{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The Gentlemen ransomware presents an environment-wide destructive risk; identifying the precursors of lateral movement and exfiltration provides the final window for containment before encryption." }, "name": "Lateral Movement and Ransomware Deployment: The Gentlemen", "type": "investigation", "labels": [ "hunt", "attack.t1003.001", "attack.t1558.003", "attack.t1219", "attack.t1021.001", "attack.t1021.002", "attack.t1567.002", "attack.t1486", "attack.t1489", "attack.t1053.005", "attack.t1484.001" ], "series": { "slug": "flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware", "index": 3, "title": "Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware", "total": 3 }, "related": [ { "hunt": "active-directory-gpo-scheduled-task-persistence", "reason": "This hunt targets the ransomware impact flow; generic GPO-based persistence is a broader identity hunt.", "relation": "out-of-scope-alternative" }, { "hunt": "decentralized-saas-c2-infrastructure", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single rule for shadow copy deletion is often too late. This hunt pivots across the intrusion chain\u2014correlating rare RMM activity, credential access, cloud exfiltration traffic, and impact commands\u2014to identify a systemic threat that a single detection rule would miss.", "coverage": [ { "stage": "credential-access-lsass-dumping", "steps": [ "lsass-dumping-detection" ], "status": "covered" }, { "stage": "lateral-movement-rmm-and-netexec", "steps": [ "identify-beachhead-rmm", "rare-lateral-movement-tools", "early-stage-triage" ], "status": "covered" }, { "stage": "data-exfiltration-rclone", "steps": [ "wasabi-exfiltration" ], "status": "covered" }, { "stage": "impact-gpo-ransomware", "steps": [ "ransomware-impact-commands" ], "status": "covered" }, { "stage": "initial-access-trojanized-msi", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" }, { "stage": "etherrat-execution-node-js", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" }, { "stage": "persistence-registry-run-key", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" }, { "stage": "internal-reconnaissance-and-discovery", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" }, { "stage": "secondary-payload-sideloading", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" }, { "stage": "blockchain-and-saas-c2", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Trojanized MSI installer", "slug": "initial-access-trojanized-msi", "tactic": "initial-access", "techniques": [ "T1204.002" ], "observables": [ "msiexec.exe /V", "MVnVmUYj.cmd", "RAMMap utility masquerade" ] }, { "name": "EtherRAT execution via Node.js", "slug": "etherrat-execution-node-js", "tactic": "execution", "techniques": [ "T1059.003", "T1105" ], "observables": [ "curl -sLo \"C:\\Users\\REDACTED\\AppData\\Local\\Temp\\9gY0LJMyXW.zip\" \"https://nodejs.org/dist/v18.20.5/node-v18.20.5-win-x64.zip\"", "node-v18.20.5-win-x64.zip", "node.exe", "A7Pnj975bl.cfg" ] }, { "name": "Persistence via Registry Run key", "slug": "persistence-registry-run-key", "tactic": "persistence", "techniques": [ "T1547.001" ], "observables": [ "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v AppResolver /d \"conhost --headless \"C:\\Users\\REDACTED\\AppData\\Local\\P2RsupmqXnmx\\gksVMg\\node.exe\" \"C:\\Users\\REDACTED\\AppData\\Local\\P2RsupmqXnmx\\A7Pnj975bl.cfg\"\" /f", "AppResolver" ] }, { "name": "Internal reconnaissance and discovery", "slug": "internal-reconnaissance-and-discovery", "tactic": "discovery", "techniques": [ "T1082", "T1518.001", "T1087.002", "T1018" ], "observables": [ "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command \"[System.Globalization.CultureInfo]::InstalledUICulture.Name\"", "powershell -Command \"try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }\"", "net group \"Domain Admins\" /domain", "nltest /domain_trusts /all_trusts", "netscan.exe" ] }, { "name": "TukTuk deployment via DLL sideloading", "slug": "secondary-payload-sideloading", "tactic": "defense-evasion", "techniques": [ "T1574.002" ], "observables": [ "Greenshot.exe", "SyncTrayzor.exe", "docfx.exe", "Cake.exe" ] }, { "name": "Blockchain and SaaS C2", "slug": "blockchain-and-saas-c2", "tactic": "command-and-control", "techniques": [ "T1102.001", "T1572" ], "observables": [ "1rpc.io", "goldsky.arweave.net", "trycloudflare.com", "supabase.co", "1rpc.io", "goldsky.arweave.net" ] }, { "name": "Credential Access via LSASS dumping", "slug": "credential-access-lsass-dumping", "tactic": "credential-access", "techniques": [ "T1003.001", "T1558.003" ], "observables": [ "rundll32.exe C:\\windows\\System32\\comsvcs.dll, #+0000^24", "Kerberoasting", "NTDS dumping" ] }, { "name": "Lateral movement via RMM and NetExec", "slug": "lateral-movement-rmm-and-netexec", "tactic": "lateral-movement", "techniques": [ "T1219", "T1021.001", "T1021.002" ], "observables": [ "GoToResolveProcessChecker.exe", "nxc smb REDACTED_IP -u REDACTED_USER -p REDACTED_PASSWORD --ntds", "nxc", "winrm" ] }, { "name": "Data exfiltration via Rclone", "slug": "data-exfiltration-rclone", "tactic": "exfiltration", "techniques": [ "T1567.002" ], "observables": [ "rclone", "Wasabi cloud storage" ] }, { "name": "Ransomware deployment via GPO", "slug": "impact-gpo-ransomware", "tactic": "impact", "techniques": [ "T1486", "T1489", "T1053.005", "T1484.001" ], "observables": [ "The Gentlemen ransomware", "Microsoft Defender disabled", "GPO execution via SYSVOL/NETLOGON", "vssadmin.exe delete shadows" ] } ], "summary": "A threat actor used a trojanized MSI installer to deploy EtherRAT, leveraging Ethereum blockchain and TryCloudflare for resilient C2 before deploying the TukTuk framework via DLL sideloading. The intrusion progressed through extensive AD discovery and lateral movement using NetExec and GoTo Resolve, concluding with data exfiltration via Rclone and domain-wide deployment of The Gentleman ransomware via GPO and scheduled tasks." }, "severity": "high", "rationale": "Focus on domain controllers and file servers first. Expand scope if SoftPerfect or GoTo Resolve execution is found on any workstation.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has moved laterally from an RMM-controlled beachhead using NetExec or GoTo Resolve to dump credentials and exfiltrate data to Wasabi before initiating domain-wide encryption via GPO.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-defined", "kind": "manual", "observed": "2026-05-11" }, "type": "list[host]", "default": [], "description": "Hosts identified in the scoping step; leave empty to hunt across the entire estate." }, "lookback_days": { "from": { "ref": "default-retention", "kind": "manual", "observed": "2026-05-11" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "wasabi_domains": { "from": { "ref": "https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/", "kind": "article", "observed": "2026-05-11" }, "type": "list[domain]", "default": [ "wasabisys.com", "wasabi.com", "s3.wasabisys.com" ], "description": "Cloud storage domains used for data exfiltration." }, "lateral_tool_filenames": { "from": { "ref": "https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/", "kind": "article", "observed": "2026-05-11" }, "type": "list[string]", "default": [ "mimikatz.exe", "nxc.exe", "netscan.exe", "rclone.exe" ], "description": "Filenames of known lateral movement and exfiltration tools." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/", "name": "DFIR Report \u2014 Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware" } ], "blind_spots": [ { "id": "memory-only-execution", "risk": "A hands-on-keyboard actor can interact with the OS without spawning new processes or leaving command-line artifacts.", "owner": "Detection Engineering", "stage": "lateral-movement-rmm-and-netexec", "question": "Whether nxc or mimikatz was used to execute shellcode or scripts entirely in memory", "requires": "Memory forensics or process injection hooks", "remediation": "Monitor for unauthorized RMM process memory modifications." }, { "id": "gpo-audit-gap", "risk": "The ransomware deployment via GPO is only visible on the DC's file system or via identity logs.", "owner": "Active Directory Team", "stage": "impact-gpo-ransomware", "question": "Whether a GPO was created or modified to execute ransomware", "requires": "AD auditing of GPO changes (Event ID 5136)", "remediation": "Enable and ingest Event ID 5136 and file activity on SYSVOL shares." } ] }, "name": "Lateral Movement and Ransomware Deployment: The Gentlemen", "description": "This hunt targets the hands-on-keyboard phase of a ransomware intrusion. It begins by scoping for hosts showing portable RMM execution, such as GoTo Resolve or SoftPerfect, which are used as beachheads. The first phase hunts for credential dumping and lateral tools by looking for behavioral strings and original file names that survive renaming. The second phase corroborates this with network traffic to cloud storage and final-stage impact commands. An agent correlates these stages to distinguish administrative activity from a ransomware kill chain." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware", "index": 3, "title": "Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware", "total": 3 }, "coverage": [ { "stage": "credential-access-lsass-dumping", "steps": [ "lsass-dumping-detection" ], "status": "covered" }, { "stage": "lateral-movement-rmm-and-netexec", "steps": [ "identify-beachhead-rmm", "rare-lateral-movement-tools", "early-stage-triage" ], "status": "covered" }, { "stage": "data-exfiltration-rclone", "steps": [ "wasabi-exfiltration" ], "status": "covered" }, { "stage": "impact-gpo-ransomware", "steps": [ "ransomware-impact-commands" ], "status": "covered" }, { "stage": "initial-access-trojanized-msi", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" }, { "stage": "etherrat-execution-node-js", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" }, { "stage": "persistence-registry-run-key", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" }, { "stage": "internal-reconnaissance-and-discovery", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" }, { "stage": "secondary-payload-sideloading", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" }, { "stage": "blockchain-and-saas-c2", "reason": "Belongs to another part of the 'Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware' series.", "status": "out_of_scope" } ], "rationale": "An adversary has moved laterally from an RMM-controlled beachhead using NetExec or GoTo Resolve to dump credentials and exfiltrate data to Wasabi before initiating domain-wide encryption via GPO.", "blind_spots": [ { "id": "memory-only-execution", "risk": "A hands-on-keyboard actor can interact with the OS without spawning new processes or leaving command-line artifacts.", "owner": "Detection Engineering", "stage": "lateral-movement-rmm-and-netexec", "question": "Whether nxc or mimikatz was used to execute shellcode or scripts entirely in memory", "requires": "Memory forensics or process injection hooks", "remediation": "Monitor for unauthorized RMM process memory modifications." }, { "id": "gpo-audit-gap", "risk": "The ransomware deployment via GPO is only visible on the DC's file system or via identity logs.", "owner": "Active Directory Team", "stage": "impact-gpo-ransomware", "question": "Whether a GPO was created or modified to execute ransomware", "requires": "AD auditing of GPO changes (Event ID 5136)", "remediation": "Enable and ingest Event ID 5136 and file activity on SYSVOL shares." } ], "scoping_notes": "Focus on domain controllers and file servers first. Expand scope if SoftPerfect or GoTo Resolve execution is found on any workstation.", "beyond_detection": "A single rule for shadow copy deletion is often too late. This hunt pivots across the intrusion chain\u2014correlating rare RMM activity, credential access, cloud exfiltration traffic, and impact commands\u2014to identify a systemic threat that a single detection rule would miss." } }, { "id": "identify-beachhead-rmm", "type": "query", "label": "Identify portable RMM and scanner execution", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%goto%resolve%' OR LOWER(process_name) LIKE '%netscan%' OR LOWER(process_cmd_line) LIKE '%netscan%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Locate hosts running GoTo Resolve or SoftPerfect Network Scanner. These define the primary hosts of interest for the lateral movement phase.", "expected_signal": "Execution of GoTo Resolve or NetScan binaries. Silence means these specific tools were not launched, not that no RMM activity occurred." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify portable RMM and scanner execution", "reads": [ "device_hostname", "process_name", "process_path", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%goto%resolve%' OR LOWER(process_name) LIKE '%netscan%' OR LOWER(process_cmd_line) LIKE '%netscan%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Execution of GoTo Resolve or NetScan binaries. Silence means these specific tools were not launched, not that no RMM activity occurred.", "verified": "dry-run", "verified_at": "2026-09-24" } }, { "id": "lsass-dumping-detection", "type": "query", "label": "LSASS dumping via comsvcs", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE LOWER(process_cmd_line) LIKE '%comsvcs.dll%#+0000%24%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify process execution targeting LSASS memory using the comsvcs.dll ordinal technique.", "expected_signal": "Command lines containing rundll32 and comsvcs.dll ordinal #24. This is a high-fidelity indicator of credential dumping." }, "parents": [ { "id": "identify-beachhead-rmm" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "LSASS dumping via comsvcs", "reads": [ "device_hostname", "process_name", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE LOWER(process_cmd_line) LIKE '%comsvcs.dll%#+0000%24%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "Command lines containing rundll32 and comsvcs.dll ordinal #24. This is a high-fidelity indicator of credential dumping.", "verified": "dry-run", "verified_at": "2026-09-24" } }, { "id": "rare-lateral-movement-tools", "type": "query", "label": "Rare lateral tools by original name and behavior", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_original_file_name) AS original_name, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (instr(',' || '{{lateral_tool_filenames}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0 OR LOWER(process_cmd_line) LIKE '%sekurlane%' OR LOWER(process_cmd_line) LIKE '%lsadump%' OR LOWER(process_cmd_line) LIKE '%netexec%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING hosts <= 3", "surface": "hb_process_activity", "description": "Identify lateral movement tools that may have been renamed to bypass process name detections.", "expected_signal": "Processes whose original file name or command line strings match known lateral tools. Rare occurrences (1-3 hosts) indicate adversary use." }, "parents": [ { "id": "identify-beachhead-rmm" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare lateral tools by original name and behavior", "reads": [ "device_hostname", "process_original_file_name", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_original_file_name) AS original_name, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (instr(',' || '{{lateral_tool_filenames}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0 OR LOWER(process_cmd_line) LIKE '%sekurlane%' OR LOWER(process_cmd_line) LIKE '%lsadump%' OR LOWER(process_cmd_line) LIKE '%netexec%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING hosts <= 3", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Processes whose original file name or command line strings match known lateral tools. Rare occurrences (1-3 hosts) indicate adversary use.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_original_file_name" ], "rare_below": 3 }, "verified_at": "2026-09-24" } }, { "id": "early-stage-triage", "type": "analytic", "label": "Weigh early-stage evidence", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "identify-beachhead-rmm", "lsass-dumping-detection", "rare-lateral-movement-tools" ], "objective": "Identify hosts showing a high-confidence chain of beachhead RMM use followed by credential access and lateral tool execution.", "description": "Evaluate if observed beachhead RMM activity, LSASS dumping, and lateral tools constitute a suspicious movement phase.", "max_iterations": 3, "expected_signal": "A per-host verdict on the early-stage evidence.", "success_criteria": "A per-host verdict of malicious | suspicious citing specific process and original filename rows." }, "parents": [ { "id": "lsass-dumping-detection", "kind": "merge" }, { "id": "rare-lateral-movement-tools", "kind": "merge" } ] }, { "id": "wasabi-exfiltration", "type": "query", "label": "DNS lookups to Wasabi cloud storage", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, process_name, query_hostname, COUNT(*) AS lookups FROM hb_dns_activity WHERE instr(',' || '{{wasabi_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3", "surface": "hb_dns_activity", "description": "Identify outbound traffic to Wasabi, which the adversary used with Rclone for data exfiltration.", "expected_signal": "DNS queries for Wasabi domains from hosts identified in the early movement phase. Suspicious if originating from servers not performing authorized backups." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "DNS lookups to Wasabi cloud storage", "reads": [ "device_hostname", "process_name", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, query_hostname, COUNT(*) AS lookups FROM hb_dns_activity WHERE instr(',' || '{{wasabi_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3", "silence": "not_evidence_of_absence", "expected": "DNS queries for Wasabi domains from hosts identified in the early movement phase. Suspicious if originating from servers not performing authorized backups.", "verified": "dry-run", "verified_at": "2026-09-24" } }, { "id": "ransomware-impact-commands", "type": "query", "label": "Destructive behavior and AV tampering", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%vssadmin%delete%shadows%' OR LOWER(process_cmd_line) LIKE '%disable-mppreference%' OR LOWER(process_cmd_line) LIKE '%shadowcopy%delete%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify the high-fidelity impact commands used by The Gentlemen ransomware, including shadow copy deletion and Defender disabling.", "expected_signal": "Commands used to delete backups and disable security controls. Any hit on a production server or DC is critical." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Destructive behavior and AV tampering", "reads": [ "device_hostname", "process_name", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%vssadmin%delete%shadows%' OR LOWER(process_cmd_line) LIKE '%disable-mppreference%' OR LOWER(process_cmd_line) LIKE '%shadowcopy%delete%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "Commands used to delete backups and disable security controls. Any hit on a production server or DC is critical.", "verified": "dry-run", "verified_at": "2026-09-24" } }, { "id": "final-killchain-assessment", "type": "analytic", "label": "Final ransomware kill-chain triage", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "early-stage-triage", "wasabi-exfiltration", "ransomware-impact-commands" ], "objective": "Determine if the evidence chain from early movement to final destruction confirms an active Gentlemen ransomware intrusion.", "description": "Correlate early movement evidence with follow-on exfiltration and destructive behavior.", "max_iterations": 4, "expected_signal": "A comprehensive verdict connecting movement, exfiltration, and impact.", "success_criteria": "A verdict that links the hosts from the first agent to the exfiltration and impact findings, confirming a logical progression of an intrusion." }, "parents": [ { "id": "wasabi-exfiltration", "kind": "merge" }, { "id": "ransomware-impact-commands", "kind": "merge" } ] }, { "id": "intrusion-confirmed", "type": "checkpoint", "label": "Route on ransomware verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the final-killchain-assessment verdict is malicious for at least one host", "condition": "the final-killchain-assessment verdict is malicious for at least one host", "blind_spot": "memory-only-execution", "confidence": "high", "description": "Trigger immediate containment if an active ransomware chain is identified.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "final-killchain-assessment" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Prevent domain-wide encryption by isolating affected hosts identified in the kill chain.", "instructions": "Isolate the host immediately via the EDR. Proceed to manual review of GPO and RMM logs.", "action_approval": "required" }, "parents": [ { "id": "intrusion-confirmed", "branch": "on_supports" } ] }, { "id": "manual-gpo-audit", "type": "task", "label": "Manual GPO and RMM audit", "config": { "assignee": "analyst", "description": "Examine evidence of GPO modifications and RMM task history which are not always visible in endpoint process logs.", "instructions": "Check Active Directory for recent GPO modifications in SYSVOL/NETLOGON. Review GoTo Resolve console logs for unauthorized tasks launched from beachhead IPs." }, "parents": [ { "id": "intrusion-confirmed", "branch": "default" }, { "id": "intrusion-confirmed", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "hunt-close-out", "type": "task", "label": "Hunt closure", "config": { "assignee": "analyst", "description": "Finalize documentation and negative findings.", "instructions": "Record the hosts examined and whether the intrusion chain was present. If destructive behavior was found, pivot to Incident Response." }, "parents": [ { "id": "intrusion-confirmed", "branch": "on_refutes" }, { "id": "manual-gpo-audit" } ] } ] }