{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Passkeys are highly secure, but as the Huntress research shows, attackers are pivoting to the enrollment and recovery lifecycles. A negative result verifies that our move to passkeys is not being undermined by parallel authentication flows."
      },
      "name": "Passkey-Themed Phishing and Identity Lifecycle Abuse",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1566",
        "attack.t1190",
        "attack.t1176",
        "attack.t1098",
        "attack.t1137",
        "execution",
        "initial access",
        "persistence"
      ],
      "related": [
        {
          "hunt": "unauthorized-oauth-app-consent",
          "reason": "This hunt focuses specifically on the passkey-themed lure vector; broader OAuth abuse is covered separately.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "This hunt is not just a single rule; it connects three distinct signals: an unusual login protocol, an account security modification, and a cloud persistence operation. A single rule firing on any one of these would be high-noise, but the narrative connection across identity and cloud surfaces is what identifies a real compromise.",
      "coverage": [
        {
          "stage": "passkey-themed-social-engineering",
          "steps": [
            "device-code-scoping",
            "rare-auth-protocol-stack"
          ],
          "status": "covered"
        },
        {
          "stage": "device-code-flow-abuse",
          "steps": [
            "device-code-scoping",
            "early-stage-triage"
          ],
          "status": "covered"
        },
        {
          "stage": "unauthorized-identity-manipulation",
          "steps": [
            "mfa-lifecycle-anomalies",
            "cloud-persistence-audit"
          ],
          "status": "covered"
        },
        {
          "stage": "endpoint-authentication-tampering",
          "steps": [
            "unapproved-browser-extensions",
            "manual-cleanup-verification"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Passkey-Themed Phishing Lures",
            "slug": "passkey-themed-social-engineering",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "AI-generated phishing lures tailored to victim roles",
              "Impersonation of IT staff requesting passkey updates",
              "Urgent enrollment requests or messages to authorize unfamiliar devices"
            ]
          },
          {
            "name": "Abuse of Alternative Auth Flows",
            "slug": "device-code-flow-abuse",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "Victims entering device codes on legitimate Microsoft login pages",
              "Abuse of OAuth device-code flows to obtain valid sessions",
              "EvilTokens phishing-as-a-service kit activity"
            ]
          },
          {
            "name": "Malicious Enrollment and Persistence",
            "slug": "unauthorized-identity-manipulation",
            "tactic": "persistence",
            "observables": [
              "Registration of new secondary authenticators",
              "Exploitation of MFA recovery processes",
              "Creation of inbox rules or mail forwarding addresses",
              "New OAuth application grants and consents"
            ]
          },
          {
            "name": "Endpoint Browser Tampering",
            "slug": "endpoint-authentication-tampering",
            "tactic": "execution",
            "techniques": [
              "T1176"
            ],
            "observables": [
              "Browser hooks capturing WebAuthn responses",
              "Unauthorized browser extensions from non-approved lists",
              "Unexpected browser redirects or toolbars during sign-in"
            ]
          }
        ],
        "summary": "The EvilTokens campaign and similar threats target the account lifecycle by using AI-generated phishing to abuse device-code flows and register malicious authenticators. Even with passkeys, attackers maintain access through unauthorized MFA enrollment, session persistence via OAuth grants, and endpoint-level browser manipulation to intercept authentication responses."
      },
      "severity": "high",
      "rationale": "The hunt should begin with users who have performed Device Code authentication, as this is the primary flow abused in the EvilTokens campaign and is rarely used in standard business operations.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An attacker uses social engineering lures themed around passkey enrollment to trick users into authorizing a device-code login flow, subsequently registering unauthorized authenticators and establishing persistence via cloud application grants or unapproved browser extensions.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "incident-scoping",
            "kind": "manual",
            "observed": "2024-10-14"
          },
          "type": "list[host]",
          "default": [],
          "description": "Optional list of hostnames to focus on; defaults to the entire estate if empty."
        },
        "lookback_days": {
          "from": {
            "ref": "standard-lookback",
            "kind": "manual",
            "observed": "2024-10-14"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine for identity and process events."
        },
        "approved_extension_ids": {
          "from": {
            "ref": "enterprise-allow-list",
            "kind": "manual",
            "observed": "2024-10-14"
          },
          "type": "list[string]",
          "default": [
            "hfjimclajcmimbipebeogibjcaachgei"
          ],
          "description": "List of approved browser extension IDs; leave default to review all extensions."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.huntress.com/blog/passkeys-raise-the-bar-but-attackers-can-still-get-in",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.huntress.com/blog/passkeys-raise-the-bar-but-attackers-can-still-get-in",
          "name": "Huntress \u2014 Passkeys Raise the Bar. Here\u2019s Where Attackers Can Still Get In."
        }
      ],
      "blind_spots": [
        {
          "id": "cloud-audit-gap",
          "risk": "An attacker may have established long-term persistence (inbox rules or OAuth apps) that is no longer visible in active audit logs.",
          "stage": "unauthorized-identity-manipulation",
          "question": "whether persistence was established before the current log window",
          "requires": "hb_cloud_api_activity retention beyond 90 days"
        },
        {
          "id": "memory-only-tampering",
          "risk": "Software inventory only shows installed extensions; it cannot see memory-resident hooks injected via other processes, potentially missing advanced browser tampering.",
          "stage": "endpoint-authentication-tampering",
          "question": "whether the attacker used in-memory browser hooks to alter WebAuthn responses",
          "requires": "hb_module_activity with real-time browser hook detection"
        }
      ]
    },
    "name": "Passkey-Themed Phishing and Identity Lifecycle Abuse",
    "description": "This phased hunt targets the abuse of identity lifecycles during transition to phishing-resistant authentication. The first phase identifies users who use rare alternative authentication flows, such as the Device Code flow seen in the EvilTokens campaign, and correlates this with immediate MFA enrollment changes. The second phase follows these high-risk identities to find post-authentication persistence mechanisms, including malicious inbox rules and unauthorized browser extensions capable of tampering with WebAuthn responses. The hunt concludes by connecting the initial social engineering signal to the technical persistence evidence."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "passkey-themed-social-engineering",
            "steps": [
              "device-code-scoping",
              "rare-auth-protocol-stack"
            ],
            "status": "covered"
          },
          {
            "stage": "device-code-flow-abuse",
            "steps": [
              "device-code-scoping",
              "early-stage-triage"
            ],
            "status": "covered"
          },
          {
            "stage": "unauthorized-identity-manipulation",
            "steps": [
              "mfa-lifecycle-anomalies",
              "cloud-persistence-audit"
            ],
            "status": "covered"
          },
          {
            "stage": "endpoint-authentication-tampering",
            "steps": [
              "unapproved-browser-extensions",
              "manual-cleanup-verification"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An attacker uses social engineering lures themed around passkey enrollment to trick users into authorizing a device-code login flow, subsequently registering unauthorized authenticators and establishing persistence via cloud application grants or unapproved browser extensions.",
        "blind_spots": [
          {
            "id": "cloud-audit-gap",
            "risk": "An attacker may have established long-term persistence (inbox rules or OAuth apps) that is no longer visible in active audit logs.",
            "stage": "unauthorized-identity-manipulation",
            "question": "whether persistence was established before the current log window",
            "requires": "hb_cloud_api_activity retention beyond 90 days"
          },
          {
            "id": "memory-only-tampering",
            "risk": "Software inventory only shows installed extensions; it cannot see memory-resident hooks injected via other processes, potentially missing advanced browser tampering.",
            "stage": "endpoint-authentication-tampering",
            "question": "whether the attacker used in-memory browser hooks to alter WebAuthn responses",
            "requires": "hb_module_activity with real-time browser hook detection"
          }
        ],
        "scoping_notes": "The hunt should begin with users who have performed Device Code authentication, as this is the primary flow abused in the EvilTokens campaign and is rarely used in standard business operations.",
        "beyond_detection": "This hunt is not just a single rule; it connects three distinct signals: an unusual login protocol, an account security modification, and a cloud persistence operation. A single rule firing on any one of these would be high-noise, but the narrative connection across identity and cloud surfaces is what identifies a real compromise."
      }
    },
    {
      "id": "device-code-scoping",
      "type": "query",
      "label": "Identify device-code authentication users",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "identity",
        "content": "SELECT actor_user_name, device_hostname, src_endpoint_ip, auth_protocol, time FROM hb_auth_signin WHERE (LOWER(auth_protocol) LIKE '%device%code%' OR LOWER(event_type) LIKE '%device%code%') AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_auth_signin",
        "description": "Identify users and hosts that use the Device Code flow, which is a primary vector for session hijacking in passkey-themed phishing campaigns.",
        "expected_signal": "Rows identify users who successfully authorized a device code flow. In most enterprises, this flow should be rare."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify device-code authentication users",
        "reads": [
          "actor_user_name",
          "auth_protocol",
          "device_hostname",
          "event_type",
          "src_endpoint_ip",
          "status_id",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, device_hostname, src_endpoint_ip, auth_protocol, time FROM hb_auth_signin WHERE (LOWER(auth_protocol) LIKE '%device%code%' OR LOWER(event_type) LIKE '%device%code%') AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Rows identify users who successfully authorized a device code flow. In most enterprises, this flow should be rare.",
        "verified": "dry-run",
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "mfa-lifecycle-anomalies",
      "type": "query",
      "label": "Recent MFA enrollment and recovery changes",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT user_name, activity_name, actor_user_name, device_hostname, time FROM hb_account_change WHERE activity_id IN (3, 4, 99) AND (LOWER(activity_name) LIKE '%mfa%' OR LOWER(activity_name) LIKE '%authenticator%' OR LOWER(activity_name) LIKE '%credential%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_account_change",
        "description": "Detect when a user adds a new authenticator or resets credentials, which often follows a hijacked session.",
        "expected_signal": "Modifications to account security settings shortly after a login event. Silent means no such changes were recorded."
      },
      "parents": [
        {
          "id": "device-code-scoping"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Recent MFA enrollment and recovery changes",
        "reads": [
          "activity_id",
          "activity_name",
          "actor_user_name",
          "device_hostname",
          "time",
          "user_name"
        ],
        "source": "hb_account_change",
        "target": "endpoint",
        "content": "SELECT user_name, activity_name, actor_user_name, device_hostname, time FROM hb_account_change WHERE activity_id IN (3, 4, 99) AND (LOWER(activity_name) LIKE '%mfa%' OR LOWER(activity_name) LIKE '%authenticator%' OR LOWER(activity_name) LIKE '%credential%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Modifications to account security settings shortly after a login event. Silent means no such changes were recorded.",
        "verified": "dry-run",
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "rare-auth-protocol-stack",
      "type": "query",
      "label": "Rare authentication protocol usage",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "identity",
        "content": "SELECT actor_user_name, auth_protocol, src_endpoint_ip, COUNT(*) as count, MIN(time) as first_seen FROM hb_auth_signin WHERE status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, auth_protocol, src_endpoint_ip HAVING count < 5",
        "surface": "hb_auth_signin",
        "description": "Stack sign-ins by protocol and user to isolate anomalous shifts to phishing-prone flows like DeviceCode.",
        "expected_signal": "A list of users whose login protocol usage is anomalous compared to their historical patterns."
      },
      "parents": [
        {
          "id": "device-code-scoping"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare authentication protocol usage",
        "reads": [
          "actor_user_name",
          "auth_protocol",
          "src_endpoint_ip",
          "status_id",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, auth_protocol, src_endpoint_ip, COUNT(*) as count, MIN(time) as first_seen FROM hb_auth_signin WHERE status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, auth_protocol, src_endpoint_ip HAVING count < 5",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "new_this_window"
        },
        "expected": "A list of users whose login protocol usage is anomalous compared to their historical patterns.",
        "verified": "dry-run",
        "prevalence": {
          "by": "actor_user_name",
          "key": [
            "auth_protocol"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "early-stage-triage",
      "type": "analytic",
      "label": "Early stage risk triage",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "device-code-scoping",
          "mfa-lifecycle-anomalies",
          "rare-auth-protocol-stack"
        ],
        "objective": "Determine which users identified in the scoping step show correlated MFA changes or unusual protocol shifts indicative of session hijacking.",
        "description": "Weigh the initial authentication protocols against account changes to find likely social engineering successes.",
        "max_iterations": 4,
        "expected_signal": "A verdict identifying users who likely authorized an attacker via a device-code phishing lure.",
        "success_criteria": "A per-user risk score citing specific protocol events and account changes."
      },
      "parents": [
        {
          "id": "mfa-lifecycle-anomalies",
          "kind": "merge"
        },
        {
          "id": "rare-auth-protocol-stack",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "cloud-persistence-audit",
      "type": "query",
      "label": "Cloud persistence via API",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT actor_user_name, api_operation, resource_name, status, time FROM hb_cloud_api_activity WHERE (LOWER(api_operation) LIKE '%inboxrule%' OR LOWER(api_operation) LIKE '%forwarding%' OR LOWER(api_operation) LIKE '%approle%' OR LOWER(api_operation) LIKE '%consent%' OR LOWER(api_operation) LIKE '%add-mailbox%') AND status = 'success' AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_cloud_api_activity",
        "description": "Find post-compromise activity such as new inbox rules or OAuth application consents.",
        "expected_signal": "Success events for operations that grant external access or automate mailbox exfiltration."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Cloud persistence via API",
        "reads": [
          "actor_user_name",
          "api_operation",
          "resource_name",
          "status",
          "time"
        ],
        "source": "hb_cloud_api_activity",
        "target": "endpoint",
        "content": "SELECT actor_user_name, api_operation, resource_name, status, time FROM hb_cloud_api_activity WHERE (LOWER(api_operation) LIKE '%inboxrule%' OR LOWER(api_operation) LIKE '%forwarding%' OR LOWER(api_operation) LIKE '%approle%' OR LOWER(api_operation) LIKE '%consent%' OR LOWER(api_operation) LIKE '%add-mailbox%') AND status = 'success' AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Success events for operations that grant external access or automate mailbox exfiltration.",
        "verified": "dry-run",
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "unapproved-browser-extensions",
      "type": "query",
      "label": "Hunt unapproved browser extensions",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, package_name, package_uid, package_version, vendor_name FROM hb_software_inventory WHERE package_type = 'extension' AND ('{{approved_extension_ids}}' = '' OR instr(',' || '{{approved_extension_ids}}' || ',', ',' || package_uid || ',') = 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "surface": "hb_software_inventory",
        "description": "Identify browser extensions that might indicate session interception or WebAuthn tampering, focusing on hosts identified in the scoping step.",
        "expected_signal": "A list of extensions on scoped hosts that are not in the enterprise allow-list."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Hunt unapproved browser extensions",
        "reads": [
          "device_hostname",
          "package_name",
          "package_type",
          "package_uid",
          "package_version",
          "vendor_name"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT device_hostname, package_name, package_uid, package_version, vendor_name FROM hb_software_inventory WHERE package_type = 'extension' AND ('{{approved_extension_ids}}' = '' OR instr(',' || '{{approved_extension_ids}}' || ',', ',' || package_uid || ',') = 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "silence": "not_evidence_of_absence",
        "expected": "A list of extensions on scoped hosts that are not in the enterprise allow-list.",
        "verified": "dry-run",
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "full-chain-correlation",
      "type": "analytic",
      "label": "Correlate full identity-to-endpoint chain",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "early-stage-triage",
          "cloud-persistence-audit",
          "unapproved-browser-extensions"
        ],
        "objective": "Evaluate whether the early-stage identity risks resulted in cloud persistence (inbox rules/OAuth) or endpoint tampering (unapproved extensions).",
        "description": "Integrate the early identity signals with the technical persistence mechanisms to verify the full attack lifecycle.",
        "max_iterations": 6,
        "expected_signal": "A high-confidence verdict on account compromise spanning from login to persistence.",
        "success_criteria": "A final verdict of malicious or suspicious for each user and host, mapping the timeline of the compromise."
      },
      "parents": [
        {
          "id": "cloud-persistence-audit",
          "kind": "merge"
        },
        {
          "id": "unapproved-browser-extensions",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "verdict-routing",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the full-chain-correlation verdict is malicious for at least one user",
        "condition": "the full-chain-correlation verdict is malicious for at least one user",
        "blind_spot": "cloud-audit-gap",
        "confidence": "high",
        "description": "Direct the response based on the agent's full-chain correlation.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "full-chain-correlation"
        }
      ]
    },
    {
      "id": "contain-identity-compromise",
      "type": "action",
      "label": "Contain identity compromise",
      "config": {
        "target": "identity",
        "description": "Immediately terminate the attacker's access by revoking sessions and removing malicious authenticators.",
        "instructions": "Revoke all active sessions for the compromised user, remove any authenticators registered during the incident window, and disable unauthorized OAuth application grants.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "verdict-routing",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "manual-cleanup-verification",
      "type": "task",
      "label": "Manual cleanup verification",
      "config": {
        "assignee": "analyst",
        "description": "Verify that all persistence mechanisms, including inbox rules and browser extensions, have been fully remediated.",
        "instructions": "Review the compromised mailbox for hidden inbox rules or forwarding addresses. Confirm that the unapproved extensions on the affected host have been uninstalled. Update the approved_extension_ids list if the extension was legitimate."
      },
      "parents": [
        {
          "id": "verdict-routing",
          "branch": "default"
        },
        {
          "id": "verdict-routing",
          "branch": "on_unavailable"
        },
        {
          "id": "contain-identity-compromise"
        }
      ]
    },
    {
      "id": "hunt-close-out",
      "type": "task",
      "label": "Hunt close out",
      "config": {
        "assignee": "analyst",
        "description": "Document findings and lessons for future training.",
        "instructions": "Record the timeline of the attack. Use the findings to build simulated phishing scenarios focused on passkey enrollment lures to improve employee resilience."
      },
      "parents": [
        {
          "id": "verdict-routing",
          "branch": "on_refutes"
        },
        {
          "id": "manual-cleanup-verification"
        }
      ]
    }
  ]
}