{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The compromise of an RMM appliance is a 'force multiplier' for an attacker, granting them administrative control over all managed endpoints. This hunt is required to ensure that a breach of the appliance has not already progressed to estate-wide execution." }, "name": "N-central RMM Exploitation and Downstream Abuse", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1068", "attack.t1136.001", "attack.t1059", "execution", "initial access", "persistence", "privilege escalation" ], "related": [ { "hunt": "general-rmm-abuse-baseline", "reason": "This hunt is specifically for the N-central Able2Shell exploits; a broader hunt would baseline all RMM tools across the environment.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple detection rule might fire on a root shell from Tomcat, but it would miss the context of the unpatched CVE and the downstream spraying. This hunt connects the appliance exploitation, account persistence, and the prevalence of scripts across the fleet into a single investigator-led workflow.", "coverage": [ { "stage": "exploit-n-central-rce", "steps": [ "vulnerability-context", "appliance-triage" ], "status": "covered" }, { "stage": "privilege-escalation-to-root", "steps": [ "appliance-shell-activity", "appliance-triage" ], "status": "covered" }, { "stage": "unauthorized-account-creation", "steps": [ "unauthorized-accounts", "impact-triage" ], "status": "covered" }, { "stage": "downstream-rmm-abuse", "steps": [ "script-prevalence", "impact-triage" ], "status": "covered" } ], "scenario": { "stages": [ { "name": "N-central Web Exploitation", "slug": "exploit-n-central-rce", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "CVE-2026-86218", "Able2Shell exploit chains", "N-central Appliance 2026.4.0.31", "CVE-2026-18556 unauthenticated access", "HTTP requests to N-central web management interface" ] }, { "name": "Appliance Privilege Escalation", "slug": "privilege-escalation-to-root", "tactic": "privilege-escalation", "techniques": [ "T1068" ], "observables": [ "Escalation to root shell on N-central appliance", "Unauthorized execution of commands as root" ] }, { "name": "Unauthorized Admin Account Creation", "slug": "unauthorized-account-creation", "tactic": "persistence", "techniques": [ "T1136.001" ], "observables": [ "CVE-2026-86206", "CVE-2026-86207", "New administrative accounts created in N-central console", "Unauthorized RMM console access" ] }, { "name": "Downstream Script Spraying", "slug": "downstream-rmm-abuse", "tactic": "execution", "techniques": [ "T1059" ], "observables": [ "Anomalous remote access sessions", "Spraying downstream environments with scripts", "Unauthorized scripts deployed to managed agents", "Unusual RMM tool execution" ] } ], "summary": "N-able N-central RMM appliances are vulnerable to multiple exploit chains (Able2Shell) and critical CVEs allowing pre-authentication remote code execution and privilege escalation to root. Attackers can leverage these flaws to gain administrative control over the RMM console and subsequently 'spray' managed downstream environments with malicious scripts and tools." }, "severity": "high", "rationale": "Begin by identifying appliances using the software inventory. Use the hostnames from that step to populate the scope_hosts parameter in the behavioral queries. Focus the lookback on November 8 onward.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An attacker has exploited the Able2Shell vulnerability chain on an N-central RMM appliance to gain root access and is now using the appliance's native script-deployment features to execute code across managed downstream endpoints.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-defined", "kind": "manual", "observed": "2026-11-09" }, "type": "list[host]", "default": [], "description": "Hostnames of the N-central appliances identified in the scoping step; leave empty to hunt across the entire estate." }, "lookback_days": { "from": { "ref": "standard-lookback", "kind": "manual", "observed": "2026-11-09" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "vulnerable_cves": { "from": { "ref": "huntress-n-able-disclosure", "kind": "article", "observed": "2026-11-09" }, "type": "list[string]", "default": [ "CVE-2026-86218", "CVE-2026-18556", "CVE-2026-18577", "CVE-2026-86206", "CVE-2026-86207" ], "description": "CVEs named in the Able2Shell disclosure." }, "ncentral_service_names": { "from": { "ref": "n-able-docs", "kind": "manual", "observed": "2026-11-09" }, "type": "list[string]", "default": [ "ncentral", "tomcat", "n-able" ], "description": "Process names associated with the N-central appliance services." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains", "name": "Huntress \u2014 N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains" } ], "blind_spots": [ { "id": "no-script-logging", "risk": "An attacker can deploy obfuscated scripts that execute in memory; without script block logging, the analyst cannot confirm the payload's intent.", "stage": "downstream-rmm-abuse", "question": "what the sprayed scripts actually did", "requires": "hb_script_activity with full script block logging" }, { "id": "appliance-web-telemetry", "risk": "Without web logs, we only see the aftermath (the root shell); if the exploit is successful but the attacker uses internal RMM commands instead of a shell, the initial access remains invisible.", "stage": "exploit-n-central-rce", "question": "the specific URI path used for the exploit", "requires": "hb_http_activity from the N-central appliance web server" } ] }, "name": "N-central RMM Exploitation and Downstream Abuse", "description": "This hunt targets the disclosure of critical vulnerabilities in the N-central RMM platform (CVE-2026-86218). It follows a phased approach: first identifying the appliances and checking for evidence of initial exploitation or privilege escalation, then pivoting to examine the broader estate for anomalous script execution (spraying) and unauthorized account creation. This correlation is necessary because N-central breaches typically lead to mass impact across the managed environment." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "coverage": [ { "stage": "exploit-n-central-rce", "steps": [ "vulnerability-context", "appliance-triage" ], "status": "covered" }, { "stage": "privilege-escalation-to-root", "steps": [ "appliance-shell-activity", "appliance-triage" ], "status": "covered" }, { "stage": "unauthorized-account-creation", "steps": [ "unauthorized-accounts", "impact-triage" ], "status": "covered" }, { "stage": "downstream-rmm-abuse", "steps": [ "script-prevalence", "impact-triage" ], "status": "covered" } ], "rationale": "An attacker has exploited the Able2Shell vulnerability chain on an N-central RMM appliance to gain root access and is now using the appliance's native script-deployment features to execute code across managed downstream endpoints.", "blind_spots": [ { "id": "no-script-logging", "risk": "An attacker can deploy obfuscated scripts that execute in memory; without script block logging, the analyst cannot confirm the payload's intent.", "stage": "downstream-rmm-abuse", "question": "what the sprayed scripts actually did", "requires": "hb_script_activity with full script block logging" }, { "id": "appliance-web-telemetry", "risk": "Without web logs, we only see the aftermath (the root shell); if the exploit is successful but the attacker uses internal RMM commands instead of a shell, the initial access remains invisible.", "stage": "exploit-n-central-rce", "question": "the specific URI path used for the exploit", "requires": "hb_http_activity from the N-central appliance web server" } ], "scoping_notes": "Begin by identifying appliances using the software inventory. Use the hostnames from that step to populate the scope_hosts parameter in the behavioral queries. Focus the lookback on November 8 onward.", "beyond_detection": "A simple detection rule might fire on a root shell from Tomcat, but it would miss the context of the unpatched CVE and the downstream spraying. This hunt connects the appliance exploitation, account persistence, and the prevalence of scripts across the fleet into a single investigator-led workflow." } }, { "id": "identify-n-central-appliances", "type": "query", "label": "Identify N-central RMM appliances", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, device_uid, package_name, package_version, install_path FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%n-central%' OR LOWER(package_name) LIKE '%n-able%'", "surface": "hb_software_inventory", "description": "Scope the hunt to systems running the N-central software by checking the installed package inventory.", "expected_signal": "A list of hosts acting as management appliances. Silence indicates N-central is not managed within this inventory scope." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify N-central RMM appliances", "reads": [ "device_hostname", "device_uid", "package_name", "package_version", "install_path" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, device_uid, package_name, package_version, install_path FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%n-central%' OR LOWER(package_name) LIKE '%n-able%'", "silence": "not_evidence_of_absence", "expected": "A list of hosts acting as management appliances. Silence indicates N-central is not managed within this inventory scope.", "verified": "dry-run", "verified_at": "2026-11-10" } }, { "id": "vulnerability-context", "type": "query", "label": "Check for unpatched Able2Shell CVEs", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_uid, cve_uid, severity, title, status FROM hb_vulnerability_finding WHERE instr(',' || '{{vulnerable_cves}}' || ',', ',' || cve_uid || ',') > 0", "surface": "hb_vulnerability_finding", "description": "Confirm if the appliances in scope are flagged for the specific vulnerabilities being hunted.", "expected_signal": "Rows indicating that one or more appliances are vulnerable to the exploited CVEs." }, "parents": [ { "id": "identify-n-central-appliances" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Check for unpatched Able2Shell CVEs", "reads": [ "device_uid", "cve_uid", "severity", "title", "status" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT device_uid, cve_uid, severity, title, status FROM hb_vulnerability_finding WHERE instr(',' || '{{vulnerable_cves}}' || ',', ',' || cve_uid || ',') > 0", "silence": "not_evidence_of_absence", "expected": "Rows indicating that one or more appliances are vulnerable to the exploited CVEs.", "verified": "dry-run", "verified_at": "2026-11-10" } }, { "id": "appliance-shell-activity", "type": "query", "label": "Suspicious root shells from RMM services", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, parent_process_name, time FROM hb_process_activity WHERE (LOWER(user_name) = 'root' OR integrity_level = 'System') AND (instr(',' || '{{ncentral_service_names}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Detect privilege escalation by finding shells or interpreters spawned by the N-central service process as root.", "expected_signal": "A shell or system command run by the N-central service under root or System privileges. This is a primary indicator of successful RCE." }, "parents": [ { "id": "identify-n-central-appliances" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Suspicious root shells from RMM services", "reads": [ "device_hostname", "process_name", "process_cmd_line", "user_name", "parent_process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, parent_process_name, time FROM hb_process_activity WHERE (LOWER(user_name) = 'root' OR integrity_level = 'System') AND (instr(',' || '{{ncentral_service_names}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A shell or system command run by the N-central service under root or System privileges. This is a primary indicator of successful RCE.", "verified": "dry-run", "verified_at": "2026-11-10" } }, { "id": "appliance-triage", "type": "analytic", "label": "Triage appliance breach", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "identify-n-central-appliances", "vulnerability-context", "appliance-shell-activity" ], "objective": "Confirm if an intruder has exploited a vulnerability on the N-central appliance to gain high-privilege access.", "description": "Assess whether the appliance has been compromised based on the vulnerability state and the process behavioral evidence.", "max_iterations": 3, "expected_signal": "A verdict determining if the appliance is compromised, vulnerable, or clean.", "success_criteria": "A per-host verdict of malicious | suspicious | benign, citing process or vulnerability rows." }, "parents": [ { "id": "vulnerability-context", "kind": "merge" }, { "id": "appliance-shell-activity", "kind": "merge" } ] }, { "id": "unauthorized-accounts", "type": "query", "label": "Unauthorized account creation on appliance", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, user_name, activity_name, actor_user_name, time FROM hb_account_change WHERE activity_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_account_change", "description": "Detect new accounts created on the appliance, which may indicate persistence using the bypass vulnerabilities (CVE-2026-86206).", "expected_signal": "New accounts created on the N-central appliance after the vulnerability disclosure window. Silence proves no account-level persistence occurred during the window." }, "parents": [ { "id": "appliance-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Unauthorized account creation on appliance", "reads": [ "device_hostname", "user_name", "activity_name", "actor_user_name", "time" ], "source": "hb_account_change", "target": "endpoint", "content": "SELECT device_hostname, user_name, activity_name, actor_user_name, time FROM hb_account_change WHERE activity_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "New accounts created on the N-central appliance after the vulnerability disclosure window. Silence proves no account-level persistence occurred during the window.", "verified": "dry-run", "verified_at": "2026-11-10" } }, { "id": "script-prevalence", "type": "query", "label": "Rare script deployment baseline", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT script_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_script_activity WHERE (LOWER(process_name) LIKE '%ncentral%' OR LOWER(process_name) LIKE '%n-able%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY script_name HAVING host_count <= 5 ORDER BY host_count ASC", "surface": "hb_script_activity", "description": "Stack-count script execution from the N-central agent to identify rare 'spraying' behavior that deviates from standard maintenance tasks.", "expected_signal": "Scripts that appear on only a few hosts. Routine maintenance scripts will appear fleet-wide; malicious 'spraying' of a specific payload may stand out as a rare value." }, "parents": [ { "id": "appliance-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare script deployment baseline", "reads": [ "script_name", "device_hostname", "time", "process_name" ], "source": "hb_script_activity", "target": "endpoint", "content": "SELECT script_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_script_activity WHERE (LOWER(process_name) LIKE '%ncentral%' OR LOWER(process_name) LIKE '%n-able%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY script_name HAVING host_count <= 5 ORDER BY host_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Scripts that appear on only a few hosts. Routine maintenance scripts will appear fleet-wide; malicious 'spraying' of a specific payload may stand out as a rare value.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "script_name" ], "rare_below": 5 }, "verified_at": "2026-11-10" } }, { "id": "impact-triage", "type": "analytic", "label": "Assess estate-wide impact", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "appliance-triage", "unauthorized-accounts", "script-prevalence" ], "objective": "Determine if the N-central exploit was successfully used to persist on the appliance or to execute unauthorized code on downstream agents.", "description": "Aggregate the appliance-level findings with the follow-on persistence and script activity to determine the extent of the compromise.", "max_iterations": 5, "expected_signal": "A detailed narrative describing how the appliance breach progressed into downstream abuse.", "success_criteria": "A verdict citing the specific appliances compromised and any downstream scripts confirmed as malicious." }, "parents": [ { "id": "unauthorized-accounts", "kind": "merge" }, { "id": "script-prevalence", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "The impact-triage verdict is malicious for at least one host, indicating confirmed exploit aftermath or downstream spraying.", "condition": "The impact-triage verdict is malicious for at least one host, indicating confirmed exploit aftermath or downstream spraying.", "blind_spot": "no-script-logging", "confidence": "high", "description": "Direct the response based on whether a compromise was confirmed.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "impact-triage" } ] }, { "id": "isolate-appliance", "type": "action", "label": "Isolate compromised appliance", "config": { "target": "endpoint", "description": "Stop further downstream abuse by isolating the central management point.", "instructions": "Isolate the identified N-central appliance. Revoke all credentials associated with the RMM console immediately.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-remediation-task", "type": "task", "label": "Analyze sprayed scripts", "config": { "assignee": "analyst", "description": "Manually review the scripts identified as rare to understand the attacker's final objectives.", "instructions": "Review the content of scripts identified in the script-prevalence step. Look for encoded payloads, network connections to unknown IPs, or commands that harvest credentials. Apply N-able hotfixes to the appliance before restoring service." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-appliance" } ] }, { "id": "close-out-task", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Document findings and update the detection baseline.", "instructions": "Record all examined hosts. If no compromise was found, verify that N-central appliances are on the latest patched version (2026.3.1.14 or later)." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-remediation-task" } ] } ] }