{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "SMBs are frequent targets for destructive ransomware and credential theft. A negative result across the estate confirms that these high-impact post-compromise behaviors are not active."
      },
      "name": "Post-Compromise Evasion and Ransomware Impact",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1218",
        "attack.t1555",
        "attack.t1078",
        "attack.t1486",
        "credential access",
        "defense evasion",
        "impact",
        "initial access"
      ],
      "series": {
        "slug": "when-confusion-reigns-trusted-vendors-must-guide-their-smb-customers",
        "index": 2,
        "title": "When confusion reigns, trusted vendors must guide their SMB customers",
        "total": 2
      },
      "related": [
        {
          "hunt": "phishing-and-email-compromise-triage",
          "reason": "Initial access via phishing is a precursor to these behaviors but is handled by its own hunt.",
          "relation": "out-of-scope-alternative"
        },
        {
          "hunt": "initial-access-external-apps-phishing",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "This hunt pivots from an evasion lead to two different kinds of impact (credential theft and high-velocity encryption). A single rule cannot easily correlate stealthy binary execution with mass file modification while excluding administrative noise across multiple surfaces.",
      "coverage": [
        {
          "stage": "evasive-execution-and-rmm",
          "steps": [
            "lolbas-execution-lead"
          ],
          "status": "covered"
        },
        {
          "stage": "credential-theft-infostealers",
          "steps": [
            "credential-access-check"
          ],
          "status": "covered"
        },
        {
          "stage": "ransomware-data-encryption",
          "steps": [
            "ransomware-activity-check"
          ],
          "status": "covered"
        },
        {
          "stage": "inbound-application-exploitation",
          "reason": "Belongs to another part of the 'When confusion reigns, trusted vendors must guide their SMB customers' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "phishing-and-email-compromise",
          "reason": "Belongs to another part of the 'When confusion reigns, trusted vendors must guide their SMB customers' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Public-Facing Application Exploitation",
            "slug": "inbound-application-exploitation",
            "tactic": "initial-access",
            "techniques": [
              "T1190",
              "T1195"
            ],
            "observables": [
              "Exploitation of web servers",
              "AI-discovered zero-day exploits",
              "Manipulation of software update or delivery mechanisms",
              "Anomalous HTTP requests targeting vulnerabilities"
            ]
          },
          {
            "name": "Phishing and Business Email Compromise",
            "slug": "phishing-and-email-compromise",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "Emails containing malicious attachments",
              "Phishing links delivered via email",
              "Unauthorized access to business email accounts"
            ]
          },
          {
            "name": "Living off the Land and Unsanctioned RMM",
            "slug": "evasive-execution-and-rmm",
            "tactic": "defense-evasion",
            "techniques": [
              "T1218"
            ],
            "observables": [
              "Execution via signed Microsoft binaries (LOLBAS)",
              "Unsanctioned remote monitoring and management (RMM) software",
              "Use of 'safe-looking' administrative tools for malicious activity"
            ]
          },
          {
            "name": "Infostealers and Credential Harvest",
            "slug": "credential-theft-infostealers",
            "tactic": "credential-access",
            "techniques": [
              "T1555",
              "T1078"
            ],
            "observables": [
              "Infostealer malware execution",
              "Searching for credentials in password stores",
              "Abuse of compromised valid accounts for session access"
            ]
          },
          {
            "name": "Data Encryption for Impact",
            "slug": "ransomware-data-encryption",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "Deployment of ransomware binaries",
              "Mass file encryption on local or remote drives",
              "Creation of ransom notes"
            ]
          }
        ],
        "summary": "Adversaries target SMBs as a pathway into larger supply chains, using phishing and exploitation of public-facing applications for initial access. Post-compromise, they utilize 'living off the land' techniques and unsanctioned remote monitoring and management (RMM) tools to steal credentials and deploy ransomware."
      },
      "severity": "medium",
      "rationale": "Focus on workstations and file servers. Workstations are the primary beachhead for LOLBAS and infostealers, while file servers provide visibility into mass encryption impact.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is using signed system binaries to proxy execution of infostealers or ransomware, transitioning from stealthy credential harvesting to mass file encryption.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "analyst-scoping",
            "kind": "manual",
            "observed": "2024-11-02"
          },
          "type": "list[host]",
          "default": [],
          "description": "Hosts identified in the lead step; populate this to scope the corroboration queries."
        },
        "lolbas_paths": {
          "from": {
            "ref": "lolbas-project",
            "kind": "article",
            "observed": "2024-11-02"
          },
          "type": "list[path]",
          "default": [
            "c:\\windows\\system32\\mshta.exe",
            "c:\\windows\\syswow64\\mshta.exe",
            "c:\\windows\\system32\\certutil.exe",
            "c:\\windows\\system32\\regsvr32.exe",
            "c:\\windows\\system32\\rundll32.exe"
          ],
          "description": "Full paths to common binaries used for system binary proxy execution."
        },
        "lookback_days": {
          "from": {
            "ref": "hunt-standard-lookback",
            "kind": "manual",
            "observed": "2024-11-02"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "credential_filenames": {
          "from": {
            "ref": "infostealer-mechanics",
            "kind": "article",
            "observed": "2024-11-02"
          },
          "type": "list[string]",
          "default": [
            "login data",
            "cookies",
            "history",
            "credentials",
            "masterkey",
            "key3.db",
            "key4.db"
          ],
          "description": "Specific filenames associated with browser and system credential stores."
        },
        "ransom_note_filenames": {
          "from": {
            "ref": "ransomware-trends-2024",
            "kind": "article",
            "observed": "2024-11-02"
          },
          "type": "list[string]",
          "default": [
            "readme.txt",
            "decrypt.txt",
            "how_to_back.txt",
            "ransom.txt",
            "instruction.txt"
          ],
          "description": "Common file names for ransomware instructions."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.welivesecurity.com/en/business-security/when-confusion-reigns-trusted-vendors-guide-smb-customers/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.welivesecurity.com/en/business-security/when-confusion-reigns-trusted-vendors-guide-smb-customers/",
          "name": "ESET \u2014 When confusion reigns, trusted vendors must guide their SMB customers"
        }
      ],
      "blind_spots": [
        {
          "id": "missing-endpoint-telemetry",
          "risk": "An adversary could encrypt shared network drives from a machine without an agent, or on a drive excluded from monitoring, causing the encryption check to return zero rows.",
          "stage": "ransomware-data-encryption",
          "question": "Can we see mass encryption if it happens on an unmonitored disk or network mount?",
          "requires": "hb_file_activity on all drives"
        },
        {
          "id": "in-memory-theft",
          "risk": "Sophisticated infostealers that read from memory (LSASS) rather than files will not be identified by the credential-access-check.",
          "stage": "credential-theft-infostealers",
          "question": "Are credentials stolen directly from memory without touching the browser files?",
          "requires": "hb_process_activity showing handle access to LSASS"
        }
      ]
    },
    "name": "Post-Compromise Evasion and Ransomware Impact",
    "description": "This hunt identifies the progression from defense evasion to destructive impact. It begins by identifying LOLBAS binaries performing suspicious network requests. The hunt then fans out to investigate whether these specific hosts show signs of credential theft or high-velocity file encryption. By scoping the impact queries to the suspicious hosts identified in the lead, the hunt distinguishes malicious activity from fleet-wide background noise and administrative maintenance."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "when-confusion-reigns-trusted-vendors-must-guide-their-smb-customers",
          "index": 2,
          "title": "When confusion reigns, trusted vendors must guide their SMB customers",
          "total": 2
        },
        "coverage": [
          {
            "stage": "evasive-execution-and-rmm",
            "steps": [
              "lolbas-execution-lead"
            ],
            "status": "covered"
          },
          {
            "stage": "credential-theft-infostealers",
            "steps": [
              "credential-access-check"
            ],
            "status": "covered"
          },
          {
            "stage": "ransomware-data-encryption",
            "steps": [
              "ransomware-activity-check"
            ],
            "status": "covered"
          },
          {
            "stage": "inbound-application-exploitation",
            "reason": "Belongs to another part of the 'When confusion reigns, trusted vendors must guide their SMB customers' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "phishing-and-email-compromise",
            "reason": "Belongs to another part of the 'When confusion reigns, trusted vendors must guide their SMB customers' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary is using signed system binaries to proxy execution of infostealers or ransomware, transitioning from stealthy credential harvesting to mass file encryption.",
        "blind_spots": [
          {
            "id": "missing-endpoint-telemetry",
            "risk": "An adversary could encrypt shared network drives from a machine without an agent, or on a drive excluded from monitoring, causing the encryption check to return zero rows.",
            "stage": "ransomware-data-encryption",
            "question": "Can we see mass encryption if it happens on an unmonitored disk or network mount?",
            "requires": "hb_file_activity on all drives"
          },
          {
            "id": "in-memory-theft",
            "risk": "Sophisticated infostealers that read from memory (LSASS) rather than files will not be identified by the credential-access-check.",
            "stage": "credential-theft-infostealers",
            "question": "Are credentials stolen directly from memory without touching the browser files?",
            "requires": "hb_process_activity showing handle access to LSASS"
          }
        ],
        "scoping_notes": "Focus on workstations and file servers. Workstations are the primary beachhead for LOLBAS and infostealers, while file servers provide visibility into mass encryption impact.",
        "beyond_detection": "This hunt pivots from an evasion lead to two different kinds of impact (credential theft and high-velocity encryption). A single rule cannot easily correlate stealthy binary execution with mass file modification while excluding administrative noise across multiple surfaces."
      }
    },
    {
      "id": "lolbas-execution-lead",
      "type": "query",
      "label": "Suspicious System Binary Proxy Execution",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE instr(',' || '{{lolbas_paths}}' || ',', ',' || LOWER(process_path) || ',') > 0 AND (LOWER(process_cmd_line) LIKE '%http%' OR LOWER(process_cmd_line) LIKE '%ftp%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Find instances of signed Microsoft binaries being used to execute code or fetch content, which often precedes credential theft or ransomware deployment.",
        "expected_signal": "Trusted binaries behaving as downloaders. Silence suggests no obvious LOLBAS abuse in this window."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Suspicious System Binary Proxy Execution",
        "reads": [
          "device_hostname",
          "process_name",
          "process_cmd_line",
          "parent_process_name",
          "user_name",
          "time",
          "process_path"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE instr(',' || '{{lolbas_paths}}' || ',', ',' || LOWER(process_path) || ',') > 0 AND (LOWER(process_cmd_line) LIKE '%http%' OR LOWER(process_cmd_line) LIKE '%ftp%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Trusted binaries behaving as downloaders. Silence suggests no obvious LOLBAS abuse in this window.",
        "verified": "dry-run",
        "verified_at": "2026-11-03"
      }
    },
    {
      "id": "credential-access-check",
      "type": "query",
      "label": "Access to Credential Stores",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, file_name, file_path, time FROM hb_file_activity WHERE activity_id IN (2, 14) AND instr(',' || '{{credential_filenames}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_file_activity",
        "description": "Identify processes reading browser password and session stores, limited to suspicious hosts to ensure findings are actionable.",
        "expected_signal": "Anomalous processes accessing sensitive credential files. Silence suggests no secondary file impact on those machines."
      },
      "parents": [
        {
          "id": "lolbas-execution-lead"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Access to Credential Stores",
        "reads": [
          "device_hostname",
          "process_name",
          "file_name",
          "file_path",
          "time",
          "activity_id"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, file_name, file_path, time FROM hb_file_activity WHERE activity_id IN (2, 14) AND instr(',' || '{{credential_filenames}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Anomalous processes accessing sensitive credential files. Silence suggests no secondary file impact on those machines.",
        "verified": "dry-run",
        "verified_at": "2026-11-03"
      }
    },
    {
      "id": "ransomware-activity-check",
      "type": "query",
      "label": "Mass File Activity and Ransom Notes",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, COUNT(DISTINCT file_path) AS file_count, MIN(time) AS first_seen FROM hb_file_activity WHERE (activity_id IN (1, 3, 5) OR instr(',' || '{{ransom_note_filenames}}' || ',', ',' || LOWER(file_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name HAVING file_count > 500 OR MAX(CASE WHEN instr(',' || '{{ransom_note_filenames}}' || ',', ',' || LOWER(file_name) || ',') > 0 THEN 1 ELSE 0 END) = 1",
        "surface": "hb_file_activity",
        "description": "Find high-velocity file modifications or ransom note creation scoped to the suspicious hosts.",
        "expected_signal": "A process touching many unique files or dropping a ransom note. Silence indicates no active mass encryption."
      },
      "parents": [
        {
          "id": "lolbas-execution-lead"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Mass File Activity and Ransom Notes",
        "reads": [
          "device_hostname",
          "process_name",
          "file_name",
          "file_path",
          "activity_id",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, COUNT(DISTINCT file_path) AS file_count, MIN(time) AS first_seen FROM hb_file_activity WHERE (activity_id IN (1, 3, 5) OR instr(',' || '{{ransom_note_filenames}}' || ',', ',' || LOWER(file_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name HAVING file_count > 500 OR MAX(CASE WHEN instr(',' || '{{ransom_note_filenames}}' || ',', ',' || LOWER(file_name) || ',') > 0 THEN 1 ELSE 0 END) = 1",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "A process touching many unique files or dropping a ransom note. Silence indicates no active mass encryption.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "process_name"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-11-03"
      }
    },
    {
      "id": "intrusion-triage",
      "type": "analytic",
      "label": "Triage Intrusion Evidence",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint"
        ],
        "context": [
          "lolbas-execution-lead",
          "credential-access-check",
          "ransomware-activity-check"
        ],
        "objective": "Determine if the observed LOLBAS execution on any host correlates with credential theft or mass encryption findings. Ignore traffic to legitimate Microsoft domains.",
        "description": "Correlate the LOLBAS lead with the observed file impacts to settle on a verdict.",
        "max_iterations": 6,
        "expected_signal": "A per-host verdict linking evasion to concrete impact.",
        "success_criteria": "A verdict of malicious | suspicious | benign per host, citing the specific binary and the file impact rows."
      },
      "parents": [
        {
          "id": "credential-access-check",
          "kind": "merge"
        },
        {
          "id": "ransomware-activity-check",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "verdict-routing",
      "type": "checkpoint",
      "label": "Route on Verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious for at least one host involving both a LOLBAS binary and either credential access or mass file activity",
        "condition": "the triage verdict is malicious for at least one host involving both a LOLBAS binary and either credential access or mass file activity",
        "blind_spot": "missing-endpoint-telemetry",
        "confidence": "high",
        "description": "Take immediate action on malicious findings or route to an analyst for deeper review.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "intrusion-triage"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate Malicious Endpoint",
      "config": {
        "target": "endpoint",
        "description": "Prevent ransomware spread and halt credential theft immediately.",
        "instructions": "Isolate the host immediately via EDR and revoke all active sessions for users associated with the host.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "verdict-routing",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-forensic-review",
      "type": "task",
      "label": "Analyst Forensic Review",
      "config": {
        "assignee": "analyst",
        "description": "Validate the findings and investigate the scope of the incident.",
        "instructions": "Review the agent's citations. Examine the process tree of the identified LOLBAS binary and check for SMB activity from the same process to determine if encryption occurred on network shares."
      },
      "parents": [
        {
          "id": "verdict-routing",
          "branch": "default"
        },
        {
          "id": "verdict-routing",
          "branch": "on_unavailable"
        },
        {
          "id": "verdict-routing",
          "branch": "on_refutes"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Remediation and Close Out",
      "config": {
        "assignee": "analyst",
        "description": "Finalize remediation and tune the hunt for future runs.",
        "instructions": "Document the findings. If benign admin noise was found, record those parent processes for future exclusions."
      },
      "parents": [
        {
          "id": "analyst-forensic-review"
        }
      ]
    }
  ]
}