{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Business Email Compromise (BEC) resulting in fraudulent ACH transfers is a direct financial loss risk. Validating whether employees have successfully interacted with known lookalike domains confirms whether the current campaign has breached the human layer."
      },
      "name": "Interaction with BEC Lookalike Infrastructure",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1566",
        "attack.t1598",
        "attack.t1583.001",
        "attack.t1591"
      ],
      "related": [
        {
          "hunt": "m365-bec-forwarding-rules",
          "reason": "This hunt focuses on infrastructure interaction; another hunt is required to find internal persistence via email forwarding rules used to hide BEC replies.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "Simple detection rules alert on the domains themselves; this hunt links the DNS resolution lead to process-level socket state and HTTP URIs to determine if the social engineering was effective. The gated flow ensures that high-volume telemetry is only searched for specific high-fidelity leads.",
      "coverage": [
        {
          "stage": "infrastructure-setup",
          "steps": [
            "dns-leads"
          ],
          "status": "covered"
        },
        {
          "stage": "executive-impersonation-phishing",
          "reason": "The dossier provides no hb_email surface or M365-native email logs to examine message headers, separators, or HTML comments.",
          "status": "not_visible",
          "blind_spot": "missing-email-context"
        },
        {
          "stage": "fraudulent-interaction",
          "steps": [
            "socket-connections",
            "web-requests"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Lookalike Domain Registration",
            "slug": "infrastructure-setup",
            "tactic": "resource-development",
            "techniques": [
              "T1583.001",
              "T1585.002"
            ],
            "observables": [
              "service-nowinc.com",
              "domainlify.net",
              "Registration date 2026-07-31"
            ]
          },
          {
            "name": "AI-Assisted Phishing Delivery",
            "slug": "executive-impersonation-phishing",
            "tactic": "initial-access",
            "techniques": [
              "T1566",
              "T1598",
              "T1090.003"
            ],
            "observables": [
              "Subject keywords: 'due bill', 'ACH Parment'",
              "ServiceNow Platform \u2014 Annual Subscription",
              "Reply-To: domainlify.net",
              "CEO signature impersonation",
              "Banner separators: ===========",
              "HTML comments in email source",
              "Em-dash usage: \u2014"
            ]
          },
          {
            "name": "Lookalike Domain Interaction",
            "slug": "fraudulent-interaction",
            "tactic": "reconnaissance",
            "techniques": [
              "T1591"
            ],
            "observables": [
              "service-nowinc.com",
              "domainlify.net"
            ]
          }
        ],
        "summary": "A large-scale business email compromise campaign used AI-assisted templates to impersonate company executives and vendor representatives to facilitate ACH payment fraud. The threat actor registered lookalike domains and used third-party email infrastructure to deliver over a million phishing emails containing fabricated invoices and simulated internal conversation threads."
      },
      "severity": "medium",
      "rationale": "Prioritize finance and executive workstations as they are the intended targets of the ACH fraud lures. Use the hosts found in the dns-leads step to populate the scope_hosts parameter for the parallel connection investigation.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An employee has received a BEC email and is interacting with lookalike infrastructure to view a fake invoice or initiate a fraudulent payment.",
      "parameters": {
        "bec_domains": {
          "from": {
            "ref": "msrc-blog",
            "kind": "article",
            "observed": "2026-09-10"
          },
          "type": "list[domain]",
          "default": [
            "service-nowinc.com",
            "domainlify.net"
          ],
          "description": "Known lookalike domains from the campaign report."
        },
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Filter interaction queries to these hosts; leave empty to check the whole estate."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
          "name": "MSRC \u2014 Protecting organizations from AI-assisted executive impersonation and invoice fraud"
        }
      ],
      "blind_spots": [
        {
          "id": "encrypted-dns-visibility",
          "risk": "Modern browsers using DoH bypass traditional DNS resolvers, so the gate may close prematurely even if an interaction occurred.",
          "stage": "infrastructure-setup",
          "question": "whether the host used DNS-over-HTTPS (DoH) to resolve lookalike domains",
          "requires": "Network-level DNS logs (hb_dns_activity)"
        },
        {
          "id": "endpoint-telemetry-gap",
          "risk": "If a target host lacks an agent, we see the connection at the network level but cannot attribute it to a specific user or application, leading to indeterminate verdicts.",
          "stage": "fraudulent-interaction",
          "question": "which process initiated the connection to the fraud domains on unmanaged hosts",
          "requires": "Endpoint agent coverage for hb_network_connection"
        },
        {
          "id": "missing-email-context",
          "risk": "We are hunting interactions without visibility into the delivery mechanism, missing the chance to see headers or AI markers in the source email.",
          "stage": "executive-impersonation-phishing",
          "question": "whether the initial phishing email was successfully delivered and seen by the user",
          "requires": "hb_email_activity or M365 email logs"
        }
      ]
    },
    "name": "Interaction with BEC Lookalike Infrastructure",
    "description": "This hunt identifies internal interaction with infrastructure registered for AI-assisted executive impersonation. It uses a gated flow to first find low-cost DNS leads matching known lookalike patterns, then expands the investigation to process-level sockets and HTTP telemetry only when a lead is confirmed. The hunt distinguishes between simple email delivery and successful social engineering by verifying if an endpoint established a connection to the fraud domains."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "infrastructure-setup",
            "steps": [
              "dns-leads"
            ],
            "status": "covered"
          },
          {
            "stage": "executive-impersonation-phishing",
            "reason": "The dossier provides no hb_email surface or M365-native email logs to examine message headers, separators, or HTML comments.",
            "status": "not_visible",
            "blind_spot": "missing-email-context"
          },
          {
            "stage": "fraudulent-interaction",
            "steps": [
              "socket-connections",
              "web-requests"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An employee has received a BEC email and is interacting with lookalike infrastructure to view a fake invoice or initiate a fraudulent payment.",
        "blind_spots": [
          {
            "id": "encrypted-dns-visibility",
            "risk": "Modern browsers using DoH bypass traditional DNS resolvers, so the gate may close prematurely even if an interaction occurred.",
            "stage": "infrastructure-setup",
            "question": "whether the host used DNS-over-HTTPS (DoH) to resolve lookalike domains",
            "requires": "Network-level DNS logs (hb_dns_activity)"
          },
          {
            "id": "endpoint-telemetry-gap",
            "risk": "If a target host lacks an agent, we see the connection at the network level but cannot attribute it to a specific user or application, leading to indeterminate verdicts.",
            "stage": "fraudulent-interaction",
            "question": "which process initiated the connection to the fraud domains on unmanaged hosts",
            "requires": "Endpoint agent coverage for hb_network_connection"
          },
          {
            "id": "missing-email-context",
            "risk": "We are hunting interactions without visibility into the delivery mechanism, missing the chance to see headers or AI markers in the source email.",
            "stage": "executive-impersonation-phishing",
            "question": "whether the initial phishing email was successfully delivered and seen by the user",
            "requires": "hb_email_activity or M365 email logs"
          }
        ],
        "scoping_notes": "Prioritize finance and executive workstations as they are the intended targets of the ACH fraud lures. Use the hosts found in the dns-leads step to populate the scope_hosts parameter for the parallel connection investigation.",
        "beyond_detection": "Simple detection rules alert on the domains themselves; this hunt links the DNS resolution lead to process-level socket state and HTTP URIs to determine if the social engineering was effective. The gated flow ensures that high-volume telemetry is only searched for specific high-fidelity leads."
      }
    },
    {
      "id": "dns-leads",
      "type": "query",
      "label": "DNS lookups for lookalike domains",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, query_hostname, answers, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE activity_id = 1 AND instr(',' || '{{bec_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname, answers",
        "surface": "hb_dns_activity",
        "description": "Identify any internal host attempting to resolve the campaign infrastructure.",
        "expected_signal": "A host resolving these domains suggests a potential victim who clicked a link. Silence proves no resolution occurred via monitored DNS resolvers."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "DNS lookups for lookalike domains",
        "reads": [
          "activity_id",
          "answers",
          "device_hostname",
          "query_hostname",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, query_hostname, answers, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE activity_id = 1 AND instr(',' || '{{bec_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname, answers",
        "silence": "not_evidence_of_absence",
        "expected": "A host resolving these domains suggests a potential victim who clicked a link. Silence proves no resolution occurred via monitored DNS resolvers.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "read-leads",
      "type": "analytic",
      "label": "Evaluate DNS leads",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network",
          "web"
        ],
        "context": [
          "dns-leads"
        ],
        "objective": "Determine if the DNS lookups for {{bec_domains}} indicate meaningful interaction that should open the gate for connection telemetry.",
        "description": "Assess the DNS results to decide if the interaction warrants more expensive telemetry searches.",
        "max_iterations": 3,
        "expected_signal": "A recommendation on whether to proceed with host-level connection analysis.",
        "success_criteria": "A per-host verdict on whether the DNS activity is a positive lead for follow-on queries."
      },
      "parents": [
        {
          "id": "dns-leads"
        }
      ]
    },
    {
      "id": "gate-on-leads",
      "type": "checkpoint",
      "label": "Gate on lead significance",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the agent finds at least one host resolving lookalike domains",
        "condition": "the agent finds at least one host resolving lookalike domains",
        "blind_spot": "encrypted-dns-visibility",
        "confidence": "high",
        "description": "Manage query cost by only running parallel telemetry searches if a valid lead exists.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "read-leads"
        }
      ]
    },
    {
      "id": "socket-connections",
      "type": "query",
      "label": "Sockets to fraud domains",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_hostname, process_name, user_name, time FROM hb_network_connection WHERE activity_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{bec_domains}}' || ',', ',' || LOWER(dst_endpoint_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_network_connection",
        "description": "Identify the process and user that connected to the identified infrastructure.",
        "expected_signal": "A row identifies a browser or application talking to the BEC site. Silence means no established socket was recorded for those domains."
      },
      "parents": [
        {
          "id": "gate-on-leads",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Sockets to fraud domains",
        "reads": [
          "activity_id",
          "device_hostname",
          "dst_endpoint_hostname",
          "dst_endpoint_ip",
          "process_name",
          "time",
          "user_name"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_hostname, process_name, user_name, time FROM hb_network_connection WHERE activity_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{bec_domains}}' || ',', ',' || LOWER(dst_endpoint_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A row identifies a browser or application talking to the BEC site. Silence means no established socket was recorded for those domains.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "web-requests",
      "type": "query",
      "label": "HTTP telemetry for fraud URIs",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "web",
        "content": "SELECT device_hostname, url_hostname, url_full, user_agent, time FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{bec_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Inspect the full URL to determine if the user accessed specific invoice or payment portals.",
        "expected_signal": "Full URI paths show specific interaction targets (e.g., /invoice/ACH). Silence may mean the traffic was encrypted at the proxy."
      },
      "parents": [
        {
          "id": "gate-on-leads",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "HTTP telemetry for fraud URIs",
        "reads": [
          "device_hostname",
          "time",
          "url_full",
          "url_hostname",
          "user_agent"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_hostname, url_full, user_agent, time FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{bec_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Full URI paths show specific interaction targets (e.g., /invoice/ACH). Silence may mean the traffic was encrypted at the proxy.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "final-triage",
      "type": "analytic",
      "label": "Synthesize interaction evidence",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network",
          "web"
        ],
        "context": [
          "read-leads",
          "socket-connections",
          "web-requests"
        ],
        "objective": "Determine if any host successfully engaged with lookalike infrastructure based on the combined telemetry.",
        "description": "Consolidate DNS, socket, and HTTP results to confirm successful social engineering.",
        "max_iterations": 6,
        "expected_signal": "A per-host verdict of malicious | suspicious | benign citing specific process and web activity.",
        "success_criteria": "A verdict that distinguishes between mere resolution and active session engagement."
      },
      "parents": [
        {
          "id": "socket-connections",
          "kind": "merge"
        },
        {
          "id": "web-requests",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-verdict",
      "type": "checkpoint",
      "label": "Route based on interaction",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage confirms active interaction with fraud infrastructure for at least one host",
        "condition": "the triage confirms active interaction with fraud infrastructure for at least one host",
        "blind_spot": "endpoint-telemetry-gap",
        "confidence": "high",
        "description": "Isolate hosts where engagement with the BEC infrastructure is confirmed.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "final-triage"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate target endpoint",
      "config": {
        "target": "endpoint",
        "description": "Contain the threat and prevent further fraudulent actions by the user.",
        "instructions": "Isolate the host and revoke active identity sessions for the involved user account.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Verify fraud completion",
      "config": {
        "assignee": "analyst",
        "description": "Analyze the extent of the interaction and check for initiated financial transfers.",
        "instructions": "Review the full URIs in the web-requests step. Check the user inbox for the impersonation emails to verify if they match the AI-generated patterns described in the report. Coordinate with finance to check for pending ACH transfers to unknown bank accounts."
      },
      "parents": [
        {
          "id": "gate-on-leads",
          "branch": "default"
        },
        {
          "id": "gate-on-leads",
          "branch": "on_unavailable"
        },
        {
          "id": "route-verdict",
          "branch": "default"
        },
        {
          "id": "route-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Hunt close-out",
      "config": {
        "assignee": "analyst",
        "description": "Document findings and update blocklists.",
        "instructions": "Record all hosts that were examined and found to have no interaction. Add any newly discovered fraudulent IPs to the perimeter blocklist."
      },
      "parents": [
        {
          "id": "gate-on-leads",
          "branch": "on_refutes"
        },
        {
          "id": "route-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-review"
        }
      ]
    }
  ]
}