{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "PaaS products like the Iron Man System bypass traditional MFA through real-time victim interaction. A negative result confirms that these sophisticated harvesting sessions are not active in the high-value software scope."
      },
      "name": "Phishing Infrastructure and Interactive Exfiltration",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1566",
        "attack.t1041",
        "attack.t1090.003",
        "collection",
        "command and control",
        "exfiltration",
        "initial access",
        "persistence",
        "privilege escalation",
        "reconnaissance"
      ],
      "series": {
        "slug": "the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime",
        "index": 2,
        "title": "The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime",
        "total": 2
      },
      "related": [
        {
          "hunt": "cloud-tenant-takeover-graph-abuse",
          "reason": "This hunt focuses on the endpoint exfiltration side; cloud-side resource and Graph abuse belong to the infrastructure takeover hunt.",
          "relation": "out-of-scope-alternative"
        },
        {
          "hunt": "cloud-tenant-hijacking-service-principal-abuse",
          "relation": "follows"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A simple detection rule for jewishchoice.org is easily bypassed. This hunt combines specific scoping, behavioral network heuristics for WebSockets, and exfiltration pattern analysis into a single decision, which avoids the false positives a single heuristic rule would generate.",
      "coverage": [
        {
          "stage": "command-and-control-dns-routing",
          "steps": [
            "dns-infrastructure-leads"
          ],
          "status": "covered"
        },
        {
          "stage": "exfiltration-interactive-credential-harvesting",
          "steps": [
            "interactive-websocket-heuristics",
            "telegram-bot-exfiltration"
          ],
          "status": "covered"
        },
        {
          "stage": "reconnaissance-automated-cloud-profiling",
          "reason": "Belongs to another part of the 'The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "initial-access-app-only-auth",
          "reason": "Belongs to another part of the 'The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "persistence-account-manipulation",
          "reason": "Belongs to another part of the 'The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "privilege-escalation-graph-abuse",
          "reason": "Belongs to another part of the 'The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "collection-resource-hosting-abuse",
          "reason": "Belongs to another part of the 'The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Automated Cloud Tenant Reconnaissance",
            "slug": "reconnaissance-automated-cloud-profiling",
            "tactic": "reconnaissance",
            "techniques": [
              "T1090.003",
              "T1595"
            ],
            "observables": [
              "Flask-based reconnaissance tooling",
              "Tor infrastructure for anonymity",
              "Profiling of M365 tenant enrollment opportunities",
              "Discovery of Azure cloud information"
            ]
          },
          {
            "name": "Application-Level Environment Takeover",
            "slug": "initial-access-app-only-auth",
            "tactic": "initial-access",
            "techniques": [
              "T1078.004"
            ],
            "observables": [
              "Application-only authentication flows",
              "Usage of stolen client secrets",
              "PHP, Java/Spring, and Cloudflare Workers admin panels",
              "Client secret-based directory control"
            ]
          },
          {
            "name": "Silent Password Resets and License Assignment",
            "slug": "persistence-account-manipulation",
            "tactic": "persistence",
            "techniques": [
              "T1098"
            ],
            "observables": [
              "Silent password resets (without force-change requirement)",
              "Assignment of education licenses",
              "Granting of privileged account attributes"
            ]
          },
          {
            "name": "Graph API Privilege Escalation",
            "slug": "privilege-escalation-graph-abuse",
            "tactic": "privilege-escalation",
            "techniques": [
              "T1098.003"
            ],
            "observables": [
              "Self-provisioning of PnP Management Shell service principal",
              "Granting AppCatalog.ReadWrite.All permission",
              "Broad Microsoft Graph permissions grant",
              "Full control over SharePoint API"
            ]
          },
          {
            "name": "SharePoint and OneDrive Storage Abuse",
            "slug": "collection-resource-hosting-abuse",
            "tactic": "collection",
            "techniques": [
              "T1560"
            ],
            "observables": [
              "Abuse of SharePoint as bulk hosting platform",
              "Abuse of OneDrive for phishing content hosting",
              "Conversion of hijacked storage into sellable products"
            ]
          },
          {
            "name": "DNS Management and Domain Routing",
            "slug": "command-and-control-dns-routing",
            "tactic": "command-and-control",
            "techniques": [
              "T1090.003",
              "T1568"
            ],
            "observables": [
              "Custom DNS management platform",
              "Cloudflare domain-routing configurations",
              "jewishchoice.org",
              "AI-generated nonprofit web presence"
            ]
          },
          {
            "name": "Real-time Phishing and Exfiltration",
            "slug": "exfiltration-interactive-credential-harvesting",
            "tactic": "exfiltration",
            "techniques": [
              "T1566",
              "T1041"
            ],
            "observables": [
              "WebSocket connections for real-time victim interaction",
              "Telegram bot tokens and chat IDs for exfiltration",
              "Iron Man System phishing kit",
              "Credential harvesting (usernames, passwords, credit card info)"
            ]
          }
        ],
        "summary": "Storm-3119 (YAM Store) functions as an infrastructure broker that hijacks Microsoft 365 and Azure environments through automated reconnaissance and application-level credential abuse. These compromised environments and PaaS phishing kits (Storm-2990) are then used by downstream actors to conduct large-scale credential and financial theft, leveraging real-time victim interaction via WebSockets and Telegram."
      },
      "severity": "high",
      "rationale": "Focus on departments with high-value cloud access, such as finance or executive administration, as these are the primary targets for tenant hijacking.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is operating the Iron Man System phishing kit to harvest credentials in real-time, using specific domains for infrastructure management and Telegram for automated exfiltration.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "Analyst scoping",
            "kind": "manual",
            "observed": "2026-10-14"
          },
          "type": "list[host]",
          "default": [],
          "description": "Optional list of hostnames to focus the hunt; leave empty to scan the estate."
        },
        "lookback_days": {
          "from": {
            "ref": "Standard retention window",
            "kind": "manual",
            "observed": "2026-10-14"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "reported_domains": {
          "from": {
            "ref": "Microsoft Storm-3119 Report",
            "kind": "article",
            "observed": "2026-10-14"
          },
          "type": "list[domain]",
          "default": [
            "jewishchoice.org"
          ],
          "description": "Malicious domains linked to Storm-3119 infrastructure management."
        },
        "target_software_keywords": {
          "from": {
            "ref": "Reported target platforms",
            "kind": "manual",
            "observed": "2026-10-14"
          },
          "type": "list[string]",
          "default": [
            "Google Drive",
            "SharePoint",
            "OneDrive",
            "Microsoft 365"
          ],
          "description": "Software keywords to identify high-value target hosts."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/",
          "name": "The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime"
        }
      ],
      "blind_spots": [
        {
          "id": "encrypted-websocket-blind-spot",
          "risk": "Standard endpoint telemetry shows encrypted 443 traffic but not the protocol upgrade, necessitating reliance on packet-volume heuristics.",
          "stage": "exfiltration-interactive-credential-harvesting",
          "question": "Are the high-volume outbound connections confirmed to be WebSocket (HTTP Upgrade) traffic?",
          "requires": "TLS decryption at the network proxy"
        },
        {
          "id": "non-http-telegram",
          "risk": "If the kit bypasses the HTTPS Bot API, it will not appear on the hb_http_activity surface.",
          "stage": "exfiltration-interactive-credential-harvesting",
          "question": "Is the actor using a non-HTTP method or MTProto for Telegram exfiltration?",
          "requires": "hb_network_connection with destination IP attribution for Telegram"
        }
      ]
    },
    "name": "Phishing Infrastructure and Interactive Exfiltration",
    "description": "This hunt targets the interactive phases of the Storm-2990 and Storm-3119 phishing ecosystem. It focuses on the behavioral hallmarks of the Iron Man System: high-frequency WebSocket-like traffic for real-time operator-victim interaction and exfiltration via the Telegram Bot API. The hunt first scopes to hosts running core productivity software targeted by this group, then fans out to identify connections to reported infrastructure and behavioral exfiltration patterns. An agent triages the converged evidence to distinguish legitimate application traffic from active phishing sessions."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime",
          "index": 2,
          "title": "The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime",
          "total": 2
        },
        "coverage": [
          {
            "stage": "command-and-control-dns-routing",
            "steps": [
              "dns-infrastructure-leads"
            ],
            "status": "covered"
          },
          {
            "stage": "exfiltration-interactive-credential-harvesting",
            "steps": [
              "interactive-websocket-heuristics",
              "telegram-bot-exfiltration"
            ],
            "status": "covered"
          },
          {
            "stage": "reconnaissance-automated-cloud-profiling",
            "reason": "Belongs to another part of the 'The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "initial-access-app-only-auth",
            "reason": "Belongs to another part of the 'The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "persistence-account-manipulation",
            "reason": "Belongs to another part of the 'The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "privilege-escalation-graph-abuse",
            "reason": "Belongs to another part of the 'The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "collection-resource-hosting-abuse",
            "reason": "Belongs to another part of the 'The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary is operating the Iron Man System phishing kit to harvest credentials in real-time, using specific domains for infrastructure management and Telegram for automated exfiltration.",
        "blind_spots": [
          {
            "id": "encrypted-websocket-blind-spot",
            "risk": "Standard endpoint telemetry shows encrypted 443 traffic but not the protocol upgrade, necessitating reliance on packet-volume heuristics.",
            "stage": "exfiltration-interactive-credential-harvesting",
            "question": "Are the high-volume outbound connections confirmed to be WebSocket (HTTP Upgrade) traffic?",
            "requires": "TLS decryption at the network proxy"
          },
          {
            "id": "non-http-telegram",
            "risk": "If the kit bypasses the HTTPS Bot API, it will not appear on the hb_http_activity surface.",
            "stage": "exfiltration-interactive-credential-harvesting",
            "question": "Is the actor using a non-HTTP method or MTProto for Telegram exfiltration?",
            "requires": "hb_network_connection with destination IP attribution for Telegram"
          }
        ],
        "scoping_notes": "Focus on departments with high-value cloud access, such as finance or executive administration, as these are the primary targets for tenant hijacking.",
        "beyond_detection": "A simple detection rule for jewishchoice.org is easily bypassed. This hunt combines specific scoping, behavioral network heuristics for WebSockets, and exfiltration pattern analysis into a single decision, which avoids the false positives a single heuristic rule would generate."
      }
    },
    {
      "id": "scoping-targeted-software",
      "type": "query",
      "label": "Scope to hosts with targeted productivity software",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (instr(',' || '{{target_software_keywords}}' || ',', ',' || package_name || ',') > 0 OR LOWER(package_name) LIKE '%microsoft 365%' OR LOWER(package_name) LIKE '%sharepoint%')",
        "surface": "hb_software_inventory",
        "description": "Find hosts running business productivity software that are the reported targets for this infrastructure abuse.",
        "expected_signal": "A list of hosts that run the software targeted for hijacking. Silence does not prove absence of threat but narrows the hunt to the most likely beachheads."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Scope to hosts with targeted productivity software",
        "reads": [
          "device_hostname",
          "package_name",
          "package_version"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (instr(',' || '{{target_software_keywords}}' || ',', ',' || package_name || ',') > 0 OR LOWER(package_name) LIKE '%microsoft 365%' OR LOWER(package_name) LIKE '%sharepoint%')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hosts that run the software targeted for hijacking. Silence does not prove absence of threat but narrows the hunt to the most likely beachheads.",
        "verified": "dry-run",
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "dns-infrastructure-leads",
      "type": "query",
      "label": "DNS lookups to reported management infrastructure",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, query_hostname, query_type, time FROM hb_dns_activity WHERE (instr(',' || '{{reported_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%jewishchoice.org%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_dns_activity",
        "description": "Find any host resolving domains linked to the Storm-3119 management infrastructure.",
        "expected_signal": "A resolution of jewishchoice.org or other reported domains. This is a high-confidence lead for interaction with the management infrastructure."
      },
      "parents": [
        {
          "id": "scoping-targeted-software"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "DNS lookups to reported management infrastructure",
        "reads": [
          "device_hostname",
          "query_hostname",
          "query_type",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, query_hostname, query_type, time FROM hb_dns_activity WHERE (instr(',' || '{{reported_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%jewishchoice.org%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A resolution of jewishchoice.org or other reported domains. This is a high-confidence lead for interaction with the management infrastructure.",
        "verified": "dry-run",
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "interactive-websocket-heuristics",
      "type": "query",
      "label": "Interactive high-packet outbound sessions",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, COUNT(*) as connection_count, SUM(traffic_packets) as total_packets, MIN(time) as first_seen FROM hb_network_connection WHERE dst_endpoint_port = 443 AND state_kind = 'log' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip HAVING total_packets > 500",
        "surface": "hb_network_connection",
        "description": "Identify hosts with sustained, high-packet outbound traffic on port 443, characteristic of interactive phishing sessions.",
        "expected_signal": "High packet volume to an external IP seen on few hosts suggests a long-lived session like a WebSocket used for interactive harvesting."
      },
      "parents": [
        {
          "id": "scoping-targeted-software"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Interactive high-packet outbound sessions",
        "reads": [
          "device_hostname",
          "dst_endpoint_ip",
          "dst_endpoint_port",
          "traffic_packets",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, COUNT(*) as connection_count, SUM(traffic_packets) as total_packets, MIN(time) as first_seen FROM hb_network_connection WHERE dst_endpoint_port = 443 AND state_kind = 'log' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip HAVING total_packets > 500",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "new_this_window"
        },
        "expected": "High packet volume to an external IP seen on few hosts suggests a long-lived session like a WebSocket used for interactive harvesting.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "dst_endpoint_ip"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "telegram-bot-exfiltration",
      "type": "query",
      "label": "Telegram Bot API exfiltration",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, user_agent, time FROM hb_http_activity WHERE (LOWER(url_hostname) = 'api.telegram.org' AND LOWER(url_path) LIKE '/bot%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Detect direct connections to the Telegram Bot API used for real-time exfiltration notifications.",
        "expected_signal": "Requests to api.telegram.org/bot are the primary channel for the Iron Man System's real-time exfiltration alerts."
      },
      "parents": [
        {
          "id": "scoping-targeted-software"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Telegram Bot API exfiltration",
        "reads": [
          "device_hostname",
          "url_hostname",
          "url_path",
          "user_agent",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, user_agent, time FROM hb_http_activity WHERE (LOWER(url_hostname) = 'api.telegram.org' AND LOWER(url_path) LIKE '/bot%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Requests to api.telegram.org/bot are the primary channel for the Iron Man System's real-time exfiltration alerts.",
        "verified": "dry-run",
        "verified_at": "2026-10-15"
      }
    },
    {
      "id": "triage-phishing-activity",
      "type": "analytic",
      "label": "Phishing session triage",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network",
          "web"
        ],
        "context": [
          "scoping-targeted-software",
          "dns-infrastructure-leads",
          "interactive-websocket-heuristics",
          "telegram-bot-exfiltration"
        ],
        "objective": "Determine if any host shows signs of interactive phishing through a combination of Storm-3119 management domain hits, high-volume WebSocket heuristics, and Telegram exfiltration.",
        "description": "Synthesize infrastructure leads and behavioral exfiltration signals to identify compromised hosts.",
        "max_iterations": 4,
        "expected_signal": "A per-host verdict linking targeted software usage, DNS infrastructure resolutions, and behavioral exfiltration.",
        "success_criteria": "A verdict of malicious, suspicious, or benign per host, citing specific rows from the DNS and HTTP surfaces."
      },
      "parents": [
        {
          "id": "dns-infrastructure-leads",
          "kind": "merge"
        },
        {
          "id": "interactive-websocket-heuristics",
          "kind": "merge"
        },
        {
          "id": "telegram-bot-exfiltration",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on triage verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious for at least one host based on concurrent DNS and HTTP exfiltration signals",
        "condition": "the triage verdict is malicious for at least one host based on concurrent DNS and HTTP exfiltration signals",
        "blind_spot": "encrypted-websocket-blind-spot",
        "confidence": "high",
        "description": "Route findings for immediate containment or analyst review.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-phishing-activity"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate compromised host",
      "config": {
        "target": "endpoint",
        "description": "Stop further exfiltration of credentials during an active session.",
        "instructions": "Isolate the host immediately. Revoke any active Microsoft 365 or Google cloud sessions for the user logged in at the time of the exfiltration signal.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-investigation",
      "type": "task",
      "label": "Investigate interactive phishing lures",
      "config": {
        "assignee": "analyst",
        "description": "Analyze the victim's interaction and identify the specific phishing template used.",
        "instructions": "Review browser history and cache on the isolated host to find the initial phishing URL. Extract bot tokens from the Telegram API request paths if visible in the HTTP logs."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Hunt close-out",
      "config": {
        "assignee": "analyst",
        "description": "Document results and update blocklists.",
        "instructions": "Record the findings. Update organizational blocklists with any newly identified malicious domains or IPs found during the analyst investigation."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-investigation"
        }
      ]
    }
  ]
}