{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Detecting multi-hop proxy usage is vital for identifying covert communication channels that bypass standard boundary controls; a negative result over the estate confirms the absence of high-commonality relay behaviors."
      },
      "name": "Network Proxy and Relay Obfuscation Detection",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1090.003"
      ],
      "related": [
        {
          "hunt": "unauthorized-vpn-usage",
          "reason": "VPN clients exhibit similar outbound connectivity but typically use different protocols than multi-hop relays.",
          "relation": "sibling"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "While static rules can catch known proxy domains like 'torproject.org', this hunt pivots across network connections, host-based process context, and destination prevalence. By identifying shell processes talking to rare external IPs, we find custom ORB infrastructure that has not yet been blacklisted.",
      "coverage": [
        {
          "stage": "c2-multi-hop-proxy",
          "steps": [
            "shell-outbound-leads",
            "rare-ip-stacking",
            "proxy-dns-lookup"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Multi-hop Proxy Command and Control",
            "slug": "c2-multi-hop-proxy",
            "tactic": "command-and-control",
            "techniques": [
              "T1090.003"
            ],
            "observables": [
              "DNS queries for .onion or known proxy domains",
              "Outbound connections to Operational Relay Box (ORB) nodes or VPS infrastructure",
              "Network traffic patterns indicating multi-hop proxy chains",
              "Use of Tor for encrypted C2 communications"
            ]
          }
        ],
        "summary": "The Microsoft DART IR Workshop assesses organizational readiness by simulating realistic attack scenarios across identity, endpoint, and cloud surfaces. This chain focuses on the simulation of command-and-control traffic obfuscated through multi-hop proxies and relay networks, testing the effectiveness of network monitoring and detection strategies."
      },
      "severity": "medium",
      "rationale": "Focus on high-value targets such as domain controllers, jump boxes, and workstations of sensitive users. Exclude known corporate VPN egress points that may skew prevalence counts.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is using multi-hop proxies or Operational Relay Box (ORB) networks to disguise command-and-control traffic, which can be identified by shell processes making outbound connections to rare external IP addresses and resolving proxy-related DNS infrastructure.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "analyst-defined-scope",
            "kind": "manual",
            "observed": "2024-05-22"
          },
          "type": "list[host]",
          "default": [],
          "description": "Hostnames to focus on during enrichment; leave empty to search the whole estate."
        },
        "lookback_days": {
          "from": {
            "ref": "standard-lookback",
            "kind": "manual",
            "observed": "2024-05-22"
          },
          "type": "number",
          "default": "14",
          "description": "Number of days of history to examine."
        },
        "proxy_domains": {
          "from": {
            "ref": "dart-workshop-obfuscation-signals",
            "kind": "manual",
            "observed": "2024-05-22"
          },
          "type": "list[domain]",
          "default": [
            "torproject.org",
            "ngrok.com",
            "localtunnel.me",
            "pagekite.me",
            "proxy.com",
            "relay.network"
          ],
          "description": "Known proxy and relay service domains used to identify infrastructure resolution."
        },
        "shell_processes": {
          "from": {
            "ref": "dart-workshop-obfuscation-signals",
            "kind": "manual",
            "observed": "2024-05-22"
          },
          "type": "list[string]",
          "default": [
            "powershell.exe",
            "pwsh",
            "cmd.exe",
            "rundll32.exe",
            "certutil.exe",
            "bash"
          ],
          "description": "Process names that should rarely initiate direct outbound connections to the public internet."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.microsoft.com/en-us/security/blog/2026/09/01/cybersecurity-ir-workshop-you-shouldnt-miss/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.microsoft.com/en-us/security/blog/2026/09/01/cybersecurity-ir-workshop-you-shouldnt-miss/",
          "name": "Microsoft Security Blog \u2014 Cybersecurity IR Workshop: The workshop you shouldn\u2019t miss"
        }
      ],
      "blind_spots": [
        {
          "id": "no-agent-coverage",
          "risk": "A host without an agent provides no network or process telemetry, allowing rogues to hide relay traffic.",
          "stage": "c2-multi-hop-proxy",
          "question": "Are unmanaged devices in the network using multi-hop proxies?",
          "requires": "Endpoint agent on all hosts"
        },
        {
          "id": "direct-ip-bypassing-dns",
          "risk": "If an adversary avoids DNS lookups, the DNS enrichment step will be empty, making the IP prevalence signal the only behavioral evidence.",
          "stage": "c2-multi-hop-proxy",
          "question": "Are adversaries bypassing DNS resolution by using hardcoded IP addresses?",
          "requires": "hb_network_connection destination IP analysis"
        }
      ]
    },
    "name": "Network Proxy and Relay Obfuscation Detection",
    "description": "Multi-hop proxies, such as Tor or ORB networks, are a staple of advanced persistent threat (APT) tradecraft used to obfuscate the origin of malicious traffic. This hunt identifies indicators of this behavior by first finding shell and utility processes communicating with public IP addresses, then corroborating those findings with fleet-wide destination prevalence and DNS queries for known proxy infrastructure. This behavioral approach moves beyond static indicator lists to find the infrastructure-agnostic patterns of relay usage as emphasized in Microsoft IR readiness workshops."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "c2-multi-hop-proxy",
            "steps": [
              "shell-outbound-leads",
              "rare-ip-stacking",
              "proxy-dns-lookup"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary is using multi-hop proxies or Operational Relay Box (ORB) networks to disguise command-and-control traffic, which can be identified by shell processes making outbound connections to rare external IP addresses and resolving proxy-related DNS infrastructure.",
        "blind_spots": [
          {
            "id": "no-agent-coverage",
            "risk": "A host without an agent provides no network or process telemetry, allowing rogues to hide relay traffic.",
            "stage": "c2-multi-hop-proxy",
            "question": "Are unmanaged devices in the network using multi-hop proxies?",
            "requires": "Endpoint agent on all hosts"
          },
          {
            "id": "direct-ip-bypassing-dns",
            "risk": "If an adversary avoids DNS lookups, the DNS enrichment step will be empty, making the IP prevalence signal the only behavioral evidence.",
            "stage": "c2-multi-hop-proxy",
            "question": "Are adversaries bypassing DNS resolution by using hardcoded IP addresses?",
            "requires": "hb_network_connection destination IP analysis"
          }
        ],
        "scoping_notes": "Focus on high-value targets such as domain controllers, jump boxes, and workstations of sensitive users. Exclude known corporate VPN egress points that may skew prevalence counts.",
        "beyond_detection": "While static rules can catch known proxy domains like 'torproject.org', this hunt pivots across network connections, host-based process context, and destination prevalence. By identifying shell processes talking to rare external IPs, we find custom ORB infrastructure that has not yet been blacklisted."
      }
    },
    {
      "id": "shell-outbound-leads",
      "type": "query",
      "label": "Outbound connections from shell processes",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "network",
        "content": "SELECT device_hostname, process_name, process_path, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE direction = 'outbound' AND (instr(',' || '{{shell_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND dst_endpoint_ip NOT LIKE '10.%' AND dst_endpoint_ip NOT LIKE '192.168.%' AND dst_endpoint_ip NOT LIKE '172.16.%' AND dst_endpoint_ip NOT LIKE '127.%' AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_network_connection",
        "description": "Find shell or administrative processes making direct outbound connections to external IP addresses, serving as the lead for potential proxy clients.",
        "expected_signal": "A list of shell executions communicating with public IPs. None means no shell-based internet traffic was recorded."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Outbound connections from shell processes",
        "reads": [
          "device_hostname",
          "process_name",
          "process_path",
          "dst_endpoint_ip",
          "dst_endpoint_port",
          "time",
          "direction"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, process_name, process_path, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE direction = 'outbound' AND (instr(',' || '{{shell_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND dst_endpoint_ip NOT LIKE '10.%' AND dst_endpoint_ip NOT LIKE '192.168.%' AND dst_endpoint_ip NOT LIKE '172.16.%' AND dst_endpoint_ip NOT LIKE '127.%' AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of shell executions communicating with public IPs. None means no shell-based internet traffic was recorded.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "rare-ip-stacking",
      "type": "query",
      "label": "Prevalence of outbound destination IPs",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "network",
        "content": "SELECT dst_endpoint_ip, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_network_connection WHERE direction = 'outbound' AND (instr(',' || '{{shell_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND dst_endpoint_ip NOT LIKE '10.%' AND dst_endpoint_ip NOT LIKE '192.168.%' AND dst_endpoint_ip NOT LIKE '172.16.%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_ip HAVING host_count <= 2 ORDER BY host_count ASC",
        "surface": "hb_network_connection",
        "description": "Identify rare remote IP addresses visited by shells across the fleet, highlighting potential private relay nodes or VPS-hosted ORB infrastructure.",
        "expected_signal": "IP addresses visited by only one or two hosts via shell processes. Rare external destinations for shells suggest targeted proxy use."
      },
      "parents": [
        {
          "id": "shell-outbound-leads"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Prevalence of outbound destination IPs",
        "reads": [
          "dst_endpoint_ip",
          "device_hostname",
          "time",
          "direction",
          "process_name"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT dst_endpoint_ip, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_network_connection WHERE direction = 'outbound' AND (instr(',' || '{{shell_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND dst_endpoint_ip NOT LIKE '10.%' AND dst_endpoint_ip NOT LIKE '192.168.%' AND dst_endpoint_ip NOT LIKE '172.16.%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_ip HAVING host_count <= 2 ORDER BY host_count ASC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "IP addresses visited by only one or two hosts via shell processes. Rare external destinations for shells suggest targeted proxy use.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "dst_endpoint_ip"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "proxy-dns-lookup",
      "type": "query",
      "label": "DNS activity for proxy infrastructure",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, query_hostname, time FROM hb_dns_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{proxy_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%.onion%' OR LOWER(query_hostname) LIKE '%exit-node%' OR LOWER(query_hostname) LIKE '%relay%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_dns_activity",
        "description": "Search for DNS resolutions matching known proxy domains or containing obfuscation keywords on suspicious hosts.",
        "expected_signal": "DNS resolutions for proxy services or relay-related keywords. Silence suggests the adversary is using hardcoded IPs or a less common proxy provider."
      },
      "parents": [
        {
          "id": "shell-outbound-leads"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "DNS activity for proxy infrastructure",
        "reads": [
          "device_hostname",
          "process_name",
          "query_hostname",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, query_hostname, time FROM hb_dns_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{proxy_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%.onion%' OR LOWER(query_hostname) LIKE '%exit-node%' OR LOWER(query_hostname) LIKE '%relay%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "DNS resolutions for proxy services or relay-related keywords. Silence suggests the adversary is using hardcoded IPs or a less common proxy provider.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "agent-triage",
      "type": "analytic",
      "label": "Triage proxy and relay activity",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "shell-outbound-leads",
          "rare-ip-stacking",
          "proxy-dns-lookup"
        ],
        "objective": "Determine if the network connections and DNS resolutions indicate an unauthorized multi-hop proxy or relay network used for C2 obfuscation.",
        "description": "Determine if the combination of shell network activity, rare destination IPs, and DNS indicators points to an unauthorized multi-hop proxy chain.",
        "max_iterations": 6,
        "expected_signal": "A per-host verdict citing evidence across the three telemetry steps.",
        "success_criteria": "A verdict of malicious, suspicious, or benign for each identified host with cited rows."
      },
      "parents": [
        {
          "id": "rare-ip-stacking",
          "kind": "merge"
        },
        {
          "id": "proxy-dns-lookup",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "decision-route",
      "type": "checkpoint",
      "label": "Route on proxy verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the agent verdict is malicious for at least one host based on shell connections to rare IPs",
        "condition": "the agent verdict is malicious for at least one host based on shell connections to rare IPs",
        "blind_spot": "no-agent-coverage",
        "confidence": "high",
        "description": "Escalate hosts with malicious verdicts to containment or manual review.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "agent-triage"
        }
      ]
    },
    {
      "id": "action-isolate",
      "type": "action",
      "label": "Isolate host",
      "config": {
        "target": "endpoint",
        "description": "Halt the potential C2 channel and preserve volatile evidence from the relay client.",
        "instructions": "Isolate the host from the network. Capture a memory dump of the shell process before rebooting to preserve tunnel configuration.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "decision-route",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "task-investigate",
      "type": "task",
      "label": "Analyst forensic review",
      "config": {
        "assignee": "analyst",
        "description": "Verify if the activity was a simulation, authorized tool, or a genuine breach.",
        "instructions": "Examine the captured process memory for evidence of encrypted tunnels or proxy configuration strings. Check against the IR Workshop schedule to see if this activity aligns with a planned exercise."
      },
      "parents": [
        {
          "id": "decision-route",
          "branch": "default"
        },
        {
          "id": "decision-route",
          "branch": "on_unavailable"
        },
        {
          "id": "action-isolate"
        }
      ]
    },
    {
      "id": "task-close",
      "type": "task",
      "label": "Document and tune",
      "config": {
        "assignee": "analyst",
        "description": "Update the hunt results and suppress authorized administrative proxies.",
        "instructions": "Summarize findings. If administrative proxies were detected, update the scoping_notes or exclude those hosts from future runs of this hunt."
      },
      "parents": [
        {
          "id": "decision-route",
          "branch": "on_refutes"
        },
        {
          "id": "task-investigate"
        }
      ]
    }
  ]
}