{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "The php2shell vulnerability represents a critical RCE threat to PHP-based web applications, and its exploitation for ransomware by INC and The Gentlemen affiliates has severe operational impact."
      },
      "name": "PHP2Shell RCE and Ransomware Execution",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1486",
        "attack.t1059.003",
        "attack.t1082",
        "discovery",
        "execution",
        "impact",
        "initial access"
      ],
      "related": [
        {
          "hunt": "generic-php-webshell-behavior",
          "reason": "Adversaries may use the same PHP2Shell exploit to drop generic webshells without proceeding to ransomware.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "This hunt correlates the presence of unpatched software, network-level exploit attempts, and behavioral encryption patterns to identify a complete intrusion chain that a single detection rule would miss.",
      "coverage": [
        {
          "stage": "vulnerability-identification-eol-php",
          "steps": [
            "scope-vulnerable-php"
          ],
          "status": "covered"
        },
        {
          "stage": "initial-access-php2shell-rce",
          "steps": [
            "http-exploit-requests",
            "php-child-interpreters"
          ],
          "status": "covered"
        },
        {
          "stage": "execution-payload-deployment",
          "steps": [
            "malicious-payloads"
          ],
          "status": "covered"
        },
        {
          "stage": "impact-data-encryption",
          "steps": [
            "bulk-file-encryption"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Identification of Vulnerable PHP Environments",
            "slug": "vulnerability-identification-eol-php",
            "tactic": "discovery",
            "techniques": [
              "T1082"
            ],
            "observables": [
              "PHP versions 5.4 through 8.1",
              "End of Life (EOL) PHP branches",
              "WordPress, Drupal, Magento, Shopware, WooCommerce"
            ]
          },
          {
            "name": "PHP2Shell Remote Code Execution",
            "slug": "initial-access-php2shell-rce",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "Simple HTTP request",
              "php2shell",
              "Targeting WordPress, Drupal, or Magento installations"
            ]
          },
          {
            "name": "Malicious Payload Execution",
            "slug": "execution-payload-deployment",
            "tactic": "execution",
            "techniques": [
              "T1059.003"
            ],
            "observables": [
              "sample.exe",
              "cca616647db9370c88998ae25da6997f.exe",
              "485055033bcddfde56325c0d2feea4f2.exe",
              "d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1.exe",
              "Win.Tool.Kmsauto",
              "Win.Worm.Zard"
            ]
          },
          {
            "name": "Ransomware Encryption",
            "slug": "impact-data-encryption",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "INC Ransomware encryptor builds",
              "The Gentlemen ransomware encryptor builds"
            ]
          }
        ],
        "summary": "Attackers exploit 'php2shell' unauthenticated RCE vulnerabilities in PHP versions 5.4 through 8.1 via crafted HTTP requests to gain initial access. This exploitation is being leveraged by ransomware affiliates like INC and The Gentlemen to execute malicious payloads, including encryptors and administrative tools."
      },
      "severity": "critical",
      "rationale": "Start with internet-exposed servers in the DMZ. Use the scoping step to identify hosts where the software inventory confirms PHP 8.1 or older.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has exploited the php2shell unauthenticated RCE vulnerability on a host running an end-of-life PHP version to deploy ransomware and encrypt local data.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Hosts identified as running vulnerable PHP; if empty, the whole estate is searched."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "payload_names": {
          "from": {
            "ref": "https://blog.talosintelligence.com/i-had-plans-for-that-second/",
            "kind": "article",
            "observed": "2026-10-22"
          },
          "type": "list[path]",
          "default": [
            "sample.exe",
            "cca616647db9370c88998ae25da6997f.exe",
            "485055033bcddfde56325c0d2feea4f2.exe",
            "d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1.exe"
          ],
          "description": "Filenames associated with malicious activity."
        },
        "payload_hashes": {
          "from": {
            "ref": "https://blog.talosintelligence.com/i-had-plans-for-that-second/",
            "kind": "article",
            "observed": "2026-10-22"
          },
          "type": "list[hash]",
          "default": [
            "9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507",
            "7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f",
            "985c3972712218c62d2418b41056dba5fe883ca5104d8ec12041f8611db344f9",
            "d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1"
          ],
          "description": "SHA256 hashes of payloads from the Talos report."
        },
        "interpreter_names": {
          "from": {
            "ref": "Common tradecraft",
            "kind": "manual",
            "observed": "2024-05-20"
          },
          "type": "list[string]",
          "default": [
            "cmd.exe",
            "powershell.exe",
            "sh",
            "bash",
            "python",
            "curl",
            "wget"
          ],
          "description": "Common shell and utility binaries launched by web servers after exploitation."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://blog.talosintelligence.com/i-had-plans-for-that-second/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://blog.talosintelligence.com/i-had-plans-for-that-second/",
          "name": "Cisco Talos \u2014 I had plans for that second"
        }
      ],
      "blind_spots": [
        {
          "id": "no-file-telemetry",
          "risk": "Massive encryption activity might not emit sufficient rows to be identified by a count-based baseline.",
          "stage": "impact-data-encryption",
          "question": "whether encryption is occurring on hosts where file logging is suppressed for high-volume processes",
          "requires": "hb_file_activity with bulk modification logging"
        },
        {
          "id": "http-visibility",
          "risk": "Exploits delivered over encrypted channels will not be visible in raw HTTP logs without decryption.",
          "stage": "initial-access-php2shell-rce",
          "question": "whether the exploit attempt is visible in HTTPS traffic",
          "requires": "hb_http_activity with SSL decryption"
        }
      ]
    },
    "name": "PHP2Shell RCE and Ransomware Execution",
    "description": "This phased hunt identifies internet-facing hosts running vulnerable, end-of-life PHP versions (5.4 through 8.1) and investigates signs of the php2shell RCE. The first phase looks for suspicious HTTP requests and unusual child processes spawned by the PHP interpreter. The second phase follows these leads to identify the deployment of specific ransomware payloads mentioned in the Talos research and evidence of mass file encryption. The hunt concludes by routing suspicious hosts for immediate isolation and analyst review."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "vulnerability-identification-eol-php",
            "steps": [
              "scope-vulnerable-php"
            ],
            "status": "covered"
          },
          {
            "stage": "initial-access-php2shell-rce",
            "steps": [
              "http-exploit-requests",
              "php-child-interpreters"
            ],
            "status": "covered"
          },
          {
            "stage": "execution-payload-deployment",
            "steps": [
              "malicious-payloads"
            ],
            "status": "covered"
          },
          {
            "stage": "impact-data-encryption",
            "steps": [
              "bulk-file-encryption"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary has exploited the php2shell unauthenticated RCE vulnerability on a host running an end-of-life PHP version to deploy ransomware and encrypt local data.",
        "blind_spots": [
          {
            "id": "no-file-telemetry",
            "risk": "Massive encryption activity might not emit sufficient rows to be identified by a count-based baseline.",
            "stage": "impact-data-encryption",
            "question": "whether encryption is occurring on hosts where file logging is suppressed for high-volume processes",
            "requires": "hb_file_activity with bulk modification logging"
          },
          {
            "id": "http-visibility",
            "risk": "Exploits delivered over encrypted channels will not be visible in raw HTTP logs without decryption.",
            "stage": "initial-access-php2shell-rce",
            "question": "whether the exploit attempt is visible in HTTPS traffic",
            "requires": "hb_http_activity with SSL decryption"
          }
        ],
        "scoping_notes": "Start with internet-exposed servers in the DMZ. Use the scoping step to identify hosts where the software inventory confirms PHP 8.1 or older.",
        "beyond_detection": "This hunt correlates the presence of unpatched software, network-level exploit attempts, and behavioral encryption patterns to identify a complete intrusion chain that a single detection rule would miss."
      }
    },
    {
      "id": "scope-vulnerable-php",
      "type": "query",
      "label": "Identify EOL PHP environments",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%php%' OR LOWER(package_name) LIKE '%wordpress%' OR LOWER(package_name) LIKE '%drupal%' OR LOWER(package_name) LIKE '%magento%' OR LOWER(package_name) LIKE '%shopware%' OR LOWER(package_name) LIKE '%woocommerce%') AND (package_version LIKE '5.%' OR package_version LIKE '6.%' OR package_version LIKE '7.%' OR package_version LIKE '8.0%' OR package_version LIKE '8.1%')",
        "surface": "hb_software_inventory",
        "description": "Scope the estate to hosts running PHP versions 5.4 through 8.1 which are susceptible to PHP2Shell.",
        "expected_signal": "A list of hosts and their PHP versions. Zero rows means no vulnerable versions are recorded in the inventory."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify EOL PHP environments",
        "reads": [
          "device_hostname",
          "install_path",
          "package_name",
          "package_version"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%php%' OR LOWER(package_name) LIKE '%wordpress%' OR LOWER(package_name) LIKE '%drupal%' OR LOWER(package_name) LIKE '%magento%' OR LOWER(package_name) LIKE '%shopware%' OR LOWER(package_name) LIKE '%woocommerce%') AND (package_version LIKE '5.%' OR package_version LIKE '6.%' OR package_version LIKE '7.%' OR package_version LIKE '8.0%' OR package_version LIKE '8.1%')",
        "silence": "evidence_of_absence",
        "expected": "A list of hosts and their PHP versions. Zero rows means no vulnerable versions are recorded in the inventory.",
        "verified": "dry-run",
        "verified_at": "2026-10-23"
      }
    },
    {
      "id": "http-exploit-requests",
      "type": "query",
      "label": "HTTP requests to PHP targets",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "web",
        "content": "SELECT device_hostname, url_path, url_query, src_endpoint_ip, status_code, time FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(url_path) LIKE '%.php%' OR LOWER(url_query) LIKE '%php2shell%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Find HTTP requests targeting PHP endpoints or application-specific paths on the scoped hosts.",
        "expected_signal": "Unusual HTTP requests targeting PHP scripts, potentially containing exploit strings."
      },
      "parents": [
        {
          "id": "scope-vulnerable-php"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "HTTP requests to PHP targets",
        "reads": [
          "device_hostname",
          "src_endpoint_ip",
          "status_code",
          "time",
          "url_path",
          "url_query"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_path, url_query, src_endpoint_ip, status_code, time FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(url_path) LIKE '%.php%' OR LOWER(url_query) LIKE '%php2shell%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Unusual HTTP requests targeting PHP scripts, potentially containing exploit strings.",
        "verified": "dry-run",
        "verified_at": "2026-10-23"
      }
    },
    {
      "id": "php-child-interpreters",
      "type": "query",
      "label": "PHP spawning shells or interpreters",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND LOWER(parent_process_name) LIKE '%php%' AND (instr(',' || '{{interpreter_names}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0 OR instr(',' || '{{interpreter_names}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Identify if a PHP interpreter launched a shell or common utility, indicating code execution.",
        "expected_signal": "Processes like cmd.exe or sh whose parent is a PHP binary. This is highly indicative of successful RCE."
      },
      "parents": [
        {
          "id": "scope-vulnerable-php"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "PHP spawning shells or interpreters",
        "reads": [
          "device_hostname",
          "parent_process_name",
          "process_cmd_line",
          "process_name",
          "process_original_file_name",
          "time",
          "user_name"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND LOWER(parent_process_name) LIKE '%php%' AND (instr(',' || '{{interpreter_names}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0 OR instr(',' || '{{interpreter_names}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Processes like cmd.exe or sh whose parent is a PHP binary. This is highly indicative of successful RCE.",
        "verified": "dry-run",
        "verified_at": "2026-10-23"
      }
    },
    {
      "id": "early-triage",
      "type": "analytic",
      "label": "Evaluate early-stage signals",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "web"
        ],
        "context": [
          "scope-vulnerable-php",
          "http-exploit-requests",
          "php-child-interpreters"
        ],
        "objective": "Determine if any host running EOL PHP has been targeted by an HTTP request that resulted in an unusual shell or utility launch.",
        "description": "Analyze whether the scoping and access queries together prove a php2shell exploit attempt.",
        "max_iterations": 3,
        "expected_signal": "A host-by-host verdict on exploit success.",
        "success_criteria": "A per-host verdict citing specific rows from the process and HTTP surfaces."
      },
      "parents": [
        {
          "id": "http-exploit-requests",
          "kind": "merge"
        },
        {
          "id": "php-child-interpreters",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "malicious-payloads",
      "type": "query",
      "label": "Match known payload indicators",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, process_hash_sha256, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{payload_hashes}}' || ',', ',' || LOWER(process_hash_sha256) || ',') > 0 OR instr(',' || '{{payload_names}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Search for the specific SHA256 hashes and executables used by INC and The Gentlemen ransomware.",
        "expected_signal": "Execution of a binary matching the report's hashes or names. Any hit is high confidence for payload deployment."
      },
      "parents": [
        {
          "id": "early-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Match known payload indicators",
        "reads": [
          "device_hostname",
          "process_cmd_line",
          "process_hash_sha256",
          "process_name",
          "process_original_file_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, process_hash_sha256, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{payload_hashes}}' || ',', ',' || LOWER(process_hash_sha256) || ',') > 0 OR instr(',' || '{{payload_names}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Execution of a binary matching the report's hashes or names. Any hit is high confidence for payload deployment.",
        "verified": "dry-run",
        "verified_at": "2026-10-23"
      }
    },
    {
      "id": "bulk-file-encryption",
      "type": "query",
      "label": "Detection of mass file modifications",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, COUNT(DISTINCT file_path) AS unique_files, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id IN (1, 3, 5) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name HAVING unique_files > 100",
        "surface": "hb_file_activity",
        "description": "Identify processes performing high-volume file modifications, indicative of encryption.",
        "expected_signal": "A process modifying over 100 files on a single host. If that process matches the payload query, impact is confirmed."
      },
      "parents": [
        {
          "id": "early-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Detection of mass file modifications",
        "reads": [
          "activity_id",
          "device_hostname",
          "file_path",
          "process_name",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, COUNT(DISTINCT file_path) AS unique_files, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id IN (1, 3, 5) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name HAVING unique_files > 100",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "new_this_window"
        },
        "expected": "A process modifying over 100 files on a single host. If that process matches the payload query, impact is confirmed.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "process_name"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-23"
      }
    },
    {
      "id": "follow-on-triage",
      "type": "analytic",
      "label": "Evaluate full intrusion chain",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "web"
        ],
        "context": [
          "early-triage",
          "malicious-payloads",
          "bulk-file-encryption"
        ],
        "objective": "Confirm if the early-stage RCE indicators on PHP hosts correlate with the identified ransomware payload execution and mass file modification.",
        "description": "Weigh the evidence from all stages to confirm a successful PHP-to-ransomware intrusion.",
        "max_iterations": 4,
        "expected_signal": "A final verdict linking the RCE beachhead to the ransomware impact.",
        "success_criteria": "A definitive verdict for each host showing at least two stages of the chain."
      },
      "parents": [
        {
          "id": "malicious-payloads",
          "kind": "merge"
        },
        {
          "id": "bulk-file-encryption",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on final verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the follow-on-triage verdict is malicious for at least one host",
        "condition": "the follow-on-triage verdict is malicious for at least one host",
        "blind_spot": "no-file-telemetry",
        "confidence": "high",
        "description": "Take immediate containment action if a ransomware intrusion is confirmed.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "follow-on-triage"
        }
      ]
    },
    {
      "id": "contain-host",
      "type": "action",
      "label": "Isolate affected host",
      "config": {
        "target": "endpoint",
        "description": "Halt the spread of ransomware and stop data destruction.",
        "instructions": "Isolate the host and collect the malicious binary for forensic analysis.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Intrusion confirmation",
      "config": {
        "assignee": "analyst",
        "description": "A human analyst reviews the evidence chain to plan full remediation.",
        "instructions": "Review the agent's citations. Verify the PHP version on the target and the source of the HTTP request. If encryption is confirmed, initiate the ransomware recovery playbook."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "contain-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Document the hunt's findings and note vulnerable hosts for patching.",
        "instructions": "Record that no active intrusion was found. Note any EOL PHP hosts for immediate update to PHP 8.2+ as per the advisory."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-review"
        }
      ]
    }
  ]
}