--- analysis: "While a single rule might fire on a high-volume scanner, this hunt correlates\ \ that network signal with specific, rare process-level exploitation attempts on\ \ management servers\u2014pivoting across three different telemetry surfaces to\ \ confirm the intrusion's intent and target." blind_spots: - id: missing-endpoint-telemetry question: Are we missing exploitation attempts on servers without an EDR agent? requires: endpoint agent on all management servers risk: A management server without an agent contributes no process activity, meaning an RCE could succeed silently if network logs are not meticulously reviewed. stage: wsus-exploitation-attempt - id: http-payload-visibility question: What specific sensitive data was inside the attachments that were scraped? requires: hb_http_activity with response body capture risk: We can see the file paths and request frequency but not the actual contents of the scraped documentation. stage: data-share-and-doc-collection coverage: - stage: internal-network-discovery status: covered steps: - internal-scanning-behavior - stage: data-share-and-doc-collection status: covered steps: - review-collection - stage: wsus-exploitation-attempt status: covered steps: - identify-management-infrastructure - suspicious-management-activity - reason: 'Belongs to another part of the ''The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk'' series.' stage: unauthorized-vpn-access status: out_of_scope - reason: 'Belongs to another part of the ''The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk'' series.' stage: internal-credential-testing status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: Management infrastructure like WSUS is a high-value target for lateral movement and environment-wide persistence. Identifying noisy internal discovery prevents an opportunistic attacker from successfully pivoting from a beachhead to the core infrastructure. methodology: model-assisted trigger: intel-report hypothesis: An attacker is performing noisy internal network discovery and casting a wide net for data shares while attempting to exploit management infrastructure like WSUS for environment-wide persistence. labels: - hunt - attack.t1078 - attack.t1110 - attack.t1133 - attack.t1190 - collection - credential access - discovery - execution - initial access name: Internal Discovery and Management Server Exploitation parameters: lookback_days: default: '14' description: Days of history to examine. from: kind: manual observed: '2024-10-21' ref: default type: number management_binaries: default: - wsus_service.exe - w3wp.exe - mmc.exe - sqlservr.exe description: Executable names associated with WSUS, IIS, or SQL management roles. from: kind: manual observed: '2024-10-21' ref: common-knowledge type: list[string] scan_threshold: default: '100' description: Minimum count of unique internal destination IPs per source to define a scanning event. from: kind: article observed: '2024-10-13' ref: unit42-noise-inside-network type: number scope_hosts: default: [] description: Optional list of hostnames identified as management servers from the scoping step; leave empty to scan the whole estate. from: kind: manual observed: '2024-10-21' ref: analyst-defined type: list[host] suspicious_child_commands: default: - cmd.exe - powershell.exe - whoami.exe - net.exe - systeminfo.exe - nltest.exe - query.exe description: Shells and discovery tools indicative of exploitation or manual reconnaissance. from: kind: article observed: '2024-10-13' ref: unit42-noise-inside-network type: list[string] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://unit42.paloaltonetworks.com/noise-inside-network-third-party-risk/ gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: The hunt begins by identifying the WSUS and management servers via software inventory. If no WSUS servers are found, proceed with a general estate-wide scanning baseline. Focus the process hunt on the hosts identified in step one. references: - name: "Unit 42 \u2014 The Noise Inside the Network: How an Unsophisticated Attack\ \ Exposed a Third-Party Risk" url: https://unit42.paloaltonetworks.com/noise-inside-network-third-party-risk/ related: - hunt: internal-credential-brute-force reason: Credential brute forcing is a distinct phase of this intrusion handled by a sibling hunt focusing on authentication logs. relation: out-of-scope-alternative - hunt: vpn-entry-credential-abuse relation: follows scenario: stages: - name: Unauthorized VPN Access observables: - VPN-based access attempts - Third-party-managed external gateway appliance - Compromised credentials - Authentication without MFA slug: unauthorized-vpn-access tactic: initial-access techniques: - T1133 - T1078 - name: Broad Internal Discovery observables: - Host and network scans - Interactions with thousands of systems - Multiple protocol usage for reconnaissance slug: internal-network-discovery tactic: discovery - name: Internal Credential Brute Force observables: - Password-guessing campaigns - Brute-force authentication attempts - Targeting of administrator accounts slug: internal-credential-testing tactic: credential-access techniques: - T1110 - name: Internal Data Collection observables: - Automated web requests to internal systems - Scraping documentation pages and attachments - Enumeration of network shares slug: data-share-and-doc-collection tactic: collection - name: WSUS Remote Code Execution Attempt observables: - WSUS remote code execution vulnerability - Central configuration management server - Unauthorized code execution attempt slug: wsus-exploitation-attempt tactic: execution techniques: - T1190 summary: An opportunistic attacker exploited a misconfigured third-party VPN gateway using compromised credentials to gain access to a bank's internal network. The intruder performed broad network scanning, brute-force attempts against administrator accounts, and scraped internal documentation before attempting to execute code via a WSUS vulnerability, which was blocked by endpoint security. series: index: 2 slug: the-noise-inside-the-network-how-an-unsophisticated-attack-exposed-a-third-party-risk title: 'The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk' total: 2 severity: medium targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent network: category: network name: Network telemetry telemetry: - network tlp: clear type: investigation --- # Internal Discovery and Management Server Exploitation This hunt targets the post-access phase of an intrusion characterized by opportunistic, noisy behavior. It identifies central management servers through software inventory, then simultaneously searches for high-volume internal network scanning and suspicious process execution on those identified servers. An agent correlates these signals to identify actors who may have bypassed initial access controls but are now exposing themselves through reconnaissance volume and persistence attempts on update infrastructure. ## identify-management-infrastructure Locate hosts running WSUS or Configuration Manager to focus the exploitation hunt. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of hostnames providing central IT management. No rows mean these roles are not identifiable in inventory. reads: - device_hostname - device_uid - package_name - package_version silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-10-14' ~~~ SELECT DISTINCT device_hostname, device_uid, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%update services%' OR LOWER(package_name) LIKE '%wsus%' OR LOWER(package_name) LIKE '%configuration manager%') ``` ## parallel-evidence-gathering parallel: - → internal-scanning-behavior - → suspicious-management-activity join: → triage-signals ## internal-scanning-behavior Identify hosts that are systematically scanning internal IP ranges across many targets and ports. ```sqlite target=network role=baseline params=(lookback_days=lookback_days, scan_threshold=scan_threshold) ~~~yaml baseline: compare: new_this_window window: '{{lookback_days}}d' expected: A small number of source IPs connecting to hundreds of internal systems, indicative of a reconnaissance tool casting a wide net. reads: - src_endpoint_ip - device_hostname - dst_endpoint_ip - dst_endpoint_port - direction - time silence: not_evidence_of_absence source: hb_network_connection verified: dry-run verified_at: '2026-10-14' ~~~ SELECT src_endpoint_ip, device_hostname, COUNT(DISTINCT dst_endpoint_ip) as system_count, COUNT(DISTINCT dst_endpoint_port) as port_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_network_connection WHERE time >= datetime('now', '-{{lookback_days}} days') AND direction = 'outbound' AND (dst_endpoint_ip LIKE '10.%' OR dst_endpoint_ip LIKE '192.168.%' OR dst_endpoint_ip LIKE '172.16.%' OR dst_endpoint_ip LIKE '172.17.%' OR dst_endpoint_ip LIKE '172.18.%' OR dst_endpoint_ip LIKE '172.19.%' OR dst_endpoint_ip LIKE '172.20.%' OR dst_endpoint_ip LIKE '172.21.%' OR dst_endpoint_ip LIKE '172.22.%' OR dst_endpoint_ip LIKE '172.23.%' OR dst_endpoint_ip LIKE '172.24.%' OR dst_endpoint_ip LIKE '172.25.%' OR dst_endpoint_ip LIKE '172.26.%' OR dst_endpoint_ip LIKE '172.27.%' OR dst_endpoint_ip LIKE '172.28.%' OR dst_endpoint_ip LIKE '172.29.%' OR dst_endpoint_ip LIKE '172.30.%' OR dst_endpoint_ip LIKE '172.31.%') GROUP BY src_endpoint_ip, device_hostname HAVING system_count > {{scan_threshold}} ORDER BY system_count DESC ``` ## suspicious-management-activity Find shells or discovery tools spawned by management service binaries on servers in scope. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts, management_binaries=management_binaries, suspicious_child_commands=suspicious_child_commands) ~~~yaml expected: A management server (WSUS/IIS) spawning a command shell or discovery tool like whoami or net.exe. reads: - device_hostname - process_name - process_cmd_line - parent_process_name - user_name - time silence: evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-10-14' ~~~ SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{management_binaries}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0) AND (instr(',' || '{{suspicious_child_commands}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-signals ```agent target=hunter cite: required context: - identify-management-infrastructure - internal-scanning-behavior - suspicious-management-activity max_iterations: 6 objective: Identify if the host performing broad internal scanning is also the reporting host or target for suspicious process activity on management servers. Verify if the identified scanner targeted the management servers found in the scoping step. success_criteria: A detailed verdict citing rows that link a scanning IP to subsequent process-level exploitation signals on identified management infrastructure. tools: - endpoint - network ``` ## route-on-verdict if~: "the triage verdict is malicious for at least one host, indicating confirmed scanning or exploitation attempts" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → review-collection unavailable: → review-collection (blind_spot: missing-endpoint-telemetry) else: → close-out ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host identified in the triage-signals step and initiate full forensic imaging. ``` → review-collection ## review-collection ```manual target=analyst For the identified malicious IP/host, query hb_http_activity and hb_smb_activity to identify spikes in access to internal portals or documentation shares. Look for automated request patterns and scraping of attachments or documentation pages. ``` → close-out ## close-out ```manual target=analyst Record the hosts examined and the extent of scanning. Recommend patching WSUS RCE vulnerabilities and rotating any credentials potentially identified in the scraped documentation or shares. ``` → end