Internal Discovery and Management Server Exploitation

Source

---
analysis: "While a single rule might fire on a high-volume scanner, this hunt correlates\
  \ that network signal with specific, rare process-level exploitation attempts on\
  \ management servers\u2014pivoting across three different telemetry surfaces to\
  \ confirm the intrusion's intent and target."
blind_spots:
- id: missing-endpoint-telemetry
  question: Are we missing exploitation attempts on servers without an EDR agent?
  requires: endpoint agent on all management servers
  risk: A management server without an agent contributes no process activity, meaning
    an RCE could succeed silently if network logs are not meticulously reviewed.
  stage: wsus-exploitation-attempt
- id: http-payload-visibility
  question: What specific sensitive data was inside the attachments that were scraped?
  requires: hb_http_activity with response body capture
  risk: We can see the file paths and request frequency but not the actual contents
    of the scraped documentation.
  stage: data-share-and-doc-collection
coverage:
- stage: internal-network-discovery
  status: covered
  steps:
  - internal-scanning-behavior
- stage: data-share-and-doc-collection
  status: covered
  steps:
  - review-collection
- stage: wsus-exploitation-attempt
  status: covered
  steps:
  - identify-management-infrastructure
  - suspicious-management-activity
- reason: 'Belongs to another part of the ''The Noise Inside the Network: How an Unsophisticated
    Attack Exposed a Third-Party Risk'' series.'
  stage: unauthorized-vpn-access
  status: out_of_scope
- reason: 'Belongs to another part of the ''The Noise Inside the Network: How an Unsophisticated
    Attack Exposed a Third-Party Risk'' series.'
  stage: internal-credential-testing
  status: out_of_scope
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: promote-to-detection
  justification: Management infrastructure like WSUS is a high-value target for lateral
    movement and environment-wide persistence. Identifying noisy internal discovery
    prevents an opportunistic attacker from successfully pivoting from a beachhead
    to the core infrastructure.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An attacker is performing noisy internal network discovery and casting
  a wide net for data shares while attempting to exploit management infrastructure
  like WSUS for environment-wide persistence.
labels:
- hunt
- attack.t1078
- attack.t1110
- attack.t1133
- attack.t1190
- collection
- credential access
- discovery
- execution
- initial access
name: Internal Discovery and Management Server Exploitation
parameters:
  lookback_days:
    default: '14'
    description: Days of history to examine.
    from:
      kind: manual
      observed: '2024-10-21'
      ref: default
    type: number
  management_binaries:
    default:
    - wsus_service.exe
    - w3wp.exe
    - mmc.exe
    - sqlservr.exe
    description: Executable names associated with WSUS, IIS, or SQL management roles.
    from:
      kind: manual
      observed: '2024-10-21'
      ref: common-knowledge
    type: list[string]
  scan_threshold:
    default: '100'
    description: Minimum count of unique internal destination IPs per source to define
      a scanning event.
    from:
      kind: article
      observed: '2024-10-13'
      ref: unit42-noise-inside-network
    type: number
  scope_hosts:
    default: []
    description: Optional list of hostnames identified as management servers from
      the scoping step; leave empty to scan the whole estate.
    from:
      kind: manual
      observed: '2024-10-21'
      ref: analyst-defined
    type: list[host]
  suspicious_child_commands:
    default:
    - cmd.exe
    - powershell.exe
    - whoami.exe
    - net.exe
    - systeminfo.exe
    - nltest.exe
    - query.exe
    description: Shells and discovery tools indicative of exploitation or manual reconnaissance.
    from:
      kind: article
      observed: '2024-10-13'
      ref: unit42-noise-inside-network
    type: list[string]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://unit42.paloaltonetworks.com/noise-inside-network-third-party-risk/
    gates:
    - dry-run
    - lint
    model: hb_google/gemini-3-flash-preview
rationale: The hunt begins by identifying the WSUS and management servers via software
  inventory. If no WSUS servers are found, proceed with a general estate-wide scanning
  baseline. Focus the process hunt on the hosts identified in step one.
references:
- name: "Unit 42 \u2014 The Noise Inside the Network: How an Unsophisticated Attack\
    \ Exposed a Third-Party Risk"
  url: https://unit42.paloaltonetworks.com/noise-inside-network-third-party-risk/
related:
- hunt: internal-credential-brute-force
  reason: Credential brute forcing is a distinct phase of this intrusion handled by
    a sibling hunt focusing on authentication logs.
  relation: out-of-scope-alternative
- hunt: vpn-entry-credential-abuse
  relation: follows
scenario:
  stages:
  - name: Unauthorized VPN Access
    observables:
    - VPN-based access attempts
    - Third-party-managed external gateway appliance
    - Compromised credentials
    - Authentication without MFA
    slug: unauthorized-vpn-access
    tactic: initial-access
    techniques:
    - T1133
    - T1078
  - name: Broad Internal Discovery
    observables:
    - Host and network scans
    - Interactions with thousands of systems
    - Multiple protocol usage for reconnaissance
    slug: internal-network-discovery
    tactic: discovery
  - name: Internal Credential Brute Force
    observables:
    - Password-guessing campaigns
    - Brute-force authentication attempts
    - Targeting of administrator accounts
    slug: internal-credential-testing
    tactic: credential-access
    techniques:
    - T1110
  - name: Internal Data Collection
    observables:
    - Automated web requests to internal systems
    - Scraping documentation pages and attachments
    - Enumeration of network shares
    slug: data-share-and-doc-collection
    tactic: collection
  - name: WSUS Remote Code Execution Attempt
    observables:
    - WSUS remote code execution vulnerability
    - Central configuration management server
    - Unauthorized code execution attempt
    slug: wsus-exploitation-attempt
    tactic: execution
    techniques:
    - T1190
  summary: An opportunistic attacker exploited a misconfigured third-party VPN gateway
    using compromised credentials to gain access to a bank's internal network. The
    intruder performed broad network scanning, brute-force attempts against administrator
    accounts, and scraped internal documentation before attempting to execute code
    via a WSUS vulnerability, which was blocked by endpoint security.
series:
  index: 2
  slug: the-noise-inside-the-network-how-an-unsophisticated-attack-exposed-a-third-party-risk
  title: 'The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party
    Risk'
  total: 2
severity: medium
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  network:
    category: network
    name: Network telemetry
    telemetry:
    - network
tlp: clear
type: investigation
---


# Internal Discovery and Management Server Exploitation

This hunt targets the post-access phase of an intrusion characterized by opportunistic, noisy behavior. It identifies central management servers through software inventory, then simultaneously searches for high-volume internal network scanning and suspicious process execution on those identified servers. An agent correlates these signals to identify actors who may have bypassed initial access controls but are now exposing themselves through reconnaissance volume and persistence attempts on update infrastructure.

## identify-management-infrastructure
<!-- Identify management and update servers -->
Locate hosts running WSUS or Configuration Manager to focus the exploitation hunt.

```sqlite target=endpoint role=scoping
~~~yaml
expected: A list of hostnames providing central IT management. No rows mean these
  roles are not identifiable in inventory.
reads:
- device_hostname
- device_uid
- package_name
- package_version
silence: not_evidence_of_absence
source: hb_software_inventory
verified: dry-run
verified_at: '2026-10-14'
~~~
SELECT DISTINCT device_hostname, device_uid, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%update services%' OR LOWER(package_name) LIKE '%wsus%' OR LOWER(package_name) LIKE '%configuration manager%')
```

## parallel-evidence-gathering
<!-- Gather network and endpoint evidence -->
parallel:
- → internal-scanning-behavior
- → suspicious-management-activity
join: → triage-signals

## internal-scanning-behavior
<!-- Broad internal discovery patterns -->
Identify hosts that are systematically scanning internal IP ranges across many targets and ports.

```sqlite target=network role=baseline params=(lookback_days=lookback_days, scan_threshold=scan_threshold)
~~~yaml
baseline:
  compare: new_this_window
  window: '{{lookback_days}}d'
expected: A small number of source IPs connecting to hundreds of internal systems,
  indicative of a reconnaissance tool casting a wide net.
reads:
- src_endpoint_ip
- device_hostname
- dst_endpoint_ip
- dst_endpoint_port
- direction
- time
silence: not_evidence_of_absence
source: hb_network_connection
verified: dry-run
verified_at: '2026-10-14'
~~~
SELECT src_endpoint_ip, device_hostname, COUNT(DISTINCT dst_endpoint_ip) as system_count, COUNT(DISTINCT dst_endpoint_port) as port_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_network_connection WHERE time >= datetime('now', '-{{lookback_days}} days') AND direction = 'outbound' AND (dst_endpoint_ip LIKE '10.%' OR dst_endpoint_ip LIKE '192.168.%' OR dst_endpoint_ip LIKE '172.16.%' OR dst_endpoint_ip LIKE '172.17.%' OR dst_endpoint_ip LIKE '172.18.%' OR dst_endpoint_ip LIKE '172.19.%' OR dst_endpoint_ip LIKE '172.20.%' OR dst_endpoint_ip LIKE '172.21.%' OR dst_endpoint_ip LIKE '172.22.%' OR dst_endpoint_ip LIKE '172.23.%' OR dst_endpoint_ip LIKE '172.24.%' OR dst_endpoint_ip LIKE '172.25.%' OR dst_endpoint_ip LIKE '172.26.%' OR dst_endpoint_ip LIKE '172.27.%' OR dst_endpoint_ip LIKE '172.28.%' OR dst_endpoint_ip LIKE '172.29.%' OR dst_endpoint_ip LIKE '172.30.%' OR dst_endpoint_ip LIKE '172.31.%') GROUP BY src_endpoint_ip, device_hostname HAVING system_count > {{scan_threshold}} ORDER BY system_count DESC
```

## suspicious-management-activity
<!-- Anomalous processes on management servers -->
Find shells or discovery tools spawned by management service binaries on servers in scope.

```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts, management_binaries=management_binaries, suspicious_child_commands=suspicious_child_commands)
~~~yaml
expected: A management server (WSUS/IIS) spawning a command shell or discovery tool
  like whoami or net.exe.
reads:
- device_hostname
- process_name
- process_cmd_line
- parent_process_name
- user_name
- time
silence: evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-10-14'
~~~
SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{management_binaries}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0) AND (instr(',' || '{{suspicious_child_commands}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## triage-signals
<!-- Evaluate discovery and exploitation -->
```agent target=hunter
cite: required
context:
- identify-management-infrastructure
- internal-scanning-behavior
- suspicious-management-activity
max_iterations: 6
objective: Identify if the host performing broad internal scanning is also the reporting
  host or target for suspicious process activity on management servers. Verify if
  the identified scanner targeted the management servers found in the scoping step.
success_criteria: A detailed verdict citing rows that link a scanning IP to subsequent
  process-level exploitation signals on identified management infrastructure.
tools:
- endpoint
- network
```

## route-on-verdict
<!-- Route on verdict -->
if~: "the triage verdict is malicious for at least one host, indicating confirmed scanning or exploitation attempts" (confidence: high, judge=hunter)
then: → isolate-host
indeterminate: → review-collection
unavailable: → review-collection (blind_spot: missing-endpoint-telemetry)
else: → close-out

## isolate-host
<!-- Isolate compromised host -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the host identified in the triage-signals step and initiate full forensic imaging.
```
→ review-collection

## review-collection
<!-- Review internal data collection -->
```manual target=analyst
For the identified malicious IP/host, query hb_http_activity and hb_smb_activity to identify spikes in access to internal portals or documentation shares. Look for automated request patterns and scraping of attachments or documentation pages.
```
→ close-out

## close-out
<!-- Close out hunt -->
```manual target=analyst
Record the hosts examined and the extent of scanning. Recommend patching WSUS RCE vulnerabilities and rotating any credentials potentially identified in the scraped documentation or shares.
```
→ end