{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "SMBs are the primary entry point for supply-chain attacks; a negative result for perimeter exploitation and high-risk identity events confirms that the exposed attack surface remains secure."
      },
      "name": "Initial Access via External Applications and Phishing",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1195",
        "attack.t1566",
        "attack.t1078",
        "credential access",
        "defense evasion",
        "impact",
        "initial access"
      ],
      "series": {
        "slug": "when-confusion-reigns-trusted-vendors-must-guide-their-smb-customers",
        "index": 1,
        "title": "When confusion reigns, trusted vendors must guide their SMB customers",
        "total": 2
      },
      "related": [
        {
          "hunt": "evasive-execution-and-rmm",
          "reason": "Once initial access is gained, the adversary moves to evasive execution; that is a sibling hunt focusing on process behavior.",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A standard rule alerts on a single high-risk sign-in; this hunt correlates the vulnerability state of the host with rare application crashes and identity flags, finding the 'living off the land' beachhead that a single-surface rule would miss.",
      "coverage": [
        {
          "stage": "inbound-application-exploitation",
          "steps": [
            "vulnerable-device-scoping",
            "rare-application-crashes"
          ],
          "status": "covered"
        },
        {
          "stage": "phishing-and-email-compromise",
          "steps": [
            "suspicious-identity-events"
          ],
          "status": "covered"
        },
        {
          "stage": "evasive-execution-and-rmm",
          "reason": "Belongs to another part of the 'When confusion reigns, trusted vendors must guide their SMB customers' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "credential-theft-infostealers",
          "reason": "Belongs to another part of the 'When confusion reigns, trusted vendors must guide their SMB customers' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "ransomware-data-encryption",
          "reason": "Belongs to another part of the 'When confusion reigns, trusted vendors must guide their SMB customers' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Public-Facing Application Exploitation",
            "slug": "inbound-application-exploitation",
            "tactic": "initial-access",
            "techniques": [
              "T1190",
              "T1195"
            ],
            "observables": [
              "Exploitation of web servers",
              "AI-discovered zero-day exploits",
              "Manipulation of software update or delivery mechanisms",
              "Anomalous HTTP requests targeting vulnerabilities"
            ]
          },
          {
            "name": "Phishing and Business Email Compromise",
            "slug": "phishing-and-email-compromise",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "Emails containing malicious attachments",
              "Phishing links delivered via email",
              "Unauthorized access to business email accounts"
            ]
          },
          {
            "name": "Living off the Land and Unsanctioned RMM",
            "slug": "evasive-execution-and-rmm",
            "tactic": "defense-evasion",
            "techniques": [
              "T1218"
            ],
            "observables": [
              "Execution via signed Microsoft binaries (LOLBAS)",
              "Unsanctioned remote monitoring and management (RMM) software",
              "Use of 'safe-looking' administrative tools for malicious activity"
            ]
          },
          {
            "name": "Infostealers and Credential Harvest",
            "slug": "credential-theft-infostealers",
            "tactic": "credential-access",
            "techniques": [
              "T1555",
              "T1078"
            ],
            "observables": [
              "Infostealer malware execution",
              "Searching for credentials in password stores",
              "Abuse of compromised valid accounts for session access"
            ]
          },
          {
            "name": "Data Encryption for Impact",
            "slug": "ransomware-data-encryption",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "Deployment of ransomware binaries",
              "Mass file encryption on local or remote drives",
              "Creation of ransom notes"
            ]
          }
        ],
        "summary": "Adversaries target SMBs as a pathway into larger supply chains, using phishing and exploitation of public-facing applications for initial access. Post-compromise, they utilize 'living off the land' techniques and unsanctioned remote monitoring and management (RMM) tools to steal credentials and deploy ransomware."
      },
      "severity": "medium",
      "rationale": "Begin by querying the vulnerability inventory for hosts with active critical CVEs (severity_id 4 or 5). Use these hostnames to narrow the behavioral queries in the next steps.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has gained initial access by either exploiting a critical vulnerability in a public-facing application or by use of stolen credentials from a phishing campaign, resulting in anomalous application crashes or high-risk authentication events on perimeter assets.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "scoping-result",
            "kind": "manual",
            "observed": "2024-11-01"
          },
          "type": "list[host]",
          "default": [],
          "description": "Hostnames identified in the scoping step to narrow the behavioral queries."
        },
        "lookback_days": {
          "from": {
            "ref": "standard-retention",
            "kind": "manual",
            "observed": "2024-11-01"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine for behavior."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.welivesecurity.com/en/business-security/when-confusion-reigns-trusted-vendors-guide-smb-customers/",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.welivesecurity.com/en/business-security/when-confusion-reigns-trusted-vendors-guide-smb-customers/",
          "name": "When confusion reigns, trusted vendors must guide their SMB customers"
        }
      ],
      "blind_spots": [
        {
          "id": "no-identity-logging",
          "risk": "If the identity provider does not log the specific MFA method used, we cannot distinguish between a legitimate login and a bypass.",
          "stage": "phishing-and-email-compromise",
          "question": "whether a successful login used an MFA bypass technique",
          "requires": "hb_auth_signin with full risk detail"
        },
        {
          "id": "crash-log-omission",
          "risk": "Standard server logs (IIS, Apache) are captured, but proprietary or legacy applications may not report crashes to the OS error logging service.",
          "stage": "inbound-application-exploitation",
          "question": "whether a non-standard web service was exploited",
          "requires": "hb_application_error covering all custom services"
        }
      ]
    },
    "name": "Initial Access via External Applications and Phishing",
    "description": "Following research that suggests SMBs are frequently targeted as supply-chain beachheads, this hunt identifies assets with known critical vulnerabilities. The hunt then launches parallel queries to find rare application faults in web services and high-risk authentication flags from identity providers. Finally, an agent correlates these disparate signals to determine if a perimeter breach has occurred, and an analyst reviews the evidence to confirm the intrusion vector."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "when-confusion-reigns-trusted-vendors-must-guide-their-smb-customers",
          "index": 1,
          "title": "When confusion reigns, trusted vendors must guide their SMB customers",
          "total": 2
        },
        "coverage": [
          {
            "stage": "inbound-application-exploitation",
            "steps": [
              "vulnerable-device-scoping",
              "rare-application-crashes"
            ],
            "status": "covered"
          },
          {
            "stage": "phishing-and-email-compromise",
            "steps": [
              "suspicious-identity-events"
            ],
            "status": "covered"
          },
          {
            "stage": "evasive-execution-and-rmm",
            "reason": "Belongs to another part of the 'When confusion reigns, trusted vendors must guide their SMB customers' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "credential-theft-infostealers",
            "reason": "Belongs to another part of the 'When confusion reigns, trusted vendors must guide their SMB customers' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "ransomware-data-encryption",
            "reason": "Belongs to another part of the 'When confusion reigns, trusted vendors must guide their SMB customers' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary has gained initial access by either exploiting a critical vulnerability in a public-facing application or by use of stolen credentials from a phishing campaign, resulting in anomalous application crashes or high-risk authentication events on perimeter assets.",
        "blind_spots": [
          {
            "id": "no-identity-logging",
            "risk": "If the identity provider does not log the specific MFA method used, we cannot distinguish between a legitimate login and a bypass.",
            "stage": "phishing-and-email-compromise",
            "question": "whether a successful login used an MFA bypass technique",
            "requires": "hb_auth_signin with full risk detail"
          },
          {
            "id": "crash-log-omission",
            "risk": "Standard server logs (IIS, Apache) are captured, but proprietary or legacy applications may not report crashes to the OS error logging service.",
            "stage": "inbound-application-exploitation",
            "question": "whether a non-standard web service was exploited",
            "requires": "hb_application_error covering all custom services"
          }
        ],
        "scoping_notes": "Begin by querying the vulnerability inventory for hosts with active critical CVEs (severity_id 4 or 5). Use these hostnames to narrow the behavioral queries in the next steps.",
        "beyond_detection": "A standard rule alerts on a single high-risk sign-in; this hunt correlates the vulnerability state of the host with rare application crashes and identity flags, finding the 'living off the land' beachhead that a single-surface rule would miss."
      }
    },
    {
      "id": "vulnerable-device-scoping",
      "type": "query",
      "label": "Identify vulnerable perimeter assets",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_uid, resource_uid AS device_hostname, cve_uid, severity, cvss_score FROM hb_vulnerability_finding WHERE severity_id >= 4 AND status = 'active' AND resource_type = 'device' ORDER BY cvss_score DESC",
        "surface": "hb_vulnerability_finding",
        "description": "Identify devices with critical active vulnerabilities that could serve as the initial entry point for an adversary.",
        "expected_signal": "A list of hostnames with critical CVEs. Silence indicates no active critical vulnerabilities are reported in the scanner inventory."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify vulnerable perimeter assets",
        "reads": [
          "device_uid",
          "resource_uid",
          "cve_uid",
          "severity",
          "cvss_score",
          "severity_id",
          "status",
          "resource_type"
        ],
        "source": "hb_vulnerability_finding",
        "target": "endpoint",
        "content": "SELECT device_uid, resource_uid AS device_hostname, cve_uid, severity, cvss_score FROM hb_vulnerability_finding WHERE severity_id >= 4 AND status = 'active' AND resource_type = 'device' ORDER BY cvss_score DESC",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames with critical CVEs. Silence indicates no active critical vulnerabilities are reported in the scanner inventory.",
        "verified": "dry-run",
        "verified_at": "2026-11-03"
      }
    },
    {
      "id": "rare-application-crashes",
      "type": "query",
      "label": "Rare application crashes on vulnerable hosts",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT device_hostname, app_name, exception_code, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_application_error WHERE (LOWER(app_name) LIKE '%w3wp%' OR LOWER(app_name) LIKE '%httpd%' OR LOWER(app_name) LIKE '%nginx%' OR LOWER(app_name) LIKE '%sql%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY app_name, exception_code HAVING host_count < 3 ORDER BY host_count ASC",
        "surface": "hb_application_error",
        "description": "Find rare application failures in web services that could indicate memory corruption or exploit attempts.",
        "expected_signal": "A crash in a web server or database process occurring on fewer than 3 hosts. Silence suggests no rare fatal application errors occurred."
      },
      "parents": [
        {
          "id": "vulnerable-device-scoping"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare application crashes on vulnerable hosts",
        "reads": [
          "device_hostname",
          "app_name",
          "exception_code",
          "time"
        ],
        "source": "hb_application_error",
        "target": "endpoint",
        "content": "SELECT device_hostname, app_name, exception_code, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_application_error WHERE (LOWER(app_name) LIKE '%w3wp%' OR LOWER(app_name) LIKE '%httpd%' OR LOWER(app_name) LIKE '%nginx%' OR LOWER(app_name) LIKE '%sql%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY app_name, exception_code HAVING host_count < 3 ORDER BY host_count ASC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "A crash in a web server or database process occurring on fewer than 3 hosts. Silence suggests no rare fatal application errors occurred.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "app_name",
            "exception_code"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-11-03"
      }
    },
    {
      "id": "suspicious-identity-events",
      "type": "query",
      "label": "High-risk authentication and credential abuse",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "identity",
        "content": "SELECT dst_endpoint_hostname AS device_hostname, actor_user_name, src_endpoint_ip, risk_state, status_code, event_type, time FROM hb_auth_signin WHERE (risk_state != 'none' OR status_code IN ('50126', '50053', '500121')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_auth_signin",
        "description": "Identify sign-ins flagged by providers as high-risk or indicating brute-force/MFA exhaustion.",
        "expected_signal": "Successful or failed sign-ins with 'atRisk' states or codes for brute force/MFA failure. Silence indicates no high-risk identity alerts."
      },
      "parents": [
        {
          "id": "vulnerable-device-scoping"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "High-risk authentication and credential abuse",
        "reads": [
          "dst_endpoint_hostname",
          "actor_user_name",
          "src_endpoint_ip",
          "risk_state",
          "status_code",
          "event_type",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT dst_endpoint_hostname AS device_hostname, actor_user_name, src_endpoint_ip, risk_state, status_code, event_type, time FROM hb_auth_signin WHERE (risk_state != 'none' OR status_code IN ('50126', '50053', '500121')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Successful or failed sign-ins with 'atRisk' states or codes for brute force/MFA failure. Silence indicates no high-risk identity alerts.",
        "verified": "dry-run",
        "verified_at": "2026-11-03"
      }
    },
    {
      "id": "initial-access-triage",
      "type": "analytic",
      "label": "Triage initial access signals",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "vulnerable-device-scoping",
          "rare-application-crashes",
          "suspicious-identity-events"
        ],
        "objective": "Review the critical vulnerabilities on scoping hosts and correlate them with any rare application crashes or high-risk authentication events on those same hosts. Decide if the timing and nature of these signals represent a successful intrusion.",
        "description": "Determine if the identified vulnerabilities, application crashes, and identity risks together indicate a successful perimeter breach.",
        "max_iterations": 4,
        "expected_signal": "A per-host verdict of malicious, suspicious, or benign citing specific event rows.",
        "success_criteria": "A verdict for each host in the context, citing specific rows for crashes or sign-in risks."
      },
      "parents": [
        {
          "id": "rare-application-crashes",
          "kind": "merge"
        },
        {
          "id": "suspicious-identity-events",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "intrusion-decision",
      "type": "checkpoint",
      "label": "Route based on intrusion verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the initial-access-triage verdict is malicious for at least one host",
        "condition": "the initial-access-triage verdict is malicious for at least one host",
        "blind_spot": "no-identity-logging",
        "confidence": "high",
        "description": "Direct the hunt to containment if successful initial access is confirmed.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "initial-access-triage"
        }
      ]
    },
    {
      "id": "isolate-compromised-host",
      "type": "action",
      "label": "Isolate the compromised host",
      "config": {
        "target": "endpoint",
        "description": "Contain the threat and prevent lateral movement from the beachhead.",
        "instructions": "Isolate the host identified as malicious and revoke all active sessions for the involved users in the identity provider (Entra ID/Okta).",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "intrusion-decision",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "incident-response-task",
      "type": "task",
      "label": "Forensic lead analysis",
      "config": {
        "assignee": "analyst",
        "description": "Analyze the crash and authentication evidence to confirm the root cause.",
        "instructions": "Review the application errors and authentication logs. If an application crash was found, correlate with hb_http_activity to find the URI and source IP that triggered the fault. If auth risk was found, check for subsequent hb_process_activity or hb_file_activity that indicates hands-on-keyboard activity."
      },
      "parents": [
        {
          "id": "intrusion-decision",
          "branch": "default"
        },
        {
          "id": "intrusion-decision",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-compromised-host"
        }
      ]
    },
    {
      "id": "remediation-task",
      "type": "task",
      "label": "Close the gaps",
      "config": {
        "assignee": "analyst",
        "description": "Patch vulnerabilities and improve resilience based on the hunt findings.",
        "instructions": "Immediately patch the CVEs identified on any malicious or suspicious hosts. Review the conditional access policies for any accounts flagged for risk to ensure phishing-resistant MFA is required for perimeter access."
      },
      "parents": [
        {
          "id": "intrusion-decision",
          "branch": "on_refutes"
        },
        {
          "id": "incident-response-task"
        }
      ]
    }
  ]
}