{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Protects Linux web infrastructure from automated, AI-driven persistence that bypasses standard signatures by masquerading as legitimate administrative configuration changes." }, "name": "Linux Persistence and Credential Hijacking", "type": "investigation", "labels": [ "hunt", "attack.t1505.003", "attack.t1059", "attack.t1071", "attack.t1041", "collection", "command and control", "credential access", "execution", "persistence" ], "series": { "slug": "ai-powered-espionage-campaign-targets-government-linux-infrastructure", "index": 1, "title": "AI-Powered Espionage Campaign Targets Government Linux Infrastructure", "total": 2 }, "related": [ { "hunt": "sysgorat-rat-detection", "reason": "Detection of the custom Go-based SysGoRAT binary is handled in a separate hunt focused on binary-on-disk analysis.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A static rule can find the plesk_sys_driver.php filename, but this hunt correlates rare configuration changes with live behavioral anomalies like web server process managers spawning shells, identifying AI-generated payloads that use varying filenames or paths to evade simple rules.", "coverage": [ { "stage": "web-shell-deployment", "steps": [ "webshell-execution-patterns", "rare-config-modifications" ], "status": "covered" }, { "stage": "php-persistence-tampering", "steps": [ "rare-config-modifications" ], "status": "covered" }, { "stage": "credential-harvesting-sudo", "steps": [ "rare-config-modifications" ], "status": "covered" }, { "stage": "sysgorat-execution", "reason": "Belongs to another part of the 'AI-Powered Espionage Campaign Targets Government Linux Infrastructure' series.", "status": "out_of_scope" }, { "stage": "reverse-shell-activity", "reason": "Belongs to another part of the 'AI-Powered Espionage Campaign Targets Government Linux Infrastructure' series.", "status": "out_of_scope" }, { "stage": "c2-communication", "reason": "Belongs to another part of the 'AI-Powered Espionage Campaign Targets Government Linux Infrastructure' series.", "status": "out_of_scope" }, { "stage": "data-collection-exfiltration", "reason": "Belongs to another part of the 'AI-Powered Espionage Campaign Targets Government Linux Infrastructure' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Web Shell Deployment", "slug": "web-shell-deployment", "tactic": "persistence", "techniques": [ "T1505.003" ], "observables": [ "/usr/lib/php/plesk_sys_driver.php", "POST requests to PHP files via php-fpm parent process", "search_social.php" ] }, { "name": "PHP Configuration Tampering", "slug": "php-persistence-tampering", "tactic": "persistence", "techniques": [ "T1505.003" ], "observables": [ "Modification of auto_prepend_file in /etc/php/", "Modification of auto_prepend_file in /opt/plesk/php/" ] }, { "name": "Sudo Command Hijacking", "slug": "credential-harvesting-sudo", "tactic": "credential-access", "techniques": [ "T1059" ], "observables": [ "Modification of .bashrc with sudo aliases", "Solarwinds.StatusLog.txt", "Commands searching for SMTP or database passwords in config files" ] }, { "name": "SysGoRAT Backdoor Execution", "slug": "sysgorat-execution", "tactic": "execution", "techniques": [ "T1059" ], "observables": [ "sys-control-client", "pip2.7", "ea_install", "./semanage", "Go-based multi-platform RAT" ] }, { "name": "In-Memory Reverse Shells", "slug": "reverse-shell-activity", "tactic": "execution", "techniques": [ "T1059" ], "observables": [ "mkfifo /tmp/f; cat /tmp/f | bash -i 2>&1 | nc", "bash -i >& /dev/tcp/", "python3 -c \"import socket,subprocess,os; s=socket.socket(...)\"" ] }, { "name": "WebSocket Command and Control", "slug": "c2-communication", "tactic": "command-and-control", "techniques": [ "T1071" ], "observables": [ "wss:///ws", "104.194.158.65:443", "proxy_connect command via RAT" ] }, { "name": "Mailbox and Database Collection", "slug": "data-collection-exfiltration", "tactic": "collection", "techniques": [ "T1041" ], "observables": [ "Enumeration of /var/qmail/mailnames/", "zip_mails.sh", "Iteration through Maildir/cur/ directories" ] } ], "summary": "CL-UNK-1211 is an AI-assisted campaign targeting government Linux infrastructure to exfiltrate mailboxes and sensitive databases. The attackers utilize custom Go-based backdoors (SysGoRAT), extensive web shell deployments, and creative credential theft such as hijacking the sudo command through .bashrc modifications." }, "severity": "high", "rationale": "Start with Linux servers running Plesk or public-facing PHP applications. The identify-linux-web-servers query finds these based on installed software. Use the resulting host list to populate scope_hosts for the detection queries.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has established persistence on Linux web servers using AI-generated PHP web shells and hijacked administrative credentials by tampering with shell profiles and configuration files.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "List of hostnames identified in the scoping step; refresh this list with results from identify-linux-web-servers before running detection steps." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "known_malicious_files": { "from": { "ref": "Unit 42 CL-UNK-1211", "kind": "article", "observed": "2026-10-15" }, "type": "list[string]", "default": [ "plesk_sys_driver.php", "search_social.php", "Solarwinds.StatusLog.txt", "zip_mails.sh" ], "description": "Malicious filenames or decoy logs identified in the campaign." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/", "name": "Unit 42 \u2014 AI-Powered Espionage Campaign Targets Government Linux Infrastructure" } ], "blind_spots": [ { "id": "missing-file-telemetry", "risk": "If file activity logging is not enabled for system configuration paths, the initial modification by the web shell may be missed, leaving only the persistent state visible.", "stage": "php-persistence-tampering", "question": "Which process originally modified the PHP configuration files", "requires": "hb_linux_audit or real-time FIM on /etc/php and /opt/plesk" }, { "id": "ephemeral-webshell-execution", "risk": "AI-automated agents may deploy a web shell, execute commands, and delete the file within seconds, making it invisible to file system snapshots.", "stage": "web-shell-deployment", "question": "Whether a web shell was deployed and deleted in a very short window", "requires": "hb_process_activity with low latency" } ] }, "name": "Linux Persistence and Credential Hijacking", "description": "The adversary uses AI-assisted code to modify PHP configuration directories and .bashrc profiles, ensuring that malicious code executes whenever a web request is processed or a user elevates privileges. This hunt targets the activity of CL-UNK-1211, focusing on the specialized Linux persistence and credential theft observed in their campaign. The hunt identifies the web server estate and executes parallel checks: one to find anomalous shell execution originating from web server process managers, and another to baseline rare file modifications across critical configuration paths. The analyst evaluates the results to differentiate legitimate administrative activity from AI-automated intrusion artifacts." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "ai-powered-espionage-campaign-targets-government-linux-infrastructure", "index": 1, "title": "AI-Powered Espionage Campaign Targets Government Linux Infrastructure", "total": 2 }, "coverage": [ { "stage": "web-shell-deployment", "steps": [ "webshell-execution-patterns", "rare-config-modifications" ], "status": "covered" }, { "stage": "php-persistence-tampering", "steps": [ "rare-config-modifications" ], "status": "covered" }, { "stage": "credential-harvesting-sudo", "steps": [ "rare-config-modifications" ], "status": "covered" }, { "stage": "sysgorat-execution", "reason": "Belongs to another part of the 'AI-Powered Espionage Campaign Targets Government Linux Infrastructure' series.", "status": "out_of_scope" }, { "stage": "reverse-shell-activity", "reason": "Belongs to another part of the 'AI-Powered Espionage Campaign Targets Government Linux Infrastructure' series.", "status": "out_of_scope" }, { "stage": "c2-communication", "reason": "Belongs to another part of the 'AI-Powered Espionage Campaign Targets Government Linux Infrastructure' series.", "status": "out_of_scope" }, { "stage": "data-collection-exfiltration", "reason": "Belongs to another part of the 'AI-Powered Espionage Campaign Targets Government Linux Infrastructure' series.", "status": "out_of_scope" } ], "rationale": "An adversary has established persistence on Linux web servers using AI-generated PHP web shells and hijacked administrative credentials by tampering with shell profiles and configuration files.", "blind_spots": [ { "id": "missing-file-telemetry", "risk": "If file activity logging is not enabled for system configuration paths, the initial modification by the web shell may be missed, leaving only the persistent state visible.", "stage": "php-persistence-tampering", "question": "Which process originally modified the PHP configuration files", "requires": "hb_linux_audit or real-time FIM on /etc/php and /opt/plesk" }, { "id": "ephemeral-webshell-execution", "risk": "AI-automated agents may deploy a web shell, execute commands, and delete the file within seconds, making it invisible to file system snapshots.", "stage": "web-shell-deployment", "question": "Whether a web shell was deployed and deleted in a very short window", "requires": "hb_process_activity with low latency" } ], "scoping_notes": "Start with Linux servers running Plesk or public-facing PHP applications. The identify-linux-web-servers query finds these based on installed software. Use the resulting host list to populate scope_hosts for the detection queries.", "beyond_detection": "A static rule can find the plesk_sys_driver.php filename, but this hunt correlates rare configuration changes with live behavioral anomalies like web server process managers spawning shells, identifying AI-generated payloads that use varying filenames or paths to evade simple rules." } }, { "id": "identify-linux-web-servers", "type": "query", "label": "Identify Linux web server estate", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%php%' OR LOWER(package_name) LIKE '%plesk%' OR LOWER(package_name) LIKE '%nginx%' OR LOWER(package_name) LIKE '%apache%') AND asset_scope = 'endpoint'", "surface": "hb_software_inventory", "description": "Scope the hunt to Linux hosts running PHP, Plesk, or common web server packages where these persistence techniques are viable.", "expected_signal": "A list of hostnames serving as web infrastructure. Use these results to populate the scope_hosts parameter for subsequent steps." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify Linux web server estate", "reads": [ "device_hostname", "package_name", "package_version", "asset_scope" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%php%' OR LOWER(package_name) LIKE '%plesk%' OR LOWER(package_name) LIKE '%nginx%' OR LOWER(package_name) LIKE '%apache%') AND asset_scope = 'endpoint'", "silence": "not_evidence_of_absence", "expected": "A list of hostnames serving as web infrastructure. Use these results to populate the scope_hosts parameter for subsequent steps.", "verified": "dry-run", "verified_at": "2026-10-17" } }, { "id": "webshell-execution-patterns", "type": "query", "label": "Web shell execution patterns", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, user_name, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%php-fpm%' OR LOWER(parent_process_name) LIKE '%httpd%' OR LOWER(parent_process_name) LIKE '%nginx%' OR LOWER(parent_process_name) LIKE '%apache%') AND (LOWER(process_name) LIKE '%bash%' OR LOWER(process_name) LIKE '%sh%' OR LOWER(process_name) LIKE '%nc%' OR LOWER(process_name) LIKE '%python%' OR LOWER(process_name) LIKE '%perl%' OR LOWER(process_name) LIKE '%php%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify the primary behavioral signature of a web shell: a web server process manager spawning an interactive shell or interpreter.", "expected_signal": "Web server child processes that are shell interpreters. User name 'www-data' or similar indicates web shell context; 'root' indicates successful privilege escalation." }, "parents": [ { "id": "identify-linux-web-servers" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Web shell execution patterns", "reads": [ "device_hostname", "user_name", "process_name", "process_cmd_line", "parent_process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, user_name, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%php-fpm%' OR LOWER(parent_process_name) LIKE '%httpd%' OR LOWER(parent_process_name) LIKE '%nginx%' OR LOWER(parent_process_name) LIKE '%apache%') AND (LOWER(process_name) LIKE '%bash%' OR LOWER(process_name) LIKE '%sh%' OR LOWER(process_name) LIKE '%nc%' OR LOWER(process_name) LIKE '%python%' OR LOWER(process_name) LIKE '%perl%' OR LOWER(process_name) LIKE '%php%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Web server child processes that are shell interpreters. User name 'www-data' or similar indicates web shell context; 'root' indicates successful privilege escalation.", "verified": "dry-run", "verified_at": "2026-10-17" } }, { "id": "rare-config-modifications", "type": "query", "label": "Rare modifications to configurations and profiles", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, actor_user_name, file_path, time FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%/etc/php/%' OR LOWER(file_path) LIKE '%/opt/plesk/php/%' OR LOWER(file_path) LIKE '%/.bashrc' OR instr(',' || '{{known_malicious_files}}' || ',', ',' || LOWER(file_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND file_path IN (SELECT file_path FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%/etc/php/%' OR LOWER(file_path) LIKE '%/opt/plesk/php/%' OR LOWER(file_path) LIKE '%/.bashrc' OR instr(',' || '{{known_malicious_files}}' || ',', ',' || LOWER(file_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY file_path HAVING COUNT(DISTINCT device_hostname) <= 5) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Identify modifications to PHP configuration directories and shell profiles that are rare across the fleet, suggesting targeted tampering.", "expected_signal": "Rare file modifications in critical paths. The presence of deceptive names like Solarwinds.StatusLog.txt or plesk_sys_driver.php on specific hosts is a strong indicator of the CL-UNK-1211 playbook." }, "parents": [ { "id": "identify-linux-web-servers" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare modifications to configurations and profiles", "reads": [ "device_hostname", "actor_user_name", "file_path", "file_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, actor_user_name, file_path, time FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%/etc/php/%' OR LOWER(file_path) LIKE '%/opt/plesk/php/%' OR LOWER(file_path) LIKE '%/.bashrc' OR instr(',' || '{{known_malicious_files}}' || ',', ',' || LOWER(file_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND file_path IN (SELECT file_path FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%/etc/php/%' OR LOWER(file_path) LIKE '%/opt/plesk/php/%' OR LOWER(file_path) LIKE '%/.bashrc' OR instr(',' || '{{known_malicious_files}}' || ',', ',' || LOWER(file_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY file_path HAVING COUNT(DISTINCT device_hostname) <= 5) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Rare file modifications in critical paths. The presence of deceptive names like Solarwinds.StatusLog.txt or plesk_sys_driver.php on specific hosts is a strong indicator of the CL-UNK-1211 playbook.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "file_path" ], "rare_below": 5 }, "verified_at": "2026-10-17" } }, { "id": "triage-compromise", "type": "analytic", "label": "Triage compromise indicators", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "webshell-execution-patterns", "rare-config-modifications" ], "objective": "Identify persistent web shells or credential harvesting artifacts by correlating rare file modifications with anomalous shell execution under web server processes. Compare the user context of process execution against the file actors to identify suspicious elevation.", "description": "Correlate rare file tampering with anomalous web server processes to identify persistent foothills and credential hijacking.", "max_iterations": 4, "expected_signal": "N/A", "success_criteria": "A per-host verdict of malicious, suspicious, or benign citing the relevant process and file rows." }, "parents": [ { "id": "webshell-execution-patterns", "kind": "merge" }, { "id": "rare-config-modifications", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one host based on shell execution and config tampering", "condition": "the triage verdict is malicious for at least one host based on shell execution and config tampering", "blind_spot": "missing-file-telemetry", "confidence": "high", "description": "Initiate response or forensic review based on the agent's evaluation.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-compromise" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Contain the threat to prevent further credential harvesting or data exfiltration.", "instructions": "Isolate the host from the network and revoke any active sessions for administrative accounts seen in the interactive shell telemetry.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "forensic-verification", "type": "task", "label": "Forensic verification", "config": { "assignee": "analyst", "description": "Manually verify the findings for AI-generated artifacts.", "instructions": "Examine the identified .bashrc and PHP configuration files on the isolated host. Check for conversational comments or 'AI-reasoning' markers within the code. Recover the content of any deceptive log files like Solarwinds.StatusLog.txt to identify captured administrative passwords and force immediate resets for those accounts." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Hunt closure", "config": { "assignee": "analyst", "description": "Document findings and telemetry gaps.", "instructions": "Record the effectiveness of the prevalence check for identifying configuration tampering. Note any hosts that lacked software inventory for web services." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "forensic-verification" } ] } ] }