{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Linking identity-provider events to specific host-based activity is the primary way to deanonymize sessions arriving via multi-hop proxies; this hunt provides that correlation across siloed telemetry surfaces."
      },
      "name": "Correlating Proxy-Obscured Identity and Endpoint Activity",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1090.003",
        "attack.t1078",
        "attack.t1059"
      ],
      "related": [
        {
          "hunt": "okta-mfa-fatigue-triage",
          "reason": "This hunt focuses on proxy-obscured source attribution rather than authentication mechanism exploitation.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A single detection rule can trigger on a known Tor IP or a specific discovery command, but it cannot verify if that IP was used for a successful Okta login that then led to discovery activity on an internal host. This hunt pivots between Identity, DNS, Network, and Process surfaces to confirm the behavioral link.",
      "coverage": [
        {
          "stage": "proxy-infrastructure-resolution",
          "steps": [
            "dns-proxy-infra"
          ],
          "status": "covered"
        },
        {
          "stage": "okta-authentication-via-proxy",
          "steps": [
            "auth-suspicious-ips"
          ],
          "status": "covered"
        },
        {
          "stage": "multi-hop-network-egress",
          "steps": [
            "network-proxy-egress"
          ],
          "status": "covered"
        },
        {
          "stage": "endpoint-identity-execution",
          "steps": [
            "endpoint-discovery"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Proxy Infrastructure DNS Resolution",
            "slug": "proxy-infrastructure-resolution",
            "tactic": "command-and-control",
            "techniques": [
              "T1090.003"
            ],
            "observables": [
              "query_hostname: torproject.org",
              "query_hostname: *.hiddenservice.net",
              "query_hostname: bridge.torproject.org"
            ]
          },
          {
            "name": "Identity Authentication via Multi-hop Proxy",
            "slug": "okta-authentication-via-proxy",
            "tactic": "initial-access",
            "techniques": [
              "T1078",
              "T1090.003"
            ],
            "observables": [
              "src_endpoint_ip belonging to VPS or known Tor exit node ranges",
              "auth_protocol: SAML",
              "auth_protocol: OAuth",
              "provider: okta"
            ]
          },
          {
            "name": "Network Egress to Proxy Nodes",
            "slug": "multi-hop-network-egress",
            "tactic": "command-and-control",
            "techniques": [
              "T1090.003"
            ],
            "observables": [
              "dst_endpoint_port: 9001",
              "dst_endpoint_port: 9050",
              "dst_endpoint_ip: known Tor relays",
              "protocol: tcp"
            ]
          },
          {
            "name": "Identity-Correlated Process Execution",
            "slug": "endpoint-identity-execution",
            "tactic": "execution",
            "techniques": [
              "T1059"
            ],
            "observables": [
              "process_cmd_line: whoami",
              "process_cmd_line: hostname",
              "user_name matching actor_user_name from Okta authentication events"
            ]
          }
        ],
        "summary": "Adversaries leverage multi-hop proxies to obscure their origin while authenticating to identity providers like Okta, subsequently performing unauthorized actions on endpoints. Detection relies on the difficult task of correlating proxy-anonymized sign-in events with subsequent host-level process and network telemetry."
      },
      "severity": "medium",
      "rationale": "Start with high-privilege users in the Okta logs. Focus on authentication events where the source IP does not match the user's typical office or VPN range.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is using multi-hop proxy infrastructure to authenticate via Okta and subsequently execute discovery commands on an endpoint, obscured by network egress to proxy relay ports.",
      "parameters": {
        "proxy_ips": {
          "from": {
            "ref": "threat-intel",
            "kind": "manual",
            "observed": "2026-06-11"
          },
          "type": "list[ip]",
          "default": [
            "185.220.101.0",
            "176.10.99.200"
          ],
          "description": "Known Tor exit node or VPS IP addresses."
        },
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Specific hostnames to narrow the hunt."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "proxy_domains": {
          "from": {
            "ref": "red-canary",
            "kind": "article",
            "observed": "2026-06-11"
          },
          "type": "list[domain]",
          "default": [
            "torproject.org",
            "bridge.torproject.org",
            "check.torproject.org"
          ],
          "description": "Known proxy infrastructure domains."
        },
        "discovery_commands": {
          "from": {
            "ref": "red-canary",
            "kind": "article",
            "observed": "2026-06-11"
          },
          "type": "list[string]",
          "default": [
            "whoami",
            "hostname",
            "ipconfig",
            "net user"
          ],
          "description": "Discovery commands often run by adversaries immediately after gaining access."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://redcanary.com/blog/threat-detection/threat-hunting-scaled/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://redcanary.com/blog/threat-detection/threat-hunting-scaled/",
          "name": "How threat hunting evolves at scale \u2014 Red Canary"
        }
      ],
      "blind_spots": [
        {
          "id": "missing-endpoint-telemetry",
          "risk": "An adversary could authenticate via proxy and access unmanaged infrastructure without detection.",
          "stage": "endpoint-identity-execution",
          "question": "Did the user execute commands on hosts where no EDR agent is installed?",
          "requires": "hb_process_activity from all endpoints"
        },
        {
          "id": "ephemeral-proxy-nodes",
          "risk": "Static IP lists will miss private relays or fresh VPS infrastructure.",
          "stage": "okta-authentication-via-proxy",
          "question": "Was the authentication from a newly stood-up VPS not yet in our IP lists?",
          "requires": "Up-to-date threat intelligence on Tor exit nodes"
        }
      ]
    },
    "name": "Correlating Proxy-Obscured Identity and Endpoint Activity",
    "description": "This hunt bridges identity telemetry with endpoint behavior to deanonymize sessions arriving through multi-hop proxies. It starts by identifying successful Okta logins and correlating them with hosts resolving known proxy infrastructure. The hunt then pivots to find network egress to standard proxy ports (9001, 9050) and the execution of post-authentication discovery commands on those same hosts. By linking these disparate surfaces, the analyst can identify compromised credentials even when the source IP is obscured."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "proxy-infrastructure-resolution",
            "steps": [
              "dns-proxy-infra"
            ],
            "status": "covered"
          },
          {
            "stage": "okta-authentication-via-proxy",
            "steps": [
              "auth-suspicious-ips"
            ],
            "status": "covered"
          },
          {
            "stage": "multi-hop-network-egress",
            "steps": [
              "network-proxy-egress"
            ],
            "status": "covered"
          },
          {
            "stage": "endpoint-identity-execution",
            "steps": [
              "endpoint-discovery"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary is using multi-hop proxy infrastructure to authenticate via Okta and subsequently execute discovery commands on an endpoint, obscured by network egress to proxy relay ports.",
        "blind_spots": [
          {
            "id": "missing-endpoint-telemetry",
            "risk": "An adversary could authenticate via proxy and access unmanaged infrastructure without detection.",
            "stage": "endpoint-identity-execution",
            "question": "Did the user execute commands on hosts where no EDR agent is installed?",
            "requires": "hb_process_activity from all endpoints"
          },
          {
            "id": "ephemeral-proxy-nodes",
            "risk": "Static IP lists will miss private relays or fresh VPS infrastructure.",
            "stage": "okta-authentication-via-proxy",
            "question": "Was the authentication from a newly stood-up VPS not yet in our IP lists?",
            "requires": "Up-to-date threat intelligence on Tor exit nodes"
          }
        ],
        "scoping_notes": "Start with high-privilege users in the Okta logs. Focus on authentication events where the source IP does not match the user's typical office or VPN range.",
        "beyond_detection": "A single detection rule can trigger on a known Tor IP or a specific discovery command, but it cannot verify if that IP was used for a successful Okta login that then led to discovery activity on an internal host. This hunt pivots between Identity, DNS, Network, and Process surfaces to confirm the behavioral link."
      }
    },
    {
      "id": "scope-okta-logins",
      "type": "query",
      "label": "Scope Okta Authentication Activity",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, dst_endpoint_name, auth_protocol, time FROM hb_auth_signin WHERE provider = 'okta' AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_auth_signin",
        "description": "Establish a baseline of successful Okta logins to identify active users and potential beachhead IPs.",
        "expected_signal": "A list of successful Okta logins. Silence indicates no Okta telemetry is available for the period."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Scope Okta Authentication Activity",
        "reads": [
          "actor_user_name",
          "auth_protocol",
          "dst_endpoint_name",
          "provider",
          "src_endpoint_ip",
          "status_id",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, dst_endpoint_name, auth_protocol, time FROM hb_auth_signin WHERE provider = 'okta' AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of successful Okta logins. Silence indicates no Okta telemetry is available for the period.",
        "verified": "dry-run",
        "verified_at": "2026-09-21"
      }
    },
    {
      "id": "dns-proxy-infra",
      "type": "query",
      "label": "DNS Resolutions for Proxy Infrastructure",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, query_hostname, time FROM hb_dns_activity WHERE (instr(',' || '{{proxy_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%.hiddenservice.net') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_dns_activity",
        "description": "Detect endpoints resolving domains associated with proxy services like Tor or onion routing.",
        "expected_signal": "Hosts resolving Tor-related domains. Silence suggests no active use of these proxy gateways via DNS."
      },
      "parents": [
        {
          "id": "scope-okta-logins"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "DNS Resolutions for Proxy Infrastructure",
        "reads": [
          "device_hostname",
          "process_name",
          "query_hostname",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, query_hostname, time FROM hb_dns_activity WHERE (instr(',' || '{{proxy_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%.hiddenservice.net') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Hosts resolving Tor-related domains. Silence suggests no active use of these proxy gateways via DNS.",
        "verified": "dry-run",
        "verified_at": "2026-09-21"
      }
    },
    {
      "id": "auth-suspicious-ips",
      "type": "query",
      "label": "Suspicious Okta Login Source IPs",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "identity",
        "content": "SELECT src_endpoint_ip, COUNT(DISTINCT actor_user_name) AS user_count, COUNT(*) AS login_count FROM hb_auth_signin WHERE provider = 'okta' AND status_id = 1 AND (instr(',' || '{{proxy_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 OR src_endpoint_ip IN (SELECT src_endpoint_ip FROM hb_auth_signin WHERE provider = 'okta' GROUP BY src_endpoint_ip HAVING COUNT(DISTINCT actor_user_name) <= 3)) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip",
        "surface": "hb_auth_signin",
        "description": "Identify Okta logins from known proxy IPs or IPs used by very few users across the fleet.",
        "expected_signal": "Successful logins from known proxy exit nodes or highly unique IPs. Silence suggests no anomalous authentication source IPs."
      },
      "parents": [
        {
          "id": "scope-okta-logins"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Suspicious Okta Login Source IPs",
        "reads": [
          "actor_user_name",
          "provider",
          "src_endpoint_ip",
          "status_id",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT src_endpoint_ip, COUNT(DISTINCT actor_user_name) AS user_count, COUNT(*) AS login_count FROM hb_auth_signin WHERE provider = 'okta' AND status_id = 1 AND (instr(',' || '{{proxy_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 OR src_endpoint_ip IN (SELECT src_endpoint_ip FROM hb_auth_signin WHERE provider = 'okta' GROUP BY src_endpoint_ip HAVING COUNT(DISTINCT actor_user_name) <= 3)) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Successful logins from known proxy exit nodes or highly unique IPs. Silence suggests no anomalous authentication source IPs.",
        "verified": "dry-run",
        "prevalence": {
          "by": "actor_user_name",
          "key": [
            "src_endpoint_ip"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-21"
      }
    },
    {
      "id": "early-stage-triage",
      "type": "analytic",
      "label": "Early Stage Evidence Triage",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "network"
        ],
        "context": [
          "scope-okta-logins",
          "dns-proxy-infra",
          "auth-suspicious-ips"
        ],
        "objective": "Identify if any Okta login session from a rare or known proxy IP (auth-suspicious-ips) occurred on a host that was also resolving proxy infrastructure domains (dns-proxy-infra).",
        "description": "Correlate rare identity authentication events with endpoint proxy infrastructure resolution.",
        "max_iterations": 3,
        "expected_signal": "A per-host verdict linking a specific user login to proxy domain resolution.",
        "success_criteria": "A verdict citing specific hosts and users where both signals occurred in close proximity."
      },
      "parents": [
        {
          "id": "dns-proxy-infra",
          "kind": "merge"
        },
        {
          "id": "auth-suspicious-ips",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "network-proxy-egress",
      "type": "query",
      "label": "Network Egress to Proxy Relay Ports",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, process_name, time FROM hb_network_connection WHERE dst_endpoint_port IN (9001, 9050) AND protocol = 'tcp' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_network_connection",
        "description": "Detect TCP connections to standard proxy ports like 9001 and 9050 that often signal Tor or multi-hop traffic.",
        "expected_signal": "Established connections to proxy relay ports. Silence means no egress to these specific ports was observed."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Network Egress to Proxy Relay Ports",
        "reads": [
          "device_hostname",
          "dst_endpoint_ip",
          "dst_endpoint_port",
          "process_name",
          "protocol",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, process_name, time FROM hb_network_connection WHERE dst_endpoint_port IN (9001, 9050) AND protocol = 'tcp' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Established connections to proxy relay ports. Silence means no egress to these specific ports was observed.",
        "verified": "dry-run",
        "verified_at": "2026-09-21"
      }
    },
    {
      "id": "endpoint-discovery",
      "type": "query",
      "label": "Endpoint Discovery Command Execution",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, user_name, process_name, process_cmd_line, time FROM hb_process_activity WHERE (instr(',' || '{{discovery_commands}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{discovery_commands}}' || ',', ',' || LOWER(process_cmd_line) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Find discovery commands executed on the host that correlate with the suspected proxy session.",
        "expected_signal": "Process execution of common discovery tools. Silence suggests no discovery activity was logged."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Endpoint Discovery Command Execution",
        "reads": [
          "device_hostname",
          "process_cmd_line",
          "process_name",
          "time",
          "user_name"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, user_name, process_name, process_cmd_line, time FROM hb_process_activity WHERE (instr(',' || '{{discovery_commands}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{discovery_commands}}' || ',', ',' || LOWER(process_cmd_line) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Process execution of common discovery tools. Silence suggests no discovery activity was logged.",
        "verified": "dry-run",
        "verified_at": "2026-09-21"
      }
    },
    {
      "id": "follow-on-triage",
      "type": "analytic",
      "label": "Follow-on Evidence Triage",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "network"
        ],
        "context": [
          "early-stage-triage",
          "network-proxy-egress",
          "endpoint-discovery"
        ],
        "objective": "Confirm whether the suspect users and hosts from early-stage-triage showed subsequent network egress to proxy nodes or discovery command execution on the same endpoint.",
        "description": "Finalize the intrusion chain by linking the suspicious login to follow-on network and process activity.",
        "max_iterations": 6,
        "expected_signal": "A high-confidence malicious verdict for hosts showing the full chain.",
        "success_criteria": "A final malicious | suspicious verdict citing the temporal link between auth, network, and process events."
      },
      "parents": [
        {
          "id": "network-proxy-egress",
          "kind": "merge"
        },
        {
          "id": "endpoint-discovery",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-verdict",
      "type": "checkpoint",
      "label": "Route Based on Intrusion Chain",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the follow-on-triage verdict is malicious for at least one host and user",
        "condition": "the follow-on-triage verdict is malicious for at least one host and user",
        "blind_spot": "missing-endpoint-telemetry",
        "confidence": "high",
        "description": "Direct the hunt to containment if a full proxy-to-endpoint chain is confirmed.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "follow-on-triage"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate Host and Revoke Identity",
      "config": {
        "target": "endpoint",
        "description": "Contain the threat by isolating the beachhead host and revoking compromised Okta sessions.",
        "instructions": "Isolate the endpoint in the EDR console and revoke all active Okta sessions for the identified user.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-validation",
      "type": "task",
      "label": "Analyst Final Validation",
      "config": {
        "assignee": "analyst",
        "description": "Confirm the findings and verify no lateral movement occurred.",
        "instructions": "Verify the link between the Okta login IP and the endpoint network/process activity. Investigate any lateral movement (e.g. RDP/SSH) from this host within the same window."
      },
      "parents": [
        {
          "id": "route-verdict",
          "branch": "default"
        },
        {
          "id": "route-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close Out and Record ROI",
      "config": {
        "assignee": "analyst",
        "description": "Final documentation and performance metrics.",
        "instructions": "Document the findings and update any baseline filters if the activity was determined to be authorized administrative work. Record the detection of a proxy-obscured session as a successful hunt ROI."
      },
      "parents": [
        {
          "id": "route-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-validation"
        }
      ]
    }
  ]
}