{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Adversaries are using legitimate remote-support tools to bypass security boundaries and expand laterally using native protocols like WinRM. This hunt protects the critical internal infrastructure that these multi-stage paths target." }, "name": "IT Support Impersonation and WinRM Lateral Expansion", "type": "investigation", "labels": [ "hunt", "attack.t1219", "attack.t1059.001", "attack.t1105", "attack.t1071.001", "attack.t1087.002", "attack.t1021.006" ], "related": [ { "hunt": "teams-guest-account-takeover", "reason": "The initial impersonation via Teams is an identity-focused hunt that precedes the endpoint activities covered here.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single rule on Node.js execution might be too noisy in developer environments; this hunt correlates the rare runtime with preceding remote-support takeover and following lateral movement, providing the full context an analyst needs to act.", "coverage": [ { "stage": "execution-remote-support-takeover", "steps": [ "remote-support-spawning-shells" ], "status": "covered" }, { "stage": "execution-powershell-msi-download", "steps": [ "powershell-msi-scripting" ], "status": "covered" }, { "stage": "command-and-control-node-js", "steps": [ "portable-node-prevalence" ], "status": "covered" }, { "stage": "discovery-active-directory-mapping", "reason": "AD mapping via WinRM typically uses internal API calls or LDAP traffic not captured in standard process or network activity surfaces.", "status": "not_visible" }, { "stage": "lateral-movement-winrm-dc", "steps": [ "winrm-lateral-expansion" ], "status": "covered" }, { "stage": "initial-access-teams-impersonation", "reason": "Not examined by this hunt; belongs to a separate hunt.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "IT Support Impersonation via Teams", "slug": "initial-access-teams-impersonation", "tactic": "initial-access", "techniques": [ "T1566.002", "T1566.003" ], "observables": [ "Microsoft Teams conversation", "IT support impersonation" ] }, { "name": "Remote Support Software Execution", "slug": "execution-remote-support-takeover", "tactic": "execution", "techniques": [ "T1219" ], "observables": [ "Legitimate remote-support software", "User-granted session control" ] }, { "name": "PowerShell MSI Deployment", "slug": "execution-powershell-msi-download", "tactic": "execution", "techniques": [ "T1059.001", "T1105" ], "observables": [ "powershell.exe", "Windows Installer (MSI) package download", "msiexec.exe" ] }, { "name": "Node.js Portable Runtime C2", "slug": "command-and-control-node-js", "tactic": "command-and-control", "techniques": [ "T1105", "T1071.001" ], "observables": [ "Portable Node.js runtime", "node.exe", "Outbound C2 connection" ] }, { "name": "Active Directory Mapping", "slug": "discovery-active-directory-mapping", "tactic": "discovery", "techniques": [ "T1087.002", "T1482" ], "observables": [ "Active Directory mapping commands", "Queries against domain controllers" ] }, { "name": "Lateral Movement via WinRM", "slug": "lateral-movement-winrm-dc", "tactic": "lateral-movement", "techniques": [ "T1021.006" ], "observables": [ "WinRM protocol usage", "Connections to domain controllers", "Connections to certificate authorities" ] } ], "summary": "Attackers impersonate IT support via Microsoft Teams to trick users into granting control via legitimate remote-support software, followed by the deployment of a portable Node.js runtime for command-and-control. Once established, the operators map Active Directory and move laterally to critical infrastructure like domain controllers and certificate authorities using WinRM." }, "severity": "high", "rationale": "Focus on endpoints where remote-support software is prevalent but restricted to IT use. Provide known Domain Controller and CA IP addresses to refine the lateral movement detection.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has hijacked a remote-support session to execute PowerShell, use a portable Node.js runtime for C2, and expand laterally via WinRM to domain controllers.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional hostnames to narrow the scope." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "admin_shell_binaries": { "type": "list[string]", "default": [ "powershell.exe", "cmd.exe", "msiexec.exe" ], "description": "Shells and installers typically used after takeover." }, "sensitive_ip_targets": { "from": { "ref": "https://www.microsoft.com/en-us/security/blog/2026/09/17/from-guidance-to-action-security-fundamentals-that-materially-reduce-risk/", "kind": "article", "observed": "2026-09-17" }, "type": "list[ip]", "default": [], "description": "IPs of Domain Controllers or Certificate Authorities to monitor for WinRM." }, "remote_support_tool_names": { "from": { "ref": "common-remote-support-processes", "kind": "manual", "observed": "2024-05-20" }, "type": "list[string]", "default": [ "anydesk.exe", "teamviewer.exe", "teamviewer_desktop.exe", "screenconnect.client.exe", "quickassist.exe", "remoteassistant.exe" ], "description": "Common remote support process names." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.microsoft.com/en-us/security/blog/2026/09/17/from-guidance-to-action-security-fundamentals-that-materially-reduce-risk/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/09/17/from-guidance-to-action-security-fundamentals-that-materially-reduce-risk/", "name": "MSRC \u2014 From guidance to action: Security fundamentals that materially reduce risk" } ], "blind_spots": [ { "id": "no-winrm-command-logging", "risk": "While the connection is visible, the impact (e.g., AD mapping, account creation) remains hidden without detailed host logs on the destination.", "owner": "Infrastructure Team", "stage": "lateral-movement-winrm-dc", "question": "Which specific administrative commands were executed on the Domain Controller?", "requires": "WinRM Operational logging or deep packet inspection", "remediation": "Enable WinRM auditing and Process Command Line logging on all Domain Controllers and Certificate Authorities." }, { "id": "node-runtime-renaming", "risk": "If node.exe is renamed to svchost.exe or similar, the current process_name filter will miss it.", "owner": "Endpoint Security Team", "stage": "command-and-control-node-js", "question": "Did the attacker rename the portable Node.js runtime to masquerade as a system process?", "requires": "hb_process_activity with original file name or hash-based detection", "remediation": "Deploy hash-based monitoring for known portable runtimes or utilize original_file_name columns in process activity queries." } ] }, "name": "IT Support Impersonation and WinRM Lateral Expansion", "description": "This hunt identifies the multi-stage progression of the CaptiveCrunch campaign. It first isolates hosts where legitimate remote-support tools are used as a launchpad for PowerShell-based MSI downloads. It then pivots to find the deployment of rare Node.js runtimes in user-writable paths and subsequent WinRM connections to sensitive internal infrastructure like Domain Controllers and Certificate Authorities." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "coverage": [ { "stage": "execution-remote-support-takeover", "steps": [ "remote-support-spawning-shells" ], "status": "covered" }, { "stage": "execution-powershell-msi-download", "steps": [ "powershell-msi-scripting" ], "status": "covered" }, { "stage": "command-and-control-node-js", "steps": [ "portable-node-prevalence" ], "status": "covered" }, { "stage": "discovery-active-directory-mapping", "reason": "AD mapping via WinRM typically uses internal API calls or LDAP traffic not captured in standard process or network activity surfaces.", "status": "not_visible" }, { "stage": "lateral-movement-winrm-dc", "steps": [ "winrm-lateral-expansion" ], "status": "covered" }, { "stage": "initial-access-teams-impersonation", "reason": "Not examined by this hunt; belongs to a separate hunt.", "status": "out_of_scope" } ], "rationale": "An adversary has hijacked a remote-support session to execute PowerShell, use a portable Node.js runtime for C2, and expand laterally via WinRM to domain controllers.", "blind_spots": [ { "id": "no-winrm-command-logging", "risk": "While the connection is visible, the impact (e.g., AD mapping, account creation) remains hidden without detailed host logs on the destination.", "owner": "Infrastructure Team", "stage": "lateral-movement-winrm-dc", "question": "Which specific administrative commands were executed on the Domain Controller?", "requires": "WinRM Operational logging or deep packet inspection", "remediation": "Enable WinRM auditing and Process Command Line logging on all Domain Controllers and Certificate Authorities." }, { "id": "node-runtime-renaming", "risk": "If node.exe is renamed to svchost.exe or similar, the current process_name filter will miss it.", "owner": "Endpoint Security Team", "stage": "command-and-control-node-js", "question": "Did the attacker rename the portable Node.js runtime to masquerade as a system process?", "requires": "hb_process_activity with original file name or hash-based detection", "remediation": "Deploy hash-based monitoring for known portable runtimes or utilize original_file_name columns in process activity queries." } ], "scoping_notes": "Focus on endpoints where remote-support software is prevalent but restricted to IT use. Provide known Domain Controller and CA IP addresses to refine the lateral movement detection.", "beyond_detection": "A single rule on Node.js execution might be too noisy in developer environments; this hunt correlates the rare runtime with preceding remote-support takeover and following lateral movement, providing the full context an analyst needs to act." } }, { "id": "identify-remote-support-hosts", "type": "query", "label": "Inventory of hosts with remote support software", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%anydesk%' OR LOWER(package_name) LIKE '%teamviewer%' OR LOWER(package_name) LIKE '%connectwise%' OR LOWER(package_name) LIKE '%screenconnect%' OR LOWER(package_name) LIKE '%quick assist%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_software_inventory", "description": "Find the subset of the estate where remote support tools are installed to focus behavioral analysis.", "expected_signal": "A list of hosts with known remote-support packages. Silence is expected if these tools are not in the official inventory." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Inventory of hosts with remote support software", "reads": [ "device_hostname", "install_path", "package_name", "package_version" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%anydesk%' OR LOWER(package_name) LIKE '%teamviewer%' OR LOWER(package_name) LIKE '%connectwise%' OR LOWER(package_name) LIKE '%screenconnect%' OR LOWER(package_name) LIKE '%quick assist%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "A list of hosts with known remote-support packages. Silence is expected if these tools are not in the official inventory.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "remote-support-spawning-shells", "type": "query", "label": "Remote support tools spawning administrative shells", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, time, process_name, process_cmd_line, parent_process_name, user_name FROM hb_process_activity WHERE instr(',' || '{{remote_support_tool_names}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 AND instr(',' || '{{admin_shell_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_process_activity", "description": "Identify process patterns where a support tool acts as a parent to a shell or installer.", "expected_signal": "A support tool launching PowerShell, CMD, or MSIExec. Legitimate admin use may occur but will be weighed by the agent." }, "parents": [ { "id": "identify-remote-support-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Remote support tools spawning administrative shells", "reads": [ "device_hostname", "parent_process_name", "process_cmd_line", "process_name", "time", "user_name" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, time, process_name, process_cmd_line, parent_process_name, user_name FROM hb_process_activity WHERE instr(',' || '{{remote_support_tool_names}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 AND instr(',' || '{{admin_shell_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "A support tool launching PowerShell, CMD, or MSIExec. Legitimate admin use may occur but will be weighed by the agent.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "powershell-msi-scripting", "type": "query", "label": "PowerShell script blocks downloading MSI files", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, time, script_content, actor_user_name FROM hb_script_activity WHERE LOWER(script_content) LIKE '%.msi%' AND (LOWER(script_content) LIKE '%download%' OR LOWER(script_content) LIKE '%iwr%' OR LOWER(script_content) LIKE '%http%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_script_activity", "description": "Detect the specific scripting commands used to retrieve malicious installer packages.", "expected_signal": "Script contents showing network-based retrieval of MSI files. This is a behavioral indicator of staging." }, "parents": [ { "id": "identify-remote-support-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "PowerShell script blocks downloading MSI files", "reads": [ "actor_user_name", "device_hostname", "script_content", "time" ], "source": "hb_script_activity", "target": "endpoint", "content": "SELECT device_hostname, time, script_content, actor_user_name FROM hb_script_activity WHERE LOWER(script_content) LIKE '%.msi%' AND (LOWER(script_content) LIKE '%download%' OR LOWER(script_content) LIKE '%iwr%' OR LOWER(script_content) LIKE '%http%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "Script contents showing network-based retrieval of MSI files. This is a behavioral indicator of staging.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "agent-early-takeover-triage", "type": "analytic", "label": "Triaging remote-support takeover", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "identify-remote-support-hosts", "remote-support-spawning-shells", "powershell-msi-scripting" ], "objective": "Identify hosts where remote support software spawned PowerShell or MSIExec to download external packages.", "description": "Assess whether the remote tool execution and subsequent scripting indicate a compromise on specific hosts.", "max_iterations": 3, "expected_signal": "Identification of hosts with high-confidence takeover activity.", "success_criteria": "A per-host verdict citing the specific process and script rows that indicate malicious staging." }, "parents": [ { "id": "remote-support-spawning-shells", "kind": "merge" }, { "id": "powershell-msi-scripting", "kind": "merge" } ] }, { "id": "portable-node-prevalence", "type": "query", "label": "Prevalence of Node.js runtimes in user paths", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE LOWER(process_name) = 'node.exe' AND (LOWER(process_path) LIKE '%\\users\\%' OR LOWER(process_path) LIKE '%\\public\\%' OR LOWER(process_path) LIKE '%\\temp\\%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY 1 HAVING hosts <= 5 ORDER BY hosts ASC", "surface": "hb_process_activity", "description": "Stack-count Node.js executions from user-writable paths to isolate the portable C2 runtime from official installations.", "expected_signal": "A Node.js binary seen on only a few hosts, running from a non-standard directory. Common developer installs will appear across more hosts." }, "parents": [ { "id": "agent-early-takeover-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Prevalence of Node.js runtimes in user paths", "reads": [ "device_hostname", "process_name", "process_path", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE LOWER(process_name) = 'node.exe' AND (LOWER(process_path) LIKE '%\\users\\%' OR LOWER(process_path) LIKE '%\\public\\%' OR LOWER(process_path) LIKE '%\\temp\\%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY 1 HAVING hosts <= 5 ORDER BY hosts ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A Node.js binary seen on only a few hosts, running from a non-standard directory. Common developer installs will appear across more hosts.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_path" ], "rare_below": 5 }, "verified_at": "2026-09-20" } }, { "id": "winrm-lateral-expansion", "type": "query", "label": "WinRM connections to sensitive internal targets", "config": { "dsl": "sqlite", "role": "enrichment", "source": "network", "content": "SELECT device_hostname, time, process_name, dst_endpoint_ip, dst_endpoint_port, direction FROM hb_network_connection WHERE (dst_endpoint_port IN (5985, 5986) OR LOWER(process_name) = 'wsmprovhost.exe') AND (instr(',' || '{{sensitive_ip_targets}}' || ',', ',' || dst_endpoint_ip || ',') > 0 OR '{{sensitive_ip_targets}}' = '') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_network_connection", "description": "Identify lateral movement attempts targeting high-value infrastructure like Domain Controllers.", "expected_signal": "Connections from the suspected beachhead to sensitive IPs over WinRM ports. Silence means no such connections were logged." }, "parents": [ { "id": "agent-early-takeover-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "WinRM connections to sensitive internal targets", "reads": [ "device_hostname", "direction", "dst_endpoint_ip", "dst_endpoint_port", "process_name", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, time, process_name, dst_endpoint_ip, dst_endpoint_port, direction FROM hb_network_connection WHERE (dst_endpoint_port IN (5985, 5986) OR LOWER(process_name) = 'wsmprovhost.exe') AND (instr(',' || '{{sensitive_ip_targets}}' || ',', ',' || dst_endpoint_ip || ',') > 0 OR '{{sensitive_ip_targets}}' = '') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "Connections from the suspected beachhead to sensitive IPs over WinRM ports. Silence means no such connections were logged.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "agent-full-chain-triage", "type": "analytic", "label": "Final multi-stage chain correlation", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "agent-early-takeover-triage", "portable-node-prevalence", "winrm-lateral-expansion" ], "objective": "Determine if any host identified as suspicious in the early triage also displays rare Node.js runtimes and WinRM lateral movement.", "description": "Connect the early takeover evidence with the follow-on portable runtime and WinRM activity to confirm the full attack path.", "max_iterations": 5, "expected_signal": "A high-fidelity verdict for hosts that display the complete progression from takeover to expansion.", "success_criteria": "A final verdict of malicious for hosts matching the CaptiveCrunch behavioral pattern." }, "parents": [ { "id": "portable-node-prevalence", "kind": "merge" }, { "id": "winrm-lateral-expansion", "kind": "merge" } ] }, { "id": "route-on-full-verdict", "type": "checkpoint", "label": "Route on attack chain confirmation", "config": { "fuzzy": true, "judge": "hunter", "question": "the final triage verdict is malicious for at least one host, linking remote-support takeover to lateral movement", "condition": "the final triage verdict is malicious for at least one host, linking remote-support takeover to lateral movement", "blind_spot": "no-winrm-command-logging", "confidence": "high", "description": "Direct confirmed malicious activity to isolation and analyst review.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "agent-full-chain-triage" } ] }, { "id": "isolate-endpoint", "type": "action", "label": "Isolate compromised endpoint", "config": { "target": "endpoint", "description": "Prevent further lateral movement or data exfiltration by isolating the confirmed beachhead.", "instructions": "Isolate the host identified in the triage verdict. Revoke any active sessions for the user(s) associated with the remote-support takeover.", "action_approval": "required" }, "parents": [ { "id": "route-on-full-verdict", "branch": "on_supports" } ] }, { "id": "analyst-forensic-task", "type": "task", "label": "Analyst forensic and AD review", "config": { "assignee": "analyst", "description": "Manually verify the scope of the lateral expansion on the Domain Controller side.", "instructions": "Review WinRM logs (Event ID 91) on the targeted Domain Controllers to identify executed commands. Search for any new MSI installations or portable node.exe binaries on those systems." }, "parents": [ { "id": "route-on-full-verdict", "branch": "default" }, { "id": "route-on-full-verdict", "branch": "on_unavailable" }, { "id": "isolate-endpoint" } ] }, { "id": "close-out-hunt", "type": "task", "label": "Hunt closure and documentation", "config": { "assignee": "analyst", "description": "Finalize the investigation and document findings.", "instructions": "Record the hosts examined and the final verdicts. If legitimate remote support was found but used as a vector, recommend tighter ASR rules." }, "parents": [ { "id": "route-on-full-verdict", "branch": "on_refutes" }, { "id": "analyst-forensic-task" } ] } ] }