{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Production continuity in manufacturing relies on the security of aging HMIs. Identifying unencrypted management exposure reduces the risk of lateral movement into critical OT segments."
      },
      "name": "Industrial Protocol Abuse on Legacy Manufacturing Assets",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1133",
        "attack.t1572",
        "attack.t1021.002",
        "attack.t1195",
        "command and control",
        "discovery",
        "impact",
        "initial access"
      ],
      "series": {
        "slug": "7-key-manufacturing-cybersecurity-trends-for-2027-huntress",
        "index": 2,
        "title": "7 Key Manufacturing Cybersecurity Trends for 2027 | Huntress",
        "total": 2
      },
      "related": [
        {
          "hunt": "it-ot-gateway-bridging",
          "reason": "This hunt focuses on the internal legacy systems, not the initial bridge from the IT network.",
          "relation": "out-of-scope-alternative"
        },
        {
          "hunt": "abuse-remote-gateways-third-party-access",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "While a rule can alert on Telnet traffic, this hunt correlates traffic with legacy OS inventory and baselines outbound movement from those systems to identify internal pivots that standard perimeter rules miss.",
      "coverage": [
        {
          "stage": "legacy-system-discovery",
          "steps": [
            "legacy-host-inventory",
            "insecure-inbound-traffic"
          ],
          "status": "covered"
        },
        {
          "stage": "lateral-protocol-tunneling",
          "steps": [
            "lateral-outbound-stack"
          ],
          "status": "covered"
        },
        {
          "stage": "phishing-initial-foothold",
          "reason": "Belongs to another part of the '7 Key Manufacturing Cybersecurity Trends for 2027 | Huntress' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "third-party-supply-chain-entry",
          "reason": "Belongs to another part of the '7 Key Manufacturing Cybersecurity Trends for 2027 | Huntress' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "it-ot-gateway-bridging",
          "reason": "Belongs to another part of the '7 Key Manufacturing Cybersecurity Trends for 2027 | Huntress' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "ot-impact-ransomware",
          "reason": "Belongs to another part of the '7 Key Manufacturing Cybersecurity Trends for 2027 | Huntress' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Corporate Phishing Foothold",
            "slug": "phishing-initial-foothold",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "Phishing emails targeting Sales or Finance departments",
              "Execution of malicious attachments on corporate laptops"
            ]
          },
          {
            "name": "Compromised Third-Party Vendor Access",
            "slug": "third-party-supply-chain-entry",
            "tactic": "initial-access",
            "techniques": [
              "T1195"
            ],
            "observables": [
              "Use of stolen credentials from specialized machine integrators or HVAC contractors",
              "Persistent 'always-on' VPN links from vendor networks",
              "Remote management tool logins appearing as routine maintenance"
            ]
          },
          {
            "name": "IT-to-OT Bridge Access",
            "slug": "it-ot-gateway-bridging",
            "tactic": "initial-access",
            "techniques": [
              "T1133"
            ],
            "observables": [
              "Access to Citrix or VPN appliances acting as bridges",
              "Logins to jump servers positioned between corporate and plant networks",
              "Stolen credentials used to cross network segmentation boundaries"
            ]
          },
          {
            "name": "Legacy Industrial Asset Discovery",
            "slug": "legacy-system-discovery",
            "tactic": "discovery",
            "techniques": [
              "T1133"
            ],
            "observables": [
              "Windows 7 and Windows XP systems running as HMIs",
              "Legacy PLCs with hard-coded passwords like '1234' or 'password'",
              "Unencrypted management ports active on legacy execution systems"
            ]
          },
          {
            "name": "Lateral Movement via Tunneling",
            "slug": "lateral-protocol-tunneling",
            "tactic": "command-and-control",
            "techniques": [
              "T1572"
            ],
            "observables": [
              "Encapsulated network traffic traversing segment digital walls",
              "Lateral movement using Telnet (port 23), FTP (port 21), or unencrypted HTTP (port 80)",
              "Connections to Human-Machine Interfaces (HMIs) and Programmable Logic Controllers (PLCs)"
            ]
          },
          {
            "name": "Operational Technology Ransomware Impact",
            "slug": "ot-impact-ransomware",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "Encryption of files on Manufacturing Execution Systems (MES)",
              "Manipulation of PLC recipe values or belt speed",
              "Disabling of safety sensors on the plant floor"
            ]
          }
        ],
        "summary": "Attackers target manufacturing environments by gaining a corporate foothold via phishing or compromised third-party vendor VPNs, subsequently pivoting into operational technology (OT) networks through jump servers or poorly segmented bridges. Once inside, they exploit legacy systems and unencrypted protocols (Telnet, HTTP) to manipulate industrial control systems or deploy ransomware that disrupts production uptime and assembly lines."
      },
      "severity": "medium",
      "rationale": "Focus on subnets known to house HMI or PLC management workstations. Use the OS names to build a target list of legacy devices before proceeding to the network traffic queries.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "Adversaries target legacy Windows 7 and XP systems used as HMIs to bridge into OT networks by using unencrypted management protocols like Telnet and FTP for lateral movement.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Hostnames of legacy Windows systems identified in the inventory step; leave empty to hunt across the entire estate."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "insecure_ports": {
          "from": {
            "ref": "Huntress Manufacturing Trends 2026",
            "kind": "article",
            "observed": "2026-10-14"
          },
          "type": "list[string]",
          "default": [
            "21",
            "23",
            "80"
          ],
          "description": "Unencrypted ports commonly used for legacy management (FTP, Telnet, HTTP)."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.huntress.com/blog/manufacturing-cybersecurity-trends",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.huntress.com/blog/manufacturing-cybersecurity-trends",
          "name": "Huntress \u2014 7 Key Manufacturing Cybersecurity Trends for 2027"
        }
      ],
      "blind_spots": [
        {
          "id": "incomplete-network-telemetry",
          "risk": "A sophisticated adversary might tunnel Telnet inside another protocol, making the connection appear benign to simple port-based queries.",
          "stage": "lateral-protocol-tunneling",
          "question": "whether protocol tunneling (T1572) is masking the internal insecure traffic",
          "requires": "Deep Packet Inspection (DPI) or internal firewall logs",
          "remediation": "Enable application-layer visibility on internal segmentation firewalls."
        },
        {
          "id": "missing-host-listeners",
          "risk": "The hunt only sees services that are actively being talked to. Insecure services waiting for a 'knock' are missed if no connection occurs in the window.",
          "stage": "legacy-system-discovery",
          "question": "which ports are listening on legacy hosts without active sessions",
          "requires": "hb_network_listener with device_hostname column",
          "remediation": "Map device_hostname into the hb_network_listener surface."
        }
      ]
    },
    "name": "Industrial Protocol Abuse on Legacy Manufacturing Assets",
    "description": "Manufacturing environments often rely on legacy Windows systems (HMI/ICS) that cannot be patched and lack modern security controls. The adversary exploits these systems to bridge the gap into OT networks. This hunt identifies these soft targets and monitors for unencrypted protocol abuse. It inventories legacy OS versions, then fans out to detect inbound management sessions on insecure ports and outbound lateral movement to other internal assets. An agent triages the evidence so an analyst can settle the verdict."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "7-key-manufacturing-cybersecurity-trends-for-2027-huntress",
          "index": 2,
          "title": "7 Key Manufacturing Cybersecurity Trends for 2027 | Huntress",
          "total": 2
        },
        "coverage": [
          {
            "stage": "legacy-system-discovery",
            "steps": [
              "legacy-host-inventory",
              "insecure-inbound-traffic"
            ],
            "status": "covered"
          },
          {
            "stage": "lateral-protocol-tunneling",
            "steps": [
              "lateral-outbound-stack"
            ],
            "status": "covered"
          },
          {
            "stage": "phishing-initial-foothold",
            "reason": "Belongs to another part of the '7 Key Manufacturing Cybersecurity Trends for 2027 | Huntress' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "third-party-supply-chain-entry",
            "reason": "Belongs to another part of the '7 Key Manufacturing Cybersecurity Trends for 2027 | Huntress' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "it-ot-gateway-bridging",
            "reason": "Belongs to another part of the '7 Key Manufacturing Cybersecurity Trends for 2027 | Huntress' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "ot-impact-ransomware",
            "reason": "Belongs to another part of the '7 Key Manufacturing Cybersecurity Trends for 2027 | Huntress' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "Adversaries target legacy Windows 7 and XP systems used as HMIs to bridge into OT networks by using unencrypted management protocols like Telnet and FTP for lateral movement.",
        "blind_spots": [
          {
            "id": "incomplete-network-telemetry",
            "risk": "A sophisticated adversary might tunnel Telnet inside another protocol, making the connection appear benign to simple port-based queries.",
            "stage": "lateral-protocol-tunneling",
            "question": "whether protocol tunneling (T1572) is masking the internal insecure traffic",
            "requires": "Deep Packet Inspection (DPI) or internal firewall logs",
            "remediation": "Enable application-layer visibility on internal segmentation firewalls."
          },
          {
            "id": "missing-host-listeners",
            "risk": "The hunt only sees services that are actively being talked to. Insecure services waiting for a 'knock' are missed if no connection occurs in the window.",
            "stage": "legacy-system-discovery",
            "question": "which ports are listening on legacy hosts without active sessions",
            "requires": "hb_network_listener with device_hostname column",
            "remediation": "Map device_hostname into the hb_network_listener surface."
          }
        ],
        "scoping_notes": "Focus on subnets known to house HMI or PLC management workstations. Use the OS names to build a target list of legacy devices before proceeding to the network traffic queries.",
        "beyond_detection": "While a rule can alert on Telnet traffic, this hunt correlates traffic with legacy OS inventory and baselines outbound movement from those systems to identify internal pivots that standard perimeter rules miss."
      }
    },
    {
      "id": "legacy-host-inventory",
      "type": "query",
      "label": "Inventory legacy Windows assets",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT hostname, os_name, os_version, device_uid, time FROM hb_devices WHERE (LOWER(os_name) LIKE '%windows 7%' OR LOWER(os_name) LIKE '%windows xp%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_devices",
        "description": "Identify Windows 7 and Windows XP systems that likely serve as HMIs or legacy industrial controllers.",
        "expected_signal": "A list of hosts running outdated operating systems. These are the primary targets for monitoring insecure protocol usage."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Inventory legacy Windows assets",
        "reads": [
          "hostname",
          "os_name",
          "os_version",
          "device_uid",
          "time"
        ],
        "source": "hb_devices",
        "target": "endpoint",
        "content": "SELECT hostname, os_name, os_version, device_uid, time FROM hb_devices WHERE (LOWER(os_name) LIKE '%windows 7%' OR LOWER(os_name) LIKE '%windows xp%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hosts running outdated operating systems. These are the primary targets for monitoring insecure protocol usage.",
        "verified": "dry-run",
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "insecure-inbound-traffic",
      "type": "query",
      "label": "Inbound insecure management sessions",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "network",
        "content": "SELECT device_hostname, src_endpoint_ip, dst_endpoint_port, process_name, time FROM hb_network_connection WHERE direction = 'inbound' AND activity_id = 1 AND instr(',' || '{{insecure_ports}}' || ',', ',' || CAST(dst_endpoint_port AS TEXT) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_network_connection",
        "description": "Detect when hosts connect to Telnet, FTP, or unencrypted HTTP on legacy manufacturing systems.",
        "expected_signal": "Sessions established to ports 21, 23, or 80. While potentially for maintenance, these expose credentials and allow command access."
      },
      "parents": [
        {
          "id": "legacy-host-inventory"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Inbound insecure management sessions",
        "reads": [
          "device_hostname",
          "src_endpoint_ip",
          "dst_endpoint_port",
          "process_name",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, src_endpoint_ip, dst_endpoint_port, process_name, time FROM hb_network_connection WHERE direction = 'inbound' AND activity_id = 1 AND instr(',' || '{{insecure_ports}}' || ',', ',' || CAST(dst_endpoint_port AS TEXT) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Sessions established to ports 21, 23, or 80. While potentially for maintenance, these expose credentials and allow command access.",
        "verified": "dry-run",
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "lateral-outbound-stack",
      "type": "query",
      "label": "Baseline outbound lateral movement",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, COUNT(*) AS connection_count, MIN(time) AS first_seen FROM hb_network_connection WHERE direction = 'outbound' AND (dst_endpoint_port = 21 OR dst_endpoint_port = 23) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip, dst_endpoint_port",
        "surface": "hb_network_connection",
        "description": "Identify if legacy systems are being used as jump boxes to scan or connect to other internal OT assets via Telnet or FTP.",
        "expected_signal": "A stack-count of outbound legacy protocol attempts. Rare destinations or high connection counts from a single HMI suggest malicious pivoting."
      },
      "parents": [
        {
          "id": "legacy-host-inventory"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Baseline outbound lateral movement",
        "reads": [
          "device_hostname",
          "dst_endpoint_ip",
          "dst_endpoint_port",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, COUNT(*) AS connection_count, MIN(time) AS first_seen FROM hb_network_connection WHERE direction = 'outbound' AND (dst_endpoint_port = 21 OR dst_endpoint_port = 23) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip, dst_endpoint_port",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "A stack-count of outbound legacy protocol attempts. Rare destinations or high connection counts from a single HMI suggest malicious pivoting.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "dst_endpoint_ip"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "triage-agent",
      "type": "analytic",
      "label": "Triage legacy protocol abuse",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "legacy-host-inventory",
          "insecure-inbound-traffic",
          "lateral-outbound-stack"
        ],
        "objective": "Determine if any legacy Windows host identified in the inventory is being abused as a lateral movement pivot point or is accepting unauthorized unencrypted management traffic.",
        "description": "The agent weighs the OS version, the existence of inbound unencrypted sessions, and any rare outbound pivoting to determine risk.",
        "max_iterations": 6,
        "expected_signal": "A per-host verdict citing specific rows of network traffic.",
        "success_criteria": "A detailed verdict citing row evidence for each host showing high-risk exposure."
      },
      "parents": [
        {
          "id": "insecure-inbound-traffic",
          "kind": "merge"
        },
        {
          "id": "lateral-outbound-stack",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "risk-decision",
      "type": "checkpoint",
      "label": "Evaluate triage results",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious for at least one legacy host exhibiting rare outbound pivoting",
        "condition": "the triage verdict is malicious for at least one legacy host exhibiting rare outbound pivoting",
        "blind_spot": "incomplete-network-telemetry",
        "confidence": "high",
        "description": "Route malicious findings to containment and suspicious exposure to manual review.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-agent"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate legacy asset",
      "config": {
        "target": "endpoint",
        "description": "Immediately prevent further lateral movement from a confirmed compromised legacy host.",
        "instructions": "Isolate the identified legacy host from the network. Coordinate with the plant floor manager to ensure production safety systems are not impacted by the isolation.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "risk-decision",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "audit-task",
      "type": "task",
      "label": "Manual audit of legacy listeners",
      "config": {
        "assignee": "analyst",
        "description": "Verify if the detected unencrypted management services are business-critical and require compensating controls.",
        "instructions": "Review the identified hosts. If Telnet, FTP, or HTTP (port 80) are being used for routine administration, implement strict IP-based segmentation or plan for migration to a secure jump server. If the traffic is anomalous, perform a full forensic imaging of the host."
      },
      "parents": [
        {
          "id": "risk-decision",
          "branch": "default"
        },
        {
          "id": "risk-decision",
          "branch": "on_unavailable"
        },
        {
          "id": "risk-decision",
          "branch": "on_refutes"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "closure-task",
      "type": "task",
      "label": "Hunt closure and documentation",
      "config": {
        "assignee": "analyst",
        "description": "Document identified legacy assets and update the asset inventory to reflect current OS versions and service exposure.",
        "instructions": "Log the identified legacy systems in the central asset registry. Share the protocol abuse findings with the IT-OT gateway team to improve segmentation rules."
      },
      "parents": [
        {
          "id": "audit-task"
        }
      ]
    }
  ]
}