{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Management infrastructure like WSUS is a high-value target for lateral movement and environment-wide persistence. Identifying noisy internal discovery prevents an opportunistic attacker from successfully pivoting from a beachhead to the core infrastructure." }, "name": "Internal Discovery and Management Server Exploitation", "type": "investigation", "labels": [ "hunt", "attack.t1078", "attack.t1110", "attack.t1133", "attack.t1190", "collection", "credential access", "discovery", "execution", "initial access" ], "series": { "slug": "the-noise-inside-the-network-how-an-unsophisticated-attack-exposed-a-third-party-risk", "index": 2, "title": "The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk", "total": 2 }, "related": [ { "hunt": "internal-credential-brute-force", "reason": "Credential brute forcing is a distinct phase of this intrusion handled by a sibling hunt focusing on authentication logs.", "relation": "out-of-scope-alternative" }, { "hunt": "vpn-entry-credential-abuse", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "While a single rule might fire on a high-volume scanner, this hunt correlates that network signal with specific, rare process-level exploitation attempts on management servers\u2014pivoting across three different telemetry surfaces to confirm the intrusion's intent and target.", "coverage": [ { "stage": "internal-network-discovery", "steps": [ "internal-scanning-behavior" ], "status": "covered" }, { "stage": "data-share-and-doc-collection", "steps": [ "review-collection" ], "status": "covered" }, { "stage": "wsus-exploitation-attempt", "steps": [ "identify-management-infrastructure", "suspicious-management-activity" ], "status": "covered" }, { "stage": "unauthorized-vpn-access", "reason": "Belongs to another part of the 'The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk' series.", "status": "out_of_scope" }, { "stage": "internal-credential-testing", "reason": "Belongs to another part of the 'The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Unauthorized VPN Access", "slug": "unauthorized-vpn-access", "tactic": "initial-access", "techniques": [ "T1133", "T1078" ], "observables": [ "VPN-based access attempts", "Third-party-managed external gateway appliance", "Compromised credentials", "Authentication without MFA" ] }, { "name": "Broad Internal Discovery", "slug": "internal-network-discovery", "tactic": "discovery", "observables": [ "Host and network scans", "Interactions with thousands of systems", "Multiple protocol usage for reconnaissance" ] }, { "name": "Internal Credential Brute Force", "slug": "internal-credential-testing", "tactic": "credential-access", "techniques": [ "T1110" ], "observables": [ "Password-guessing campaigns", "Brute-force authentication attempts", "Targeting of administrator accounts" ] }, { "name": "Internal Data Collection", "slug": "data-share-and-doc-collection", "tactic": "collection", "observables": [ "Automated web requests to internal systems", "Scraping documentation pages and attachments", "Enumeration of network shares" ] }, { "name": "WSUS Remote Code Execution Attempt", "slug": "wsus-exploitation-attempt", "tactic": "execution", "techniques": [ "T1190" ], "observables": [ "WSUS remote code execution vulnerability", "Central configuration management server", "Unauthorized code execution attempt" ] } ], "summary": "An opportunistic attacker exploited a misconfigured third-party VPN gateway using compromised credentials to gain access to a bank's internal network. The intruder performed broad network scanning, brute-force attempts against administrator accounts, and scraped internal documentation before attempting to execute code via a WSUS vulnerability, which was blocked by endpoint security." }, "severity": "medium", "rationale": "The hunt begins by identifying the WSUS and management servers via software inventory. If no WSUS servers are found, proceed with a general estate-wide scanning baseline. Focus the process hunt on the hosts identified in step one.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An attacker is performing noisy internal network discovery and casting a wide net for data shares while attempting to exploit management infrastructure like WSUS for environment-wide persistence.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-defined", "kind": "manual", "observed": "2024-10-21" }, "type": "list[host]", "default": [], "description": "Optional list of hostnames identified as management servers from the scoping step; leave empty to scan the whole estate." }, "lookback_days": { "from": { "ref": "default", "kind": "manual", "observed": "2024-10-21" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "scan_threshold": { "from": { "ref": "unit42-noise-inside-network", "kind": "article", "observed": "2024-10-13" }, "type": "number", "default": "100", "description": "Minimum count of unique internal destination IPs per source to define a scanning event." }, "management_binaries": { "from": { "ref": "common-knowledge", "kind": "manual", "observed": "2024-10-21" }, "type": "list[string]", "default": [ "wsus_service.exe", "w3wp.exe", "mmc.exe", "sqlservr.exe" ], "description": "Executable names associated with WSUS, IIS, or SQL management roles." }, "suspicious_child_commands": { "from": { "ref": "unit42-noise-inside-network", "kind": "article", "observed": "2024-10-13" }, "type": "list[string]", "default": [ "cmd.exe", "powershell.exe", "whoami.exe", "net.exe", "systeminfo.exe", "nltest.exe", "query.exe" ], "description": "Shells and discovery tools indicative of exploitation or manual reconnaissance." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/noise-inside-network-third-party-risk/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/noise-inside-network-third-party-risk/", "name": "Unit 42 \u2014 The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk" } ], "blind_spots": [ { "id": "missing-endpoint-telemetry", "risk": "A management server without an agent contributes no process activity, meaning an RCE could succeed silently if network logs are not meticulously reviewed.", "stage": "wsus-exploitation-attempt", "question": "Are we missing exploitation attempts on servers without an EDR agent?", "requires": "endpoint agent on all management servers" }, { "id": "http-payload-visibility", "risk": "We can see the file paths and request frequency but not the actual contents of the scraped documentation.", "stage": "data-share-and-doc-collection", "question": "What specific sensitive data was inside the attachments that were scraped?", "requires": "hb_http_activity with response body capture" } ] }, "name": "Internal Discovery and Management Server Exploitation", "description": "This hunt targets the post-access phase of an intrusion characterized by opportunistic, noisy behavior. It identifies central management servers through software inventory, then simultaneously searches for high-volume internal network scanning and suspicious process execution on those identified servers. An agent correlates these signals to identify actors who may have bypassed initial access controls but are now exposing themselves through reconnaissance volume and persistence attempts on update infrastructure." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "the-noise-inside-the-network-how-an-unsophisticated-attack-exposed-a-third-party-risk", "index": 2, "title": "The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk", "total": 2 }, "coverage": [ { "stage": "internal-network-discovery", "steps": [ "internal-scanning-behavior" ], "status": "covered" }, { "stage": "data-share-and-doc-collection", "steps": [ "review-collection" ], "status": "covered" }, { "stage": "wsus-exploitation-attempt", "steps": [ "identify-management-infrastructure", "suspicious-management-activity" ], "status": "covered" }, { "stage": "unauthorized-vpn-access", "reason": "Belongs to another part of the 'The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk' series.", "status": "out_of_scope" }, { "stage": "internal-credential-testing", "reason": "Belongs to another part of the 'The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk' series.", "status": "out_of_scope" } ], "rationale": "An attacker is performing noisy internal network discovery and casting a wide net for data shares while attempting to exploit management infrastructure like WSUS for environment-wide persistence.", "blind_spots": [ { "id": "missing-endpoint-telemetry", "risk": "A management server without an agent contributes no process activity, meaning an RCE could succeed silently if network logs are not meticulously reviewed.", "stage": "wsus-exploitation-attempt", "question": "Are we missing exploitation attempts on servers without an EDR agent?", "requires": "endpoint agent on all management servers" }, { "id": "http-payload-visibility", "risk": "We can see the file paths and request frequency but not the actual contents of the scraped documentation.", "stage": "data-share-and-doc-collection", "question": "What specific sensitive data was inside the attachments that were scraped?", "requires": "hb_http_activity with response body capture" } ], "scoping_notes": "The hunt begins by identifying the WSUS and management servers via software inventory. If no WSUS servers are found, proceed with a general estate-wide scanning baseline. Focus the process hunt on the hosts identified in step one.", "beyond_detection": "While a single rule might fire on a high-volume scanner, this hunt correlates that network signal with specific, rare process-level exploitation attempts on management servers\u2014pivoting across three different telemetry surfaces to confirm the intrusion's intent and target." } }, { "id": "identify-management-infrastructure", "type": "query", "label": "Identify management and update servers", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT device_hostname, device_uid, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%update services%' OR LOWER(package_name) LIKE '%wsus%' OR LOWER(package_name) LIKE '%configuration manager%')", "surface": "hb_software_inventory", "description": "Locate hosts running WSUS or Configuration Manager to focus the exploitation hunt.", "expected_signal": "A list of hostnames providing central IT management. No rows mean these roles are not identifiable in inventory." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify management and update servers", "reads": [ "device_hostname", "device_uid", "package_name", "package_version" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT DISTINCT device_hostname, device_uid, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%update services%' OR LOWER(package_name) LIKE '%wsus%' OR LOWER(package_name) LIKE '%configuration manager%')", "silence": "not_evidence_of_absence", "expected": "A list of hostnames providing central IT management. No rows mean these roles are not identifiable in inventory.", "verified": "dry-run", "verified_at": "2026-10-14" } }, { "id": "internal-scanning-behavior", "type": "query", "label": "Broad internal discovery patterns", "config": { "dsl": "sqlite", "role": "baseline", "source": "network", "content": "SELECT src_endpoint_ip, device_hostname, COUNT(DISTINCT dst_endpoint_ip) as system_count, COUNT(DISTINCT dst_endpoint_port) as port_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_network_connection WHERE time >= datetime('now', '-{{lookback_days}} days') AND direction = 'outbound' AND (dst_endpoint_ip LIKE '10.%' OR dst_endpoint_ip LIKE '192.168.%' OR dst_endpoint_ip LIKE '172.16.%' OR dst_endpoint_ip LIKE '172.17.%' OR dst_endpoint_ip LIKE '172.18.%' OR dst_endpoint_ip LIKE '172.19.%' OR dst_endpoint_ip LIKE '172.20.%' OR dst_endpoint_ip LIKE '172.21.%' OR dst_endpoint_ip LIKE '172.22.%' OR dst_endpoint_ip LIKE '172.23.%' OR dst_endpoint_ip LIKE '172.24.%' OR dst_endpoint_ip LIKE '172.25.%' OR dst_endpoint_ip LIKE '172.26.%' OR dst_endpoint_ip LIKE '172.27.%' OR dst_endpoint_ip LIKE '172.28.%' OR dst_endpoint_ip LIKE '172.29.%' OR dst_endpoint_ip LIKE '172.30.%' OR dst_endpoint_ip LIKE '172.31.%') GROUP BY src_endpoint_ip, device_hostname HAVING system_count > {{scan_threshold}} ORDER BY system_count DESC", "surface": "hb_network_connection", "description": "Identify hosts that are systematically scanning internal IP ranges across many targets and ports.", "expected_signal": "A small number of source IPs connecting to hundreds of internal systems, indicative of a reconnaissance tool casting a wide net." }, "parents": [ { "id": "identify-management-infrastructure" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Broad internal discovery patterns", "reads": [ "src_endpoint_ip", "device_hostname", "dst_endpoint_ip", "dst_endpoint_port", "direction", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT src_endpoint_ip, device_hostname, COUNT(DISTINCT dst_endpoint_ip) as system_count, COUNT(DISTINCT dst_endpoint_port) as port_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_network_connection WHERE time >= datetime('now', '-{{lookback_days}} days') AND direction = 'outbound' AND (dst_endpoint_ip LIKE '10.%' OR dst_endpoint_ip LIKE '192.168.%' OR dst_endpoint_ip LIKE '172.16.%' OR dst_endpoint_ip LIKE '172.17.%' OR dst_endpoint_ip LIKE '172.18.%' OR dst_endpoint_ip LIKE '172.19.%' OR dst_endpoint_ip LIKE '172.20.%' OR dst_endpoint_ip LIKE '172.21.%' OR dst_endpoint_ip LIKE '172.22.%' OR dst_endpoint_ip LIKE '172.23.%' OR dst_endpoint_ip LIKE '172.24.%' OR dst_endpoint_ip LIKE '172.25.%' OR dst_endpoint_ip LIKE '172.26.%' OR dst_endpoint_ip LIKE '172.27.%' OR dst_endpoint_ip LIKE '172.28.%' OR dst_endpoint_ip LIKE '172.29.%' OR dst_endpoint_ip LIKE '172.30.%' OR dst_endpoint_ip LIKE '172.31.%') GROUP BY src_endpoint_ip, device_hostname HAVING system_count > {{scan_threshold}} ORDER BY system_count DESC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "new_this_window" }, "expected": "A small number of source IPs connecting to hundreds of internal systems, indicative of a reconnaissance tool casting a wide net.", "verified": "dry-run", "verified_at": "2026-10-14" } }, { "id": "suspicious-management-activity", "type": "query", "label": "Anomalous processes on management servers", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{management_binaries}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0) AND (instr(',' || '{{suspicious_child_commands}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Find shells or discovery tools spawned by management service binaries on servers in scope.", "expected_signal": "A management server (WSUS/IIS) spawning a command shell or discovery tool like whoami or net.exe." }, "parents": [ { "id": "identify-management-infrastructure" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Anomalous processes on management servers", "reads": [ "device_hostname", "process_name", "process_cmd_line", "parent_process_name", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{management_binaries}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0) AND (instr(',' || '{{suspicious_child_commands}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "A management server (WSUS/IIS) spawning a command shell or discovery tool like whoami or net.exe.", "verified": "dry-run", "verified_at": "2026-10-14" } }, { "id": "triage-signals", "type": "analytic", "label": "Evaluate discovery and exploitation", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "identify-management-infrastructure", "internal-scanning-behavior", "suspicious-management-activity" ], "objective": "Identify if the host performing broad internal scanning is also the reporting host or target for suspicious process activity on management servers. Verify if the identified scanner targeted the management servers found in the scoping step.", "description": "Determine if internal scanning behavior correlates with suspicious activity on management servers.", "max_iterations": 6, "expected_signal": "A per-host verdict of malicious | suspicious | benign, linking scanning sources to exploitation targets.", "success_criteria": "A detailed verdict citing rows that link a scanning IP to subsequent process-level exploitation signals on identified management infrastructure." }, "parents": [ { "id": "internal-scanning-behavior", "kind": "merge" }, { "id": "suspicious-management-activity", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one host, indicating confirmed scanning or exploitation attempts", "condition": "the triage verdict is malicious for at least one host, indicating confirmed scanning or exploitation attempts", "blind_spot": "missing-endpoint-telemetry", "confidence": "high", "description": "Direct the hunt to containment or investigation tasks based on the triage verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-signals" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Halt the intrusion by isolating the host identified as either a scanner or a victim of management server exploitation.", "instructions": "Isolate the host identified in the triage-signals step and initiate full forensic imaging.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "review-collection", "type": "task", "label": "Review internal data collection", "config": { "assignee": "analyst", "description": "Investigate whether the attacker used the identified host to scrape internal web documentation or enumerate shares.", "instructions": "For the identified malicious IP/host, query hb_http_activity and hb_smb_activity to identify spikes in access to internal portals or documentation shares. Look for automated request patterns and scraping of attachments or documentation pages." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Finalize findings and recommend remediation for discovered management server vulnerabilities.", "instructions": "Record the hosts examined and the extent of scanning. Recommend patching WSUS RCE vulnerabilities and rotating any credentials potentially identified in the scraped documentation or shares." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "review-collection" } ] } ] }