{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Adversaries use the inherent trust in commerce and SaaS infrastructure to bypass standard email authentication. A negative result confirms that these trusted delivery pipelines are not currently being used to deliver social-engineering lures to the estate."
      },
      "name": "Platform-as-a-Proxy Phishing and Input Abuse",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1566",
        "initial access"
      ],
      "related": [
        {
          "hunt": "m365-social-engineering-lure-detection",
          "reason": "This hunt focuses specifically on platform proxy abuse; broader phishing hunts cover general lure types.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A static detection rule on Staples or Dell order domains would create excessive noise. This hunt uses a gated flow to baseline normal brand activity first, then uses an agent to correlate lure keywords in cloud audit logs with registration patterns, identifying the specific 'Platform-as-a-Proxy' tradecraft that single-surface rules miss.",
      "coverage": [
        {
          "stage": "public-facing-input-injection",
          "steps": [
            "http-registration-abuse"
          ],
          "status": "covered"
        },
        {
          "stage": "legitimate-platform-phishing-delivery",
          "steps": [
            "dns-brand-lead",
            "m365-mail-lures"
          ],
          "status": "covered"
        },
        {
          "stage": "delivery-status-notification-abuse",
          "steps": [
            "m365-mail-lures"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Exploitation of Public-Facing Application Forms",
            "slug": "public-facing-input-injection",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "hostile string injected into name fields",
              "malicious strings in company or title registration fields",
              "cryptocurrency-themed lures in registration forms"
            ]
          },
          {
            "name": "High-Reputation Notification Phishing",
            "slug": "legitimate-platform-phishing-delivery",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "support@orders.staples.com",
              "received@order.dellcom",
              "order.dell.com",
              "Helpline 806 283 7712",
              "Helpline 808 232 6397",
              "Here\u2019s your Staples order #9939818875. Thanks for shopping with us.",
              "We have your order | Dell Purchase ID: 2009829958247",
              "Confirmed Order in shipping fields",
              "Call Our Sales Team in billing fields"
            ]
          },
          {
            "name": "Abuse of Mail Delivery Status Reports",
            "slug": "delivery-status-notification-abuse",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "Non-delivery report (NDR) carrying WeTransfer-themed lure",
              "Delivery status notification (DSN) with encapsulated phishing link",
              "WeTransfer file-sharing lure inside administrative mail wrapper"
            ]
          }
        ],
        "summary": "Adversaries are exploiting unvalidated input fields on legitimate SaaS and commerce platforms to inject malicious content into automated, high-reputation notifications. These 'Platform-as-a-Proxy' (PaaP) attacks leverage trusted infrastructure like Staples, Dell, and WeTransfer to deliver phishing lures, fake helplines, and fraudulent delivery status reports that bypass traditional email security filters."
      },
      "severity": "high",
      "rationale": "The hunt begins by identifying hosts running Microsoft 365, Office, or Cisco software. These systems are most relevant for phishing delivery and potential input abuse into corporate-facing applications.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is using trusted third-party retail or SaaS infrastructure to deliver social-engineering lures by injecting fraudulent helpline numbers into transactional notification fields or abusing public-facing registration forms.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Optional list of hosts identified in the scoping step; leave empty to hunt across the entire estate."
        },
        "brand_domains": {
          "from": {
            "ref": "https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/",
            "kind": "article",
            "observed": "2026-10-21"
          },
          "type": "list[domain]",
          "default": [
            "orders.staples.com",
            "order.dell.com",
            "order.dellcom"
          ],
          "description": "High-reputation domains identified in the report as being abused."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/",
          "name": "Talos \u2014 Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers"
        }
      ],
      "blind_spots": [
        {
          "id": "no-dns-telemetry",
          "risk": "Hosts using external DNS resolvers like 8.8.8.8 will not appear in hb_dns_activity, making the lead query incomplete.",
          "stage": "legitimate-platform-phishing-delivery",
          "question": "whether we see the lookup for the abused retail domain on every host",
          "requires": "Endpoint DNS logging or full recursive resolver logs"
        },
        {
          "id": "no-mail-body-inspection",
          "risk": "M365 audit logs show subjects and metadata but not the body content where the Helpline numbers live, necessitating manual review.",
          "stage": "legitimate-platform-phishing-delivery",
          "question": "what the specific fraudulent phone number was inside the email body",
          "requires": "Full email body indexing or Mail Gateway logs"
        },
        {
          "id": "no-http-body-visibility",
          "risk": "If the hostile string is sent in the request body rather than the URL query parameters, hb_http_activity will miss the lure content.",
          "stage": "public-facing-input-injection",
          "question": "what strings were injected into the POST body of registration forms",
          "requires": "hb_http_activity (request_body_len or full request_body)"
        }
      ]
    },
    "name": "Platform-as-a-Proxy Phishing and Input Abuse",
    "description": "This hunt identifies the subversion of legitimate commerce and SaaS pipelines where attackers inject malicious intent into fields that are later rendered into high-reputation, automated notifications. The hunt uses a gated flow, starting with a scoping of hosts running collaboration software and a cheap lead for DNS activity to abused retail domains, before fanning out to examine cloud audit logs for specific lures and HTTP traffic for registration form abuse."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "public-facing-input-injection",
            "steps": [
              "http-registration-abuse"
            ],
            "status": "covered"
          },
          {
            "stage": "legitimate-platform-phishing-delivery",
            "steps": [
              "dns-brand-lead",
              "m365-mail-lures"
            ],
            "status": "covered"
          },
          {
            "stage": "delivery-status-notification-abuse",
            "steps": [
              "m365-mail-lures"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary is using trusted third-party retail or SaaS infrastructure to deliver social-engineering lures by injecting fraudulent helpline numbers into transactional notification fields or abusing public-facing registration forms.",
        "blind_spots": [
          {
            "id": "no-dns-telemetry",
            "risk": "Hosts using external DNS resolvers like 8.8.8.8 will not appear in hb_dns_activity, making the lead query incomplete.",
            "stage": "legitimate-platform-phishing-delivery",
            "question": "whether we see the lookup for the abused retail domain on every host",
            "requires": "Endpoint DNS logging or full recursive resolver logs"
          },
          {
            "id": "no-mail-body-inspection",
            "risk": "M365 audit logs show subjects and metadata but not the body content where the Helpline numbers live, necessitating manual review.",
            "stage": "legitimate-platform-phishing-delivery",
            "question": "what the specific fraudulent phone number was inside the email body",
            "requires": "Full email body indexing or Mail Gateway logs"
          },
          {
            "id": "no-http-body-visibility",
            "risk": "If the hostile string is sent in the request body rather than the URL query parameters, hb_http_activity will miss the lure content.",
            "stage": "public-facing-input-injection",
            "question": "what strings were injected into the POST body of registration forms",
            "requires": "hb_http_activity (request_body_len or full request_body)"
          }
        ],
        "scoping_notes": "The hunt begins by identifying hosts running Microsoft 365, Office, or Cisco software. These systems are most relevant for phishing delivery and potential input abuse into corporate-facing applications.",
        "beyond_detection": "A static detection rule on Staples or Dell order domains would create excessive noise. This hunt uses a gated flow to baseline normal brand activity first, then uses an agent to correlate lure keywords in cloud audit logs with registration patterns, identifying the specific 'Platform-as-a-Proxy' tradecraft that single-surface rules miss."
      }
    },
    {
      "id": "identify-relevant-software",
      "type": "query",
      "label": "Identify hosts with collaboration and mail software",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, package_name, vendor_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%microsoft 365%' OR LOWER(package_name) LIKE '%office%' OR LOWER(package_name) LIKE '%cisco%')",
        "surface": "hb_software_inventory",
        "description": "Find the hosts running Microsoft 365, Office, or Cisco components that could be the recipients of high-reputation phishing or the origin of form abuse.",
        "expected_signal": "A list of hosts running products named in the threat research. These represent the likely targets for notification-based social engineering."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify hosts with collaboration and mail software",
        "reads": [
          "device_hostname",
          "package_name",
          "vendor_name",
          "package_version"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT device_hostname, package_name, vendor_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%microsoft 365%' OR LOWER(package_name) LIKE '%office%' OR LOWER(package_name) LIKE '%cisco%')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hosts running products named in the threat research. These represent the likely targets for notification-based social engineering.",
        "verified": "dry-run",
        "verified_at": "2026-10-22"
      }
    },
    {
      "id": "dns-brand-lead",
      "type": "query",
      "label": "DNS lookups to abused brand domains",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT device_hostname, query_hostname, process_name, COUNT(*) AS lookup_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE instr(',' || '{{brand_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname, process_name",
        "surface": "hb_dns_activity",
        "description": "Identify hosts interacting with the specific Staples and Dell domains named in the report as a low-cost lead.",
        "expected_signal": "Hosts resolving the order-related domains. While frequent for shoppers, lookups coinciding with lure keywords in other surfaces suggest the receipt of a fraudulent notification."
      },
      "parents": [
        {
          "id": "identify-relevant-software"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "DNS lookups to abused brand domains",
        "reads": [
          "device_hostname",
          "query_hostname",
          "process_name",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, query_hostname, process_name, COUNT(*) AS lookup_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE instr(',' || '{{brand_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname, process_name",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Hosts resolving the order-related domains. While frequent for shoppers, lookups coinciding with lure keywords in other surfaces suggest the receipt of a fraudulent notification.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "query_hostname"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-10-22"
      }
    },
    {
      "id": "eval-lead",
      "type": "analytic",
      "label": "Evaluate brand interaction",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "web"
        ],
        "context": [
          "dns-brand-lead"
        ],
        "objective": "Review the DNS lookup volume and requesting processes. Identify hosts where lookups to order domains are rare or appear in tight clusters suggesting automated notifications.",
        "description": "Determine if the DNS activity is sufficiently anomalous or volume-heavy to justify expensive cloud and web queries.",
        "max_iterations": 3,
        "expected_signal": "A judgement on which hosts warrant deeper investigation based on their interaction with Staples or Dell infrastructure.",
        "success_criteria": "A verdict per host indicating whether the lead is worth following."
      },
      "parents": [
        {
          "id": "dns-brand-lead"
        }
      ]
    },
    {
      "id": "gate-decision",
      "type": "checkpoint",
      "label": "Gate: Proceed to content analysis",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the eval-lead verdict identifies at least one host resolving abused brand domains in a suspicious manner",
        "condition": "the eval-lead verdict identifies at least one host resolving abused brand domains in a suspicious manner",
        "blind_spot": "no-dns-telemetry",
        "confidence": "high",
        "description": "Route the hunt to expensive searches only when a suspicious lead is confirmed.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "eval-lead"
        }
      ]
    },
    {
      "id": "m365-mail-lures",
      "type": "query",
      "label": "M365 notification and lure activity",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT actor_user_name, api_operation, resource_name, resource_uid, time FROM hb_cloud_api_activity WHERE provider = 'm365' AND (instr(LOWER(resource_name), 'helpline') > 0 OR instr(LOWER(resource_name), 'order confirmed') > 0 OR instr(LOWER(resource_name), 'purchase id') > 0 OR instr(LOWER(resource_name), 'wetransfer') > 0 OR instr(LOWER(resource_name), 'non-delivery') > 0 OR instr(LOWER(resource_name), 'delivery status') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_cloud_api_activity",
        "description": "Search Office 365 Unified Audit Logs for incoming mail items containing the specific report lures in the subject line.",
        "expected_signal": "Audit records reflecting the arrival of mail items with suspicious subjects like Helpline or Order Confirmed. M365 UAL captures subject lines in resource_name for certain Exchange operations."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "M365 notification and lure activity",
        "reads": [
          "actor_user_name",
          "api_operation",
          "resource_name",
          "resource_uid",
          "time"
        ],
        "source": "hb_cloud_api_activity",
        "target": "endpoint",
        "content": "SELECT actor_user_name, api_operation, resource_name, resource_uid, time FROM hb_cloud_api_activity WHERE provider = 'm365' AND (instr(LOWER(resource_name), 'helpline') > 0 OR instr(LOWER(resource_name), 'order confirmed') > 0 OR instr(LOWER(resource_name), 'purchase id') > 0 OR instr(LOWER(resource_name), 'wetransfer') > 0 OR instr(LOWER(resource_name), 'non-delivery') > 0 OR instr(LOWER(resource_name), 'delivery status') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Audit records reflecting the arrival of mail items with suspicious subjects like Helpline or Order Confirmed. M365 UAL captures subject lines in resource_name for certain Exchange operations.",
        "verified": "dry-run",
        "verified_at": "2026-10-22"
      }
    },
    {
      "id": "http-registration-abuse",
      "type": "query",
      "label": "Platform registration and form input abuse",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "web",
        "content": "SELECT device_hostname, src_endpoint_ip, url_full, http_method, time FROM hb_http_activity WHERE http_method = 'POST' AND (LOWER(url_path) LIKE '%signup%' OR LOWER(url_path) LIKE '%register%' OR LOWER(url_path) LIKE '%profile%') AND (LOWER(url_query) LIKE '%crypto%' OR LOWER(url_query) LIKE '%helpline%' OR LOWER(url_query) LIKE '%bitcoin%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Find outbound web requests attempting to use registration forms with hostile strings, representing the input stage of the proxy abuse.",
        "expected_signal": "POST requests to registration or signup endpoints that contain crypto or helpline keywords in the query parameters. This indicates a host may be attempting to trigger reflexive notifications."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Platform registration and form input abuse",
        "reads": [
          "device_hostname",
          "src_endpoint_ip",
          "url_full",
          "http_method",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, src_endpoint_ip, url_full, http_method, time FROM hb_http_activity WHERE http_method = 'POST' AND (LOWER(url_path) LIKE '%signup%' OR LOWER(url_path) LIKE '%register%' OR LOWER(url_path) LIKE '%profile%') AND (LOWER(url_query) LIKE '%crypto%' OR LOWER(url_query) LIKE '%helpline%' OR LOWER(url_query) LIKE '%bitcoin%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "POST requests to registration or signup endpoints that contain crypto or helpline keywords in the query parameters. This indicates a host may be attempting to trigger reflexive notifications.",
        "verified": "dry-run",
        "verified_at": "2026-10-22"
      }
    },
    {
      "id": "final-triage",
      "type": "analytic",
      "label": "Correlate platform abuse and notifications",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "web"
        ],
        "context": [
          "eval-lead",
          "m365-mail-lures",
          "http-registration-abuse"
        ],
        "objective": "Determine if a host has received a suspicious retail notification (from Staples/Dell) or if a host is attempting to inject lures into SaaS forms. Correlate the timing of DNS lookups to Staples/Dell with the arrival of mail items identified in the M365 logs.",
        "description": "Weigh the evidence from the DNS lead, the mail logs, and the HTTP traffic to confirm if Platform-as-a-Proxy abuse is occurring.",
        "max_iterations": 6,
        "expected_signal": "A detailed verdict citing mail arrivals, brand domain lookups, and form submissions per host.",
        "success_criteria": "A per-host verdict of malicious, suspicious, or benign citing specific rows."
      },
      "parents": [
        {
          "id": "m365-mail-lures",
          "kind": "merge"
        },
        {
          "id": "http-registration-abuse",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-confirmed-threat",
      "type": "checkpoint",
      "label": "Route on confirmed threat",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the final-triage verdict is malicious for at least one host",
        "condition": "the final-triage verdict is malicious for at least one host",
        "blind_spot": "no-mail-body-inspection",
        "confidence": "high",
        "description": "Isolate high-risk hosts where social engineering lures have likely been delivered and engaged.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "final-triage"
        }
      ]
    },
    {
      "id": "isolate-endpoint",
      "type": "action",
      "label": "Isolate host and revoke sessions",
      "config": {
        "target": "endpoint",
        "description": "Contain the threat by preventing further interaction with the fraudulent notification or the attacker-controlled phone number.",
        "instructions": "Isolate the identified host. Revoke the M365 user session to prevent further engagement with fraudulent mail content.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-confirmed-threat",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-manual-review",
      "type": "task",
      "label": "Analyst manual review",
      "config": {
        "assignee": "analyst",
        "description": "Manually inspect the notification content and verify the fraud attempt.",
        "instructions": "Review the specific Exchange mail items found in the UAL. Check for the helpline numbers mentioned in the Talos report (806-283-7712 or 808-232-6397). Confirm if the user has made any outbound calls or browser connections to the retail brands immediately after receiving these notifications."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "default"
        },
        {
          "id": "gate-decision",
          "branch": "on_unavailable"
        },
        {
          "id": "route-confirmed-threat",
          "branch": "default"
        },
        {
          "id": "route-confirmed-threat",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-endpoint"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Finalize the hunt and document findings or false positives.",
        "instructions": "Record the examined hosts. If lookups to Staples/Dell were found but no lures were identified in mail logs, mark as benign retail activity. Document any new registration forms abused to update the HTTP keyword list."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "on_refutes"
        },
        {
          "id": "route-confirmed-threat",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}