{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Interlock RAT is a gateway to ransomware; confirming its absence across the estate is a priority for business continuity and risk mitigation." }, "name": "Interlock RAT Endpoint Execution and Reconnaissance", "type": "investigation", "labels": [ "hunt", "attack.t1059.001", "attack.t1105", "attack.t1082", "attack.t1057", "attack.t1018", "attack.t1087", "attack.t1069", "attack.t1016", "attack.t1547.001" ], "series": { "slug": "kongtuke-filefix-leads-to-new-interlock-rat-variant", "index": 1, "title": "KongTuke FileFix Leads to New Interlock RAT Variant", "total": 2 }, "related": [ { "hunt": "interlock-rat-c2-tunnel-analysis", "reason": "Cloudflare Tunnel traffic analysis requires high-fidelity network or proxy logs which are handled in a separate hunt.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single rule for reconnaissance commands might be noisy, but this hunt correlates those commands with the arrival of a rare PHP binary in a user-writable path and DNS callbacks, reducing false positives in varied environments.", "coverage": [ { "stage": "powershell-stager-execution", "steps": [ "enrichment-dns-c2", "agent-early-triage" ], "status": "covered" }, { "stage": "php-rat-deployment", "steps": [ "scoping-php-in-appdata", "baseline-rare-php-paths", "enrichment-config-hashes" ], "status": "covered" }, { "stage": "automated-and-manual-discovery", "steps": [ "detection-recon-commands" ], "status": "covered" }, { "stage": "persistence-registry-run", "steps": [ "triage-registry-persistence" ], "status": "covered" }, { "stage": "initial-access-web-inject", "reason": "Belongs to another part of the 'KongTuke FileFix Leads to New Interlock RAT Variant' series.", "status": "out_of_scope" }, { "stage": "c2-cloudflare-tunneling", "reason": "Belongs to another part of the 'KongTuke FileFix Leads to New Interlock RAT Variant' series.", "status": "out_of_scope" }, { "stage": "lateral-movement-rdp", "reason": "Belongs to another part of the 'KongTuke FileFix Leads to New Interlock RAT Variant' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Social Engineering via Web-Inject", "slug": "initial-access-web-inject", "tactic": "initial-access", "techniques": [ "T1189", "T1204.002" ], "observables": [ "captcha verification prompt", "human verification steps", "clipboard paste into run command" ] }, { "name": "PowerShell Stager Execution", "slug": "powershell-stager-execution", "tactic": "execution", "techniques": [ "T1059.001", "T1105" ], "observables": [ "schtasks /delete /tn Updater /f", "New-Object System.Net.WebClient", "DownloadString", "deadly-programming-attorneys-our.trycloudflare.com", "User-Agent: PowerShell" ] }, { "name": "Interlock RAT (PHP) Deployment", "slug": "php-rat-deployment", "tactic": "execution", "techniques": [ "T1059" ], "observables": [ "AppData\\Roaming\\php\\php.exe", "wefs.cfg", "php.exe -d extension=zip -d extension_dir=ext", "28a9982cf2b4fc53a1545b6ed0d0c1788ca9369a847750f5652ffa0ca7f7b7d3", "8afd6c0636c5d70ac0622396268786190a428635e9cf28ab23add939377727b0" ] }, { "name": "Automated and Manual Discovery", "slug": "automated-and-manual-discovery", "tactic": "discovery", "techniques": [ "T1082", "T1057", "T1018", "T1087", "T1069", "T1016" ], "observables": [ "Get-NetNeighbor -AddressFamily IPv4", "systeminfo /FO CSV", "tasklist /svc", "Get-Service", "Get-PSDrive", "[Security.Principal.WindowsIdentity]::GetCurrent()", "[adsiSearcher]\"(ObjectClass=computer)\"", "nltest /dclist:", "net user %USERNAME% /domain" ] }, { "name": "Registry Run Key Persistence", "slug": "persistence-registry-run", "tactic": "persistence", "techniques": [ "T1547.001" ], "observables": [ "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", "php.exe AppData\\Roaming\\php\\wefs.cfg" ] }, { "name": "Cloudflare Tunnel C2", "slug": "c2-cloudflare-tunneling", "tactic": "command-and-control", "techniques": [ "T1071.001", "T1572" ], "observables": [ "existed-bunch-balance-councils.trycloudflare.com", "ferrari-rolling-facilities-lounge.trycloudflare.com", "galleries-physicians-psp-wv.trycloudflare.com", "evidence-deleted-procedure-bringing.trycloudflare.com", "nowhere-locked-manor-hs.trycloudflare.com", "ranked-accordingly-ab-hired.trycloudflare.com", "64.95.12.71", "184.95.51.165" ] }, { "name": "Lateral Movement via RDP", "slug": "lateral-movement-rdp", "tactic": "lateral-movement", "techniques": [ "T1021.001" ], "observables": [ "Remote Desktop Protocol usage" ] } ], "summary": "The Interlock ransomware group utilizes KongTuke web-injects to deliver a PHP-based RAT through a multi-stage PowerShell stager executed via social engineering. The malware conducts extensive automated and manual reconnaissance of system profiles and Active Directory, maintains persistence through registry Run keys, and leverages Cloudflare Tunnels for resilient C2 before facilitating lateral movement via RDP." }, "severity": "high", "rationale": "Exclude developer workstations where PHP may be legitimately running from user-specific paths (e.g., via Composer). Focus on general user workstations.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has deployed a PHP-based RAT into user-writable directories via a PowerShell stager and is conducting automated system reconnaissance to map the environment.", "parameters": { "c2_domains": { "from": { "ref": "https://thedfirreport.com/2025/07/14/kongtuke-filefix-leads-to-new-interlock-rat-variant/", "kind": "article", "observed": "2025-07-14" }, "type": "list[domain]", "default": [ "deadly-programming-attorneys-our.trycloudflare.com", "existed-bunch-balance-councils.trycloudflare.com", "ferrari-rolling-facilities-lounge.trycloudflare.com", "galleries-physicians-psp-wv.trycloudflare.com", "evidence-deleted-procedure-bringing.trycloudflare.com", "nowhere-locked-manor-hs.trycloudflare.com", "ranked-accordingly-ab-hired.trycloudflare.com" ], "description": "C2 domains observed in Interlock RAT campaigns." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hosts to restrict the hunt to." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "rat_config_hashes": { "from": { "ref": "https://thedfirreport.com/2025/07/14/kongtuke-filefix-leads-to-new-interlock-rat-variant/", "kind": "article", "observed": "2025-07-14" }, "type": "list[hash]", "default": [ "28a9982cf2b4fc53a1545b6ed0d0c1788ca9369a847750f5652ffa0ca7f7b7d3", "8afd6c0636c5d70ac0622396268786190a428635e9cf28ab23add939377727b0" ], "description": "SHA256 hashes of the Interlock RAT configuration files." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://thedfirreport.com/2025/07/14/kongtuke-filefix-leads-to-new-interlock-rat-variant/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://thedfirreport.com/2025/07/14/kongtuke-filefix-leads-to-new-interlock-rat-variant/", "name": "The DFIR Report \u2014 KongTuke FileFix Leads to New Interlock RAT Variant" } ], "blind_spots": [ { "id": "no-process-audit", "risk": "A host that does not audit process creation or command lines will not show the reconnaissance behavior or the PHP arguments.", "stage": "php-rat-deployment", "question": "Which hosts are not currently reporting process command lines?", "requires": "hb_process_activity with command lines" }, { "id": "ephemeral-trycloudflare-domains", "risk": "TryCloudflare subdomains are ephemeral; if the actor has rotated to new ones not listed in the parameters, the DNS step will return zero rows.", "stage": "powershell-stager-execution", "question": "Did the actor rotate domains before the hunt began?", "requires": "hb_dns_activity" } ] }, "name": "Interlock RAT Endpoint Execution and Reconnaissance", "description": "This hunt identifies the Interlock RAT PHP variant, a tool used by the Interlock ransomware group as a successor to NodeSnake. We look for the arrival of the PowerShell stager, the deployment of PHP binaries into Roaming AppData, the subsequent reconnaissance commands used to profile the host, and the persistence mechanisms used to survive reboots. The hunt uses a phased approach: first identifying the initial execution and rare interpreter paths, then pivoting to follow-on discovery and persistence behaviors seen in the June 2025 campaign." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "kongtuke-filefix-leads-to-new-interlock-rat-variant", "index": 1, "title": "KongTuke FileFix Leads to New Interlock RAT Variant", "total": 2 }, "coverage": [ { "stage": "powershell-stager-execution", "steps": [ "enrichment-dns-c2", "agent-early-triage" ], "status": "covered" }, { "stage": "php-rat-deployment", "steps": [ "scoping-php-in-appdata", "baseline-rare-php-paths", "enrichment-config-hashes" ], "status": "covered" }, { "stage": "automated-and-manual-discovery", "steps": [ "detection-recon-commands" ], "status": "covered" }, { "stage": "persistence-registry-run", "steps": [ "triage-registry-persistence" ], "status": "covered" }, { "stage": "initial-access-web-inject", "reason": "Belongs to another part of the 'KongTuke FileFix Leads to New Interlock RAT Variant' series.", "status": "out_of_scope" }, { "stage": "c2-cloudflare-tunneling", "reason": "Belongs to another part of the 'KongTuke FileFix Leads to New Interlock RAT Variant' series.", "status": "out_of_scope" }, { "stage": "lateral-movement-rdp", "reason": "Belongs to another part of the 'KongTuke FileFix Leads to New Interlock RAT Variant' series.", "status": "out_of_scope" } ], "rationale": "An intruder has deployed a PHP-based RAT into user-writable directories via a PowerShell stager and is conducting automated system reconnaissance to map the environment.", "blind_spots": [ { "id": "no-process-audit", "risk": "A host that does not audit process creation or command lines will not show the reconnaissance behavior or the PHP arguments.", "stage": "php-rat-deployment", "question": "Which hosts are not currently reporting process command lines?", "requires": "hb_process_activity with command lines" }, { "id": "ephemeral-trycloudflare-domains", "risk": "TryCloudflare subdomains are ephemeral; if the actor has rotated to new ones not listed in the parameters, the DNS step will return zero rows.", "stage": "powershell-stager-execution", "question": "Did the actor rotate domains before the hunt began?", "requires": "hb_dns_activity" } ], "scoping_notes": "Exclude developer workstations where PHP may be legitimately running from user-specific paths (e.g., via Composer). Focus on general user workstations.", "beyond_detection": "A single rule for reconnaissance commands might be noisy, but this hunt correlates those commands with the arrival of a rare PHP binary in a user-writable path and DNS callbacks, reducing false positives in varied environments." } }, { "id": "scoping-php-in-appdata", "type": "query", "label": "Scope hosts with PHP in AppData", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\appdata\\roaming\\php\\php.exe' OR LOWER(process_name) LIKE '%\\appdata\\roaming\\php\\php.exe') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify hosts running PHP executables from the user Roaming profile, which is the hallmark of the Interlock RAT delivery method.", "expected_signal": "A list of hosts where PHP was executed from a non-standard, user-writable path. Silence suggests this specific delivery hasn't occurred." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope hosts with PHP in AppData", "reads": [ "device_hostname", "process_name", "process_path", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\appdata\\roaming\\php\\php.exe' OR LOWER(process_name) LIKE '%\\appdata\\roaming\\php\\php.exe') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A list of hosts where PHP was executed from a non-standard, user-writable path. Silence suggests this specific delivery hasn't occurred.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "baseline-rare-php-paths", "type": "query", "label": "Baseline rare PHP binary paths", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\php.exe' OR LOWER(process_name) = 'php.exe') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_path) HAVING host_count < 5", "surface": "hb_process_activity", "description": "Stack-count PHP binary paths across the fleet to identify outliers running from user-writable directories.", "expected_signal": "PHP executables seen on very few hosts, particularly those under user profile paths. Normal installations under Program Files will be common." }, "parents": [ { "id": "scoping-php-in-appdata" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Baseline rare PHP binary paths", "reads": [ "device_hostname", "process_name", "process_path", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\php.exe' OR LOWER(process_name) = 'php.exe') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_path) HAVING host_count < 5", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "PHP executables seen on very few hosts, particularly those under user profile paths. Normal installations under Program Files will be common.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_path" ], "rare_below": 5 }, "verified_at": "2026-09-20" } }, { "id": "enrichment-dns-c2", "type": "query", "label": "DNS callbacks to stager C2", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE (instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%.trycloudflare.com') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_dns_activity", "description": "Match host DNS activity against the Cloudflare Tunnel domains associated with the Interlock campaign.", "expected_signal": "DNS lookups for known C2 domains or generic Cloudflare Tunnel patterns that coincide with rare PHP execution." }, "parents": [ { "id": "scoping-php-in-appdata" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "DNS callbacks to stager C2", "reads": [ "device_hostname", "process_name", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE (instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%.trycloudflare.com') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "DNS lookups for known C2 domains or generic Cloudflare Tunnel patterns that coincide with rare PHP execution.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "agent-early-triage", "type": "analytic", "label": "Triage early infection stage", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "baseline-rare-php-paths", "enrichment-dns-c2" ], "objective": "Identify hosts where PHP.exe arrived in a user path and immediately communicated with Cloudflare Tunnel domains.", "description": "Determine if the combination of non-standard PHP paths and DNS lookups points to an Interlock RAT infection.", "max_iterations": 3, "expected_signal": "A per-host verdict on whether the initial stager and RAT binary have arrived.", "success_criteria": "A verdict citing specific process paths and domain lookups." }, "parents": [ { "id": "baseline-rare-php-paths", "kind": "merge" }, { "id": "enrichment-dns-c2", "kind": "merge" } ] }, { "id": "detection-recon-commands", "type": "query", "label": "Post-infection reconnaissance commands", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_cmd_line, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_cmd_line) LIKE '%get-netneighbor%' OR LOWER(process_cmd_line) LIKE '%systeminfo /fo csv%' OR LOWER(process_cmd_line) LIKE '%tasklist /svc%' OR LOWER(process_cmd_line) LIKE '%[security.principal.windowsidentity]%' OR LOWER(process_cmd_line) LIKE '%[adsisearcher]%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify the automated system profiling commands typically run by the Interlock RAT upon successful deployment.", "expected_signal": "A sequence of PowerShell or CMD commands profiling the network, system, and user context, often spawned from the PHP process." }, "parents": [ { "id": "agent-early-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Post-infection reconnaissance commands", "reads": [ "device_hostname", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_cmd_line, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_cmd_line) LIKE '%get-netneighbor%' OR LOWER(process_cmd_line) LIKE '%systeminfo /fo csv%' OR LOWER(process_cmd_line) LIKE '%tasklist /svc%' OR LOWER(process_cmd_line) LIKE '%[security.principal.windowsidentity]%' OR LOWER(process_cmd_line) LIKE '%[adsisearcher]%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A sequence of PowerShell or CMD commands profiling the network, system, and user context, often spawned from the PHP process.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "triage-registry-persistence", "type": "query", "label": "RAT Run key persistence", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_data, time FROM hb_registry_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND LOWER(reg_target) LIKE '%\\currentversion\\run%' AND LOWER(reg_value_data) LIKE '%php.exe%' AND LOWER(reg_value_data) LIKE '%.cfg%' AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_registry_activity", "description": "Locate the Registry Run keys used by the RAT to ensure persistence across reboots, specifically pointing to the PHP interpreter and a config file.", "expected_signal": "Registry values in the Run key pointing to the PHP executable in AppData, which confirms a persistent installation." }, "parents": [ { "id": "agent-early-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "RAT Run key persistence", "reads": [ "device_hostname", "reg_target", "reg_value_data", "time" ], "source": "hb_registry_activity", "target": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_data, time FROM hb_registry_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND LOWER(reg_target) LIKE '%\\currentversion\\run%' AND LOWER(reg_value_data) LIKE '%php.exe%' AND LOWER(reg_value_data) LIKE '%.cfg%' AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Registry values in the Run key pointing to the PHP executable in AppData, which confirms a persistent installation.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "enrichment-config-hashes", "type": "query", "label": "Interlock config file matches", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, file_path, file_hash_sha256, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{rat_config_hashes}}' || ',', ',' || file_hash_sha256 || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Corroborate the findings by matching SHA256 hashes of known Interlock RAT configuration files on disk.", "expected_signal": "File creation or access events for .cfg files with matching hashes from the report." }, "parents": [ { "id": "agent-early-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Interlock config file matches", "reads": [ "device_hostname", "file_hash_sha256", "file_path", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_path, file_hash_sha256, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{rat_config_hashes}}' || ',', ',' || file_hash_sha256 || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "File creation or access events for .cfg files with matching hashes from the report.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "agent-follow-on-synthesis", "type": "analytic", "label": "Synthesize final verdict", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "agent-early-triage", "detection-recon-commands", "triage-registry-persistence", "enrichment-config-hashes" ], "objective": "Confirm Interlock RAT presence by weighing the rare PHP paths from the first phase against the reconnaissance commands and Registry Run keys in the second phase.", "description": "Combine evidence from the early arrival, reconnaissance behavior, and persistence to confirm active host compromise.", "max_iterations": 4, "expected_signal": "A comprehensive verdict per host citing the full attack chain.", "success_criteria": "A per-host verdict of malicious | suspicious | benign citing all relevant rows." }, "parents": [ { "id": "detection-recon-commands", "kind": "merge" }, { "id": "triage-registry-persistence", "kind": "merge" }, { "id": "enrichment-config-hashes", "kind": "merge" } ] }, { "id": "decision-route", "type": "checkpoint", "label": "Route on final verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the agent-follow-on-synthesis verdict is malicious for at least one host", "condition": "the agent-follow-on-synthesis verdict is malicious for at least one host", "blind_spot": "no-process-audit", "confidence": "high", "description": "Route the hunt based on whether a host was confirmed as compromised by the Interlock RAT.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "agent-follow-on-synthesis" } ] }, { "id": "action-isolate", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Isolate the compromised host to prevent further lateral movement and C2 communication.", "instructions": "Isolate the host immediately through the console and alert the IR team for follow-up.", "action_approval": "required" }, "parents": [ { "id": "decision-route", "branch": "on_supports" } ] }, { "id": "task-analyst-verify", "type": "task", "label": "Analyst verification", "config": { "assignee": "analyst", "description": "Analyze the forensics findings, collect the PHP executable, and confirm the specific RAT variant.", "instructions": "Collect the php.exe binary and .cfg configuration files from AppData\\Roaming\\php. Verify the parent process of the PHP execution to find the initial stager origin." }, "parents": [ { "id": "decision-route", "branch": "default" }, { "id": "decision-route", "branch": "on_unavailable" }, { "id": "action-isolate" } ] }, { "id": "task-close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Finalize the hunt and record tuning suggestions for future detection rules.", "instructions": "Record all confirmed findings. Propose a new detection rule for PHP.exe running from AppData Roaming with specific extension arguments as identified in this hunt." }, "parents": [ { "id": "decision-route", "branch": "on_refutes" }, { "id": "task-analyst-verify" } ] } ] }