{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Adversaries are using AI to refine LotL scripting and staging techniques. A single-surface detection rule cannot capture this progression; a multi-stage hunt is required to correlate the beachhead with extortion impact." }, "name": "Post-Intrusion LotL and Extortion Chain", "type": "investigation", "labels": [ "hunt", "attack.t1041", "attack.t1486", "attack.t1555", "credential access", "defense evasion", "exfiltration", "impact", "initial access" ], "series": { "slug": "unit-42-threat-intelligence-highlights-nov-2-2026", "index": 2, "title": "Unit 42 Threat Intelligence Highlights - Nov. 2, 2026", "total": 2 }, "related": [ { "hunt": "initial-access-exploit-perimeter", "reason": "This hunt focuses on the internal progression of an attack; the initial perimeter breach is a separate concern.", "relation": "out-of-scope-alternative" }, { "hunt": "perimeter-access-identity-fraud", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "This hunt uses a phased approach to correlate evidence across four telemetry surfaces (software inventory, processes, registry, and files) and detection findings, using agents to weigh context\u2014a relationship too complex for a single detection rule.", "coverage": [ { "stage": "evasion-and-execution-lotl", "steps": [ "lotl-execution" ], "status": "covered" }, { "stage": "credential-access-harvesting", "steps": [ "credential-store-access" ], "status": "covered" }, { "stage": "collection-exfiltration-staging", "steps": [ "data-staging-archives" ], "status": "covered" }, { "stage": "impact-ransomware-encryption", "steps": [ "ransomware-detections" ], "status": "covered" }, { "stage": "initial-access-ai-phishing", "reason": "Belongs to another part of the 'Unit 42 Threat Intelligence Highlights - Nov. 2, 2026' series.", "status": "out_of_scope" }, { "stage": "initial-access-exploit-perimeter", "reason": "Belongs to another part of the 'Unit 42 Threat Intelligence Highlights - Nov. 2, 2026' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "AI-Enhanced Phishing", "slug": "initial-access-ai-phishing", "tactic": "initial-access", "techniques": [ "T1566" ], "observables": [ "context-tailored social engineering lures", "synthetic personas", "deepfakes", "executive impersonation" ] }, { "name": "Perimeter Application Exploitation", "slug": "initial-access-exploit-perimeter", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "unpatched perimeter assets", "zero-day vulnerabilities", "internet-facing web applications" ] }, { "name": "Living-off-the-Land and Scripting", "slug": "evasion-and-execution-lotl", "tactic": "defense-evasion", "observables": [ "LotL binaries", "built-in administration tools", "AI-assisted scripting", "payload debugging", "code obfuscation" ] }, { "name": "Credential Harvesting", "slug": "credential-access-harvesting", "tactic": "credential-access", "techniques": [ "T1555" ], "observables": [ "infostealer logs", "exposed credentials", "access to password storage locations" ] }, { "name": "Staging and Exfiltration", "slug": "collection-exfiltration-staging", "tactic": "exfiltration", "techniques": [ "T1041" ], "observables": [ "low-and-slow data staging", "exfiltration over C2 channel", "public exposure threats" ] }, { "name": "Data Encryption and Extortion", "slug": "impact-ransomware-encryption", "tactic": "impact", "techniques": [ "T1486" ], "observables": [ "ransomware deployment", "multi-extortion models", "systemic data compromise" ] } ], "summary": "Threat actors are employing AI-enhanced social engineering and Large Language Model (LLM) assisted scripting to refine initial access through targeted phishing and perimeter application exploitation. Once inside, they utilize living-off-the-land (LotL) binaries for credential harvesting and low-and-slow data staging, culminating in strategic data theft or multi-extortion ransomware attacks." }, "severity": "high", "rationale": "Focus on high-value servers first as they are primary extortion targets. Expand to general workstations only if the server estate is quiet.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary uses built-in administrative tools to harvest credentials and stage data in temporary paths before deploying ransomware for extortion, following a successful initial breach.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Specific hosts to narrow the hunt; leave empty to hunt the whole estate." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "lotl_binaries": { "type": "list[string]", "default": [ "c:\\windows\\system32\\powershell.exe", "c:\\windows\\system32\\certutil.exe", "c:\\windows\\system32\\bitsadmin.exe", "c:\\windows\\system32\\wbem\\wmic.exe", "c:\\windows\\system32\\vssadmin.exe", "c:\\windows\\system32\\net.exe", "c:\\windows\\system32\\whoami.exe", "c:\\windows\\system32\\mshta.exe", "powershell.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe", "vssadmin.exe", "net.exe", "whoami.exe", "mshta.exe" ], "description": "Built-in binaries used for living-off-the-land execution." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/u42-threat-intelligence-highlights-oct-2026/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/u42-threat-intelligence-highlights-oct-2026/", "name": "Unit 42 Threat Intelligence Highlights - Nov. 2, 2026" } ], "blind_spots": [ { "id": "registry-audit-gap", "risk": "Adversary credential harvesting through registry hives will go unrecorded if the specific audit policy for registry object access is disabled.", "stage": "credential-access-harvesting", "question": "Whether the SAM or SECURITY hives were read by the adversary", "requires": "Windows Security Audit Policy for Object Access (Registry)" }, { "id": "obfuscated-script-visibility", "risk": "While the process command line shows the tool launch, the actual malicious logic inside an obfuscated script may be hidden without full script block telemetry.", "stage": "evasion-and-execution-lotl", "question": "The specific intent of AI-generated obfuscated scripts", "requires": "hb_script_activity with full block logging" } ] }, "name": "Post-Intrusion LotL and Extortion Chain", "description": "This hunt tracks the internal progression of a stealthy intrusion from its initial beachhead to final impact. It begins by identifying living-off-the-land (LotL) binary execution and credential store access on high-value server assets. The flow then pivots to identify data staging activities, such as mass compression in temporary folders, and correlates these with ransomware-related detection findings. Two agent stages evaluate the early beachhead and follow-on extortion behaviors to distinguish coordinated attacks from isolated administrative noise." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "unit-42-threat-intelligence-highlights-nov-2-2026", "index": 2, "title": "Unit 42 Threat Intelligence Highlights - Nov. 2, 2026", "total": 2 }, "coverage": [ { "stage": "evasion-and-execution-lotl", "steps": [ "lotl-execution" ], "status": "covered" }, { "stage": "credential-access-harvesting", "steps": [ "credential-store-access" ], "status": "covered" }, { "stage": "collection-exfiltration-staging", "steps": [ "data-staging-archives" ], "status": "covered" }, { "stage": "impact-ransomware-encryption", "steps": [ "ransomware-detections" ], "status": "covered" }, { "stage": "initial-access-ai-phishing", "reason": "Belongs to another part of the 'Unit 42 Threat Intelligence Highlights - Nov. 2, 2026' series.", "status": "out_of_scope" }, { "stage": "initial-access-exploit-perimeter", "reason": "Belongs to another part of the 'Unit 42 Threat Intelligence Highlights - Nov. 2, 2026' series.", "status": "out_of_scope" } ], "rationale": "An adversary uses built-in administrative tools to harvest credentials and stage data in temporary paths before deploying ransomware for extortion, following a successful initial breach.", "blind_spots": [ { "id": "registry-audit-gap", "risk": "Adversary credential harvesting through registry hives will go unrecorded if the specific audit policy for registry object access is disabled.", "stage": "credential-access-harvesting", "question": "Whether the SAM or SECURITY hives were read by the adversary", "requires": "Windows Security Audit Policy for Object Access (Registry)" }, { "id": "obfuscated-script-visibility", "risk": "While the process command line shows the tool launch, the actual malicious logic inside an obfuscated script may be hidden without full script block telemetry.", "stage": "evasion-and-execution-lotl", "question": "The specific intent of AI-generated obfuscated scripts", "requires": "hb_script_activity with full block logging" } ], "scoping_notes": "Focus on high-value servers first as they are primary extortion targets. Expand to general workstations only if the server estate is quiet.", "beyond_detection": "This hunt uses a phased approach to correlate evidence across four telemetry surfaces (software inventory, processes, registry, and files) and detection findings, using agents to weigh context\u2014a relationship too complex for a single detection rule." } }, { "id": "identify-high-value-servers", "type": "query", "label": "Identify high-value server targets", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%sql%' OR LOWER(package_name) LIKE '%iis%' OR LOWER(package_name) LIKE '%apache%' OR LOWER(package_name) LIKE '%nginx%' GROUP BY device_hostname, package_name", "surface": "hb_software_inventory", "description": "Focus the hunt on servers hosting database and web services that are primary targets for extortion.", "expected_signal": "A list of hosts running sensitive server software. Silence means no such software is indexed in the inventory." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify high-value server targets", "reads": [ "device_hostname", "package_name", "package_version" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%sql%' OR LOWER(package_name) LIKE '%iis%' OR LOWER(package_name) LIKE '%apache%' OR LOWER(package_name) LIKE '%nginx%' GROUP BY device_hostname, package_name", "silence": "not_evidence_of_absence", "expected": "A list of hosts running sensitive server software. Silence means no such software is indexed in the inventory.", "verified": "dry-run", "verified_at": "2026-11-03" } }, { "id": "lotl-execution", "type": "query", "label": "Rare living-off-the-land execution", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (instr(',' || '{{lotl_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{lotl_binaries}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_cmd_line HAVING hosts <= 3 ORDER BY hosts ASC", "surface": "hb_process_activity", "description": "Find administrative tools running with rare command lines, identifying potential AI-assisted scripting.", "expected_signal": "Rare command lines using built-in tools like powershell or certutil. Silence on a busy host is a strong negative signal." }, "parents": [ { "id": "identify-high-value-servers" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Rare living-off-the-land execution", "reads": [ "device_hostname", "process_cmd_line", "process_name", "process_original_file_name", "time", "user_name" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (instr(',' || '{{lotl_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{lotl_binaries}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_cmd_line HAVING hosts <= 3 ORDER BY hosts ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Rare command lines using built-in tools like powershell or certutil. Silence on a busy host is a strong negative signal.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_cmd_line" ], "rare_below": 3 }, "verified_at": "2026-11-03" } }, { "id": "credential-store-access", "type": "query", "label": "Access to registry credential stores", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, actor_process_name, actor_user_name, object_name, time FROM hb_resource_activity WHERE object_type = 'Key' AND (LOWER(object_name) LIKE '%\\registry\\machine\\sam%' OR LOWER(object_name) LIKE '%\\registry\\machine\\security%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_resource_activity", "description": "Identify processes reading the SAM or SECURITY registry hives to harvest local credentials.", "expected_signal": "Access to credential hives from processes other than the system kernel or known backup tools." }, "parents": [ { "id": "identify-high-value-servers" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Access to registry credential stores", "reads": [ "actor_process_name", "actor_user_name", "device_hostname", "object_name", "object_type", "time" ], "source": "hb_resource_activity", "target": "endpoint", "content": "SELECT device_hostname, actor_process_name, actor_user_name, object_name, time FROM hb_resource_activity WHERE object_type = 'Key' AND (LOWER(object_name) LIKE '%\\registry\\machine\\sam%' OR LOWER(object_name) LIKE '%\\registry\\machine\\security%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Access to credential hives from processes other than the system kernel or known backup tools.", "verified": "dry-run", "verified_at": "2026-11-03" } }, { "id": "triage-beachhead", "type": "analytic", "label": "Evaluate early-stage indicators", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "identify-high-value-servers", "lotl-execution", "credential-store-access" ], "objective": "Identify hosts where LotL execution and credential access suggest a beachhead has been established.", "description": "Determine if LotL tool usage and credential harvesting attempts indicate a valid security incident on specific hosts.", "max_iterations": 4, "expected_signal": "A per-host verdict of malicious, suspicious, or benign based on the early telemetry.", "success_criteria": "A detailed verdict per host citing specific command lines and registry objects." }, "parents": [ { "id": "lotl-execution", "kind": "merge" }, { "id": "credential-store-access", "kind": "merge" } ] }, { "id": "data-staging-archives", "type": "query", "label": "Mass file compression in temporary paths", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, process_name, file_path, file_name, time FROM hb_file_activity WHERE activity_id = 1 AND (LOWER(file_path) LIKE '%\\temp\\%' OR LOWER(file_path) LIKE '%\\users\\public\\%') AND (LOWER(file_name) LIKE '%.zip' OR LOWER(file_name) LIKE '%.7z' OR LOWER(file_name) LIKE '%.rar') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Identify data staging by looking for the creation of archive files in globally-writable directories.", "expected_signal": "Archive files created by unusual processes in temporary paths, suggesting staging for exfiltration." }, "parents": [ { "id": "triage-beachhead" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Mass file compression in temporary paths", "reads": [ "activity_id", "device_hostname", "file_name", "file_path", "process_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, file_path, file_name, time FROM hb_file_activity WHERE activity_id = 1 AND (LOWER(file_path) LIKE '%\\temp\\%' OR LOWER(file_path) LIKE '%\\users\\public\\%') AND (LOWER(file_name) LIKE '%.zip' OR LOWER(file_name) LIKE '%.7z' OR LOWER(file_name) LIKE '%.rar') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Archive files created by unusual processes in temporary paths, suggesting staging for exfiltration.", "verified": "dry-run", "verified_at": "2026-11-03" } }, { "id": "ransomware-detections", "type": "query", "label": "Existing ransomware alerts", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, finding_title, malware_category, malware_name, disposition, time FROM hb_detection_finding WHERE (LOWER(malware_category) = 'ransomware' OR LOWER(finding_title) LIKE '%ransomware%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_detection_finding", "description": "Find existing detections that may have been dismissed or only partially mitigated on targeted hosts.", "expected_signal": "Confirmed security alerts naming ransomware or mass-encryption behaviors." }, "parents": [ { "id": "triage-beachhead" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Existing ransomware alerts", "reads": [ "device_hostname", "disposition", "finding_title", "malware_category", "malware_name", "time" ], "source": "hb_detection_finding", "target": "endpoint", "content": "SELECT device_hostname, finding_title, malware_category, malware_name, disposition, time FROM hb_detection_finding WHERE (LOWER(malware_category) = 'ransomware' OR LOWER(finding_title) LIKE '%ransomware%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Confirmed security alerts naming ransomware or mass-encryption behaviors.", "verified": "dry-run", "verified_at": "2026-11-03" } }, { "id": "evaluate-extortion-chain", "type": "analytic", "label": "Correlate entire extortion chain", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "triage-beachhead", "data-staging-archives", "ransomware-detections" ], "objective": "Determine if any host is undergoing a coordinated extortion attack by correlating beachhead indicators with data staging and ransomware findings.", "description": "Provide a final determination by linking beachhead signs to staging and detection telemetry.", "max_iterations": 5, "expected_signal": "A final verdict for each host with a narrative of the full attack chain.", "success_criteria": "A final verdict for each host with cited evidence and an assessment of attack progression." }, "parents": [ { "id": "data-staging-archives", "kind": "merge" }, { "id": "ransomware-detections", "kind": "merge" } ] }, { "id": "route-on-extortion", "type": "checkpoint", "label": "Route on extortion verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the evaluate-extortion-chain verdict is malicious for at least one host", "condition": "the evaluate-extortion-chain verdict is malicious for at least one host", "blind_spot": "registry-audit-gap", "confidence": "high", "description": "Initiate containment for high-confidence threats or manual review for ambiguous cases.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "evaluate-extortion-chain" } ] }, { "id": "contain-host", "type": "action", "label": "Isolate host and contain threat", "config": { "target": "endpoint", "description": "Halt the adversary's progression and prevent final data encryption.", "instructions": "Isolate the identified host and revoke active credentials for any user observed on the host during the lookback period.", "action_approval": "required" }, "parents": [ { "id": "route-on-extortion", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst forensic review", "config": { "assignee": "analyst", "description": "Verify agent findings and identify indicators not captured in automated telemetry.", "instructions": "Review the specific file paths and command lines cited in the final verdict. Search for lateral movement from the beachhead and identify the initial access vector." }, "parents": [ { "id": "route-on-extortion", "branch": "default" }, { "id": "route-on-extortion", "branch": "on_unavailable" }, { "id": "contain-host" } ] }, { "id": "close-out-hunt", "type": "task", "label": "Hunt closeout", "config": { "assignee": "analyst", "description": "Record results and promote durable signals to detection rules.", "instructions": "Document the findings and host status. If the LotL execution query provided high-confidence results, hand it off for promotion to a detection rule." }, "parents": [ { "id": "route-on-extortion", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }