{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "MSSQL servers are primary targets for ransomware affiliates because they often store high-value data and run with administrative privileges. This hunt finds the intrusion at the beachhead, before encryption occurs."
      },
      "name": "Mallox Ransomware MSSQL Authentication and Service Abuse",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1110",
        "attack.t1190",
        "attack.t1059.001",
        "attack.t1047",
        "attack.t1486"
      ],
      "series": {
        "slug": "mallox-ransomware-affiliate-leverages-purecrypter-in-mssql-exploitation",
        "index": 1,
        "title": "Mallox ransomware affiliate leverages PureCrypter in MSSQL exploitation",
        "total": 2
      },
      "related": [
        {
          "hunt": "purecrypter-loading-behavior",
          "reason": "The loading phase of PureCrypter involves anti-analysis and memory reflection common to many malware families beyond Mallox.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A simple rule might catch sa brute force, but this hunt links those login failures to specific, unauthorized child processes from the SQL service. This correlation across two telemetry surfaces reduces the noise of automated scanners and identifies confirmed human-driven activity.",
      "coverage": [
        {
          "stage": "initial-access-mssql-brute-force",
          "steps": [
            "sa-account-brute-force"
          ],
          "status": "covered"
        },
        {
          "stage": "execution-mssql-exploitation",
          "steps": [
            "sql-server-shell-spawn",
            "forensic-verification"
          ],
          "status": "covered"
        },
        {
          "stage": "command-and-control-payload-download",
          "reason": "Belongs to another part of the 'Mallox ransomware affiliate leverages PureCrypter in MSSQL exploitation' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "defense-evasion-purecrypter-loading",
          "reason": "Belongs to another part of the 'Mallox ransomware affiliate leverages PureCrypter in MSSQL exploitation' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "impact-mallox-encryption",
          "reason": "Belongs to another part of the 'Mallox ransomware affiliate leverages PureCrypter in MSSQL exploitation' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "MSSQL Brute-force",
            "slug": "initial-access-mssql-brute-force",
            "tactic": "initial-access",
            "techniques": [
              "T1110",
              "T1190"
            ],
            "observables": [
              "Targeting 'sa' account",
              "~320 attempts per minute",
              "Inbound traffic on port 1433",
              "Application name vYMiFrYR"
            ]
          },
          {
            "name": "MSSQL Feature Abuse",
            "slug": "execution-mssql-exploitation",
            "tactic": "execution",
            "techniques": [
              "T1059.001",
              "T1047"
            ],
            "observables": [
              "Enable TRUSTWORTHY parameter on master database",
              "Enable clr enabled parameter",
              "Create assembly named 'shell' on msdb database",
              "Enable xp_cmdshell",
              "Use sp_oacreate to create wscript.shell OLE object",
              "PowerShell script in C:\\ProgramData",
              "WMIC execution of binary"
            ]
          },
          {
            "name": "PureCrypter Retrieval",
            "slug": "command-and-control-payload-download",
            "tactic": "command-and-control",
            "techniques": [
              "T1090.003"
            ],
            "observables": [
              "Download of random-named files with media extensions (.mp4, .wav, .pdf)",
              "3DES encrypted data payload"
            ]
          },
          {
            "name": "PureCrypter Evasion and Persistence",
            "slug": "defense-evasion-purecrypter-loading",
            "tactic": "defense-evasion",
            "techniques": [
              "T1059.001",
              "T1047"
            ],
            "observables": [
              "Registry key Software\\Microsoft\\Windows\\CurrentVersion\\Run\\",
              "WMI query select * from Win32_BIOS",
              "WMI query select * from Win32_ComputerSystem",
              "EtwEventWrite patching",
              "AmsiScanBuffer patching",
              "MpPreference -Exclusion commands",
              "Module load of SbieDll.dll",
              "Reflective code loading of .NET library"
            ]
          },
          {
            "name": "Mallox Ransomware Encryption",
            "slug": "impact-mallox-encryption",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "Ydxhjxwf.exe in %appdata%",
              "AES-CBC encrypted file content",
              "Ransomware file encryption activity"
            ]
          }
        ],
        "summary": "Mallox ransomware affiliates compromise internet-facing MS-SQL servers through brute-force attacks on the 'sa' account. Once inside, they abuse internal SQL features like CLR assemblies and OLE automation to execute PowerShell scripts that deploy PureCrypter, which eventually loads the Mallox ransomware in memory."
      },
      "severity": "high",
      "rationale": "Start with SQL servers exposed on port 1433 or those located in DMZ segments. If the software inventory is stale, run the behavioral queries over the whole estate.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is brute-forcing the MSSQL sa account to enable administrative features and execute a PowerShell loader from the SQL process.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Limit the hunt to specific hosts; leave empty for the whole estate."
        },
        "shell_paths": {
          "from": {
            "ref": "Sekoia Mallox",
            "kind": "article",
            "observed": "2024-05-02"
          },
          "type": "list[path]",
          "default": [
            "c:\\windows\\system32\\cmd.exe",
            "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
            "c:\\windows\\system32\\wbem\\wmic.exe"
          ],
          "description": "Full paths to shell interpreters used in exploitation."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "target_accounts": {
          "from": {
            "ref": "Sekoia Mallox",
            "kind": "article",
            "observed": "2024-05-02"
          },
          "type": "list[string]",
          "default": [
            "sa"
          ],
          "description": "Common administrative accounts targeted in MSSQL brute force."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/",
          "name": "Sekoia \u2014 Mallox ransomware affiliate leverages PureCrypter in MSSQL exploitation"
        }
      ],
      "blind_spots": [
        {
          "id": "mssql-internal-logs",
          "risk": "The hunt sees the resulting process but may miss failed exploitation attempts or configuration changes that didn't lead to a process launch.",
          "stage": "execution-mssql-exploitation",
          "question": "Was the TRUSTWORTHY bit or CLR assembly enabled internally?",
          "requires": "MSSQL internal trace/audit logs",
          "remediation": "Enable MSSQL Audit logging for database-level changes and ship them to the platform."
        },
        {
          "id": "obfuscated-script-blocks",
          "risk": "Adversaries using Base64 or complex obfuscation may hide the downloader URI from simple command-line inspection.",
          "stage": "execution-mssql-exploitation",
          "question": "What was the intent of the PowerShell loader if it was heavily encoded?",
          "requires": "hb_script_activity with full block de-obfuscation",
          "remediation": "Ensure PowerShell Script Block Logging (ID 4104) is enabled and collected."
        }
      ]
    },
    "name": "Mallox Ransomware MSSQL Authentication and Service Abuse",
    "description": "This hunt targets the initial compromise of Microsoft SQL Servers by Mallox ransomware affiliates. It identifies high-volume authentication failures against the sa account and correlates them with the activation of SQL features like xp_cmdshell or OLE automation, which results in the SQL service spawning shells to download second-stage payloads. The hunt pivots between identity logs and endpoint process activity to identify confirmed intrusions."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "mallox-ransomware-affiliate-leverages-purecrypter-in-mssql-exploitation",
          "index": 1,
          "title": "Mallox ransomware affiliate leverages PureCrypter in MSSQL exploitation",
          "total": 2
        },
        "coverage": [
          {
            "stage": "initial-access-mssql-brute-force",
            "steps": [
              "sa-account-brute-force"
            ],
            "status": "covered"
          },
          {
            "stage": "execution-mssql-exploitation",
            "steps": [
              "sql-server-shell-spawn",
              "forensic-verification"
            ],
            "status": "covered"
          },
          {
            "stage": "command-and-control-payload-download",
            "reason": "Belongs to another part of the 'Mallox ransomware affiliate leverages PureCrypter in MSSQL exploitation' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "defense-evasion-purecrypter-loading",
            "reason": "Belongs to another part of the 'Mallox ransomware affiliate leverages PureCrypter in MSSQL exploitation' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "impact-mallox-encryption",
            "reason": "Belongs to another part of the 'Mallox ransomware affiliate leverages PureCrypter in MSSQL exploitation' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary is brute-forcing the MSSQL sa account to enable administrative features and execute a PowerShell loader from the SQL process.",
        "blind_spots": [
          {
            "id": "mssql-internal-logs",
            "risk": "The hunt sees the resulting process but may miss failed exploitation attempts or configuration changes that didn't lead to a process launch.",
            "stage": "execution-mssql-exploitation",
            "question": "Was the TRUSTWORTHY bit or CLR assembly enabled internally?",
            "requires": "MSSQL internal trace/audit logs",
            "remediation": "Enable MSSQL Audit logging for database-level changes and ship them to the platform."
          },
          {
            "id": "obfuscated-script-blocks",
            "risk": "Adversaries using Base64 or complex obfuscation may hide the downloader URI from simple command-line inspection.",
            "stage": "execution-mssql-exploitation",
            "question": "What was the intent of the PowerShell loader if it was heavily encoded?",
            "requires": "hb_script_activity with full block de-obfuscation",
            "remediation": "Ensure PowerShell Script Block Logging (ID 4104) is enabled and collected."
          }
        ],
        "scoping_notes": "Start with SQL servers exposed on port 1433 or those located in DMZ segments. If the software inventory is stale, run the behavioral queries over the whole estate.",
        "beyond_detection": "A simple rule might catch sa brute force, but this hunt links those login failures to specific, unauthorized child processes from the SQL service. This correlation across two telemetry surfaces reduces the noise of automated scanners and identifies confirmed human-driven activity."
      }
    },
    {
      "id": "identify-sql-servers",
      "type": "query",
      "label": "Identify active MSSQL installations",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%sql server%' OR LOWER(vendor_name) LIKE '%microsoft%') AND asset_scope = 'endpoint'",
        "surface": "hb_software_inventory",
        "description": "Find hosts where Microsoft SQL Server is installed to narrow the scope of the subsequent behavioral queries.",
        "expected_signal": "A list of hosts currently running SQL Server. Silence indicates no SQL installations were found in the software inventory."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify active MSSQL installations",
        "reads": [
          "device_hostname",
          "package_name",
          "vendor_name",
          "asset_scope"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%sql server%' OR LOWER(vendor_name) LIKE '%microsoft%') AND asset_scope = 'endpoint'",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hosts currently running SQL Server. Silence indicates no SQL installations were found in the software inventory.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "sa-account-brute-force",
      "type": "query",
      "label": "Brute-force activity against SQL accounts",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "identity",
        "content": "SELECT dst_endpoint_name, actor_user_name, COUNT(*) as fail_count, MIN(time) as first_fail, MAX(time) as last_fail FROM hb_auth_signin WHERE activity_id = 5 AND instr(',' || '{{target_accounts}}' || ',', ',' || LOWER(actor_user_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_name || ',') > 0) GROUP BY dst_endpoint_name, actor_user_name HAVING fail_count > 100 ORDER BY fail_count DESC",
        "surface": "hb_auth_signin",
        "description": "Detect high-volume login failure patterns targeting the SQL Administrator account.",
        "expected_signal": "A host showing hundreds of failed sign-ins on the sa account. Silence proves no large-scale brute force occurred during the window."
      },
      "parents": [
        {
          "id": "identify-sql-servers"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Brute-force activity against SQL accounts",
        "reads": [
          "dst_endpoint_name",
          "actor_user_name",
          "activity_id",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT dst_endpoint_name, actor_user_name, COUNT(*) as fail_count, MIN(time) as first_fail, MAX(time) as last_fail FROM hb_auth_signin WHERE activity_id = 5 AND instr(',' || '{{target_accounts}}' || ',', ',' || LOWER(actor_user_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_name || ',') > 0) GROUP BY dst_endpoint_name, actor_user_name HAVING fail_count > 100 ORDER BY fail_count DESC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "prior_equal_window"
        },
        "expected": "A host showing hundreds of failed sign-ins on the sa account. Silence proves no large-scale brute force occurred during the window.",
        "verified": "dry-run",
        "prevalence": {
          "by": "dst_endpoint_name",
          "key": [
            "actor_user_name"
          ],
          "rare_below": 2
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "sql-server-shell-spawn",
      "type": "query",
      "label": "SQL Server spawning shell interpreters",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%sqlservr.exe%' OR LOWER(process_cmd_line) LIKE '%sqlservr%') AND instr(',' || '{{shell_paths}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "surface": "hb_process_activity",
        "description": "Identify instances where the SQL service process spawns a shell or WMIC, indicating successful xp_cmdshell or OLE automation abuse.",
        "expected_signal": "Process rows showing cmd.exe or powershell.exe as children of the MSSQL service. Silence proves the SQL engine did not spawn common shells on the audited hosts."
      },
      "parents": [
        {
          "id": "identify-sql-servers"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "SQL Server spawning shell interpreters",
        "reads": [
          "device_hostname",
          "process_name",
          "process_cmd_line",
          "parent_process_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%sqlservr.exe%' OR LOWER(process_cmd_line) LIKE '%sqlservr%') AND instr(',' || '{{shell_paths}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "silence": "evidence_of_absence",
        "expected": "Process rows showing cmd.exe or powershell.exe as children of the MSSQL service. Silence proves the SQL engine did not spawn common shells on the audited hosts.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "triage-mallox-activity",
      "type": "analytic",
      "label": "Weigh brute-force and execution results",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "sa-account-brute-force",
          "sql-server-shell-spawn"
        ],
        "objective": "Determine if the brute-force activity against the sa account resulted in successful execution of shells or downloaders on any SQL server.",
        "description": "Correlate the identity and endpoint evidence to confirm a Mallox-style server breach.",
        "max_iterations": 3,
        "expected_signal": "A per-host verdict citing rows from both authentication and process activity.",
        "success_criteria": "A verdict of malicious for any host where shell execution temporally follows a period of login failures."
      },
      "parents": [
        {
          "id": "sa-account-brute-force",
          "kind": "merge"
        },
        {
          "id": "sql-server-shell-spawn",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "is-intrusion-confirmed",
      "type": "checkpoint",
      "label": "Confirm intrusion on SQL host",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the agent confirms that a high volume of login failures was followed by the SQL service spawning a shell or downloader on the same host",
        "condition": "the agent confirms that a high volume of login failures was followed by the SQL service spawning a shell or downloader on the same host",
        "blind_spot": "mssql-internal-logs",
        "confidence": "high",
        "description": "Route to containment if the evidence confirms the adversary has gained execution privileges on the server.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-mallox-activity"
        }
      ]
    },
    {
      "id": "isolate-infected-server",
      "type": "action",
      "label": "Isolate the compromised SQL host",
      "config": {
        "target": "endpoint",
        "description": "Stop the adversary before they can deploy the PureCrypter loader or start the ransomware encryption phase.",
        "instructions": "Isolate the host from the network immediately. Stop the MSSQL service and prevent local shell execution until investigation is complete.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "is-intrusion-confirmed",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "forensic-verification",
      "type": "task",
      "label": "Forensic audit of SQL engine",
      "config": {
        "assignee": "analyst",
        "description": "Examine internal SQL configurations and logs that the automated hunt could not reach.",
        "instructions": "Review SQL Server logs for application name vYMiFrYR. Check the master database for TRUSTWORTHY setting changes. Look for a CLR assembly named shell in the msdb database. Search C:\\ProgramData for PowerShell scripts or random-named multimedia files."
      },
      "parents": [
        {
          "id": "is-intrusion-confirmed",
          "branch": "default"
        },
        {
          "id": "is-intrusion-confirmed",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-infected-server"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Hunt close-out and remediation",
      "config": {
        "assignee": "analyst",
        "description": "Document findings and recommend hardening measures to prevent re-infection.",
        "instructions": "Record the results for all SQL servers in scope. If the shell-spawn query found true positives, promote it to a standing detection rule. Recommend rotating the sa password and disabling xp_cmdshell."
      },
      "parents": [
        {
          "id": "is-intrusion-confirmed",
          "branch": "on_refutes"
        },
        {
          "id": "forensic-verification"
        }
      ]
    }
  ]
}