--- analysis: A simple rule may fire on 'Inbox Rule Created', but this hunt pivots between the authentication context (proxy, MFA status) and the rarity of the login location, reducing noise and providing the 'why' behind the alert. blind_spots: - id: proxy-data-missing owner: Identity Engineering question: whether a login originated from an anonymizing proxy remediation: Enable IP threat intelligence and proxy detection within the IDP settings. requires: is_proxy field populated by the identity provider (e.g., Okta) risk: Attackers can hide their source IP without detection if the IDP does not provide proxy intelligence. stage: identity-theft-and-mfa-bypass - id: m365-log-latency owner: Security Operations question: how quickly persistence can be established after a compromise remediation: Move M365 log ingestion to a high-priority stream (e.g., Office 365 Management Activity API directly). requires: Real-time hb_cloud_api_activity for M365 risk: A 24-hour log delay means an attacker can exfiltrate data and establish persistence before the hunt even sees the API call. stage: bec-and-cloud-infrastructure-abuse coverage: - stage: identity-theft-and-mfa-bypass status: covered steps: - lead-suspicious-logins - rare-login-locations - stage: bec-and-cloud-infrastructure-abuse status: covered steps: - saas-persistence-indicators - reason: Belongs to another part of the 'What Cybersecurity Leaders Must Prioritize in 2027' series. stage: ai-powered-social-engineering status: out_of_scope - reason: Belongs to another part of the 'What Cybersecurity Leaders Must Prioritize in 2027' series. stage: rmm-platform-hijacking status: out_of_scope - reason: Belongs to another part of the 'What Cybersecurity Leaders Must Prioritize in 2027' series. stage: data-staging-and-exfiltration status: out_of_scope - reason: Belongs to another part of the 'What Cybersecurity Leaders Must Prioritize in 2027' series. stage: ransomware-encryption-and-extortion status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: Identity is the primary attack surface in 2026; Business Email Compromise (BEC) costs organizations more than ransomware. Detecting the gap between a successful login and the abuse of SaaS configuration is the most effective way to prevent financial fraud. methodology: model-assisted trigger: intel-report hypothesis: An adversary has bypassed MFA via session hijacking or proxy usage and is establishing persistence through malicious inbox rules or unauthorized OAuth applications in a SaaS environment. labels: - hunt - attack.t1133 - attack.t1098 - attack.t1137 - attack.t1550.004 - credential access - exfiltration - impact - initial access - persistence name: Identity Compromise and SaaS Persistence parameters: lookback_days: default: '14' description: Number of days of history to examine for suspicious activity. type: number target_users: default: [] description: Specific usernames to focus on; leave empty to hunt across the whole estate. type: list[string] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.huntress.com/blog/what-does-the-future-hold-for-todays-cybersecurity-leaders gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: Prioritize users with 'privileged' roles or those in finance/HR departments. Focus on the last 14 days to capture active BEC campaigns. references: - name: "Huntress \u2014 What Cybersecurity Leaders Must Prioritize in 2027" url: https://www.huntress.com/blog/what-does-the-future-hold-for-todays-cybersecurity-leaders related: - hunt: m365-oauth-app-audit reason: Focuses purely on historical OAuth app audits rather than active login correlations. relation: sibling - hunt: ai-social-engineering-ransomware-ops relation: follows scenario: stages: - name: AI-Powered Social Engineering and Loaders observables: - hyper-personalized phishing emails - ClickFix lures - fake CAPTCHA flows - AI-assisted smishing and vishing - malicious loader execution slug: ai-powered-social-engineering tactic: initial-access techniques: - T1566 - name: Abuse of Trusted RMM Tools observables: - ScreenConnect hijacking - unusual process chains originating from RMM tools - misuse of sanctioned IT management software slug: rmm-platform-hijacking tactic: persistence techniques: - T1133 - T1190 - name: Identity Compromise and MFA Bypass observables: - session token theft - MFA bypass - impossible travel logins - suspicious login footprints slug: identity-theft-and-mfa-bypass tactic: credential-access techniques: - T1133 - name: BEC and Cloud Application Abuse observables: - suspicious inbox rules - rogue OAuth app registration - interception of financial communications slug: bec-and-cloud-infrastructure-abuse tactic: persistence techniques: - T1133 - name: Pre-Ransomware Data Exfiltration observables: - data staging - exfiltration over existing C2 channels prior to encryption slug: data-staging-and-exfiltration tactic: exfiltration techniques: - T1041 - name: Ransomware Encryption observables: - data encryption - ransomware canaries - multi-extortion negotiation notices slug: ransomware-encryption-and-extortion tactic: impact techniques: - T1486 summary: In 2026, attackers are increasingly leveraging AI-powered phishing and the hijacking of trusted RMM tools like ScreenConnect to establish stealthy persistence. These campaigns often transition to identity-centric attacks, bypassing MFA via session theft and manipulating cloud environments through BEC flows, ultimately culminating in data exfiltration and multi-extortion ransomware. series: index: 2 slug: what-cybersecurity-leaders-must-prioritize-in-2027 title: What Cybersecurity Leaders Must Prioritize in 2027 total: 2 severity: medium targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent identity: category: identity name: Identity / sign-in telemetry telemetry: - identity tlp: clear type: investigation --- # Identity Compromise and SaaS Persistence This hunt identifies successful logins that bypass security controls (proxies, MFA failure) and correlates them with downstream SaaS persistence mechanisms. It uses three telemetry surfaces—identity logs, API activity, and geolocational stack-counting—to separate legitimate remote work from Business Email Compromise (BEC). The agent weighs the login context against the creation of inbox rules or OAuth grants to confirm active account takeover. ## lead-suspicious-logins Identify initial access leads where authentication succeeded but bypassed typical security postures. ```sqlite target=identity role=detection-candidate params=(lookback_days=lookback_days, target_users=target_users) ~~~yaml expected: Rows identify users and IPs that authenticated through known proxies or without MFA. Silence indicates no obvious bypasses in the monitored telemetry. reads: - actor_user_name - src_endpoint_ip - src_location_country - src_location_city - mfa - is_proxy - time - status_id silence: not_evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-10-15' ~~~ SELECT actor_user_name, src_endpoint_ip, src_location_country, src_location_city, mfa, is_proxy, time FROM hb_auth_signin WHERE status_id = 1 AND (is_proxy = 'true' OR mfa = 'false') AND ('{{target_users}}' = '' OR instr(',' || '{{target_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## analyze-context parallel: - → rare-login-locations - → saas-persistence-indicators join: → triage-identity-threat ## rare-login-locations Highlight 'impossible travel' or unusual login origins by identifying locations seen on fewer than three IPs per user. ```sqlite target=identity role=baseline params=(lookback_days=lookback_days, target_users=target_users) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Rare combinations of user and location. A single row for a user in a new country is a strong indicator of session theft or unauthorized access. prevalence: by: src_endpoint_ip key: - actor_user_name - src_location_country rare_below: 3 reads: - actor_user_name - src_location_country - src_location_city - src_endpoint_ip - status_id - time silence: not_evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-10-15' ~~~ SELECT actor_user_name, src_location_country, src_location_city, COUNT(DISTINCT src_endpoint_ip) AS unique_ips, MIN(time) AS first_login, MAX(time) AS last_login FROM hb_auth_signin WHERE status_id = 1 AND ('{{target_users}}' = '' OR instr(',' || '{{target_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, src_location_country, src_location_city HAVING unique_ips < 3 ORDER BY unique_ips ASC ``` ## saas-persistence-indicators Detect the technical aftermath of a successful login: inbox rule creation and OAuth app consent. ```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days, target_users=target_users) ~~~yaml expected: API calls that create persistence or allow data exfiltration. Common legitimate rules for folders should be manually filtered by the agent. reads: - actor_user_name - api_operation - resource_name - src_endpoint_ip - time silence: evidence_of_absence source: hb_cloud_api_activity verified: dry-run verified_at: '2026-10-15' ~~~ SELECT actor_user_name, api_operation, resource_name, src_endpoint_ip, time FROM hb_cloud_api_activity WHERE (LOWER(api_operation) LIKE '%inboxrule%' OR LOWER(api_operation) LIKE '%consent%' OR LOWER(api_operation) LIKE '%oauth2permissiongrant%') AND ('{{target_users}}' = '' OR instr(',' || '{{target_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-identity-threat ```agent target=hunter cite: required context: - lead-suspicious-logins - rare-login-locations - saas-persistence-indicators max_iterations: 4 objective: Determine if any user shows a pattern of 'Logon from Proxy/MFA Bypass' followed by 'Rare Location' and 'Malicious SaaS Operation' (Inbox Rule or OAuth Grant). success_criteria: A verdict of malicious, suspicious, or benign per user with cited activity timestamps. tools: - endpoint - identity ``` ## route-on-verdict if~: "the triage-identity-threat verdict is malicious for at least one user account" (confidence: high, judge=hunter) then: → revoke-compromised-sessions indeterminate: → analyst-forensic-review unavailable: → analyst-forensic-review (blind_spot: proxy-data-missing) else: → hardening-and-closeout ## revoke-compromised-sessions ```action target=identity ~~~yaml approval: required ~~~ Revoke all active sign-in sessions for the identified user(s). Force a password reset and audit MFA devices for unauthorized additions. ``` → analyst-forensic-review ## analyst-forensic-review ```manual target=analyst Inspect the content of the created inbox rules for financial keywords (invoice, wire, payment). Verify whether the OAuth applications have permissions to read mail or modify directory settings. ``` → hardening-and-closeout ## hardening-and-closeout ```manual target=analyst Record the source IPs of the attackers for blocklisting. Update MFA policies to enforce hardware-backed or FIDO2 tokens to prevent session theft bypass. If specific inbox rules were common, promote them to standing detection rules. ``` → end