--- analysis: While individual rules might flag AI domains or high file activity, this hunt uses the agent to correlate them by process ID and temporal proximity, significantly reducing false positives in environments with legitimate automation. blind_spots: - id: limited-file-telemetry question: Which specific files were renamed to ransomware extensions? requires: hb_file_activity with file extension capture risk: The hunt detects the activity volume but cannot identify the specific ransomware family without file extensions. stage: ransomware-data-encryption - id: no-auth-context question: Which user credentials were used to move laterally to host-314? requires: hb_auth_signin risk: We see the result of lateral movement but miss the credential theft event that enabled it. stage: credential-access-and-lateral-movement coverage: - stage: credential-access-and-lateral-movement status: covered steps: - scoping-lead - stage: exfiltration-over-c2 status: covered steps: - network-exfil-to-ai - stage: ransomware-data-encryption status: covered steps: - file-impact-burst guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: Adversaries often use AI tools to process or exfiltrate stolen data before executing ransomware. This hunt identifies that transition point to prevent operational impact. methodology: model-assisted trigger: intel-report hypothesis: An adversary has established a beachhead, moved laterally to host-314, exfiltrated data via Node.js to an AI service, and initiated ransomware encryption. labels: - hunt - attack.t1003 - attack.t1021 - attack.t1041 - attack.t1486 name: Multi-Stage Intrusion and Ransomware Triage parameters: exfil_domains: default: - claude.ai - anthropic.com description: Domains associated with AI tools used for data exfiltration. from: kind: article observed: '2026-05-12' ref: elastic-security-mcp-app type: list[domain] lookback_days: default: '14' description: Days of history to examine for intrusion signals. from: kind: manual observed: '2026-05-12' ref: standard-lookback type: number scope_hosts: default: [] description: Paste hostnames from the scoping step here to narrow the parallel hunt. from: kind: manual observed: '2026-05-12' ref: scoping-parameter type: list[host] suspicious_binaries: default: - node - node.exe - mimikatz.exe - psexec.exe description: Binaries associated with Node.js exfiltration and lateral movement. from: kind: article observed: '2026-05-12' ref: elastic-security-mcp-app type: list[path] target_host: default: host-314 description: The specific host identified in initial alert triage. from: kind: article observed: '2026-05-12' ref: elastic-security-mcp-app type: host provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.elastic.co/security-labs/blog/elastic-security-mcp-app gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Start with host-314. Expand the hunt to any host where the specified lateral movement or exfiltration tools are running from rare paths or by non-admin users. references: - name: "Elastic Security Labs \u2014 Elastic Security MCP App" url: https://www.elastic.co/security-labs/blog/elastic-security-mcp-app related: - hunt: node-js-reverse-shell reason: The Node.js activity could also indicate a reverse shell rather than exfiltration; that requires process-to-network correlation on socket state. relation: out-of-scope-alternative scenario: stages: - name: Credential Access and Lateral Movement observables: - credential theft - lateral movement - host-314 - process tree slug: credential-access-and-lateral-movement tactic: lateral-movement techniques: - T1003 - T1021 - name: Exfiltration over C2 observables: - data exfiltration - node.js - claude.ai - network events slug: exfiltration-over-c2 tactic: exfiltration techniques: - T1041 - name: Ransomware Data Encryption observables: - ransomware - file system activity - alert triage slug: ransomware-data-encryption tactic: impact techniques: - T1486 summary: A multi-stage campaign involving credential theft and lateral movement leading to data exfiltration and a final ransomware impact. The intrusion is monitored and triaged through an AI-integrated security operations workflow using the Elastic Security MCP App. severity: medium targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent network: category: network name: Network telemetry telemetry: - network tlp: clear type: investigation --- # Multi-Stage Intrusion and Ransomware Triage This hunt identifies multi-stage activity starting from a known compromised host. It uses process telemetry to scope the intrusion, then fans out to detect data exfiltration to AI services and high-volume file modifications. An agent correlates these signals to confirm if a coordinated attack chain exists, specifically linking the network activity of Node.js to the file system impact of encryption. ## scoping-lead Identify hosts running tools associated with exfiltration or the primary target host. ```sqlite target=endpoint role=scoping params=(target_host=target_host, suspicious_binaries=suspicious_binaries, lookback_days=lookback_days) ~~~yaml expected: A list of hosts and process names. Silence suggests the named host and suspicious tools have been inactive. reads: - device_hostname - process_name - user_name - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT DISTINCT device_hostname, process_name, user_name, time FROM hb_process_activity WHERE (LOWER(device_hostname) = LOWER('{{target_host}}') OR instr(',' || '{{suspicious_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## fan-out-evidence parallel: - → network-exfil-to-ai - → file-impact-burst join: → agent-triage ## network-exfil-to-ai Identify processes communicating with AI domains identified in the research. ```sqlite target=network role=detection-candidate params=(scope_hosts=scope_hosts, exfil_domains=exfil_domains, lookback_days=lookback_days) ~~~yaml expected: Connections from internal processes to AI domains. Silence indicates no direct communication to the named domains occurred. reads: - device_hostname - process_name - dst_endpoint_hostname - time silence: evidence_of_absence source: hb_network_connection verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, process_name, dst_endpoint_hostname, COUNT(*) AS connections, MIN(time) AS first_seen FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{exfil_domains}}' || ',', ',' || LOWER(dst_endpoint_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, dst_endpoint_hostname ``` ## file-impact-burst Identify processes modifying a high volume of files in a short window. ```sqlite target=endpoint role=baseline params=(scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A process performing over 100 updates or renames within one hour. Silence confirms no high-speed file impact occurred. prevalence: by: device_hostname key: - process_name rare_below: 3 reads: - device_hostname - process_name - activity_id - time silence: evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, process_name, STRFTIME('%Y-%m-%d %H', time) AS hour_window, COUNT(*) AS file_ops, MIN(time) AS first_op FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id IN (3, 5) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, hour_window HAVING file_ops > 100 ``` ## agent-triage ```agent target=hunter cite: required context: - scoping-lead - network-exfil-to-ai - file-impact-burst max_iterations: 3 objective: Decide whether the process activity on the scoped hosts indicates a coordinated intrusion. Determine if the process performing exfiltration to AI domains is also the one responsible for the ransomware-like file burst. success_criteria: A per-host verdict of malicious, suspicious, or benign with cited evidence. tools: - endpoint - network ``` ## verdict-decision if~: "the agent verdict is malicious for at least one host based on the correlation of exfiltration and ransomware activity" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → analyst-validation unavailable: → analyst-validation (blind_spot: limited-file-telemetry) else: → analyst-validation ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host via the management console and invalidate all active user sessions associated with the compromised account. ``` → analyst-validation ## analyst-validation ```manual target=analyst Review the parent process for the suspicious binaries. Confirm which directory paths were targeted by the file burst and assess the sensitivity of data exfiltrated to the AI service. ``` → close-out ## close-out ```manual target=analyst Record the exfiltration destination and process names for the permanent blocklist. Evaluate if the file burst threshold needs tuning for different server roles. ``` → end