{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "The Silver Fox campaign successfully evades file-based blocklists by using legitimate update utilities and randomized paths. A behavioral hunt is required to find the intersection of persistence and unusual cloud infrastructure connections across multinational operations."
      },
      "name": "Persistent implant using repurposed update utilities",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1053.005",
        "attack.t1071",
        "attack.t1105"
      ],
      "series": {
        "slug": "counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign",
        "index": 2,
        "title": "Counterfeit installers to system compromise: Tracking a deceptive software download campaign",
        "total": 2
      },
      "related": [
        {
          "hunt": "silver-fox-initial-access-spoofed-sites",
          "reason": "This hunt focuses on post-compromise persistence; finding the initial download requires web proxy or browser history analysis.",
          "relation": "out-of-scope-alternative"
        },
        {
          "hunt": "counterfeit-software-delivery-randomized-execution",
          "relation": "follows"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A standard rule alerts on task creation; this hunt asks whether the resulting binary is rare in the environment and whether it subsequently communicates with specific cloud storage providers, reducing false positives from legitimate administrative tasks.",
      "coverage": [
        {
          "stage": "persistence-scheduled-task",
          "steps": [
            "tasks-in-writable-paths",
            "rare-implant-processes"
          ],
          "status": "covered"
        },
        {
          "stage": "c2-alibaba-oss-update",
          "steps": [
            "dns-to-oss-buckets",
            "http-to-oss-buckets"
          ],
          "status": "covered"
        },
        {
          "stage": "initial-access-spoofed-sites",
          "reason": "Belongs to another part of the 'Counterfeit installers to system compromise: Tracking a deceptive software download campaign' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "delivery-dynamic-archive",
          "reason": "Belongs to another part of the 'Counterfeit installers to system compromise: Tracking a deceptive software download campaign' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "execution-randomized-payloads",
          "reason": "Belongs to another part of the 'Counterfeit installers to system compromise: Tracking a deceptive software download campaign' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Spoofed software-download sites",
            "slug": "initial-access-spoofed-sites",
            "tactic": "initial-access",
            "techniques": [
              "T1566.002"
            ],
            "observables": [
              "pc-razerzone.com.cn",
              "app-microsoft-edge.com.cn",
              "kaspersky-lab.hl.cn",
              "calibre-ebook.com.cn",
              "gehie246.com",
              "yimxg25tiy.com",
              "cc8ttkv35b.com"
            ]
          },
          {
            "name": "Dynamically generated installer archive",
            "slug": "delivery-dynamic-archive",
            "tactic": "execution",
            "techniques": [
              "T1204.002"
            ],
            "observables": [
              "app_setup.6653004.zip",
              "zinst.zip",
              "zintall.zip",
              "intsoft.zip",
              "innstll.zip",
              "/712down",
              "/73inst"
            ]
          },
          {
            "name": "Randomized stage-one payload execution",
            "slug": "execution-randomized-payloads",
            "tactic": "execution",
            "techniques": [
              "T1204.002",
              "T1036.005"
            ],
            "observables": [
              "a_instapp83353001.exe",
              "C:\\Users\\Public\\",
              "C:\\ProgramData\\",
              "Speech Processing Solutions GmbH",
              "Philips Speech Driver Client Configuration",
              "PhilipsSpeechDriverConfiguration.exe",
              "TODO: <Product name>",
              "6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8"
            ]
          },
          {
            "name": "Implant persistence via Scheduled Task",
            "slug": "persistence-scheduled-task",
            "tactic": "persistence",
            "techniques": [
              "T1053.005"
            ],
            "observables": [
              "svchost.exe -k netsvcs -p -s Schedule",
              "C:\\ProgramData\\"
            ]
          },
          {
            "name": "Repurposed update client C2",
            "slug": "c2-alibaba-oss-update",
            "tactic": "command-and-control",
            "techniques": [
              "T1071",
              "T1105"
            ],
            "observables": [
              "upitem.oss-cn-hangzhou.aliyuncs.com",
              "tu_rt.exe",
              "_ir_tu2_temp_",
              "Indigo Rose TrueUpdate Client"
            ]
          }
        ],
        "summary": "This campaign uses high-fidelity vendor look-alike domains to distribute dynamically generated installer archives to Chinese-speaking users. Once executed, the malicious installers drop randomized payloads that establish persistence via Scheduled Tasks and repurpose legitimate update utilities to retrieve further stages from Alibaba Cloud infrastructure."
      },
      "severity": "high",
      "rationale": "Start by identifying hosts with scheduled tasks pointing to world-writable paths. Narrow the subsequent process and DNS queries to these hosts to reduce noise from common third-party updaters.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An attacker has established persistence through a scheduled task that executes a randomized binary from a world-writable path, which then uses a legitimate update utility to communicate with Alibaba OSS infrastructure.",
      "parameters": {
        "c2_domains": {
          "from": {
            "ref": "msrc-blog-2026-09-01",
            "kind": "article",
            "observed": "2026-09-01"
          },
          "type": "list[domain]",
          "default": [
            "upitem.oss-cn-hangzhou.aliyuncs.com",
            "pc-razerzone.com.cn",
            "gehie246.com",
            "yimxg25tiy.com",
            "cc8ttkv35b.com",
            "n7b8t85zsg.com",
            "www.gehie246.com",
            "kaspersky-lab.hl.cn"
          ],
          "description": "Full FQDNs observed in the campaign used for delivery and C2."
        },
        "scope_hosts": {
          "from": {
            "ref": "default",
            "kind": "manual",
            "observed": "2026-09-01"
          },
          "type": "list[host]",
          "default": [],
          "description": "Hosts to focus on based on the scoping step; leave empty to hunt across the entire estate."
        },
        "lookback_days": {
          "from": {
            "ref": "default",
            "kind": "manual",
            "observed": "2026-09-01"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine for process, task, and network events."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/",
          "name": "MSRC \u2014 Counterfeit installers to system compromise: Tracking a deceptive software download campaign"
        }
      ],
      "blind_spots": [
        {
          "id": "limited-telemetry-retention",
          "risk": "An implant established months ago might be missed if the scoping query only sees recent task modifications.",
          "stage": "persistence-scheduled-task",
          "question": "When was the task first created if it was established before the lookback window?",
          "requires": "long-term hb_scheduled_job retention"
        },
        {
          "id": "encrypted-c2-visibility",
          "risk": "Defenders can see the connection to the OSS domain but cannot see the payload path or metadata within the encrypted session.",
          "stage": "c2-alibaba-oss-update",
          "question": "What specific files are being requested from the Alibaba OSS buckets?",
          "requires": "HTTPS inspection or decrypted SNI logs"
        }
      ]
    },
    "name": "Persistent implant using repurposed update utilities",
    "description": "This hunt identifies post-compromise activity associated with the Silver Fox (Yinhu) campaign. It focuses on the persistence stage where the malware stages randomized binaries in ProgramData or Public directories and launches them via the Windows Task Scheduler. The hunt identifies these implants by their unusual execution paths, host-level rarity, and subsequent DNS and HTTP requests to the attacker's Alibaba Cloud infrastructure. An agent weighs these independent behavioral signals to distinguish the implant from legitimate administrative tools and update mechanisms."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign",
          "index": 2,
          "title": "Counterfeit installers to system compromise: Tracking a deceptive software download campaign",
          "total": 2
        },
        "coverage": [
          {
            "stage": "persistence-scheduled-task",
            "steps": [
              "tasks-in-writable-paths",
              "rare-implant-processes"
            ],
            "status": "covered"
          },
          {
            "stage": "c2-alibaba-oss-update",
            "steps": [
              "dns-to-oss-buckets",
              "http-to-oss-buckets"
            ],
            "status": "covered"
          },
          {
            "stage": "initial-access-spoofed-sites",
            "reason": "Belongs to another part of the 'Counterfeit installers to system compromise: Tracking a deceptive software download campaign' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "delivery-dynamic-archive",
            "reason": "Belongs to another part of the 'Counterfeit installers to system compromise: Tracking a deceptive software download campaign' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "execution-randomized-payloads",
            "reason": "Belongs to another part of the 'Counterfeit installers to system compromise: Tracking a deceptive software download campaign' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An attacker has established persistence through a scheduled task that executes a randomized binary from a world-writable path, which then uses a legitimate update utility to communicate with Alibaba OSS infrastructure.",
        "blind_spots": [
          {
            "id": "limited-telemetry-retention",
            "risk": "An implant established months ago might be missed if the scoping query only sees recent task modifications.",
            "stage": "persistence-scheduled-task",
            "question": "When was the task first created if it was established before the lookback window?",
            "requires": "long-term hb_scheduled_job retention"
          },
          {
            "id": "encrypted-c2-visibility",
            "risk": "Defenders can see the connection to the OSS domain but cannot see the payload path or metadata within the encrypted session.",
            "stage": "c2-alibaba-oss-update",
            "question": "What specific files are being requested from the Alibaba OSS buckets?",
            "requires": "HTTPS inspection or decrypted SNI logs"
          }
        ],
        "scoping_notes": "Start by identifying hosts with scheduled tasks pointing to world-writable paths. Narrow the subsequent process and DNS queries to these hosts to reduce noise from common third-party updaters.",
        "beyond_detection": "A standard rule alerts on task creation; this hunt asks whether the resulting binary is rare in the environment and whether it subsequently communicates with specific cloud storage providers, reducing false positives from legitimate administrative tasks."
      }
    },
    {
      "id": "tasks-in-writable-paths",
      "type": "query",
      "label": "Scheduled tasks in world-writable paths",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, job_name, job_cmd_line, job_user_name, time FROM hb_scheduled_job WHERE (LOWER(job_cmd_line) LIKE '%c:\\programdata\\%' OR LOWER(job_cmd_line) LIKE '%c:\\users\\public\\%') AND LOWER(job_cmd_line) LIKE '%.exe%' AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_scheduled_job",
        "description": "Identify tasks configured to run executables from ProgramData or Public directories, the primary persistence method for this implant.",
        "expected_signal": "Tasks pointing to randomized subdirectories in world-writable paths. Absence of results means no such tasks were visible in the snapshot."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Scheduled tasks in world-writable paths",
        "reads": [
          "device_hostname",
          "job_name",
          "job_cmd_line",
          "job_user_name",
          "time"
        ],
        "source": "hb_scheduled_job",
        "target": "endpoint",
        "content": "SELECT device_hostname, job_name, job_cmd_line, job_user_name, time FROM hb_scheduled_job WHERE (LOWER(job_cmd_line) LIKE '%c:\\programdata\\%' OR LOWER(job_cmd_line) LIKE '%c:\\users\\public\\%') AND LOWER(job_cmd_line) LIKE '%.exe%' AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Tasks pointing to randomized subdirectories in world-writable paths. Absence of results means no such tasks were visible in the snapshot.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "rare-implant-processes",
      "type": "query",
      "label": "Rare processes from world-writable paths",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT process_name, process_path, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS total_runs, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%c:\\programdata\\%' OR LOWER(process_path) LIKE '%c:\\users\\public\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_name, process_path HAVING host_count <= 5 ORDER BY host_count ASC",
        "surface": "hb_process_activity",
        "description": "Stack-count processes in writable paths to isolate randomized implant binaries from fleet-wide administrative tools.",
        "expected_signal": "A binary executing on only a few hosts from a randomized path. Legitimate updaters and apps will appear on many more hosts."
      },
      "parents": [
        {
          "id": "tasks-in-writable-paths"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Rare processes from world-writable paths",
        "reads": [
          "process_name",
          "process_path",
          "device_hostname",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT process_name, process_path, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS total_runs, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%c:\\programdata\\%' OR LOWER(process_path) LIKE '%c:\\users\\public\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_name, process_path HAVING host_count <= 5 ORDER BY host_count ASC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "A binary executing on only a few hosts from a randomized path. Legitimate updaters and apps will appear on many more hosts.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "process_name",
            "process_path"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "dns-to-oss-buckets",
      "type": "query",
      "label": "DNS activity to campaign infrastructure",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_dns_activity",
        "description": "Match host activity against the campaign's known Alibaba OSS delivery and C2 infrastructure.",
        "expected_signal": "DNS requests for the specific Alibaba OSS buckets. Silence proves absence only if DNS logging covers all hosts in scope."
      },
      "parents": [
        {
          "id": "tasks-in-writable-paths"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "DNS activity to campaign infrastructure",
        "reads": [
          "device_hostname",
          "query_hostname",
          "process_name",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "DNS requests for the specific Alibaba OSS buckets. Silence proves absence only if DNS logging covers all hosts in scope.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "http-to-oss-buckets",
      "type": "query",
      "label": "HTTP requests to campaign infrastructure",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, user_agent, time FROM hb_http_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Corroborate C2 communication using the HTTP surface to identify specific URL patterns or host headers.",
        "expected_signal": "Direct HTTP connections to known campaign domains. Silence means no proxy or server-side logs recorded these requests."
      },
      "parents": [
        {
          "id": "tasks-in-writable-paths"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "HTTP requests to campaign infrastructure",
        "reads": [
          "device_hostname",
          "url_hostname",
          "url_path",
          "user_agent",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, user_agent, time FROM hb_http_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Direct HTTP connections to known campaign domains. Silence means no proxy or server-side logs recorded these requests.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "triage-implant",
      "type": "analytic",
      "label": "Triage the persistent implant",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "web"
        ],
        "context": [
          "tasks-in-writable-paths",
          "rare-implant-processes",
          "dns-to-oss-buckets",
          "http-to-oss-buckets"
        ],
        "objective": "Determine if a host is infected by linking a scheduled task in a world-writable path to a rare binary execution and observed C2 traffic.",
        "description": "Correlate the task persistence, process rarity, and C2 communication to confirm infection.",
        "max_iterations": 4,
        "expected_signal": "A verdict for each host with supporting telemetry evidence.",
        "success_criteria": "A per-host verdict of malicious, suspicious, or benign citing specific telemetry rows."
      },
      "parents": [
        {
          "id": "rare-implant-processes",
          "kind": "merge"
        },
        {
          "id": "dns-to-oss-buckets",
          "kind": "merge"
        },
        {
          "id": "http-to-oss-buckets",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious for at least one host",
        "condition": "the triage verdict is malicious for at least one host",
        "blind_spot": "limited-telemetry-retention",
        "confidence": "high",
        "description": "Direct the hunt based on the agent's findings.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-implant"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate compromised host",
      "config": {
        "target": "endpoint",
        "description": "Prevent further C2 communication and data exfiltration from confirmed infections.",
        "instructions": "Isolate the host and collect the identified binary from its world-writable path for further analysis.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst review",
      "config": {
        "assignee": "analyst",
        "description": "Verify the agent's findings and record forensic details.",
        "instructions": "Review the cited telemetry. Confirm if the binary has Indigo Rose TrueUpdate metadata and if it creates temp files following the observed pattern."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Finalize the hunt and recommend tuning.",
        "instructions": "Record the number of confirmed hosts. If the rare-process query yielded high-fidelity hits, promote it to a standing detection rule."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-review"
        }
      ]
    }
  ]
}