{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The October 2026 Patch Tuesday includes 85 critical RCE vulnerabilities and at least one 0-day. Proactive identification of exposed hosts coupled with behavioral analysis is required to mitigate the risk of exploitation before patching is complete." }, "name": "October 2026 Patch Tuesday Exposure Hunt", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1203", "attack.t1059.003", "attack.t1068", "execution", "initial access", "lateral movement", "privilege escalation" ], "related": [ { "hunt": "lateral-movement-ad-rds-october-2026", "reason": "Lateral movement via AD/RDS vulnerabilities requires identity and authentication logs (hb_auth_signin) which are handled in a separate hunt.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A standard detection rule might fire on 'shell from web server', but this hunt prioritizes confirmed unpatched systems and applies a fleet-wide baseline for rare binaries, providing context a single rule cannot provide.", "coverage": [ { "stage": "initial-access-public-facing-exploitation", "steps": [ "vulnerability-scoping", "shell-execution-from-vulnerable-apps" ], "status": "covered" }, { "stage": "execution-client-side-payloads", "steps": [ "vulnerability-scoping", "shell-execution-from-vulnerable-apps" ], "status": "covered" }, { "stage": "privilege-escalation-kernel-and-vbs", "reason": "Kernel and VBS enclave exploitation occurs in memory spaces not visible to process-level telemetry.", "status": "not_visible", "blind_spot": "memory-only-exploitation" }, { "stage": "lateral-movement-remote-infrastructure", "reason": "Belongs to a separate lateral movement hunt using hb_auth_signin.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Exploitation of Public-Facing Services", "slug": "initial-access-public-facing-exploitation", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "Microsoft Exchange Server stack-based buffer overflow (CVE-2026-70571)", "Windows DHCP Server use-after-free (CVE-2026-96934, CVE-2026-88117, CVE-2026-88119, CVE-2026-88120)", "Network Device Enrollment Service (NDES) weak authentication (CVE-2026-69802)", "Azure App Service missing authentication (CVE-2026-77900)" ] }, { "name": "Client-Side RCE and Command Injection", "slug": "execution-client-side-payloads", "tactic": "execution", "techniques": [ "T1203", "T1059.003" ], "observables": [ "Windows Shell command injection 0-day (CVE-2026-96951)", "Microsoft Excel remote code execution (CVE-2026-100211, CVE-2026-97739)", "Microsoft Outlook remote code execution (CVE-2026-70242, CVE-2026-97749)", "Microsoft Word RCE (CVE-2026-70300, CVE-2026-88185)", "Windows Media Foundation heap buffer overflow (CVE-2026-96952)" ] }, { "name": "Kernel and VBS Enclave Escalation", "slug": "privilege-escalation-kernel-and-vbs", "tactic": "privilege-escalation", "techniques": [ "T1068" ], "observables": [ "Windows Kernel heap buffer overflow (CVE-2026-96913)", "Windows Virtualization-Based Security (VBS) Enclave race condition (CVE-2026-102211)", "Windows ALPC use-after-free (CVE-2026-83917)", "Azure SRE Agent SSRF (CVE-2026-69435)" ] }, { "name": "Lateral Movement via AD and RDS", "slug": "lateral-movement-remote-infrastructure", "tactic": "lateral-movement", "techniques": [ "T1021.001", "T1210" ], "observables": [ "Windows Active Directory Domain Services incorrect authorization (CVE-2026-70229)", "Windows Remote Desktop Services use-after-free (CVE-2026-70187)", "AD FS spoofing via improper certificate validation (CVE-2026-96222)" ] } ], "summary": "The October 2026 Microsoft security update addresses 141 vulnerabilities, including a Windows Shell command injection 0-day exploited in the wild and critical RCEs in Active Directory, Exchange, and Office. The campaign involves potential initial access via vulnerable public-facing services or phishing, followed by kernel-level privilege escalation and lateral movement through Remote Desktop and Active Directory flaws." }, "severity": "high", "rationale": "Use the first step to identify unpatched systems directly by hostname via a join between vulnerability and device inventory. Widen search to the entire estate if scanner coverage is suspected to be incomplete.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "Adversaries are exploiting newly disclosed October 2026 RCE vulnerabilities to trigger anomalous shell execution and deploy payloads on unpatched Windows and Exchange hosts.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Hostnames to narrow the behavioral search; leave empty to scan the full estate." }, "critical_cves": { "from": { "ref": "https://blog.talosintelligence.com/microsoft-patch-tuesday-for-october-2026/", "kind": "article", "observed": "2026-10-13" }, "type": "list[string]", "default": [ "CVE-2026-96951", "CVE-2026-70229", "CVE-2026-70571", "CVE-2026-100202", "CVE-2026-70300", "CVE-2026-96934", "CVE-2026-70242", "CVE-2026-97749", "CVE-2026-77900" ], "description": "Critical RCE and 0-day CVEs from the October 2026 advisory." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://blog.talosintelligence.com/microsoft-patch-tuesday-for-october-2026/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://blog.talosintelligence.com/microsoft-patch-tuesday-for-october-2026/", "name": "Microsoft Patch Tuesday for October 2026 \u2014 Snort rules and prominent vulnerabilities" } ], "blind_spots": [ { "id": "incomplete-scanner-coverage", "risk": "Hosts not covered by a vulnerability provider contribute no rows to scoping, creating a false sense of security.", "stage": "initial-access-public-facing-exploitation", "question": "Which unmanaged or unscanned hosts are unpatched?", "requires": "comprehensive hb_vulnerability_finding data" }, { "id": "memory-only-exploitation", "risk": "Exploitation of CVE-2026-102211 or kernel-only CVEs occurs in memory spaces that standard process logs cannot observe.", "stage": "privilege-escalation-kernel-and-vbs", "question": "Is exploitation occurring within the VBS Enclave or kernel space?", "requires": "Memory-level kernel tracing" } ] }, "name": "October 2026 Patch Tuesday Exposure Hunt", "description": "This hunt identifies exposure to the critical remote code execution (RCE) vulnerabilities disclosed in the October 2026 Microsoft Patch Tuesday, including the Windows Shell 0-day (CVE-2026-96951). It follows the exposure flow: first identifying unpatched hosts via vulnerability findings joined with device inventory, then examining rare process activity on those hosts, and finally monitoring for high-confidence behavioral indicators like web servers or productivity applications spawning command shells." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "coverage": [ { "stage": "initial-access-public-facing-exploitation", "steps": [ "vulnerability-scoping", "shell-execution-from-vulnerable-apps" ], "status": "covered" }, { "stage": "execution-client-side-payloads", "steps": [ "vulnerability-scoping", "shell-execution-from-vulnerable-apps" ], "status": "covered" }, { "stage": "privilege-escalation-kernel-and-vbs", "reason": "Kernel and VBS enclave exploitation occurs in memory spaces not visible to process-level telemetry.", "status": "not_visible", "blind_spot": "memory-only-exploitation" }, { "stage": "lateral-movement-remote-infrastructure", "reason": "Belongs to a separate lateral movement hunt using hb_auth_signin.", "status": "out_of_scope" } ], "rationale": "Adversaries are exploiting newly disclosed October 2026 RCE vulnerabilities to trigger anomalous shell execution and deploy payloads on unpatched Windows and Exchange hosts.", "blind_spots": [ { "id": "incomplete-scanner-coverage", "risk": "Hosts not covered by a vulnerability provider contribute no rows to scoping, creating a false sense of security.", "stage": "initial-access-public-facing-exploitation", "question": "Which unmanaged or unscanned hosts are unpatched?", "requires": "comprehensive hb_vulnerability_finding data" }, { "id": "memory-only-exploitation", "risk": "Exploitation of CVE-2026-102211 or kernel-only CVEs occurs in memory spaces that standard process logs cannot observe.", "stage": "privilege-escalation-kernel-and-vbs", "question": "Is exploitation occurring within the VBS Enclave or kernel space?", "requires": "Memory-level kernel tracing" } ], "scoping_notes": "Use the first step to identify unpatched systems directly by hostname via a join between vulnerability and device inventory. Widen search to the entire estate if scanner coverage is suspected to be incomplete.", "beyond_detection": "A standard detection rule might fire on 'shell from web server', but this hunt prioritizes confirmed unpatched systems and applies a fleet-wide baseline for rare binaries, providing context a single rule cannot provide." } }, { "id": "vulnerability-scoping", "type": "query", "label": "Identify unpatched vulnerable hosts", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT d.hostname, v.cve_uid, v.severity, v.status, v.first_seen FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid WHERE instr(',' || '{{critical_cves}}' || ',', ',' || v.cve_uid || ',') > 0 AND v.status != 'suppressed' ORDER BY v.severity_id DESC", "surface": "hb_vulnerability_finding", "description": "Locate systems where vulnerability scanners have identified missing patches for the critical October 2026 CVEs, joining with device inventory for direct hostname mapping.", "expected_signal": "Rows identify specific assets by hostname that remain unpatched. Silence means no hosts are reporting these specific vulnerabilities." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify unpatched vulnerable hosts", "reads": [ "device_uid", "hostname", "cve_uid", "severity", "status", "first_seen" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT d.hostname, v.cve_uid, v.severity, v.status, v.first_seen FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid WHERE instr(',' || '{{critical_cves}}' || ',', ',' || v.cve_uid || ',') > 0 AND v.status != 'suppressed' ORDER BY v.severity_id DESC", "silence": "not_evidence_of_absence", "expected": "Rows identify specific assets by hostname that remain unpatched. Silence means no hosts are reporting these specific vulnerabilities.", "verified": "dry-run", "verified_at": "2026-10-14" } }, { "id": "rare-processes-on-exposed-hosts", "type": "query", "label": "Stack-count rare processes", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= '2026-10-13' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY path HAVING host_count <= 3 ORDER BY host_count ASC", "surface": "hb_process_activity", "description": "Identify unusual binaries on vulnerable systems to detect first-stage payloads.", "expected_signal": "A binary or script seen on only 1-3 hosts since the patch disclosure. Silence suggests no unique execution occurred on the scoped hosts." }, "parents": [ { "id": "vulnerability-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Stack-count rare processes", "reads": [ "process_path", "device_hostname", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= '2026-10-13' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY path HAVING host_count <= 3 ORDER BY host_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "new_this_window" }, "expected": "A binary or script seen on only 1-3 hosts since the patch disclosure. Silence suggests no unique execution occurred on the scoped hosts.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_path" ], "rare_below": 4 }, "verified_at": "2026-10-14" } }, { "id": "shell-execution-from-vulnerable-apps", "type": "query", "label": "Anomalous shell spawning from vulnerable apps", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, parent_process_name, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE LOWER(parent_process_name) IN ('c:\\windows\\system32\\inetsrv\\w3wp.exe', 'c:\\program files\\microsoft office\\root\\office16\\excel.exe', 'c:\\program files\\microsoft office\\root\\office16\\winword.exe', 'c:\\program files\\microsoft office\\root\\office16\\outlook.exe') AND LOWER(process_name) IN ('c:\\windows\\system32\\cmd.exe', 'c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe', 'c:\\windows\\system32\\mshta.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= '2026-10-13' AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Detect successful exploitation of Exchange or Office by monitoring for shells spawned from their respective processes, focused on activity since the patch disclosure.", "expected_signal": "A shell or script interpreter spawned by a web server or productivity application. This indicates remote code execution." }, "parents": [ { "id": "rare-processes-on-exposed-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Anomalous shell spawning from vulnerable apps", "reads": [ "device_hostname", "parent_process_name", "process_name", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, parent_process_name, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE LOWER(parent_process_name) IN ('c:\\windows\\system32\\inetsrv\\w3wp.exe', 'c:\\program files\\microsoft office\\root\\office16\\excel.exe', 'c:\\program files\\microsoft office\\root\\office16\\winword.exe', 'c:\\program files\\microsoft office\\root\\office16\\outlook.exe') AND LOWER(process_name) IN ('c:\\windows\\system32\\cmd.exe', 'c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe', 'c:\\windows\\system32\\mshta.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= '2026-10-13' AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "A shell or script interpreter spawned by a web server or productivity application. This indicates remote code execution.", "verified": "dry-run", "verified_at": "2026-10-14" } }, { "id": "triage-agent", "type": "analytic", "label": "Identify high-risk exposed systems", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "vulnerability-scoping", "rare-processes-on-exposed-hosts", "shell-execution-from-vulnerable-apps" ], "objective": "Evaluate the results from scoping and behavioral queries. Determine which hosts with missing October 2026 patches show anomalous process activity or command shell execution consistent with RCE.", "description": "Determine which unpatched hosts show signs of exploitation based on behavioral evidence.", "max_iterations": 3, "expected_signal": "A verdict per host indicating whether missing patches correlate with suspicious activity.", "success_criteria": "A list of hosts classified as 'Exploited', 'Exposed and Anomalous', or 'Exposed but Clean'." }, "parents": [ { "id": "shell-execution-from-vulnerable-apps" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on triage verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-agent verdict is malicious or suspicious for at least one host", "condition": "the triage-agent verdict is malicious or suspicious for at least one host", "blind_spot": "incomplete-scanner-coverage", "confidence": "medium", "description": "Direct the hunt to remediation review if evidence of exploitation exists.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-agent" } ] }, { "id": "remediation-review", "type": "task", "label": "Remediation and Patching Review", "config": { "assignee": "analyst", "description": "Review the identified exposure and ensure high-risk hosts are patched and investigated.", "instructions": "1. Verify the vulnerability findings on the cited hosts. 2. For hosts showing anomalous shell execution, escalate to Incident Response. 3. Ensure that the October 2026 security updates are applied and validated across the estate." }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" }, { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Document findings and archive the hunt.", "instructions": "Record the number of vulnerable vs clean hosts. Transition the anomalous shell query to a standing detection rule if it was effective." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" } ] } ] }