{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "N-central RMM tools provide unauthenticated access to thousands of downstream endpoints. The active zero-day exploitation and high CVSS score make this a critical operational risk."
      },
      "name": "N-central Web Exploitation and Persistence",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1133",
        "attack.t1572",
        "attack.t1090.003",
        "attack.t1136"
      ],
      "series": {
        "slug": "critical-n-able-n-central-vulnerability-and-active-exploitation",
        "index": 1,
        "title": "Critical N-able N-central Vulnerability and Active Exploitation",
        "total": 2
      },
      "related": [
        {
          "hunt": "n-central-lateral-movement-rmm",
          "reason": "This hunt identifies the beachhead; a following hunt must track lateral movement from N-central to downstream endpoints using RMM features.",
          "relation": "follows"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A single rule might alert on Cloudflared, but this hunt correlates initial web exploitation with the appearance of rare accounts and tunnels, providing context to confirm a full intrusion chain.",
      "coverage": [
        {
          "stage": "reconnaissance-api-probing",
          "steps": [
            "api-recon-activity"
          ],
          "status": "covered"
        },
        {
          "stage": "initial-access-rce",
          "steps": [
            "url-encoded-exploit"
          ],
          "status": "covered"
        },
        {
          "stage": "persistence-account-manipulation",
          "steps": [
            "rare-account-domains"
          ],
          "status": "covered"
        },
        {
          "stage": "persistence-c2-tunneling",
          "steps": [
            "tunnel-agent-execution"
          ],
          "status": "covered"
        },
        {
          "stage": "defense-evasion-masquerading",
          "reason": "Belongs to another part of the 'Critical N-able N-central Vulnerability and Active Exploitation' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "lateral-movement-rmm-abuse",
          "reason": "Belongs to another part of the 'Critical N-able N-central Vulnerability and Active Exploitation' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "discovery-process-enumeration",
          "reason": "Belongs to another part of the 'Critical N-able N-central Vulnerability and Active Exploitation' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "N-central API Reconnaissance",
            "slug": "reconnaissance-api-probing",
            "tactic": "reconnaissance",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "GET /remoteControlAction.do?method=getPierDetails",
              "23.234.100.105",
              "173.249.252.200",
              "185.156.46.150"
            ]
          },
          {
            "name": "Pre-Auth RCE and Auth Bypass",
            "slug": "initial-access-rce",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "CVE-2026-86218",
              "CVE-2026-18556",
              "CVE-2026-18577",
              "URL-encoded API requests using %2F"
            ]
          },
          {
            "name": "Malicious Account Creation",
            "slug": "persistence-account-manipulation",
            "tactic": "persistence",
            "techniques": [
              "T1136"
            ],
            "observables": [
              "Email addresses appended with '.invalid'",
              "Usernames with subtle character swaps",
              "Spoofed domains in email addresses"
            ]
          },
          {
            "name": "Cloudflare Protocol Tunneling",
            "slug": "persistence-c2-tunneling",
            "tactic": "command-and-control",
            "techniques": [
              "T1572",
              "T1090.003"
            ],
            "observables": [
              "Service name 'Cloudflared'",
              "Cloudflare tunnel account tag: 5568cd69c754b392121f1dbb8f900fda"
            ]
          },
          {
            "name": "Masqueraded Binary in User Folder",
            "slug": "defense-evasion-masquerading",
            "tactic": "defense-evasion",
            "techniques": [
              "T1036.005"
            ],
            "observables": [
              "svchost.exe located in Documents folder"
            ]
          },
          {
            "name": "Abuse of RMM Take Control",
            "slug": "lateral-movement-rmm-abuse",
            "tactic": "lateral-movement",
            "techniques": [
              "T1133"
            ],
            "observables": [
              "MSP Support account session logins",
              "Take Control session activity (Event IDs 4102, 8192, 8193)"
            ]
          },
          {
            "name": "Post-Exploitation Process Discovery",
            "slug": "discovery-process-enumeration",
            "tactic": "discovery",
            "techniques": [
              "T1057"
            ],
            "observables": [
              "Process list requests following exploitation"
            ]
          }
        ],
        "summary": "Attackers are exploiting multiple vulnerabilities in N-able N-central, including a zero-day RCE, to gain unauthenticated access to RMM consoles. Post-exploitation, they maintain persistence via Cloudflare tunnels and malicious user creation before using the built-in 'Take Control' feature to move laterally across managed endpoints."
      },
      "severity": "high",
      "rationale": "Narrow the hunt to N-central appliances identified in the software inventory. Focus on external-facing servers first.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An attacker has exploited unauthenticated N-central web vulnerabilities to gain administrative control, subsequently establishing persistence through rogue user accounts and Cloudflare protocol tunnels.",
      "parameters": {
        "recon_path": {
          "type": "string",
          "default": "/remoteControlAction.do?method=getPierDetails",
          "description": "Specific endpoint targeted during reconnaissance."
        },
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Specific N-central hostnames to target; leave empty to scan the entire estate."
        },
        "intruder_ips": {
          "from": {
            "ref": "https://www.huntress.com/blog/n-able-vulnerability-exploitation",
            "kind": "article",
            "observed": "2026-09-06"
          },
          "type": "list[ip]",
          "default": [
            "23.234.100.105",
            "23.234.97.68",
            "173.249.252.176",
            "185.156.46.150",
            "23.234.94.43",
            "68.235.46.235",
            "173.249.252.200"
          ],
          "description": "Known malicious IPs reported in the N-able advisories."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.huntress.com/blog/n-able-vulnerability-exploitation",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.huntress.com/blog/n-able-vulnerability-exploitation",
          "name": "Huntress \u2014 Critical N-able N-central Vulnerability and Active Exploitation"
        }
      ],
      "blind_spots": [
        {
          "id": "limited-log-retention",
          "risk": "Attackers may have exploited the system and rotated relevant logs before the hunt executed.",
          "stage": "initial-access-rce",
          "question": "Did the exploit occur before the 14-day lookback period?",
          "requires": "Extended retention for N-central appliance logs"
        },
        {
          "id": "missing-http-decryption",
          "risk": "Without server-side or proxy logging, path-based indicators are invisible to the network.",
          "stage": "initial-access-rce",
          "question": "Are the URL-encoded path traversal attempts visible in the encrypted HTTPS stream?",
          "requires": "TLS decryption for appliance traffic"
        }
      ]
    },
    "name": "N-central Web Exploitation and Persistence",
    "description": "This hunt tracks the September 2026 N-central zero-day campaign. It begins by identifying systems running vulnerable software, then looks for reconnaissance on the pier details endpoint and RCE attempts involving URL-encoded path traversals. Finally, it pivots to find post-exploitation persistence: unauthorized user accounts with anomalous email suffixes and the execution of the Cloudflared tunneling agent."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "critical-n-able-n-central-vulnerability-and-active-exploitation",
          "index": 1,
          "title": "Critical N-able N-central Vulnerability and Active Exploitation",
          "total": 2
        },
        "coverage": [
          {
            "stage": "reconnaissance-api-probing",
            "steps": [
              "api-recon-activity"
            ],
            "status": "covered"
          },
          {
            "stage": "initial-access-rce",
            "steps": [
              "url-encoded-exploit"
            ],
            "status": "covered"
          },
          {
            "stage": "persistence-account-manipulation",
            "steps": [
              "rare-account-domains"
            ],
            "status": "covered"
          },
          {
            "stage": "persistence-c2-tunneling",
            "steps": [
              "tunnel-agent-execution"
            ],
            "status": "covered"
          },
          {
            "stage": "defense-evasion-masquerading",
            "reason": "Belongs to another part of the 'Critical N-able N-central Vulnerability and Active Exploitation' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "lateral-movement-rmm-abuse",
            "reason": "Belongs to another part of the 'Critical N-able N-central Vulnerability and Active Exploitation' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "discovery-process-enumeration",
            "reason": "Belongs to another part of the 'Critical N-able N-central Vulnerability and Active Exploitation' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An attacker has exploited unauthenticated N-central web vulnerabilities to gain administrative control, subsequently establishing persistence through rogue user accounts and Cloudflare protocol tunnels.",
        "blind_spots": [
          {
            "id": "limited-log-retention",
            "risk": "Attackers may have exploited the system and rotated relevant logs before the hunt executed.",
            "stage": "initial-access-rce",
            "question": "Did the exploit occur before the 14-day lookback period?",
            "requires": "Extended retention for N-central appliance logs"
          },
          {
            "id": "missing-http-decryption",
            "risk": "Without server-side or proxy logging, path-based indicators are invisible to the network.",
            "stage": "initial-access-rce",
            "question": "Are the URL-encoded path traversal attempts visible in the encrypted HTTPS stream?",
            "requires": "TLS decryption for appliance traffic"
          }
        ],
        "scoping_notes": "Narrow the hunt to N-central appliances identified in the software inventory. Focus on external-facing servers first.",
        "beyond_detection": "A single rule might alert on Cloudflared, but this hunt correlates initial web exploitation with the appearance of rare accounts and tunnels, providing context to confirm a full intrusion chain."
      }
    },
    {
      "id": "identify-ncentral-hosts",
      "type": "query",
      "label": "Identify N-central Infrastructure",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%n-central%' OR LOWER(vendor_name) LIKE '%n-able%')",
        "surface": "hb_software_inventory",
        "description": "Identify systems running N-central software which may be vulnerable.",
        "expected_signal": "A list of hosts acting as N-central appliances. Silence means no N-central software is installed."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify N-central Infrastructure",
        "reads": [
          "device_hostname",
          "package_name",
          "package_version",
          "vendor_name"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%n-central%' OR LOWER(vendor_name) LIKE '%n-able%')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hosts acting as N-central appliances. Silence means no N-central software is installed.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "api-recon-activity",
      "type": "query",
      "label": "API Reconnaissance Probes",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "web",
        "content": "SELECT device_hostname, src_endpoint_ip, url_full, user_agent, status_code, time FROM hb_http_activity WHERE (LOWER(url_full) LIKE '%' || LOWER('{{recon_path}}') || '%' OR instr(',' || '{{intruder_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Identify early staging activity where attackers map the environment by probing specific endpoints or connecting from reported IPs.",
        "expected_signal": "HTTP requests from reported malicious IPs or targeting the getPierDetails endpoint."
      },
      "parents": [
        {
          "id": "identify-ncentral-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "API Reconnaissance Probes",
        "reads": [
          "device_hostname",
          "src_endpoint_ip",
          "url_full",
          "user_agent",
          "status_code",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, src_endpoint_ip, url_full, user_agent, status_code, time FROM hb_http_activity WHERE (LOWER(url_full) LIKE '%' || LOWER('{{recon_path}}') || '%' OR instr(',' || '{{intruder_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "HTTP requests from reported malicious IPs or targeting the getPierDetails endpoint.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "url-encoded-exploit",
      "type": "query",
      "label": "URL-Encoded API Exploitation",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "web",
        "content": "SELECT device_hostname, src_endpoint_ip, url_path, url_query, status_code, time FROM hb_http_activity WHERE (url_path LIKE '%%2F%' OR url_query LIKE '%%2F%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Detect attempts to bypass authentication or execute code using URL-encoded slashes in API paths.",
        "expected_signal": "Successful requests that include encoded slashes in the path or query, indicating an RCE attempt."
      },
      "parents": [
        {
          "id": "identify-ncentral-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "URL-Encoded API Exploitation",
        "reads": [
          "device_hostname",
          "src_endpoint_ip",
          "url_path",
          "url_query",
          "status_code",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, src_endpoint_ip, url_path, url_query, status_code, time FROM hb_http_activity WHERE (url_path LIKE '%%2F%' OR url_query LIKE '%%2F%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Successful requests that include encoded slashes in the path or query, indicating an RCE attempt.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "triage-initial-access",
      "type": "analytic",
      "label": "Triage Initial Access Attempts",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "web"
        ],
        "context": [
          "api-recon-activity",
          "url-encoded-exploit"
        ],
        "objective": "Determine if any N-central host shows evidence of successful exploitation via URL-encoded path manipulation or reconnaissance from known malicious IPs.",
        "description": "Analyze whether the web activity indicates a successful exploit against the N-central appliance.",
        "max_iterations": 3,
        "expected_signal": "A per-host verdict on whether the initial access phase succeeded.",
        "success_criteria": "A verdict for each host citing relevant HTTP requests and status codes."
      },
      "parents": [
        {
          "id": "api-recon-activity",
          "kind": "merge"
        },
        {
          "id": "url-encoded-exploit",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "rare-account-domains",
      "type": "query",
      "label": "Stack-count Rare Account Domains",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "identity",
        "content": "SELECT LOWER(SUBSTR(actor_user_name, INSTR(actor_user_name, '@') + 1)) AS domain, COUNT(DISTINCT dst_endpoint_name) AS host_count, MIN(time) AS first_seen FROM hb_auth_signin WHERE actor_user_name LIKE '%@%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY domain HAVING host_count <= 2 ORDER BY host_count ASC",
        "surface": "hb_auth_signin",
        "description": "Identify anomalous accounts by stack-counting email domains, looking for the reported .invalid suffix.",
        "expected_signal": "The .invalid domain or other rare, spoofed domains appearing on only one or two hosts."
      },
      "parents": [
        {
          "id": "triage-initial-access"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Stack-count Rare Account Domains",
        "reads": [
          "actor_user_name",
          "dst_endpoint_name",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT LOWER(SUBSTR(actor_user_name, INSTR(actor_user_name, '@') + 1)) AS domain, COUNT(DISTINCT dst_endpoint_name) AS host_count, MIN(time) AS first_seen FROM hb_auth_signin WHERE actor_user_name LIKE '%@%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY domain HAVING host_count <= 2 ORDER BY host_count ASC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "The .invalid domain or other rare, spoofed domains appearing on only one or two hosts.",
        "verified": "dry-run",
        "prevalence": {
          "by": "dst_endpoint_name",
          "key": [
            "actor_user_name"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "tunnel-agent-execution",
      "type": "query",
      "label": "Cloudflare Tunnel Agent Execution",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%cloudflared%' OR LOWER(process_cmd_line) LIKE '%cloudflared%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Identify the Cloudflared process which is a persistent backdoor for the attacker.",
        "expected_signal": "Processes running the Cloudflared binary on the N-central host, which is not standard for the appliance."
      },
      "parents": [
        {
          "id": "triage-initial-access"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Cloudflare Tunnel Agent Execution",
        "reads": [
          "device_hostname",
          "process_name",
          "process_cmd_line",
          "user_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%cloudflared%' OR LOWER(process_cmd_line) LIKE '%cloudflared%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Processes running the Cloudflared binary on the N-central host, which is not standard for the appliance.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "evaluate-breach",
      "type": "analytic",
      "label": "Evaluate Breach and Severity",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "web"
        ],
        "context": [
          "triage-initial-access",
          "rare-account-domains",
          "tunnel-agent-execution"
        ],
        "objective": "Determine if any host shows evidence of both unauthenticated API exploitation and subsequent persistence via rogue accounts or Cloudflare tunnels.",
        "description": "Combine evidence of exploitation with subsequent persistence to confirm a breach.",
        "max_iterations": 4,
        "expected_signal": "A final verdict citing both the exploit success and the discovery of persistence mechanisms.",
        "success_criteria": "A per-host verdict citing specific rows from the HTTP, Auth, and Process surfaces."
      },
      "parents": [
        {
          "id": "rare-account-domains",
          "kind": "merge"
        },
        {
          "id": "tunnel-agent-execution",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-breach",
      "type": "checkpoint",
      "label": "Route on Breach Confirmation",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the agent evaluation confirms successful exploitation followed by rogue account creation or tunnel deployment",
        "condition": "the agent evaluation confirms successful exploitation followed by rogue account creation or tunnel deployment",
        "blind_spot": "limited-log-retention",
        "confidence": "high",
        "description": "Route the hunt to immediate isolation if a breach is confirmed.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "evaluate-breach"
        }
      ]
    },
    {
      "id": "contain-and-isolate",
      "type": "action",
      "label": "Isolate Compromised N-central Host",
      "config": {
        "target": "endpoint",
        "description": "Prevent further lateral movement or data exfiltration.",
        "instructions": "Isolate the host at the network level, terminate the Cloudflared process, and collect the envoy_proxy_HTTPS.log file.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-breach",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst Forensic Review",
      "config": {
        "assignee": "analyst",
        "description": "Confirm the findings and identify the full scope of the breach.",
        "instructions": "Review the identified HTTP sessions and rogue accounts. Audit N-central internal logs for any configuration changes made by the .invalid accounts."
      },
      "parents": [
        {
          "id": "route-breach",
          "branch": "default"
        },
        {
          "id": "route-breach",
          "branch": "on_unavailable"
        },
        {
          "id": "contain-and-isolate"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Cleanup and Close",
      "config": {
        "assignee": "analyst",
        "description": "Finalize the hunt and ensure all N-central systems are patched.",
        "instructions": "Ensure all N-central hosts are upgraded to 2026.3 HF4. Document any confirmed IOCs found during the hunt."
      },
      "parents": [
        {
          "id": "route-breach",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-review"
        }
      ]
    }
  ]
}