{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Adversaries use AI for high-fidelity social engineering and exploit perimeter vulnerabilities for initial access. This hunt provides assurance that the external attack surface is not currently compromised by these advanced methods."
      },
      "name": "Perimeter Access and Identity Fraud",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1566",
        "attack.t1555",
        "attack.t1041",
        "credential access",
        "defense evasion",
        "exfiltration",
        "impact",
        "initial access"
      ],
      "series": {
        "slug": "unit-42-threat-intelligence-highlights-nov-2-2026",
        "index": 1,
        "title": "Unit 42 Threat Intelligence Highlights - Nov. 2, 2026",
        "total": 2
      },
      "related": [
        {
          "hunt": "evasion-and-execution-lotl",
          "reason": "If initial access is confirmed, the adversary will likely transition to using living-off-the-land binaries for persistence and execution.",
          "relation": "follows"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "This hunt correlates exposure (unpatched vulnerability) with behavioral anomalies (rare sign-ins, geographic shifts, and successful HTTP probes) across three distinct surfaces. A single rule might alert on a CVE or a malicious IP, but this hunt provides the cross-surface context an analyst needs to confirm a successful breach versus a failed scan.",
      "coverage": [
        {
          "stage": "initial-access-ai-phishing",
          "steps": [
            "anomalous-signins",
            "triage-initial-access"
          ],
          "status": "covered"
        },
        {
          "stage": "initial-access-exploit-perimeter",
          "steps": [
            "vulnerable-perimeter-inventory",
            "perimeter-exploitation-probes",
            "triage-initial-access"
          ],
          "status": "covered"
        },
        {
          "stage": "evasion-and-execution-lotl",
          "reason": "Belongs to another part of the 'Unit 42 Threat Intelligence Highlights - Nov. 2, 2026' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "credential-access-harvesting",
          "reason": "Belongs to another part of the 'Unit 42 Threat Intelligence Highlights - Nov. 2, 2026' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "collection-exfiltration-staging",
          "reason": "Belongs to another part of the 'Unit 42 Threat Intelligence Highlights - Nov. 2, 2026' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "impact-ransomware-encryption",
          "reason": "Belongs to another part of the 'Unit 42 Threat Intelligence Highlights - Nov. 2, 2026' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "AI-Enhanced Phishing",
            "slug": "initial-access-ai-phishing",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "context-tailored social engineering lures",
              "synthetic personas",
              "deepfakes",
              "executive impersonation"
            ]
          },
          {
            "name": "Perimeter Application Exploitation",
            "slug": "initial-access-exploit-perimeter",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "unpatched perimeter assets",
              "zero-day vulnerabilities",
              "internet-facing web applications"
            ]
          },
          {
            "name": "Living-off-the-Land and Scripting",
            "slug": "evasion-and-execution-lotl",
            "tactic": "defense-evasion",
            "observables": [
              "LotL binaries",
              "built-in administration tools",
              "AI-assisted scripting",
              "payload debugging",
              "code obfuscation"
            ]
          },
          {
            "name": "Credential Harvesting",
            "slug": "credential-access-harvesting",
            "tactic": "credential-access",
            "techniques": [
              "T1555"
            ],
            "observables": [
              "infostealer logs",
              "exposed credentials",
              "access to password storage locations"
            ]
          },
          {
            "name": "Staging and Exfiltration",
            "slug": "collection-exfiltration-staging",
            "tactic": "exfiltration",
            "techniques": [
              "T1041"
            ],
            "observables": [
              "low-and-slow data staging",
              "exfiltration over C2 channel",
              "public exposure threats"
            ]
          },
          {
            "name": "Data Encryption and Extortion",
            "slug": "impact-ransomware-encryption",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "ransomware deployment",
              "multi-extortion models",
              "systemic data compromise"
            ]
          }
        ],
        "summary": "Threat actors are employing AI-enhanced social engineering and Large Language Model (LLM) assisted scripting to refine initial access through targeted phishing and perimeter application exploitation. Once inside, they utilize living-off-the-land (LotL) binaries for credential harvesting and low-and-slow data staging, culminating in strategic data theft or multi-extortion ransomware attacks."
      },
      "severity": "high",
      "rationale": "Focus on internet-facing web servers, cloud gateways, and remote access servers identified via exposed asset scans. Use the hostnames from the first step to populate the scope_hosts parameter. If the vulnerability inventory is empty, run the behavioral queries without scoping to detect generic identity fraud.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "Adversaries target unpatched perimeter assets or use AI-generated personas for initial access, indicated by high-severity vulnerabilities on internet-facing hosts coupled with anomalous sign-ins and successful unauthorized web requests.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "List of hostnames identified in the scoping step to focus the behavioral analysis."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of historical telemetry to examine."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://unit42.paloaltonetworks.com/u42-threat-intelligence-highlights-oct-2026/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://unit42.paloaltonetworks.com/u42-threat-intelligence-highlights-oct-2026/",
          "name": "Unit 42 Threat Intelligence Highlights - Nov. 2, 2026"
        }
      ],
      "blind_spots": [
        {
          "id": "encrypted-perimeter-traffic",
          "risk": "Without decryption, hb_http_activity cannot see the URL parameters or body content where many exploits reside.",
          "stage": "initial-access-exploit-perimeter",
          "question": "whether exploit payloads are present in HTTPS traffic",
          "requires": "TLS decryption at the perimeter or web-server log auditing"
        },
        {
          "id": "stale-vulnerability-data",
          "risk": "If the vulnerability scanner hasn't run recently, the scoping step will miss hosts patched yesterday or newly vulnerable today.",
          "stage": "initial-access-exploit-perimeter",
          "question": "whether a host is currently vulnerable",
          "requires": "Real-time vulnerability scanning"
        }
      ]
    },
    "name": "Perimeter Access and Identity Fraud",
    "description": "This hunt focuses on the external-facing attack surface by identifying vulnerable assets and monitoring for subsequent signs of exploitation or identity-based deception. It uses a scoping step to identify hosts with high-severity vulnerabilities that are confirmed to be internet-exposed. The hunt simultaneously evaluates identity-based anomalies (such as rare user agents, geographic shifts, and MFA bypass patterns) and behavioral web probes. An agent weighs these independent indicators per host to identify successful initial access via unpatched services or sophisticated phishing lures."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "unit-42-threat-intelligence-highlights-nov-2-2026",
          "index": 1,
          "title": "Unit 42 Threat Intelligence Highlights - Nov. 2, 2026",
          "total": 2
        },
        "coverage": [
          {
            "stage": "initial-access-ai-phishing",
            "steps": [
              "anomalous-signins",
              "triage-initial-access"
            ],
            "status": "covered"
          },
          {
            "stage": "initial-access-exploit-perimeter",
            "steps": [
              "vulnerable-perimeter-inventory",
              "perimeter-exploitation-probes",
              "triage-initial-access"
            ],
            "status": "covered"
          },
          {
            "stage": "evasion-and-execution-lotl",
            "reason": "Belongs to another part of the 'Unit 42 Threat Intelligence Highlights - Nov. 2, 2026' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "credential-access-harvesting",
            "reason": "Belongs to another part of the 'Unit 42 Threat Intelligence Highlights - Nov. 2, 2026' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "collection-exfiltration-staging",
            "reason": "Belongs to another part of the 'Unit 42 Threat Intelligence Highlights - Nov. 2, 2026' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "impact-ransomware-encryption",
            "reason": "Belongs to another part of the 'Unit 42 Threat Intelligence Highlights - Nov. 2, 2026' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "Adversaries target unpatched perimeter assets or use AI-generated personas for initial access, indicated by high-severity vulnerabilities on internet-facing hosts coupled with anomalous sign-ins and successful unauthorized web requests.",
        "blind_spots": [
          {
            "id": "encrypted-perimeter-traffic",
            "risk": "Without decryption, hb_http_activity cannot see the URL parameters or body content where many exploits reside.",
            "stage": "initial-access-exploit-perimeter",
            "question": "whether exploit payloads are present in HTTPS traffic",
            "requires": "TLS decryption at the perimeter or web-server log auditing"
          },
          {
            "id": "stale-vulnerability-data",
            "risk": "If the vulnerability scanner hasn't run recently, the scoping step will miss hosts patched yesterday or newly vulnerable today.",
            "stage": "initial-access-exploit-perimeter",
            "question": "whether a host is currently vulnerable",
            "requires": "Real-time vulnerability scanning"
          }
        ],
        "scoping_notes": "Focus on internet-facing web servers, cloud gateways, and remote access servers identified via exposed asset scans. Use the hostnames from the first step to populate the scope_hosts parameter. If the vulnerability inventory is empty, run the behavioral queries without scoping to detect generic identity fraud.",
        "beyond_detection": "This hunt correlates exposure (unpatched vulnerability) with behavioral anomalies (rare sign-ins, geographic shifts, and successful HTTP probes) across three distinct surfaces. A single rule might alert on a CVE or a malicious IP, but this hunt provides the cross-surface context an analyst needs to confirm a successful breach versus a failed scan."
      }
    },
    {
      "id": "vulnerable-perimeter-inventory",
      "type": "query",
      "label": "High-severity perimeter vulnerabilities",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT d.hostname AS device_hostname, v.cve_uid, v.severity, v.title FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid JOIN hb_exposed_assets e ON (d.hostname = e.domain_or_ip OR d.ip_address = e.ip_address) WHERE v.severity_id >= 4 AND v.status != 'suppressed' AND v.resource_type = 'device'",
        "surface": "hb_vulnerability_finding",
        "description": "Identify internet-facing assets with high-severity vulnerabilities that could serve as initial entry points by joining vulnerability findings with device inventory and external exposure data.",
        "expected_signal": "A list of hostnames currently exposed to high-severity vulnerabilities on the perimeter. These hosts should be provided in the scope_hosts parameter for subsequent steps."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "High-severity perimeter vulnerabilities",
        "reads": [
          "device_uid",
          "severity_id",
          "status",
          "resource_type",
          "cve_uid",
          "title"
        ],
        "source": "hb_vulnerability_finding",
        "target": "endpoint",
        "content": "SELECT DISTINCT d.hostname AS device_hostname, v.cve_uid, v.severity, v.title FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid JOIN hb_exposed_assets e ON (d.hostname = e.domain_or_ip OR d.ip_address = e.ip_address) WHERE v.severity_id >= 4 AND v.status != 'suppressed' AND v.resource_type = 'device'",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames currently exposed to high-severity vulnerabilities on the perimeter. These hosts should be provided in the scope_hosts parameter for subsequent steps.",
        "verified": "dry-run",
        "verified_at": "2026-11-03"
      }
    },
    {
      "id": "anomalous-signins",
      "type": "query",
      "label": "Anomalous sign-ins and identity risk",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "identity",
        "content": "SELECT actor_user_name, user_agent, is_proxy, risk_state, src_location_country, mfa, auth_requirement, device_hostname, COUNT(*) as signin_count, MIN(time) as first_seen FROM hb_auth_signin WHERE (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, user_agent, is_proxy, risk_state, src_location_country, mfa, auth_requirement, device_hostname HAVING signin_count <= 3 ORDER BY signin_count ASC",
        "surface": "hb_auth_signin",
        "description": "Detect sign-ins that may indicate executive impersonation or session hijacking, focusing on rare user-agents, geographic anomalies, and unusual authentication requirements.",
        "expected_signal": "Login events from rare combinations of location, user-agent, and auth protocol, especially those flagged as proxies. Silence indicates no anomalous logins were captured for the specified hosts."
      },
      "parents": [
        {
          "id": "vulnerable-perimeter-inventory"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Anomalous sign-ins and identity risk",
        "reads": [
          "actor_user_name",
          "user_agent",
          "is_proxy",
          "risk_state",
          "src_location_country",
          "mfa",
          "auth_requirement",
          "device_hostname",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, user_agent, is_proxy, risk_state, src_location_country, mfa, auth_requirement, device_hostname, COUNT(*) as signin_count, MIN(time) as first_seen FROM hb_auth_signin WHERE (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, user_agent, is_proxy, risk_state, src_location_country, mfa, auth_requirement, device_hostname HAVING signin_count <= 3 ORDER BY signin_count ASC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Login events from rare combinations of location, user-agent, and auth protocol, especially those flagged as proxies. Silence indicates no anomalous logins were captured for the specified hosts.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "user_agent",
            "actor_user_name",
            "src_location_country"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-11-03"
      }
    },
    {
      "id": "perimeter-exploitation-probes",
      "type": "query",
      "label": "Perimeter exploitation behavioral probes",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "web",
        "content": "SELECT device_hostname, url_full, status_code, user_agent, time FROM hb_http_activity WHERE (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND status_code BETWEEN 200 AND 299 AND (LOWER(url_full) LIKE '%etc/passwd%' OR LOWER(url_full) LIKE '%/bin/sh%' OR LOWER(url_full) LIKE '%/cgi-bin/%' OR LOWER(url_full) LIKE '%.env%' OR LOWER(url_full) LIKE '%/wp-config%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Identify successful web requests targeting sensitive files or attempting command injection on vulnerable assets by filtering for successful HTTP response codes.",
        "expected_signal": "HTTP requests with directory traversal or command execution patterns that returned a 2xx success code. Silence indicates no successful probe-like requests were captured."
      },
      "parents": [
        {
          "id": "vulnerable-perimeter-inventory"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Perimeter exploitation behavioral probes",
        "reads": [
          "device_hostname",
          "url_full",
          "status_code",
          "user_agent",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_full, status_code, user_agent, time FROM hb_http_activity WHERE (('{{scope_hosts}}' = '') OR (instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND status_code BETWEEN 200 AND 299 AND (LOWER(url_full) LIKE '%etc/passwd%' OR LOWER(url_full) LIKE '%/bin/sh%' OR LOWER(url_full) LIKE '%/cgi-bin/%' OR LOWER(url_full) LIKE '%.env%' OR LOWER(url_full) LIKE '%/wp-config%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "HTTP requests with directory traversal or command execution patterns that returned a 2xx success code. Silence indicates no successful probe-like requests were captured.",
        "verified": "dry-run",
        "verified_at": "2026-11-03"
      }
    },
    {
      "id": "triage-initial-access",
      "type": "analytic",
      "label": "Triage initial access evidence",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "web"
        ],
        "context": [
          "vulnerable-perimeter-inventory",
          "anomalous-signins",
          "perimeter-exploitation-probes"
        ],
        "objective": "Determine if any host with high-severity vulnerabilities shows evidence of successful exploitation or unauthorized sign-in using geographic, MFA, or user-agent anomalies.",
        "description": "Correlate identified vulnerabilities with anomalous logins and successful web traffic to determine if a breach occurred.",
        "max_iterations": 5,
        "expected_signal": "A per-host verdict linking the vulnerability to observed anomalous behavior.",
        "success_criteria": "A verdict of malicious, suspicious, or benign per host, citing relevant telemetry rows."
      },
      "parents": [
        {
          "id": "anomalous-signins",
          "kind": "merge"
        },
        {
          "id": "perimeter-exploitation-probes",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "decision-on-access",
      "type": "checkpoint",
      "label": "Decision on Initial Access",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious for at least one host",
        "condition": "the triage verdict is malicious for at least one host",
        "blind_spot": "encrypted-perimeter-traffic",
        "confidence": "high",
        "description": "Route the hunt based on the agent's triage verdict.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-initial-access"
        }
      ]
    },
    {
      "id": "isolate-compromised-host",
      "type": "action",
      "label": "Isolate compromised host",
      "config": {
        "target": "endpoint",
        "description": "Immediately isolate the host to prevent lateral movement following a confirmed breach.",
        "instructions": "Isolate the endpoint and revoke any active session tokens for the affected accounts in the identity provider.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "decision-on-access",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "manual-analyst-review",
      "type": "task",
      "label": "Manual analyst review",
      "config": {
        "assignee": "analyst",
        "description": "Verify the agent's findings and assess the scope of the incident.",
        "instructions": "Review the cited sign-in anomalies and HTTP traffic; verify if the requests correlate with known vulnerability exploits. Document any AI-generated phishing indicators observed in user-agent strings or source IPs."
      },
      "parents": [
        {
          "id": "decision-on-access",
          "branch": "default"
        },
        {
          "id": "decision-on-access",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-compromised-host"
        }
      ]
    },
    {
      "id": "close-out-hunt",
      "type": "task",
      "label": "Close out hunt",
      "config": {
        "assignee": "analyst",
        "description": "Finalize the hunt results and initiate remediation for identified vulnerabilities.",
        "instructions": "Document hosts that were unpatched and prioritize them for immediate remediation. If suspicious activity was found, pivot to investigations of post-compromise behavior."
      },
      "parents": [
        {
          "id": "decision-on-access",
          "branch": "on_refutes"
        },
        {
          "id": "manual-analyst-review"
        }
      ]
    }
  ]
}