{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Medicare-themed social engineering causes high financial and identity risk to employees, which can bleed into corporate credential reuse; a negative result confirms robust user hygiene during peak scam season."
      },
      "name": "Medicare Open Enrollment Social Engineering",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1566",
        "attack.t1190",
        "attack.t1056.003",
        "attack.t1078",
        "credential access",
        "impact",
        "initial access"
      ],
      "related": [
        {
          "hunt": "brand-impersonation-lookalike-domains",
          "reason": "Generic lookalike hunts are broader but lack the seasonal context and specific impact assessment for healthcare-related fraud.",
          "relation": "alternative"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A single detection rule on Medicare keywords produces high false positives from legitimate government site usage. This hunt correlates DNS leads with rare HTTP POST behavior and downstream portal sign-ins, allowing an agent to weigh the entire attack chain.",
      "coverage": [
        {
          "stage": "initial-access-scam-lures",
          "steps": [
            "lead-dns-lookups"
          ],
          "status": "covered"
        },
        {
          "stage": "credential-access-data-harvesting",
          "steps": [
            "rare-http-post-targets"
          ],
          "status": "covered"
        },
        {
          "stage": "impact-monetization-and-fraud",
          "steps": [
            "sensitive-portal-sign-ins"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Social engineering via malvertising and phishing",
            "slug": "initial-access-scam-lures",
            "tactic": "initial-access",
            "techniques": [
              "T1566",
              "T1190"
            ],
            "observables": [
              "Google ads for Medicare plan comparisons or card updates",
              "unsolicited emails or SMS mentioning the December 7 deadline",
              "lookalike domains for medicare.gov or healthcare.gov lacking the .gov suffix",
              "inbound calls from 800-633-4227 or 800-318-2596 impersonators"
            ]
          },
          {
            "name": "Personal and medical data harvesting",
            "slug": "credential-access-data-harvesting",
            "tactic": "credential-access",
            "techniques": [
              "T1056.003"
            ],
            "observables": [
              "HTTP POST requests to lookalike domains containing Medicare numbers or SSNs",
              "accessing or updating onepassword_item_medical_record fields such as medication, dosage, or patient info in response to lures",
              "entry of bank details, credit card information, or account passwords into non-official web forms"
            ]
          },
          {
            "name": "Fraudulent monetization and account abuse",
            "slug": "impact-monetization-and-fraud",
            "tactic": "impact",
            "techniques": [
              "T1078"
            ],
            "observables": [
              "unauthorized sign-ins to health or banking portals using stolen credentials",
              "manipulation of Medicare enrollment records for fraudulent commissions",
              "suspicious Medicare claims for services or prescriptions never received"
            ]
          }
        ],
        "summary": "A seasonal social engineering campaign during the Medicare Open Enrollment period (Oct 15 - Dec 7) uses Google ads, phishing emails, and SMS to direct victims to fraudulent lookalike websites. These sites are used to harvest Medicare numbers, Social Security numbers, and account credentials to facilitate identity theft, healthcare fraud, and fraudulent enrollment manipulation."
      },
      "severity": "medium",
      "rationale": "Focus on general user workstation segments. This hunt is highly seasonal and should be run periodically during the Medicare Open Enrollment period (Oct 15 - Dec 7).",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is using lookalike domains during the Medicare Open Enrollment season to harvest personal and medical data via social engineering, subsequently using those credentials to access sensitive health and banking portals.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Hosts identified in the lead scoping step; populated by the analyst to narrow the deep-dive queries."
        },
        "legit_domains": {
          "from": {
            "ref": "https://www.welivesecurity.com/en/scams/medicare-open-enrollment-season-scams/",
            "kind": "article",
            "observed": "2026-10-14"
          },
          "type": "list[domain]",
          "default": [
            "medicare.gov",
            "healthcare.gov",
            "reportfraud.ftc.gov",
            "identitytheft.gov"
          ],
          "description": "Legitimate government domains for Medicare and reporting; queries will filter these out to focus on lures."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.welivesecurity.com/en/scams/medicare-open-enrollment-season-scams/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.welivesecurity.com/en/scams/medicare-open-enrollment-season-scams/",
          "name": "Medicare scam calls, texts and ads: What to watch for this Open Enrollment"
        }
      ],
      "blind_spots": [
        {
          "id": "tls-inspection-gap",
          "risk": "While the hunt sees POST requests to suspicious domains, it cannot confirm if a Medicare number or SSN was actually transmitted without content inspection.",
          "stage": "credential-access-data-harvesting",
          "question": "What specific personal data was submitted in the HTTP POST body?",
          "requires": "TLS inspection or proxy body logs"
        },
        {
          "id": "dns-log-retention",
          "risk": "Social engineering lures may persist for weeks; if the visit happened before the log window, the hunt will miss the initial breach.",
          "stage": "initial-access-scam-lures",
          "question": "Did the user visit the lure before the current logging window?",
          "requires": "hb_dns_activity retention >= lookback_days"
        }
      ]
    },
    "name": "Medicare Open Enrollment Social Engineering",
    "description": "This hunt identifies seasonal social engineering campaigns targeting Medicare beneficiaries. It uses a gated flow: first, a low-cost DNS scoping step identifies hosts interacting with non-government domains containing Medicare keywords. If an agent confirms these as suspicious lures, the hunt performs an expensive parallel fan-out to analyze HTTP POST data-harvesting patterns and concurrent unauthorized sign-ins to sensitive portals. This approach isolates the transition from the initial lure to the monetization of stolen identity and health data."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "initial-access-scam-lures",
            "steps": [
              "lead-dns-lookups"
            ],
            "status": "covered"
          },
          {
            "stage": "credential-access-data-harvesting",
            "steps": [
              "rare-http-post-targets"
            ],
            "status": "covered"
          },
          {
            "stage": "impact-monetization-and-fraud",
            "steps": [
              "sensitive-portal-sign-ins"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary is using lookalike domains during the Medicare Open Enrollment season to harvest personal and medical data via social engineering, subsequently using those credentials to access sensitive health and banking portals.",
        "blind_spots": [
          {
            "id": "tls-inspection-gap",
            "risk": "While the hunt sees POST requests to suspicious domains, it cannot confirm if a Medicare number or SSN was actually transmitted without content inspection.",
            "stage": "credential-access-data-harvesting",
            "question": "What specific personal data was submitted in the HTTP POST body?",
            "requires": "TLS inspection or proxy body logs"
          },
          {
            "id": "dns-log-retention",
            "risk": "Social engineering lures may persist for weeks; if the visit happened before the log window, the hunt will miss the initial breach.",
            "stage": "initial-access-scam-lures",
            "question": "Did the user visit the lure before the current logging window?",
            "requires": "hb_dns_activity retention >= lookback_days"
          }
        ],
        "scoping_notes": "Focus on general user workstation segments. This hunt is highly seasonal and should be run periodically during the Medicare Open Enrollment period (Oct 15 - Dec 7).",
        "beyond_detection": "A single detection rule on Medicare keywords produces high false positives from legitimate government site usage. This hunt correlates DNS leads with rare HTTP POST behavior and downstream portal sign-ins, allowing an agent to weigh the entire attack chain."
      }
    },
    {
      "id": "lead-dns-lookups",
      "type": "query",
      "label": "Lead DNS lookups for Medicare lures",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, actor_user_name, query_hostname, process_name, time FROM hb_dns_activity WHERE (LOWER(query_hostname) LIKE '%medicare%' OR LOWER(query_hostname) LIKE '%healthcare%') AND LOWER(query_hostname) NOT LIKE '%.gov' AND LOWER(query_hostname) NOT LIKE '%.gov.%' AND instr(',' || '{{legit_domains}}' || ',', ',' || LOWER(query_hostname) || ',') = 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_dns_activity",
        "description": "Identify potential social engineering lures by finding DNS queries for domains containing Medicare keywords that do not end in official .gov TLDs.",
        "expected_signal": "DNS queries for Medicare-themed domains on non-government infrastructure. Silence suggests no users have visited obvious lures in the window."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Lead DNS lookups for Medicare lures",
        "reads": [
          "device_hostname",
          "actor_user_name",
          "query_hostname",
          "process_name",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, actor_user_name, query_hostname, process_name, time FROM hb_dns_activity WHERE (LOWER(query_hostname) LIKE '%medicare%' OR LOWER(query_hostname) LIKE '%healthcare%') AND LOWER(query_hostname) NOT LIKE '%.gov' AND LOWER(query_hostname) NOT LIKE '%.gov.%' AND instr(',' || '{{legit_domains}}' || ',', ',' || LOWER(query_hostname) || ',') = 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "DNS queries for Medicare-themed domains on non-government infrastructure. Silence suggests no users have visited obvious lures in the window.",
        "verified": "dry-run",
        "verified_at": "2026-10-16"
      }
    },
    {
      "id": "assess-lead",
      "type": "analytic",
      "label": "Assess lead DNS activity",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "web"
        ],
        "context": [
          "lead-dns-lookups"
        ],
        "objective": "Review the DNS results to identify hosts visiting domains that masquerade as Medicare services without legitimate government attribution.",
        "description": "Evaluate whether the identified DNS lookups represent suspicious lures that warrant deeper traffic and authentication analysis.",
        "max_iterations": 3,
        "expected_signal": "A per-host verdict on whether the DNS activity suggests a user was targeted by a seasonal scam.",
        "success_criteria": "A verdict of malicious | suspicious | benign per host."
      },
      "parents": [
        {
          "id": "lead-dns-lookups"
        }
      ]
    },
    {
      "id": "gate-on-lead",
      "type": "checkpoint",
      "label": "Gate on lead assessment",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the assess-lead verdict finds suspicious or malicious DNS queries for at least one host",
        "condition": "the assess-lead verdict finds suspicious or malicious DNS queries for at least one host",
        "blind_spot": "dns-log-retention",
        "confidence": "high",
        "description": "Avoid performing expensive traffic and authentication queries unless the initial lead shows suspicious behavior.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "assess-lead"
        }
      ]
    },
    {
      "id": "rare-http-post-targets",
      "type": "query",
      "label": "Rare HTTP POST targets for Medicare keywords",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "web",
        "content": "SELECT url_hostname, url_path, actor_user_name, device_hostname, COUNT(*) AS request_count, MIN(time) AS first_seen FROM hb_http_activity WHERE http_method = 'POST' AND (LOWER(url_hostname) LIKE '%medicare%' OR LOWER(url_path) LIKE '%medicare%' OR LOWER(url_hostname) LIKE '%healthcare%' OR LOWER(url_path) LIKE '%healthcare%') AND LOWER(url_hostname) NOT LIKE '%.gov' AND LOWER(url_hostname) NOT LIKE '%.gov.%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY url_hostname, url_path, actor_user_name, device_hostname HAVING COUNT(DISTINCT device_hostname) <= 3 ORDER BY first_seen DESC",
        "surface": "hb_http_activity",
        "description": "Detect potential harvesting behavior by finding rare domains receiving POST requests containing Medicare keywords, filtered to the scoped hosts.",
        "expected_signal": "POST requests to rare, non-government domains containing Medicare keywords. This identifies the data-submission stage of the phishing attack."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Rare HTTP POST targets for Medicare keywords",
        "reads": [
          "url_hostname",
          "url_path",
          "actor_user_name",
          "device_hostname",
          "http_method",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT url_hostname, url_path, actor_user_name, device_hostname, COUNT(*) AS request_count, MIN(time) AS first_seen FROM hb_http_activity WHERE http_method = 'POST' AND (LOWER(url_hostname) LIKE '%medicare%' OR LOWER(url_path) LIKE '%medicare%' OR LOWER(url_hostname) LIKE '%healthcare%' OR LOWER(url_path) LIKE '%healthcare%') AND LOWER(url_hostname) NOT LIKE '%.gov' AND LOWER(url_hostname) NOT LIKE '%.gov.%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY url_hostname, url_path, actor_user_name, device_hostname HAVING COUNT(DISTINCT device_hostname) <= 3 ORDER BY first_seen DESC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "POST requests to rare, non-government domains containing Medicare keywords. This identifies the data-submission stage of the phishing attack.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "url_hostname",
            "url_path"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-16"
      }
    },
    {
      "id": "sensitive-portal-sign-ins",
      "type": "query",
      "label": "Sign-ins to sensitive health and financial portals",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "identity",
        "content": "SELECT device_hostname, actor_user_name, dst_endpoint_name, src_endpoint_ip, status, time FROM hb_auth_signin WHERE (LOWER(dst_endpoint_name) LIKE '%medicare%' OR LOWER(dst_endpoint_name) LIKE '%healthcare%' OR LOWER(dst_endpoint_name) LIKE '%bank%' OR LOWER(dst_endpoint_name) LIKE '%insurance%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_auth_signin",
        "description": "Identify potential credential abuse by finding sign-in activity to sensitive portals from the same scoped hosts.",
        "expected_signal": "Authentication attempts to health or financial services from hosts that interacted with lures. Silence indicates no monetization was seen."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Sign-ins to sensitive health and financial portals",
        "reads": [
          "device_hostname",
          "actor_user_name",
          "dst_endpoint_name",
          "src_endpoint_ip",
          "status",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT device_hostname, actor_user_name, dst_endpoint_name, src_endpoint_ip, status, time FROM hb_auth_signin WHERE (LOWER(dst_endpoint_name) LIKE '%medicare%' OR LOWER(dst_endpoint_name) LIKE '%healthcare%' OR LOWER(dst_endpoint_name) LIKE '%bank%' OR LOWER(dst_endpoint_name) LIKE '%insurance%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Authentication attempts to health or financial services from hosts that interacted with lures. Silence indicates no monetization was seen.",
        "verified": "dry-run",
        "verified_at": "2026-10-16"
      }
    },
    {
      "id": "triage-synthesis",
      "type": "analytic",
      "label": "Synthesize social engineering attack chain",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "web"
        ],
        "context": [
          "assess-lead",
          "rare-http-post-targets",
          "sensitive-portal-sign-ins"
        ],
        "objective": "Determine if a host has been successfully phished and if the resulting credentials or personal data are being monetized.",
        "description": "Correlate the DNS lure, the HTTP POST harvesting, and the authentication patterns into a unified verdict.",
        "max_iterations": 6,
        "expected_signal": "A final assessment citing the progression from lure interaction to data submission and credential abuse.",
        "success_criteria": "A final verdict of malicious | suspicious | benign per host, citing specific rows."
      },
      "parents": [
        {
          "id": "rare-http-post-targets",
          "kind": "merge"
        },
        {
          "id": "sensitive-portal-sign-ins",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "final-decision",
      "type": "checkpoint",
      "label": "Route on final triage",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage-synthesis verdict is malicious for at least one host",
        "condition": "the triage-synthesis verdict is malicious for at least one host",
        "blind_spot": "tls-inspection-gap",
        "confidence": "high",
        "description": "Route the hunt based on the synthesized verdict of the triage agent.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-synthesis"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate compromised host",
      "config": {
        "target": "endpoint",
        "description": "Stop further interaction with the lure and prevent ongoing credential abuse.",
        "instructions": "Isolate the host and notify the user to reset all personal and medical portal passwords immediately.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "final-decision",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst review and documentation",
      "config": {
        "assignee": "analyst",
        "description": "Verify the automated findings and document the incident context.",
        "instructions": "Review the cited DNS and HTTP rows. Confirm if the domains should be added to the enterprise-wide blocklist. Verify if the sign-in activity indicates a successful takeover of corporate or sensitive medical accounts."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "default"
        },
        {
          "id": "gate-on-lead",
          "branch": "on_unavailable"
        },
        {
          "id": "final-decision",
          "branch": "default"
        },
        {
          "id": "final-decision",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out-task",
      "type": "task",
      "label": "Close out hunt",
      "config": {
        "assignee": "analyst",
        "description": "Document the findings of the seasonal hunt.",
        "instructions": "Document the hosts and users examined. Record that no successful phishing attempts were observed during the Medicare Open Enrollment window."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "on_refutes"
        },
        {
          "id": "final-decision",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}