{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Adversaries often use AI tools to process or exfiltrate stolen data before executing ransomware. This hunt identifies that transition point to prevent operational impact."
      },
      "name": "Multi-Stage Intrusion and Ransomware Triage",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1003",
        "attack.t1021",
        "attack.t1041",
        "attack.t1486"
      ],
      "related": [
        {
          "hunt": "node-js-reverse-shell",
          "reason": "The Node.js activity could also indicate a reverse shell rather than exfiltration; that requires process-to-network correlation on socket state.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "While individual rules might flag AI domains or high file activity, this hunt uses the agent to correlate them by process ID and temporal proximity, significantly reducing false positives in environments with legitimate automation.",
      "coverage": [
        {
          "stage": "credential-access-and-lateral-movement",
          "steps": [
            "scoping-lead"
          ],
          "status": "covered"
        },
        {
          "stage": "exfiltration-over-c2",
          "steps": [
            "network-exfil-to-ai"
          ],
          "status": "covered"
        },
        {
          "stage": "ransomware-data-encryption",
          "steps": [
            "file-impact-burst"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Credential Access and Lateral Movement",
            "slug": "credential-access-and-lateral-movement",
            "tactic": "lateral-movement",
            "techniques": [
              "T1003",
              "T1021"
            ],
            "observables": [
              "credential theft",
              "lateral movement",
              "host-314",
              "process tree"
            ]
          },
          {
            "name": "Exfiltration over C2",
            "slug": "exfiltration-over-c2",
            "tactic": "exfiltration",
            "techniques": [
              "T1041"
            ],
            "observables": [
              "data exfiltration",
              "node.js",
              "claude.ai",
              "network events"
            ]
          },
          {
            "name": "Ransomware Data Encryption",
            "slug": "ransomware-data-encryption",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "ransomware",
              "file system activity",
              "alert triage"
            ]
          }
        ],
        "summary": "A multi-stage campaign involving credential theft and lateral movement leading to data exfiltration and a final ransomware impact. The intrusion is monitored and triaged through an AI-integrated security operations workflow using the Elastic Security MCP App."
      },
      "severity": "medium",
      "rationale": "Start with host-314. Expand the hunt to any host where the specified lateral movement or exfiltration tools are running from rare paths or by non-admin users.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has established a beachhead, moved laterally to host-314, exfiltrated data via Node.js to an AI service, and initiated ransomware encryption.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "scoping-parameter",
            "kind": "manual",
            "observed": "2026-05-12"
          },
          "type": "list[host]",
          "default": [],
          "description": "Paste hostnames from the scoping step here to narrow the parallel hunt."
        },
        "target_host": {
          "from": {
            "ref": "elastic-security-mcp-app",
            "kind": "article",
            "observed": "2026-05-12"
          },
          "type": "host",
          "default": "host-314",
          "description": "The specific host identified in initial alert triage."
        },
        "exfil_domains": {
          "from": {
            "ref": "elastic-security-mcp-app",
            "kind": "article",
            "observed": "2026-05-12"
          },
          "type": "list[domain]",
          "default": [
            "claude.ai",
            "anthropic.com"
          ],
          "description": "Domains associated with AI tools used for data exfiltration."
        },
        "lookback_days": {
          "from": {
            "ref": "standard-lookback",
            "kind": "manual",
            "observed": "2026-05-12"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine for intrusion signals."
        },
        "suspicious_binaries": {
          "from": {
            "ref": "elastic-security-mcp-app",
            "kind": "article",
            "observed": "2026-05-12"
          },
          "type": "list[path]",
          "default": [
            "node",
            "node.exe",
            "mimikatz.exe",
            "psexec.exe"
          ],
          "description": "Binaries associated with Node.js exfiltration and lateral movement."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.elastic.co/security-labs/blog/elastic-security-mcp-app",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.elastic.co/security-labs/blog/elastic-security-mcp-app",
          "name": "Elastic Security Labs \u2014 Elastic Security MCP App"
        }
      ],
      "blind_spots": [
        {
          "id": "limited-file-telemetry",
          "risk": "The hunt detects the activity volume but cannot identify the specific ransomware family without file extensions.",
          "stage": "ransomware-data-encryption",
          "question": "Which specific files were renamed to ransomware extensions?",
          "requires": "hb_file_activity with file extension capture"
        },
        {
          "id": "no-auth-context",
          "risk": "We see the result of lateral movement but miss the credential theft event that enabled it.",
          "stage": "credential-access-and-lateral-movement",
          "question": "Which user credentials were used to move laterally to host-314?",
          "requires": "hb_auth_signin"
        }
      ]
    },
    "name": "Multi-Stage Intrusion and Ransomware Triage",
    "description": "This hunt identifies multi-stage activity starting from a known compromised host. It uses process telemetry to scope the intrusion, then fans out to detect data exfiltration to AI services and high-volume file modifications. An agent correlates these signals to confirm if a coordinated attack chain exists, specifically linking the network activity of Node.js to the file system impact of encryption."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "credential-access-and-lateral-movement",
            "steps": [
              "scoping-lead"
            ],
            "status": "covered"
          },
          {
            "stage": "exfiltration-over-c2",
            "steps": [
              "network-exfil-to-ai"
            ],
            "status": "covered"
          },
          {
            "stage": "ransomware-data-encryption",
            "steps": [
              "file-impact-burst"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary has established a beachhead, moved laterally to host-314, exfiltrated data via Node.js to an AI service, and initiated ransomware encryption.",
        "blind_spots": [
          {
            "id": "limited-file-telemetry",
            "risk": "The hunt detects the activity volume but cannot identify the specific ransomware family without file extensions.",
            "stage": "ransomware-data-encryption",
            "question": "Which specific files were renamed to ransomware extensions?",
            "requires": "hb_file_activity with file extension capture"
          },
          {
            "id": "no-auth-context",
            "risk": "We see the result of lateral movement but miss the credential theft event that enabled it.",
            "stage": "credential-access-and-lateral-movement",
            "question": "Which user credentials were used to move laterally to host-314?",
            "requires": "hb_auth_signin"
          }
        ],
        "scoping_notes": "Start with host-314. Expand the hunt to any host where the specified lateral movement or exfiltration tools are running from rare paths or by non-admin users.",
        "beyond_detection": "While individual rules might flag AI domains or high file activity, this hunt uses the agent to correlate them by process ID and temporal proximity, significantly reducing false positives in environments with legitimate automation."
      }
    },
    {
      "id": "scoping-lead",
      "type": "query",
      "label": "Scope host and suspicious tool activity",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT device_hostname, process_name, user_name, time FROM hb_process_activity WHERE (LOWER(device_hostname) = LOWER('{{target_host}}') OR instr(',' || '{{suspicious_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Identify hosts running tools associated with exfiltration or the primary target host.",
        "expected_signal": "A list of hosts and process names. Silence suggests the named host and suspicious tools have been inactive."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Scope host and suspicious tool activity",
        "reads": [
          "device_hostname",
          "process_name",
          "user_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT DISTINCT device_hostname, process_name, user_name, time FROM hb_process_activity WHERE (LOWER(device_hostname) = LOWER('{{target_host}}') OR instr(',' || '{{suspicious_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hosts and process names. Silence suggests the named host and suspicious tools have been inactive.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "network-exfil-to-ai",
      "type": "query",
      "label": "Data exfiltration to AI services",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "network",
        "content": "SELECT device_hostname, process_name, dst_endpoint_hostname, COUNT(*) AS connections, MIN(time) AS first_seen FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{exfil_domains}}' || ',', ',' || LOWER(dst_endpoint_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, dst_endpoint_hostname",
        "surface": "hb_network_connection",
        "description": "Identify processes communicating with AI domains identified in the research.",
        "expected_signal": "Connections from internal processes to AI domains. Silence indicates no direct communication to the named domains occurred."
      },
      "parents": [
        {
          "id": "scoping-lead"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Data exfiltration to AI services",
        "reads": [
          "device_hostname",
          "process_name",
          "dst_endpoint_hostname",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, process_name, dst_endpoint_hostname, COUNT(*) AS connections, MIN(time) AS first_seen FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{exfil_domains}}' || ',', ',' || LOWER(dst_endpoint_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, dst_endpoint_hostname",
        "silence": "evidence_of_absence",
        "expected": "Connections from internal processes to AI domains. Silence indicates no direct communication to the named domains occurred.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "file-impact-burst",
      "type": "query",
      "label": "Ransomware encryption burst activity",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, STRFTIME('%Y-%m-%d %H', time) AS hour_window, COUNT(*) AS file_ops, MIN(time) AS first_op FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id IN (3, 5) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, hour_window HAVING file_ops > 100",
        "surface": "hb_file_activity",
        "description": "Identify processes modifying a high volume of files in a short window.",
        "expected_signal": "A process performing over 100 updates or renames within one hour. Silence confirms no high-speed file impact occurred."
      },
      "parents": [
        {
          "id": "scoping-lead"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Ransomware encryption burst activity",
        "reads": [
          "device_hostname",
          "process_name",
          "activity_id",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, STRFTIME('%Y-%m-%d %H', time) AS hour_window, COUNT(*) AS file_ops, MIN(time) AS first_op FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id IN (3, 5) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, hour_window HAVING file_ops > 100",
        "silence": "evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "A process performing over 100 updates or renames within one hour. Silence confirms no high-speed file impact occurred.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "process_name"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "agent-triage",
      "type": "analytic",
      "label": "Correlate exfiltration and impact",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "scoping-lead",
          "network-exfil-to-ai",
          "file-impact-burst"
        ],
        "objective": "Decide whether the process activity on the scoped hosts indicates a coordinated intrusion. Determine if the process performing exfiltration to AI domains is also the one responsible for the ransomware-like file burst.",
        "description": "Determine if the network exfiltration and file impact are driven by the same process entity.",
        "max_iterations": 3,
        "expected_signal": "A per-host verdict linking the network and file activity.",
        "success_criteria": "A per-host verdict of malicious, suspicious, or benign with cited evidence."
      },
      "parents": [
        {
          "id": "network-exfil-to-ai",
          "kind": "merge"
        },
        {
          "id": "file-impact-burst",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "verdict-decision",
      "type": "checkpoint",
      "label": "Route on agent verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the agent verdict is malicious for at least one host based on the correlation of exfiltration and ransomware activity",
        "condition": "the agent verdict is malicious for at least one host based on the correlation of exfiltration and ransomware activity",
        "blind_spot": "limited-file-telemetry",
        "confidence": "high",
        "description": "Quarantine the host if a coordinated attack chain is confirmed.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "agent-triage"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate the host",
      "config": {
        "target": "endpoint",
        "description": "Sever network connectivity to prevent further data loss or encryption.",
        "instructions": "Isolate the host via the management console and invalidate all active user sessions associated with the compromised account.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "verdict-decision",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-validation",
      "type": "task",
      "label": "Validate intrusion timeline",
      "config": {
        "assignee": "analyst",
        "description": "Verify the automated triage and determine the scope of encrypted data.",
        "instructions": "Review the parent process for the suspicious binaries. Confirm which directory paths were targeted by the file burst and assess the sensitivity of data exfiltrated to the AI service."
      },
      "parents": [
        {
          "id": "verdict-decision",
          "branch": "default"
        },
        {
          "id": "verdict-decision",
          "branch": "on_unavailable"
        },
        {
          "id": "verdict-decision",
          "branch": "on_refutes"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Hunt close-out",
      "config": {
        "assignee": "analyst",
        "description": "Document findings and propose rule improvements.",
        "instructions": "Record the exfiltration destination and process names for the permanent blocklist. Evaluate if the file burst threshold needs tuning for different server roles."
      },
      "parents": [
        {
          "id": "analyst-validation"
        }
      ]
    }
  ]
}