--- analysis: A static detection rule on Staples or Dell order domains would create excessive noise. This hunt uses a gated flow to baseline normal brand activity first, then uses an agent to correlate lure keywords in cloud audit logs with registration patterns, identifying the specific 'Platform-as-a-Proxy' tradecraft that single-surface rules miss. blind_spots: - id: no-dns-telemetry question: whether we see the lookup for the abused retail domain on every host requires: Endpoint DNS logging or full recursive resolver logs risk: Hosts using external DNS resolvers like 8.8.8.8 will not appear in hb_dns_activity, making the lead query incomplete. stage: legitimate-platform-phishing-delivery - id: no-mail-body-inspection question: what the specific fraudulent phone number was inside the email body requires: Full email body indexing or Mail Gateway logs risk: M365 audit logs show subjects and metadata but not the body content where the Helpline numbers live, necessitating manual review. stage: legitimate-platform-phishing-delivery - id: no-http-body-visibility question: what strings were injected into the POST body of registration forms requires: hb_http_activity (request_body_len or full request_body) risk: If the hostile string is sent in the request body rather than the URL query parameters, hb_http_activity will miss the lure content. stage: public-facing-input-injection coverage: - stage: public-facing-input-injection status: covered steps: - http-registration-abuse - stage: legitimate-platform-phishing-delivery status: covered steps: - dns-brand-lead - m365-mail-lures - stage: delivery-status-notification-abuse status: covered steps: - m365-mail-lures guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: Adversaries use the inherent trust in commerce and SaaS infrastructure to bypass standard email authentication. A negative result confirms that these trusted delivery pipelines are not currently being used to deliver social-engineering lures to the estate. methodology: model-assisted trigger: intel-report hypothesis: An adversary is using trusted third-party retail or SaaS infrastructure to deliver social-engineering lures by injecting fraudulent helpline numbers into transactional notification fields or abusing public-facing registration forms. labels: - hunt - attack.t1190 - attack.t1566 - initial access name: Platform-as-a-Proxy Phishing and Input Abuse parameters: brand_domains: default: - orders.staples.com - order.dell.com - order.dellcom description: High-reputation domains identified in the report as being abused. from: kind: article observed: '2026-10-21' ref: https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/ type: list[domain] lookback_days: default: '14' description: Days of history to examine. type: number scope_hosts: default: [] description: Optional list of hosts identified in the scoping step; leave empty to hunt across the entire estate. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/ gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: The hunt begins by identifying hosts running Microsoft 365, Office, or Cisco software. These systems are most relevant for phishing delivery and potential input abuse into corporate-facing applications. references: - name: "Talos \u2014 Parasitizing trust: How legitimate infrastructure becomes a\ \ delivery pipeline for attackers" url: https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/ related: - hunt: m365-social-engineering-lure-detection reason: This hunt focuses specifically on platform proxy abuse; broader phishing hunts cover general lure types. relation: out-of-scope-alternative scenario: stages: - name: Exploitation of Public-Facing Application Forms observables: - hostile string injected into name fields - malicious strings in company or title registration fields - cryptocurrency-themed lures in registration forms slug: public-facing-input-injection tactic: initial-access techniques: - T1190 - name: High-Reputation Notification Phishing observables: - support@orders.staples.com - received@order.dellcom - order.dell.com - Helpline 806 283 7712 - Helpline 808 232 6397 - "Here\u2019s your Staples order #9939818875. Thanks for shopping with us." - 'We have your order | Dell Purchase ID: 2009829958247' - Confirmed Order in shipping fields - Call Our Sales Team in billing fields slug: legitimate-platform-phishing-delivery tactic: initial-access techniques: - T1566 - name: Abuse of Mail Delivery Status Reports observables: - Non-delivery report (NDR) carrying WeTransfer-themed lure - Delivery status notification (DSN) with encapsulated phishing link - WeTransfer file-sharing lure inside administrative mail wrapper slug: delivery-status-notification-abuse tactic: initial-access techniques: - T1566 summary: Adversaries are exploiting unvalidated input fields on legitimate SaaS and commerce platforms to inject malicious content into automated, high-reputation notifications. These 'Platform-as-a-Proxy' (PaaP) attacks leverage trusted infrastructure like Staples, Dell, and WeTransfer to deliver phishing lures, fake helplines, and fraudulent delivery status reports that bypass traditional email security filters. severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # Platform-as-a-Proxy Phishing and Input Abuse This hunt identifies the subversion of legitimate commerce and SaaS pipelines where attackers inject malicious intent into fields that are later rendered into high-reputation, automated notifications. The hunt uses a gated flow, starting with a scoping of hosts running collaboration software and a cheap lead for DNS activity to abused retail domains, before fanning out to examine cloud audit logs for specific lures and HTTP traffic for registration form abuse. ## identify-relevant-software Find the hosts running Microsoft 365, Office, or Cisco components that could be the recipients of high-reputation phishing or the origin of form abuse. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of hosts running products named in the threat research. These represent the likely targets for notification-based social engineering. reads: - device_hostname - package_name - vendor_name - package_version silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-10-22' ~~~ SELECT device_hostname, package_name, vendor_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%microsoft 365%' OR LOWER(package_name) LIKE '%office%' OR LOWER(package_name) LIKE '%cisco%') ``` ## dns-brand-lead Identify hosts interacting with the specific Staples and Dell domains named in the report as a low-cost lead. ```sqlite target=endpoint role=baseline params=(brand_domains=brand_domains, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Hosts resolving the order-related domains. While frequent for shoppers, lookups coinciding with lure keywords in other surfaces suggest the receipt of a fraudulent notification. prevalence: by: device_hostname key: - query_hostname rare_below: 5 reads: - device_hostname - query_hostname - process_name - time silence: not_evidence_of_absence source: hb_dns_activity verified: dry-run verified_at: '2026-10-22' ~~~ SELECT device_hostname, query_hostname, process_name, COUNT(*) AS lookup_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE instr(',' || '{{brand_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname, process_name ``` ## eval-lead ```agent target=hunter cite: required context: - dns-brand-lead max_iterations: 3 objective: Review the DNS lookup volume and requesting processes. Identify hosts where lookups to order domains are rare or appear in tight clusters suggesting automated notifications. success_criteria: A verdict per host indicating whether the lead is worth following. tools: - endpoint - web ``` ## gate-decision if~: "the eval-lead verdict identifies at least one host resolving abused brand domains in a suspicious manner" (confidence: high, judge=hunter) then: → expensive-content-checks indeterminate: → analyst-manual-review unavailable: → analyst-manual-review (blind_spot: no-dns-telemetry) else: → close-out ## expensive-content-checks parallel: - → m365-mail-lures - → http-registration-abuse join: → final-triage ## m365-mail-lures Search Office 365 Unified Audit Logs for incoming mail items containing the specific report lures in the subject line. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days) ~~~yaml expected: Audit records reflecting the arrival of mail items with suspicious subjects like Helpline or Order Confirmed. M365 UAL captures subject lines in resource_name for certain Exchange operations. reads: - actor_user_name - api_operation - resource_name - resource_uid - time silence: not_evidence_of_absence source: hb_cloud_api_activity verified: dry-run verified_at: '2026-10-22' ~~~ SELECT actor_user_name, api_operation, resource_name, resource_uid, time FROM hb_cloud_api_activity WHERE provider = 'm365' AND (instr(LOWER(resource_name), 'helpline') > 0 OR instr(LOWER(resource_name), 'order confirmed') > 0 OR instr(LOWER(resource_name), 'purchase id') > 0 OR instr(LOWER(resource_name), 'wetransfer') > 0 OR instr(LOWER(resource_name), 'non-delivery') > 0 OR instr(LOWER(resource_name), 'delivery status') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## http-registration-abuse Find outbound web requests attempting to use registration forms with hostile strings, representing the input stage of the proxy abuse. ```sqlite target=web role=enrichment params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: POST requests to registration or signup endpoints that contain crypto or helpline keywords in the query parameters. This indicates a host may be attempting to trigger reflexive notifications. reads: - device_hostname - src_endpoint_ip - url_full - http_method - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-10-22' ~~~ SELECT device_hostname, src_endpoint_ip, url_full, http_method, time FROM hb_http_activity WHERE http_method = 'POST' AND (LOWER(url_path) LIKE '%signup%' OR LOWER(url_path) LIKE '%register%' OR LOWER(url_path) LIKE '%profile%') AND (LOWER(url_query) LIKE '%crypto%' OR LOWER(url_query) LIKE '%helpline%' OR LOWER(url_query) LIKE '%bitcoin%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## final-triage ```agent target=hunter cite: required context: - eval-lead - m365-mail-lures - http-registration-abuse max_iterations: 6 objective: Determine if a host has received a suspicious retail notification (from Staples/Dell) or if a host is attempting to inject lures into SaaS forms. Correlate the timing of DNS lookups to Staples/Dell with the arrival of mail items identified in the M365 logs. success_criteria: A per-host verdict of malicious, suspicious, or benign citing specific rows. tools: - endpoint - web ``` ## route-confirmed-threat if~: "the final-triage verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → isolate-endpoint indeterminate: → analyst-manual-review unavailable: → analyst-manual-review (blind_spot: no-mail-body-inspection) else: → close-out ## isolate-endpoint ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the identified host. Revoke the M365 user session to prevent further engagement with fraudulent mail content. ``` → analyst-manual-review ## analyst-manual-review ```manual target=analyst Review the specific Exchange mail items found in the UAL. Check for the helpline numbers mentioned in the Talos report (806-283-7712 or 808-232-6397). Confirm if the user has made any outbound calls or browser connections to the retail brands immediately after receiving these notifications. ``` → end ## close-out ```manual target=analyst Record the examined hosts. If lookups to Staples/Dell were found but no lures were identified in mail logs, mark as benign retail activity. Document any new registration forms abused to update the HTTP keyword list. ``` → end