--- analysis: A single detection rule on malware hashes is easily bypassed by binary rotation. This hunt correlates cloud identity anomalies with host behavior and file impact, providing context that a single-surface rule cannot achieve. blind_spots: - id: missing-endpoint-visibility question: Are there infected hosts that are not reporting process or file activity? requires: endpoint agent coverage risk: A host without an agent could be executing malware undetected even if identity logs show session hijacking. stage: execution-malware-droppers - id: browser-forensic-gap question: Can we confirm the browser-level cookie theft event? requires: local browser history and cookie artifacts risk: This hunt relies on identifying the aftermath (anomalous sign-ins) rather than the direct theft, which may allow stealthy proxy usage to go unnoticed. stage: credential-access-session-theft coverage: - stage: initial-access-docusign-phishing status: covered steps: - dns-phishing-lures - stage: credential-access-session-theft status: covered steps: - m365-auth-anomaly - agent-identity-triage - stage: execution-malware-droppers status: covered steps: - malware-execution - stage: impact-data-encryption status: covered steps: - ransomware-impact guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: M365 session hijacking via phishing platforms like NovaCookies bypasses traditional MFA. Detecting the subsequent malware execution and ransomware impact on the same user context provides a high-confidence signal for containing intrusions. methodology: model-assisted trigger: intel-report hypothesis: An adversary has bypassed MFA by stealing M365 session tokens via DocuSign-themed phishing, enabling them to execute malicious droppers and deploy ransomware across the fleet. labels: - hunt - attack.t1566.002 - attack.t1539 - attack.t1204.002 - attack.t1486 name: M365 Session Hijacking and Malware Execution parameters: lookback_days: default: '14' description: Days of history to examine. type: number malware_filenames: default: - VID001.exe - client32.exe - WCInstaller_NonAdmin.exe - content.js - SECOH-QAD.exe description: Known filenames of malicious droppers observed in recent telemetry. from: kind: article observed: '2026-08-27' ref: https://blog.talosintelligence.com/sorry-i-cant-help-with-that-how-your-guardrails-might-become-the-attackers-best-friend/ type: list[string] malware_hashes: default: - 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 - e7e784cae8d37f12a5af0bc9b3975c8d3e668142e9c6b0b365ed4f4e80933c47 - c4dd71e347a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2 - 38d053135ddceaef0abb8296f3b0bf6114b25e10e6fa1bb8050aeecec4ba8f55 - 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f - a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 description: SHA256 hashes of malware droppers and tools identified by Talos. from: kind: article observed: '2026-08-27' ref: https://blog.talosintelligence.com/sorry-i-cant-help-with-that-how-your-guardrails-might-become-the-attackers-best-friend/ type: list[hash] phishing_domains: default: - 95.sbx.tg - 38d053135d-95.sbx.tg - c4dd71e347-95.sbx.tg - 9f1f11a708-100.sbx.tg description: DocuSign phishing and sandbox domains observed in the campaign; docusign.net removed to reduce noise. from: kind: article observed: '2026-08-27' ref: https://blog.talosintelligence.com/sorry-i-cant-help-with-that-how-your-guardrails-might-become-the-attackers-best-friend/ type: list[domain] scope_hosts: default: [] description: Optional list of hostnames to focus the hunt. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://blog.talosintelligence.com/sorry-i-cant-help-with-that-how-your-guardrails-might-become-the-attackers-best-friend/ gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Prioritize users with access to sensitive document shares and workstations in departments commonly receiving DocuSign notifications. Start with a 14-day lookback to catch the session theft beachhead. references: - name: "\u201CSorry, I can\u2019t help with that\u201D: How your guardrails might\ \ become the attacker\u2019s best friend" url: https://blog.talosintelligence.com/sorry-i-cant-help-with-that-how-your-guardrails-might-become-the-attackers-best-friend/ - name: "Talos \u2014 Sorry, I can\u2019t help with that: How your guardrails might\ \ become the attacker\u2019s best friend" url: https://blog.blog.talosintelligence.com/sorry-i-cant-help-with-that-how-your-guardrails-might-become-the-attackers-best-friend/ related: - hunt: m365-token-theft-browser-forensics reason: This hunt focuses on network and authentication anomalies; browser-specific cookie artifacts require a separate forensic hunt. relation: out-of-scope-alternative scenario: stages: - name: DocuSign Phishing Lure observables: - genuine docusign notifications - docusign.net - NovaCookies phishing platform slug: initial-access-docusign-phishing tactic: initial-access techniques: - T1566.002 - name: M365 Session Hijacking observables: - M365 session theft - real-time session hijacking - $320/month phishing kit slug: credential-access-session-theft tactic: credential-access techniques: - T1539 - name: Malware Dropper Execution observables: - VID001.exe - client32.exe - WCInstaller_NonAdmin.exe - content.js - SECOH-QAD.exe - d4aa3e7010220ad1b458fac17039c274_62_Exe.exe - ToxicPanda banking trojan slug: execution-malware-droppers tactic: execution techniques: - T1204.002 - name: Data Encryption for Impact observables: - ransomware encryption - file renaming - inaccessible user files slug: impact-data-encryption tactic: impact techniques: - T1486 summary: The NovaCookies campaign uses genuine DocuSign notifications to lure users into Microsoft 365 session theft via a subscription-based phishing kit. Stolen sessions enable unauthorized access to corporate environments, leading to the deployment of various banking trojans and droppers like ToxicPanda or VID001.exe, and eventually culminating in data encryption for impact. severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent identity: category: identity name: Identity / sign-in telemetry telemetry: - identity tlp: clear type: investigation --- # M365 Session Hijacking and Malware Execution This hunt follows an attack lifecycle from initial cloud identity theft to endpoint ransomware impact. It begins by identifying suspicious DocuSign-related phishing activity and anomalous M365 sign-ins that suggest session hijacking using the NovaCookies platform. The hunt then pivots to the endpoint to detect the execution of specific malware droppers identified by Talos telemetry and monitors for high-frequency file operations characteristic of data encryption. By correlating cloud authentication anomalies with host-side process and file artifacts, the hunt identifies compromised users and the specific hosts where malicious code established a beachhead. ## scope-windows-workstations Identify active Windows hosts that are the primary targets for phishing and subsequent ransomware execution. ```sqlite target=endpoint role=scoping params=(lookback_days=lookback_days) ~~~yaml expected: A list of targetable Windows hosts. None means no Windows systems were enrolled or active during the window. reads: - hostname - os_name - os_version - last_seen - time silence: not_evidence_of_absence source: hb_devices verified: dry-run verified_at: '2026-09-28' ~~~ SELECT hostname, os_name, os_version, last_seen FROM hb_devices WHERE platform = 'windows' AND lifecycle_state = 'active' AND time >= datetime('now', '-{{lookback_days}} days') ``` ## early-stage-parallel parallel: - → dns-phishing-lures - → m365-auth-anomaly join: → agent-identity-triage ## dns-phishing-lures Detect resolution of DocuSign-themed phishing sites or sandbox domains named in the report. ```sqlite target=endpoint role=enrichment params=(phishing_domains=phishing_domains, lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Hosts resolving malicious domains; silence means no direct connection to the reported lures occurred. reads: - device_hostname - query_hostname - time silence: not_evidence_of_absence source: hb_dns_activity verified: dry-run verified_at: '2026-09-28' ~~~ SELECT device_hostname, query_hostname, COUNT(*) AS total_lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE instr(',' || '{{phishing_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, query_hostname ``` ## m365-auth-anomaly Find successful M365 logons from unusual IP addresses per user, suggesting session hijacking. ```sqlite target=identity role=baseline params=(lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A rare user/IP combination that differs from historical patterns. A single logon from a new IP for a user is a typical hijacking signal. prevalence: by: actor_user_name key: - src_endpoint_ip rare_below: 2 reads: - actor_user_name - src_endpoint_ip - provider - status_id - time silence: not_evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-09-28' ~~~ SELECT actor_user_name, src_endpoint_ip, COUNT(*) AS logon_count, MIN(time) AS first_logon, MAX(time) AS last_logon FROM hb_auth_signin WHERE provider = 'm365' AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, src_endpoint_ip HAVING logon_count < 5 ORDER BY logon_count ASC ``` ## agent-identity-triage ```agent target=hunter cite: required context: - dns-phishing-lures - m365-auth-anomaly max_iterations: 4 objective: Identify users who likely fell for a DocuSign phishing lure and subsequently had their M365 session hijacked. Cite the resolved domain and the anomalous logon IP. success_criteria: A list of users with corresponding suspicious IP and DNS evidence. tools: - endpoint - identity ``` ## follow-on-parallel parallel: - → malware-execution - → ransomware-impact join: → follow-on-agent ## malware-execution Detect the execution of the specific droppers and tools identified by Talos. ```sqlite target=endpoint role=detection-candidate params=(malware_hashes=malware_hashes, malware_filenames=malware_filenames, lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Process executions matching the reported malware. Any match is high confidence. reads: - device_hostname - process_name - process_hash_sha256 - process_cmd_line - user_name - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-09-28' ~~~ SELECT device_hostname, process_name, process_hash_sha256, process_cmd_line, user_name, time FROM hb_process_activity WHERE (instr(',' || '{{malware_hashes}}' || ',', ',' || LOWER(process_hash_sha256) || ',') > 0 OR instr(',' || '{{malware_filenames}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) ``` ## ransomware-impact Detect high-frequency file operations on user document types, characteristic of encryption. ```sqlite target=endpoint role=triage params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: A burst of file creations, deletions, or renames on document files. Silence means no mass encryption events were detected on the targeted surfaces. reads: - device_hostname - actor_user_name - activity_id - file_path - time silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-09-28' ~~~ SELECT device_hostname, actor_user_name, COUNT(*) AS op_count, MIN(time) AS first_op, MAX(time) AS last_op FROM hb_file_activity WHERE activity_id IN (1, 4, 5) AND (LOWER(file_path) LIKE '%.docx' OR LOWER(file_path) LIKE '%.xlsx' OR LOWER(file_path) LIKE '%.pdf') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, actor_user_name HAVING op_count > 20 ``` ## follow-on-agent ```agent target=hunter cite: required context: - agent-identity-triage - malware-execution - ransomware-impact max_iterations: 6 objective: Determine if compromised identities from the early stage match users or hosts where malware and ransomware impact occurred. Issue a malicious verdict if the killchain is confirmed. success_criteria: A final verdict per host citing the correlation between identity theft and malicious endpoint activity. tools: - endpoint - identity ``` ## route-decision if~: "the follow-on-agent verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: missing-endpoint-visibility) else: → close-out ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the infected host from the network and revoke all M365 session tokens for the affected user account. ``` → analyst-review ## analyst-review ```manual target=analyst Review the correlated evidence: DNS lure resolution, anomalous IP sign-in, and endpoint malware execution. Confirm if the file operations align with a ransomware attack. ``` → close-out ## close-out ```manual target=analyst Record the hosts and users examined. Note any new phishing domains discovered to update future hunt iterations. ``` → end