{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Phishing is the primary entry point for modern attacks, and multi-hop proxies are the standard for hiding adversary infrastructure. A negative result across the estate provides high confidence that these specific vectors are not being exploited."
      },
      "name": "Phishing and Multi-hop Proxy Detection",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1566",
        "attack.t1090.003"
      ],
      "related": [
        {
          "hunt": "dns-tunneling-detection",
          "reason": "This hunt focuses on established proxy protocols on specific ports; DNS tunneling requires different logic over hb_dns_activity.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A single rule may fire on an interpreter spawning from a browser, but this hunt correlates that event with a rare network connection on proxy-associated ports using prevalence to filter out noise, providing context a static rule cannot.",
      "coverage": [
        {
          "stage": "initial-access-phishing",
          "steps": [
            "phishing-interpreters"
          ],
          "status": "covered"
        },
        {
          "stage": "c2-multi-hop-proxy",
          "steps": [
            "rare-proxy-connections"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Phishing Delivery",
            "slug": "initial-access-phishing",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "Malicious links in HTTP requests",
              "Creation of executable or script files from email clients",
              "Suspicious child processes spawned by web browsers or mail applications",
              "Navigation to known credential harvesting or malware delivery domains"
            ]
          },
          {
            "name": "Multi-hop Proxy C2",
            "slug": "c2-multi-hop-proxy",
            "tactic": "command-and-control",
            "techniques": [
              "T1090.003"
            ],
            "observables": [
              "Network connections to known Tor exit nodes",
              "DNS queries for .onion domains",
              "Traffic to virtual private servers (VPS) or IoT device ranges associated with ORB networks",
              "Chained proxy communication patterns across multiple external IP addresses"
            ]
          }
        ],
        "summary": "This campaign involves an adversary gaining initial access through phishing messages containing malicious links or attachments. Once access is established, the attacker utilizes multi-hop proxy techniques, including Tor or operational relay box (ORB) networks, to obfuscate command-and-control traffic and hinder origin identification."
      },
      "severity": "medium",
      "rationale": "Focus on user-facing workstations rather than backend servers. Prioritize hosts where browsers and mail clients are actively used.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has gained initial access through a phishing lure and is communicating with a multi-hop proxy or ORB network to disguise command-and-control traffic.",
      "parameters": {
        "parent_apps": {
          "from": {
            "ref": "threat-intel",
            "kind": "manual",
            "observed": "2026-08-03"
          },
          "type": "list[string]",
          "default": [
            "outlook.exe",
            "winmail.exe",
            "chrome.exe",
            "msedge.exe",
            "firefox.exe"
          ],
          "description": "Common mail clients and browsers that serve as phishing vectors."
        },
        "proxy_ports": {
          "from": {
            "ref": "threat-intel",
            "kind": "manual",
            "observed": "2026-08-03"
          },
          "type": "list[string]",
          "default": [
            "9001",
            "9050",
            "9150",
            "1080",
            "8080"
          ],
          "description": "Ports commonly used by Tor nodes and SOCKS proxies."
        },
        "scope_hosts": {
          "from": {
            "ref": "analyst-input",
            "kind": "manual",
            "observed": "2026-08-03"
          },
          "type": "list[host]",
          "default": [],
          "description": "Limit the hunt to specific hosts; leave empty for the entire estate."
        },
        "interpreters": {
          "from": {
            "ref": "threat-intel",
            "kind": "manual",
            "observed": "2026-08-03"
          },
          "type": "list[string]",
          "default": [
            "powershell.exe",
            "pwsh.exe",
            "cmd.exe",
            "wscript.exe",
            "cscript.exe"
          ],
          "description": "Executables used to run malicious code after a phishing hit."
        },
        "lookback_days": {
          "from": {
            "ref": "threat-lead",
            "kind": "manual",
            "observed": "2026-08-03"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.elastic.co/security-labs/blog/soc-case-management-detection-rule-history",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.elastic.co/security-labs/blog/soc-case-management-detection-rule-history",
          "name": "Elastic Security \u2014 SOC case management and detection rule history"
        },
        {
          "url": "https://attack.mitre.org/techniques/T1090/003/",
          "name": "MITRE ATT&CK \u2014 Multi-hop Proxy"
        }
      ],
      "blind_spots": [
        {
          "id": "no-process-to-network-correlation",
          "risk": "On hosts where network logs lack a process ID, the agent cannot definitively link the interpreter to the proxy traffic, resulting in an unavailable verdict.",
          "stage": "c2-multi-hop-proxy",
          "question": "Which process initiated the rare connection?",
          "requires": "Process-enriched network logs (e.g. Sysmon) on all endpoints"
        },
        {
          "id": "encrypted-internal-traffic",
          "risk": "We can observe the proxy connection but not the actual C2 commands, making it difficult to assess the extent of the intrusion without host forensics.",
          "stage": "c2-multi-hop-proxy",
          "question": "What commands were sent inside the proxy tunnel?",
          "requires": "TLS inspection or JA3 fingerprinting"
        }
      ]
    },
    "name": "Phishing and Multi-hop Proxy Detection",
    "description": "This hunt identifies the transition from initial access to obfuscated command-and-control by correlating suspicious process spawns from productivity applications with rare outbound network connections on common proxy ports. It targets the pattern where a user opens a malicious attachment or link that launches an interpreter, which then initiates a multi-hop connection to an external relay box or Tor node. The hunt fans out across process and network telemetry to verify if a single host shows both the delivery phase and the communication phase of an intrusion."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "initial-access-phishing",
            "steps": [
              "phishing-interpreters"
            ],
            "status": "covered"
          },
          {
            "stage": "c2-multi-hop-proxy",
            "steps": [
              "rare-proxy-connections"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary has gained initial access through a phishing lure and is communicating with a multi-hop proxy or ORB network to disguise command-and-control traffic.",
        "blind_spots": [
          {
            "id": "no-process-to-network-correlation",
            "risk": "On hosts where network logs lack a process ID, the agent cannot definitively link the interpreter to the proxy traffic, resulting in an unavailable verdict.",
            "stage": "c2-multi-hop-proxy",
            "question": "Which process initiated the rare connection?",
            "requires": "Process-enriched network logs (e.g. Sysmon) on all endpoints"
          },
          {
            "id": "encrypted-internal-traffic",
            "risk": "We can observe the proxy connection but not the actual C2 commands, making it difficult to assess the extent of the intrusion without host forensics.",
            "stage": "c2-multi-hop-proxy",
            "question": "What commands were sent inside the proxy tunnel?",
            "requires": "TLS inspection or JA3 fingerprinting"
          }
        ],
        "scoping_notes": "Focus on user-facing workstations rather than backend servers. Prioritize hosts where browsers and mail clients are actively used.",
        "beyond_detection": "A single rule may fire on an interpreter spawning from a browser, but this hunt correlates that event with a rare network connection on proxy-associated ports using prevalence to filter out noise, providing context a static rule cannot."
      }
    },
    {
      "id": "workstation-scoping",
      "type": "query",
      "label": "Scope to workstations with productivity apps",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE instr(',' || '{{parent_apps}}' || ',', ',' || LOWER(package_name) || ',') > 0",
        "surface": "hb_software_inventory",
        "description": "Identify hosts in the estate that have common phishing vectors installed.",
        "expected_signal": "A list of hostnames. Silence suggests no managed productivity apps from the list are present on the surveyed hosts."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Scope to workstations with productivity apps",
        "reads": [
          "device_hostname",
          "package_name"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE instr(',' || '{{parent_apps}}' || ',', ',' || LOWER(package_name) || ',') > 0",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames. Silence suggests no managed productivity apps from the list are present on the surveyed hosts.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "phishing-interpreters",
      "type": "query",
      "label": "Interpreters spawned by productivity apps",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, parent_process_name, process_cmd_line, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id = 1 AND instr(',' || '{{parent_apps}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 AND instr(',' || '{{interpreters}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Detect suspicious child processes launched directly from mail clients or browsers.",
        "expected_signal": "Rows showing an interpreter being launched from a browser or email app. Silence means no such parent-child relationship was logged in this window."
      },
      "parents": [
        {
          "id": "workstation-scoping"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Interpreters spawned by productivity apps",
        "reads": [
          "device_hostname",
          "process_name",
          "parent_process_name",
          "process_cmd_line",
          "time",
          "activity_id"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, parent_process_name, process_cmd_line, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id = 1 AND instr(',' || '{{parent_apps}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 AND instr(',' || '{{interpreters}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Rows showing an interpreter being launched from a browser or email app. Silence means no such parent-child relationship was logged in this window.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "rare-proxy-connections",
      "type": "query",
      "label": "Rare outbound proxy connections",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, process_name, MIN(time) AS first_seen, COUNT(*) AS connections FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND state_kind = 'log' AND instr(',' || '{{proxy_ports}}' || ',', ',' || CAST(dst_endpoint_port AS TEXT) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip, dst_endpoint_port, process_name HAVING COUNT(DISTINCT device_hostname) <= 5",
        "surface": "hb_network_connection",
        "description": "Identify connections on known proxy ports that are rare across the fleet.",
        "expected_signal": "A connection to a proxy port involving a small number of hosts. Silence suggests no such connections or that the activity is fleet-wide."
      },
      "parents": [
        {
          "id": "workstation-scoping"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare outbound proxy connections",
        "reads": [
          "device_hostname",
          "dst_endpoint_ip",
          "dst_endpoint_port",
          "process_name",
          "time",
          "state_kind"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, process_name, MIN(time) AS first_seen, COUNT(*) AS connections FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND state_kind = 'log' AND instr(',' || '{{proxy_ports}}' || ',', ',' || CAST(dst_endpoint_port AS TEXT) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip, dst_endpoint_port, process_name HAVING COUNT(DISTINCT device_hostname) <= 5",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "A connection to a proxy port involving a small number of hosts. Silence suggests no such connections or that the activity is fleet-wide.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "dst_endpoint_ip",
            "dst_endpoint_port"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "triage-findings",
      "type": "analytic",
      "label": "Evaluate phishing and proxy correlation",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "phishing-interpreters",
          "rare-proxy-connections"
        ],
        "objective": "Determine whether the phishing leads and rare proxy connections together indicate a malicious intrusion on any single host.",
        "description": "Weigh the process launches and network connections per host to determine if an intrusion is in progress.",
        "max_iterations": 3,
        "expected_signal": "A per-host verdict citing specific process rows and their corresponding network activity.",
        "success_criteria": "A verdict of malicious | suspicious | benign for every host found in the queries."
      },
      "parents": [
        {
          "id": "phishing-interpreters",
          "kind": "merge"
        },
        {
          "id": "rare-proxy-connections",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-verdict",
      "type": "checkpoint",
      "label": "Route on triage verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious for at least one host",
        "condition": "the triage verdict is malicious for at least one host",
        "blind_spot": "no-process-to-network-correlation",
        "confidence": "high",
        "description": "Determine the next move based on the agent verdict.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-findings"
        }
      ]
    },
    {
      "id": "isolate-endpoint",
      "type": "action",
      "label": "Isolate infected host",
      "config": {
        "target": "endpoint",
        "description": "Stop the command-and-control channel by isolating the host.",
        "instructions": "Isolate the host and terminate the identified interpreter process.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "forensics-task",
      "type": "task",
      "label": "Perform forensic review",
      "config": {
        "assignee": "analyst",
        "description": "Investigate the source of the phishing and the intent of the proxy traffic.",
        "instructions": "Review the process command lines for encoded strings and inspect the user's email for the original phishing lure."
      },
      "parents": [
        {
          "id": "route-verdict",
          "branch": "default"
        },
        {
          "id": "route-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "route-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "isolate-endpoint"
        }
      ]
    },
    {
      "id": "close-out-task",
      "type": "task",
      "label": "Close out hunt",
      "config": {
        "assignee": "analyst",
        "description": "Record final results and update detection parameters.",
        "instructions": "Document any new C2 IPs or domains and determine if the scoping parameters need refinement."
      },
      "parents": [
        {
          "id": "forensics-task"
        }
      ]
    }
  ]
}