKE '%consent%' OR LOWER(api_operation) LIKE '%oauth2permissiongrant%') AND ('{{target_users}}' = '' OR instr(',' || '{{target_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "evidence_of_absence",
        "expected": "API calls that create persistence or allow data exfiltration. Common legitimate rules for folders should be manually filtered by the agent.",
        "verified": "dry-run",
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "triage-identity-threat",
      "type": "analytic",
      "label": "Assess for Account Compromise",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "lead-suspicious-logins",
          "rare-login-locations",
          "saas-persistence-indicators"
        ],
        "objective": "Determine if any user shows a pattern of 'Logon from Proxy/MFA Bypass' followed by 'Rare Location' and 'Malicious SaaS Operation' (Inbox Rule or OAuth Grant).",
        "description": "Correlate suspicious login leads with rare locations and SaaS-level persistence to confirm identity theft.",
        "max_iterations": 4,
        "expected_signal": "A host-by-host or user-by-user verdict.",
        "success_criteria": "A verdict of malicious, suspicious, or benign per user with cited activity timestamps."
      },
      "parents": [
        {
          "id": "rare-login-locations",
          "kind": "merge"
        },
        {
          "id": "saas-persistence-indicators",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage-identity-threat verdict is malicious for at least one user account",
        "condition": "the triage-identity-threat verdict is malicious for at least one user account",
        "blind_spot": "proxy-data-missing",
        "confidence": "high",
        "description": "Execute immediate response for confirmed compromise or route for analyst review.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-identity-threat"
        }
      ]
    },
    {
      "id": "revoke-compromised-sessions",
      "type": "action",
      "label": "Revoke User Sessions and Reset Credentials",
      "config": {
        "target": "identity",
        "description": "Evict the adversary by invalidating all current session tokens and requiring a password change with MFA re-enrollment.",
        "instructions": "Revoke all active sign-in sessions for the identified user(s). Force a password reset and audit MFA devices for unauthorized additions.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-forensic-review",
      "type": "task",
      "label": "Analyst Forensic Review",
      "config": {
        "assignee": "analyst",
        "description": "Review the specific inbox rules and OAuth grants to determine the scope of data theft or interception.",
        "instructions": "Inspect the content of the created inbox rules for financial keywords (invoice, wire, payment). Verify whether the OAuth applications have permissions to read mail or modify directory settings."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "revoke-compromised-sessions"
        }
      ]
    },
    {
      "id": "hardening-and-closeout",
      "type": "task",
      "label": "Hardening and Closeout",
      "config": {
        "assignee": "analyst",
        "description": "Improve detection coverage and identity hygiene based on the hunt findings.",
        "instructions": "Record the source IPs of the attackers for blocklisting. Update MFA policies to enforce hardware-backed or FIDO2 tokens to prevent session theft bypass. If specific inbox rules were common, promote them to standing detection rules."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-forensic-review"
        }
      ]
    }
  ]
}