{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Adversaries abuse trusted platforms like Power BI to bypass email filters; finding the subsequent RMM payload is critical for stopping persistent access early."
      },
      "name": "Power BI Phishing to ScreenConnect RMM",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1566",
        "attack.t1059.001",
        "command and control",
        "defense evasion",
        "execution",
        "initial access",
        "persistence"
      ],
      "series": {
        "slug": "phishing-campaign-abuses-microsoft-power-bi-to-deploy-rogue-rmms",
        "index": 1,
        "title": "Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs",
        "total": 2
      },
      "related": [
        {
          "hunt": "scripted-multi-stage-deployment",
          "reason": "This hunt covers delivery; follow-on execution and multi-stage RMM deployment via PowerShell are covered in the next hunt.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A standard rule might flag any ScreenConnect activity, but this hunt uses a funnel flow to correlate the phishing redirect context with rare fleet-wide relay activity, distinguishing rogue instances from corporate-approved RMM tools.",
      "coverage": [
        {
          "stage": "initial-access-powerbi-phishing",
          "steps": [
            "phishing-infrastructure-visits"
          ],
          "status": "covered"
        },
        {
          "stage": "rmm-payload-download",
          "steps": [
            "screenconnect-installer-writes",
            "rare-screenconnect-relays"
          ],
          "status": "covered"
        },
        {
          "stage": "scripted-multi-stage-deployment",
          "reason": "Belongs to another part of the 'Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "rmm-persistence-tasks",
          "reason": "Belongs to another part of the 'Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "rmm-command-and-control",
          "reason": "Belongs to another part of the 'Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "defense-evasion-cloaking",
          "reason": "Belongs to another part of the 'Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Phishing via Power BI Dashboard",
            "slug": "initial-access-powerbi-phishing",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "app.powerbi.com/view?r=eyJrIjoiNTk0NmViNDktYzM1Yy00MjEwLTkyZTctNGU5ZTJmYzMzYjEwIiwidCI6IjU1YTI4YmU2LTFiYzQtNDIzMS05MTA0LTdkMmFlYTVmMGZhNiJ9",
              "dailylifeproject.site",
              "burnsworth.site",
              "essaywritingservice.site",
              "openpediatrics.site",
              "check.vykyn.click"
            ]
          },
          {
            "name": "Rogue ScreenConnect Download",
            "slug": "rmm-payload-download",
            "tactic": "execution",
            "techniques": [
              "T1059.001"
            ],
            "observables": [
              "hamham27.screenconnect.com",
              "ScreenConnect.ClientSetup.exe",
              "5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3"
            ]
          },
          {
            "name": "Scripted RMM Deployment",
            "slug": "scripted-multi-stage-deployment",
            "tactic": "execution",
            "techniques": [
              "T1059.001"
            ],
            "observables": [
              "LyN03DvVjUKPrun.cmd",
              "SCAutoFix.ps1",
              "C:\\Temp\\ScreenConnect.ClientSetup.msi",
              "ScreenConnect.ClientSetup (6).exe",
              "onthegotree.site"
            ]
          },
          {
            "name": "Scheduled Task Persistence",
            "slug": "rmm-persistence-tasks",
            "tactic": "persistence",
            "techniques": [
              "T1053.005"
            ],
            "observables": [
              "SCAutoRepairEvery2Min"
            ]
          },
          {
            "name": "RMM C2 Communication",
            "slug": "rmm-command-and-control",
            "tactic": "c2",
            "observables": [
              "instance-g01s1n-relay.screenconnect.com"
            ]
          },
          {
            "name": "Defense Evasion and Cloaking",
            "slug": "defense-evasion-cloaking",
            "tactic": "defense-evasion",
            "observables": [
              "HideUL_x64.exe"
            ]
          }
        ],
        "summary": "Threat actors are abusing legitimate Microsoft Power BI links to bypass email filters and deliver rogue ScreenConnect RMM installers. The campaign utilizes multi-stage execution with CMD and PowerShell scripts to deploy redundant RMM instances, establishing persistence through scheduled tasks while using specialized tools to hide attacker activity."
      },
      "severity": "high",
      "rationale": "The lead query identifies potential victims via web traffic to staging domains or the Power BI portal. Use the resulting host list to focus the subsequent RMM evidence queries.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is using legitimate Microsoft Power BI dashboard links to bypass email security and deliver rogue ScreenConnect installers via staging domains.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Optional list of hostnames to narrow the search; if empty, all hosts are examined."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "staging_domains": {
          "from": {
            "ref": "huntress-screenconnect-power-bi",
            "kind": "article",
            "observed": "2026-10-07"
          },
          "type": "list[domain]",
          "default": [
            "dailylifeproject.site",
            "burnsworth.site",
            "essaywritingservice.site",
            "openpediatrics.site",
            "check.vykyn.click"
          ],
          "description": "Staging and redirect domains identified in the research."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.huntress.com/blog/screenconnect-power-bi",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.huntress.com/blog/screenconnect-power-bi",
          "name": "Huntress \u2014 Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs"
        }
      ],
      "blind_spots": [
        {
          "id": "no-http-telemetry",
          "risk": "Without HTTP telemetry, the initial phishing redirect cannot be observed, and the hunt relies entirely on the presence of the RMM installer.",
          "stage": "initial-access-powerbi-phishing",
          "question": "Which hosts visited the staging domains?",
          "requires": "hb_http_activity or proxy logs"
        },
        {
          "id": "dns-over-https",
          "risk": "DNS-based detection (hb_dns_activity) will be blind if the browser or OS uses encrypted DNS directly to external providers.",
          "stage": "initial-access-powerbi-phishing",
          "question": "Are hosts using DoH to resolve staging domains?",
          "requires": "Endpoint DNS monitoring or TLS inspection"
        }
      ]
    },
    "name": "Power BI Phishing to ScreenConnect RMM",
    "description": "This hunt identifies the delivery chain of a campaign where trusted Microsoft domains (app.powerbi.com) are used to host phishing lures. It finds hosts that visited known staging domains or specific Power BI dashboard views, then corroborates this activity by looking for ScreenConnect installer writes and rare ScreenConnect relay DNS traffic that deviates from standard corporate usage."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "phishing-campaign-abuses-microsoft-power-bi-to-deploy-rogue-rmms",
          "index": 1,
          "title": "Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs",
          "total": 2
        },
        "coverage": [
          {
            "stage": "initial-access-powerbi-phishing",
            "steps": [
              "phishing-infrastructure-visits"
            ],
            "status": "covered"
          },
          {
            "stage": "rmm-payload-download",
            "steps": [
              "screenconnect-installer-writes",
              "rare-screenconnect-relays"
            ],
            "status": "covered"
          },
          {
            "stage": "scripted-multi-stage-deployment",
            "reason": "Belongs to another part of the 'Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "rmm-persistence-tasks",
            "reason": "Belongs to another part of the 'Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "rmm-command-and-control",
            "reason": "Belongs to another part of the 'Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "defense-evasion-cloaking",
            "reason": "Belongs to another part of the 'Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary is using legitimate Microsoft Power BI dashboard links to bypass email security and deliver rogue ScreenConnect installers via staging domains.",
        "blind_spots": [
          {
            "id": "no-http-telemetry",
            "risk": "Without HTTP telemetry, the initial phishing redirect cannot be observed, and the hunt relies entirely on the presence of the RMM installer.",
            "stage": "initial-access-powerbi-phishing",
            "question": "Which hosts visited the staging domains?",
            "requires": "hb_http_activity or proxy logs"
          },
          {
            "id": "dns-over-https",
            "risk": "DNS-based detection (hb_dns_activity) will be blind if the browser or OS uses encrypted DNS directly to external providers.",
            "stage": "initial-access-powerbi-phishing",
            "question": "Are hosts using DoH to resolve staging domains?",
            "requires": "Endpoint DNS monitoring or TLS inspection"
          }
        ],
        "scoping_notes": "The lead query identifies potential victims via web traffic to staging domains or the Power BI portal. Use the resulting host list to focus the subsequent RMM evidence queries.",
        "beyond_detection": "A standard rule might flag any ScreenConnect activity, but this hunt uses a funnel flow to correlate the phishing redirect context with rare fleet-wide relay activity, distinguishing rogue instances from corporate-approved RMM tools."
      }
    },
    {
      "id": "phishing-infrastructure-visits",
      "type": "query",
      "label": "Visits to phishing staging infrastructure",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, url_full, user_agent, time FROM hb_http_activity WHERE (instr(',' || '{{staging_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 OR (LOWER(url_hostname) = 'app.powerbi.com' AND LOWER(url_path) LIKE '/view%')) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Identify hosts that visited the Power BI phishing link or the subsequent redirect staging domains.",
        "expected_signal": "Rows showing specific hosts visiting staging domains. Silence suggests the lure was not clicked or filters blocked the traffic."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Visits to phishing staging infrastructure",
        "reads": [
          "device_hostname",
          "url_hostname",
          "url_path",
          "url_full",
          "user_agent",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_hostname, url_path, url_full, user_agent, time FROM hb_http_activity WHERE (instr(',' || '{{staging_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 OR (LOWER(url_hostname) = 'app.powerbi.com' AND LOWER(url_path) LIKE '/view%')) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Rows showing specific hosts visiting staging domains. Silence suggests the lure was not clicked or filters blocked the traffic.",
        "verified": "dry-run",
        "verified_at": "2026-10-08"
      }
    },
    {
      "id": "screenconnect-installer-writes",
      "type": "query",
      "label": "ScreenConnect installer file writes",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, file_name, file_path, file_hash_sha256, time FROM hb_file_activity WHERE activity_id = 1 AND (LOWER(file_name) LIKE 'screenconnect.clientsetup%' OR file_hash_sha256 = '5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_file_activity",
        "description": "Find where ScreenConnect installers were written to disk, particularly in user downloads or temp directories.",
        "expected_signal": "Installer files written by browsers in writable paths. Silence means the payload was not saved to these monitored paths."
      },
      "parents": [
        {
          "id": "phishing-infrastructure-visits"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "ScreenConnect installer file writes",
        "reads": [
          "device_hostname",
          "process_name",
          "file_name",
          "file_path",
          "file_hash_sha256",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, file_name, file_path, file_hash_sha256, time FROM hb_file_activity WHERE activity_id = 1 AND (LOWER(file_name) LIKE 'screenconnect.clientsetup%' OR file_hash_sha256 = '5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Installer files written by browsers in writable paths. Silence means the payload was not saved to these monitored paths.",
        "verified": "dry-run",
        "verified_at": "2026-10-08"
      }
    },
    {
      "id": "rare-screenconnect-relays",
      "type": "query",
      "label": "Rare ScreenConnect relay subdomains",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT query_hostname, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE LOWER(query_hostname) LIKE '%.screenconnect.com' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY query_hostname HAVING host_count <= 3 ORDER BY host_count ASC",
        "surface": "hb_dns_activity",
        "description": "Stack-count ScreenConnect relay subdomains to surface rogue or unapproved tenants across the fleet.",
        "expected_signal": "A ScreenConnect tenant seen on very few hosts. Corporate instances usually show high prevalence."
      },
      "parents": [
        {
          "id": "phishing-infrastructure-visits"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare ScreenConnect relay subdomains",
        "reads": [
          "query_hostname",
          "device_hostname",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT query_hostname, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE LOWER(query_hostname) LIKE '%.screenconnect.com' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY query_hostname HAVING host_count <= 3 ORDER BY host_count ASC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "A ScreenConnect tenant seen on very few hosts. Corporate instances usually show high prevalence.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "query_hostname"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-10-08"
      }
    },
    {
      "id": "triage-rmm-delivery",
      "type": "analytic",
      "label": "Triage RMM delivery chain",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "web"
        ],
        "context": [
          "phishing-infrastructure-visits",
          "screenconnect-installer-writes",
          "rare-screenconnect-relays"
        ],
        "objective": "Determine if any host that visited the staging domains subsequently downloaded the rogue ScreenConnect installer or communicated with a rare ScreenConnect relay subdomain.",
        "description": "Evaluate if the phishing visit and subsequent RMM indicators represent a successful compromise.",
        "max_iterations": 4,
        "expected_signal": "A per-host verdict on the delivery outcome.",
        "success_criteria": "A verdict of malicious, suspicious, or benign per host, citing relevant rows from the HTTP, file, and DNS surfaces."
      },
      "parents": [
        {
          "id": "screenconnect-installer-writes",
          "kind": "merge"
        },
        {
          "id": "rare-screenconnect-relays",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious for at least one host",
        "condition": "the triage verdict is malicious for at least one host",
        "blind_spot": "no-http-telemetry",
        "confidence": "high",
        "description": "Decide the next course of action based on the agent's triage.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-rmm-delivery"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate host",
      "config": {
        "target": "endpoint",
        "description": "Immediately contain the host to prevent command execution by the rogue RMM.",
        "instructions": "Isolate the host and preserve the suspicious ScreenConnect installer and any associated logs for further analysis.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst review",
      "config": {
        "assignee": "analyst",
        "description": "Verify the findings and determine if the ScreenConnect instance is unapproved.",
        "instructions": "Review the cited rows. Confirm the RMM instance is unauthorized by checking against corporate policy. If confirmed, move to the multi-stage deployment hunt."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Finalize the hunt when no malicious activity is confirmed.",
        "instructions": "Document the findings, including any legitimate ScreenConnect instances that were surfaced but cleared."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}