{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Protecting corporate assets from Business Email Compromise (BEC) and unauthorized financial diversions resulting from session theft is a high-priority requirement."
      },
      "name": "M365 Session Hijacking and Mailbox Manipulation",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1550.004",
        "attack.t1137.005",
        "attack.t1565.002",
        "attack.t1133",
        "credential access",
        "execution",
        "impact",
        "initial access",
        "persistence",
        "m365"
      ],
      "series": {
        "slug": "clickfix-to-bec-in-24-hours-tragic-quadrant-huntress",
        "index": 2,
        "title": "ClickFix to BEC in 24 Hours: Tragic Quadrant | Huntress",
        "total": 2
      },
      "related": [
        {
          "hunt": "click-fix-terminal-execution",
          "reason": "Initial access via Terminal execution is handled by a separate endpoint-focused hunt.",
          "relation": "out-of-scope-alternative"
        },
        {
          "hunt": "clickfix-terminal-execution-cookie-theft",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A rule fires on '..' rules; this hunt validates the alert by correlating it with browser fingerprints and subsequent data destruction, such as HardDelete, reducing noise and providing a clear path to containment.",
      "coverage": [
        {
          "stage": "session-hijack-mfa-bypass",
          "steps": [
            "m365-session-concurrency"
          ],
          "status": "covered"
        },
        {
          "stage": "hidden-inbox-rule-persistence",
          "steps": [
            "m365-suspicious-inbox-rules"
          ],
          "status": "covered"
        },
        {
          "stage": "bec-invoice-manipulation-impact",
          "steps": [
            "m365-mailbox-impact-activity"
          ],
          "status": "covered"
        },
        {
          "stage": "click-fix-terminal-execution",
          "reason": "Belongs to another part of the 'ClickFix to BEC in 24 Hours: Tragic Quadrant | Huntress' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "browser-session-cookie-theft",
          "reason": "Belongs to another part of the 'ClickFix to BEC in 24 Hours: Tragic Quadrant | Huntress' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "ClickFix Social Engineering Execution",
            "slug": "click-fix-terminal-execution",
            "tactic": "execution",
            "techniques": [
              "T1204.002",
              "T1059.004"
            ],
            "observables": [
              "Terminal.app",
              "Command+Space",
              "curl",
              "Base64-encoded IP address in shell command"
            ]
          },
          {
            "name": "Browser Session Cookie Theft",
            "slug": "browser-session-cookie-theft",
            "tactic": "credential-access",
            "techniques": [
              "T1539"
            ],
            "observables": [
              "Microsoft 365 session cookie",
              "Access to browser cookie storage files"
            ]
          },
          {
            "name": "Session Hijacking and MFA Bypass",
            "slug": "session-hijack-mfa-bypass",
            "tactic": "initial-access",
            "techniques": [
              "T1133",
              "T1550.004"
            ],
            "observables": [
              "Two browsers active in one session",
              "Two different operating systems for the same login",
              "Traffic routed through a VPN",
              "Sign-in without password or MFA prompt"
            ]
          },
          {
            "name": "Persistence via Hidden Inbox Rule",
            "slug": "hidden-inbox-rule-persistence",
            "tactic": "persistence",
            "techniques": [
              "T1137.005"
            ],
            "observables": [
              "Inbox rule named '..'",
              "Rule set to archive messages containing invoice numbers"
            ]
          },
          {
            "name": "Business Email Compromise Impact",
            "slug": "bec-invoice-manipulation-impact",
            "tactic": "impact",
            "techniques": [
              "T1565.002"
            ],
            "observables": [
              "Replies to Treasury emails",
              "Modified routing numbers for payments",
              "Deletion of sent messages",
              "Emptying of trash/deleted items folder"
            ]
          }
        ],
        "summary": "A user seeking AI assistance was targeted by a ClickFix social engineering attack that induced them to execute a malicious shell command via Terminal. This command stole a Microsoft 365 session cookie, enabling the attacker to bypass MFA, gain unauthorized inbox access, and perform mailbox manipulation to redirect invoice payments in a Business Email Compromise (BEC) scenario."
      },
      "severity": "medium",
      "rationale": "Focus on M365 tenants with high financial risk, such as Finance or Treasury departments. Widen the lookback window if investigating a known invoice fraud incident.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has hijacked an authenticated Microsoft 365 session using stolen cookies, bypassing MFA to create stealthy inbox rules and perform fraudulent financial transactions.",
      "parameters": {
        "scope_users": {
          "from": {
            "ref": "analyst-scoping",
            "kind": "manual",
            "observed": "2024-10-24"
          },
          "type": "list[string]",
          "default": [],
          "description": "The specific users flagged in the lead step; empty means all users."
        },
        "lookback_days": {
          "from": {
            "ref": "standard-retention",
            "kind": "manual",
            "observed": "2024-10-24"
          },
          "type": "number",
          "default": "14",
          "description": "Number of days of history to examine for session and mailbox activity."
        },
        "suspicious_rule_names": {
          "from": {
            "ref": "huntress-clickfix-bec",
            "kind": "article",
            "observed": "2024-10-13"
          },
          "type": "list[string]",
          "default": [
            "..",
            ".",
            "...",
            " ",
            "z"
          ],
          "description": "Minimalist or common evasion names used for malicious inbox rules."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.huntress.com/blog/clickfix-bec-tragic-quadrant-doris",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.huntress.com/blog/clickfix-bec-tragic-quadrant-doris",
          "name": "ClickFix to BEC in 24 Hours: Tragic Quadrant | Huntress"
        }
      ],
      "blind_spots": [
        {
          "id": "no-m365-audit-logs",
          "risk": "If UAL is disabled, rule creations and email deletions are invisible to the hunt.",
          "stage": "hidden-inbox-rule-persistence",
          "question": "whether mailbox manipulation occurred",
          "requires": "Microsoft 365 Unified Audit Log (UAL) to be enabled"
        },
        {
          "id": "m365-log-latency",
          "risk": "M365 UAL logs can have a delay of several hours, meaning the attacker may have already completed the BEC before the hunt sees the signals.",
          "stage": "bec-invoice-manipulation-impact",
          "question": "if the attacker is currently active in the mailbox",
          "requires": "Real-time log ingestion for UAL"
        }
      ]
    },
    "name": "M365 Session Hijacking and Mailbox Manipulation",
    "description": "This hunt identifies the transition from endpoint compromise to identity-based fraud. It starts by finding suspicious inbox rule creations that use minimalist or hidden naming conventions common in BEC attacks. If found, the hunt expands to analyze authentication anomalies, specifically concurrent sessions using different browser fingerprints or locations, and corroborates these with mailbox activities like unauthorized email sending or permanent deletion of evidence. This flow follows the scenario where a stolen session cookie allows an attacker to manipulate an inbox for hours without triggering MFA alerts."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "clickfix-to-bec-in-24-hours-tragic-quadrant-huntress",
          "index": 2,
          "title": "ClickFix to BEC in 24 Hours: Tragic Quadrant | Huntress",
          "total": 2
        },
        "coverage": [
          {
            "stage": "session-hijack-mfa-bypass",
            "steps": [
              "m365-session-concurrency"
            ],
            "status": "covered"
          },
          {
            "stage": "hidden-inbox-rule-persistence",
            "steps": [
              "m365-suspicious-inbox-rules"
            ],
            "status": "covered"
          },
          {
            "stage": "bec-invoice-manipulation-impact",
            "steps": [
              "m365-mailbox-impact-activity"
            ],
            "status": "covered"
          },
          {
            "stage": "click-fix-terminal-execution",
            "reason": "Belongs to another part of the 'ClickFix to BEC in 24 Hours: Tragic Quadrant | Huntress' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "browser-session-cookie-theft",
            "reason": "Belongs to another part of the 'ClickFix to BEC in 24 Hours: Tragic Quadrant | Huntress' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary has hijacked an authenticated Microsoft 365 session using stolen cookies, bypassing MFA to create stealthy inbox rules and perform fraudulent financial transactions.",
        "blind_spots": [
          {
            "id": "no-m365-audit-logs",
            "risk": "If UAL is disabled, rule creations and email deletions are invisible to the hunt.",
            "stage": "hidden-inbox-rule-persistence",
            "question": "whether mailbox manipulation occurred",
            "requires": "Microsoft 365 Unified Audit Log (UAL) to be enabled"
          },
          {
            "id": "m365-log-latency",
            "risk": "M365 UAL logs can have a delay of several hours, meaning the attacker may have already completed the BEC before the hunt sees the signals.",
            "stage": "bec-invoice-manipulation-impact",
            "question": "if the attacker is currently active in the mailbox",
            "requires": "Real-time log ingestion for UAL"
          }
        ],
        "scoping_notes": "Focus on M365 tenants with high financial risk, such as Finance or Treasury departments. Widen the lookback window if investigating a known invoice fraud incident.",
        "beyond_detection": "A rule fires on '..' rules; this hunt validates the alert by correlating it with browser fingerprints and subsequent data destruction, such as HardDelete, reducing noise and providing a clear path to containment."
      }
    },
    {
      "id": "m365-suspicious-inbox-rules",
      "type": "query",
      "label": "Lead: Suspicious M365 Inbox Rule Creation",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT actor_user_name, resource_name, api_operation, src_endpoint_ip, user_agent, time FROM hb_cloud_api_activity WHERE provider = 'm365' AND (api_operation = 'New-InboxRule' OR api_operation = 'Set-InboxRule') AND (instr(',' || '{{suspicious_rule_names}}' || ',', ',' || LOWER(substr(resource_name, instr(resource_name, '\\') + 1)) || ',') > 0 OR LENGTH(substr(resource_name, instr(resource_name, '\\') + 1)) <= 2) AND time >= datetime('now', '-{{lookback_days}} days')",
        "product": "m365",
        "surface": "hb_cloud_api_activity",
        "extension": "m365",
        "description": "Identify the creation or modification of inbox rules with minimalist names like '..' which attackers use to hide mailbox manipulation.",
        "expected_signal": "A row indicates a rule created with a near-invisible name. Silence indicates no such rules were created via the API in the window."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Lead: Suspicious M365 Inbox Rule Creation",
        "reads": [
          "actor_user_name",
          "resource_name",
          "api_operation",
          "src_endpoint_ip",
          "user_agent",
          "time"
        ],
        "source": "hb_cloud_api_activity",
        "target": "endpoint",
        "content": "SELECT actor_user_name, resource_name, api_operation, src_endpoint_ip, user_agent, time FROM hb_cloud_api_activity WHERE provider = 'm365' AND (api_operation = 'New-InboxRule' OR api_operation = 'Set-InboxRule') AND (instr(',' || '{{suspicious_rule_names}}' || ',', ',' || LOWER(substr(resource_name, instr(resource_name, '\\') + 1)) || ',') > 0 OR LENGTH(substr(resource_name, instr(resource_name, '\\') + 1)) <= 2) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A row indicates a rule created with a near-invisible name. Silence indicates no such rules were created via the API in the window.",
        "verified": "dry-run",
        "verified_at": "2026-10-15",
        "target_extension": "m365"
      }
    },
    {
      "id": "evaluate-rule-lead",
      "type": "analytic",
      "label": "Evaluate Rule Lead",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "m365-suspicious-inbox-rules"
        ],
        "objective": "Review the rule creation events and determine if they represent unusual administrative behavior for the named users.",
        "description": "Decide if the identified inbox rule creation warrants a full investigation of the user session.",
        "max_iterations": 3,
        "expected_signal": "A verdict on whether the rule name and user context are suspicious enough to continue.",
        "success_criteria": "A verdict of suspicious or benign for each user identified in the lead query."
      },
      "parents": [
        {
          "id": "m365-suspicious-inbox-rules"
        }
      ]
    },
    {
      "id": "gate-suspicious-rules",
      "type": "checkpoint",
      "label": "Gate: Suspicious Rules Detected?",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the evaluate-rule-lead verdict is suspicious for at least one user",
        "condition": "the evaluate-rule-lead verdict is suspicious for at least one user",
        "blind_spot": "no-m365-audit-logs",
        "confidence": "high",
        "description": "Limit expensive concurrency and impact queries to only those cases where a suspicious rule lead exists.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "evaluate-rule-lead"
        }
      ]
    },
    {
      "id": "m365-session-concurrency",
      "type": "query",
      "label": "M365 Session Concurrency Anomalies",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "identity",
        "content": "SELECT actor_user_name, user_agent, src_endpoint_ip, src_location_country, is_proxy, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_auth_signin WHERE provider = 'm365' AND status_id = 1 AND ('{{scope_users}}' = '' OR instr(',' || '{{scope_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, user_agent, src_endpoint_ip, src_location_country, is_proxy",
        "product": "m365",
        "surface": "hb_auth_signin",
        "extension": "m365",
        "description": "Examine the session history for flagged users to find browser-string shifts or proxy use concurrent with the rule creation.",
        "expected_signal": "Users with disparate browser strings or VPN use within the same window. Silence implies single-browser sessions."
      },
      "parents": [
        {
          "id": "gate-suspicious-rules",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "M365 Session Concurrency Anomalies",
        "reads": [
          "actor_user_name",
          "user_agent",
          "src_endpoint_ip",
          "src_location_country",
          "is_proxy",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, user_agent, src_endpoint_ip, src_location_country, is_proxy, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_auth_signin WHERE provider = 'm365' AND status_id = 1 AND ('{{scope_users}}' = '' OR instr(',' || '{{scope_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, user_agent, src_endpoint_ip, src_location_country, is_proxy",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "new_this_window"
        },
        "expected": "Users with disparate browser strings or VPN use within the same window. Silence implies single-browser sessions.",
        "verified": "dry-run",
        "prevalence": {
          "by": "actor_user_name",
          "key": [
            "user_agent"
          ],
          "rare_below": 2
        },
        "verified_at": "2026-10-15",
        "target_extension": "m365"
      }
    },
    {
      "id": "m365-mailbox-impact-activity",
      "type": "query",
      "label": "M365 Mailbox Impact Actions",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT actor_user_name, api_operation, resource_name, src_endpoint_ip, time FROM hb_cloud_api_activity WHERE provider = 'm365' AND ('{{scope_users}}' = '' OR instr(',' || '{{scope_users}}' || ',', ',' || actor_user_name || ',') > 0) AND (api_operation IN ('Send', 'MoveToDeletedItems', 'HardDelete', 'EmptyFolder') OR (api_operation = 'Update' AND LOWER(resource_name) LIKE '%inbox%')) AND time >= datetime('now', '-{{lookback_days}} days')",
        "product": "m365",
        "surface": "hb_cloud_api_activity",
        "extension": "m365",
        "description": "Identify fraudulent emails being sent or the deletion of evidence to hide the attacker's presence, specifically for the flagged users.",
        "expected_signal": "A burst of email deletions or sends from a user who also showed rule anomalies. Silence indicates no destructive mailbox actions."
      },
      "parents": [
        {
          "id": "gate-suspicious-rules",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "M365 Mailbox Impact Actions",
        "reads": [
          "actor_user_name",
          "api_operation",
          "resource_name",
          "src_endpoint_ip",
          "time"
        ],
        "source": "hb_cloud_api_activity",
        "target": "endpoint",
        "content": "SELECT actor_user_name, api_operation, resource_name, src_endpoint_ip, time FROM hb_cloud_api_activity WHERE provider = 'm365' AND ('{{scope_users}}' = '' OR instr(',' || '{{scope_users}}' || ',', ',' || actor_user_name || ',') > 0) AND (api_operation IN ('Send', 'MoveToDeletedItems', 'HardDelete', 'EmptyFolder') OR (api_operation = 'Update' AND LOWER(resource_name) LIKE '%inbox%')) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A burst of email deletions or sends from a user who also showed rule anomalies. Silence indicates no destructive mailbox actions.",
        "verified": "dry-run",
        "verified_at": "2026-10-15",
        "target_extension": "m365"
      }
    },
    {
      "id": "triage-investigation",
      "type": "analytic",
      "label": "Triage Investigation",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "evaluate-rule-lead",
          "m365-session-concurrency",
          "m365-mailbox-impact-activity"
        ],
        "objective": "Determine if the user from the lead query shows session hijacking indicators, such as a new user agent during the rule creation that differs from their history, and corresponding impact actions.",
        "description": "Synthesize the rule creation, the session browser shift, and the mailbox impact to confirm a BEC event.",
        "max_iterations": 6,
        "expected_signal": "A detailed verdict on whether session hijacking and BEC occurred.",
        "success_criteria": "A verdict of malicious | suspicious | benign per user, citing specific timestamps and browser strings."
      },
      "parents": [
        {
          "id": "m365-session-concurrency",
          "kind": "merge"
        },
        {
          "id": "m365-mailbox-impact-activity",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on Verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage-investigation verdict is malicious for at least one user",
        "condition": "the triage-investigation verdict is malicious for at least one user",
        "blind_spot": "m365-log-latency",
        "confidence": "high",
        "description": "Automate the containment request if the session hijack is confirmed.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-investigation"
        }
      ]
    },
    {
      "id": "revoke-m365-sessions",
      "type": "action",
      "label": "Revoke M365 Sessions",
      "config": {
        "target": "identity",
        "description": "Immediately invalidate the stolen session cookie and prevent further unauthorized access.",
        "instructions": "Revoke all active M365 sessions for the affected user and reset the password.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-manual-review",
      "type": "task",
      "label": "Analyst Manual Review",
      "config": {
        "assignee": "analyst",
        "description": "Provide human oversight for indeterminate or suspicious cases.",
        "instructions": "Review the triage investigation output. Verify the browser string differences and the timing of the inbox rule."
      },
      "parents": [
        {
          "id": "gate-suspicious-rules",
          "branch": "default"
        },
        {
          "id": "gate-suspicious-rules",
          "branch": "on_unavailable"
        },
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "revoke-m365-sessions"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close Out",
      "config": {
        "assignee": "analyst",
        "description": "Finalize the hunt and record findings.",
        "instructions": "Document the findings. Suggest tuning the suspicious rule name list if false positives were encountered."
      },
      "parents": [
        {
          "id": "gate-suspicious-rules",
          "branch": "on_refutes"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}