{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Regulated industries are high-value targets for ransomware; confirming the absence of a phishing-to-encryption chain is a critical assurance requirement."
      },
      "name": "Regulated Industry Phishing and Ransomware Chain",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1566",
        "attack.t1090.003",
        "attack.t1486"
      ],
      "related": [
        {
          "hunt": "lateral-movement-rdp-banking",
          "reason": "This hunt focuses on the infection chain on a single host; lateral movement requires authentication and RDP session telemetry.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A simple detection rule fires on a browser spawning a shell; this hunt correlates that event with subsequent proxy-based DNS traffic and high-volume file touches, providing the multi-stage context required to confirm an intrusion.",
      "coverage": [
        {
          "stage": "phishing-initial-access",
          "steps": [
            "browser-interpreter-launch"
          ],
          "status": "covered"
        },
        {
          "stage": "multi-hop-proxy-c2",
          "steps": [
            "proxy-c2-discovery"
          ],
          "status": "covered"
        },
        {
          "stage": "ransomware-encryption-impact",
          "steps": [
            "encryption-impact-search"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Phishing via Malicious Link or Message",
            "slug": "phishing-initial-access",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "malicious links in email",
              "suspicious messages",
              "automated phishing",
              "deepfake-enhanced outreach"
            ]
          },
          {
            "name": "Multi-hop Proxy Command and Control",
            "slug": "multi-hop-proxy-c2",
            "tactic": "command-and-control",
            "techniques": [
              "T1090.003"
            ],
            "observables": [
              "onion routing networks",
              "Tor traffic",
              "proxy chains",
              "operational relay box (ORB) networks"
            ]
          },
          {
            "name": "Data Encryption for Impact",
            "slug": "ransomware-encryption-impact",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "encrypted file extensions",
              "ransomware notes",
              "mass file rename operations",
              "interruption of system availability"
            ]
          }
        ],
        "summary": "Threat actors targeting healthcare and finance sectors frequently utilize phishing to gain initial access, masking their command-and-control traffic through multi-hop proxies before deploying ransomware to encrypt sensitive data. The campaign focus is on high-value intellectual property and personal financial information in under-monitored environments."
      },
      "severity": "medium",
      "rationale": "Focus on clinical endpoints and accounting workstations identified by user profiles or software inventory. Start with a 14-day lookback.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has breached a regulated host via a browser-delivered payload and is using multi-hop proxies to coordinate a ransomware encryption phase.",
      "parameters": {
        "browsers": {
          "from": {
            "ref": "https://www.huntress.com/blog/cyberattack-readiness",
            "kind": "article",
            "observed": "2026-09-01"
          },
          "type": "list[string]",
          "default": [
            "chrome.exe",
            "msedge.exe",
            "firefox.exe",
            "iexplore.exe"
          ],
          "description": "Common browser process names used as phishing ingress points."
        },
        "scope_hosts": {
          "from": {
            "ref": "internal-scoping",
            "kind": "manual",
            "observed": "2026-09-01"
          },
          "type": "list[host]",
          "default": [],
          "description": "Optional list of hosts to scope the hunt to (e.g., finance or clinical subnets)."
        },
        "interpreters": {
          "from": {
            "ref": "https://www.huntress.com/blog/cyberattack-readiness",
            "kind": "article",
            "observed": "2026-09-01"
          },
          "type": "list[string]",
          "default": [
            "powershell.exe",
            "cmd.exe",
            "wscript.exe",
            "cscript.exe",
            "mshta.exe"
          ],
          "description": "Interpreters frequently used in phishing payloads."
        },
        "lookback_days": {
          "from": {
            "ref": "hunt-standard-lookback",
            "kind": "manual",
            "observed": "2026-09-01"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "proxy_domains": {
          "from": {
            "ref": "https://www.huntress.com/blog/cyberattack-readiness",
            "kind": "article",
            "observed": "2026-09-01"
          },
          "type": "list[domain]",
          "default": [
            "tor2web.org",
            "onion.ly",
            "onion.ws",
            "onion.pet",
            "onion.dog"
          ],
          "description": "Public proxy or Tor bridge domains used to disguise C2 traffic."
        },
        "ransomware_extensions": {
          "from": {
            "ref": "https://www.huntress.com/blog/cyberattack-readiness",
            "kind": "article",
            "observed": "2026-09-01"
          },
          "type": "list[string]",
          "default": [
            ".encrypted",
            ".locked",
            ".crypt",
            ".crypted",
            ".wnry",
            ".locky",
            ".ryuk"
          ],
          "description": "Known ransomware file extensions to look for during the impact phase."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.huntress.com/blog/cyberattack-readiness",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.huntress.com/blog/cyberattack-readiness",
          "name": "Huntress \u2014 Hackers Frequently Target Healthcare and Finance Orgs"
        }
      ],
      "blind_spots": [
        {
          "id": "no-process-visibility",
          "risk": "Hosts without EDR coverage contribute no data to the lead query, allowing a beachhead to go unnoticed.",
          "stage": "phishing-initial-access",
          "question": "whether a browser successfully launched a payload on unmanaged devices",
          "requires": "hb_process_activity on all workstations"
        },
        {
          "id": "no-file-activity-logs",
          "risk": "If the provider does not log file touches or renames, the impact stage remains silent.",
          "stage": "ransomware-encryption-impact",
          "question": "whether files are being rapidly modified or renamed",
          "requires": "hb_file_activity supported by the endpoint provider"
        },
        {
          "id": "no-dns-proxy-logs",
          "risk": "Direct IP communication for proxies bypasses DNS detection entirely.",
          "stage": "multi-hop-proxy-c2",
          "question": "whether the host is resolving proxy domains",
          "requires": "hb_dns_activity on the host or resolver"
        }
      ]
    },
    "name": "Regulated Industry Phishing and Ransomware Chain",
    "description": "Healthcare and financial organizations face extreme risk from ransomware due to the high sensitivity of their data. This hunt monitors for the progression from initial phishing ingress to command-and-control via multi-hop proxies or Tor, and finally to the encryption impact characterized by rapid file touches with known ransomware extensions. It uses a gated flow to confirm suspicious process leads before investigating more intensive telemetry surfaces."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "phishing-initial-access",
            "steps": [
              "browser-interpreter-launch"
            ],
            "status": "covered"
          },
          {
            "stage": "multi-hop-proxy-c2",
            "steps": [
              "proxy-c2-discovery"
            ],
            "status": "covered"
          },
          {
            "stage": "ransomware-encryption-impact",
            "steps": [
              "encryption-impact-search"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An adversary has breached a regulated host via a browser-delivered payload and is using multi-hop proxies to coordinate a ransomware encryption phase.",
        "blind_spots": [
          {
            "id": "no-process-visibility",
            "risk": "Hosts without EDR coverage contribute no data to the lead query, allowing a beachhead to go unnoticed.",
            "stage": "phishing-initial-access",
            "question": "whether a browser successfully launched a payload on unmanaged devices",
            "requires": "hb_process_activity on all workstations"
          },
          {
            "id": "no-file-activity-logs",
            "risk": "If the provider does not log file touches or renames, the impact stage remains silent.",
            "stage": "ransomware-encryption-impact",
            "question": "whether files are being rapidly modified or renamed",
            "requires": "hb_file_activity supported by the endpoint provider"
          },
          {
            "id": "no-dns-proxy-logs",
            "risk": "Direct IP communication for proxies bypasses DNS detection entirely.",
            "stage": "multi-hop-proxy-c2",
            "question": "whether the host is resolving proxy domains",
            "requires": "hb_dns_activity on the host or resolver"
          }
        ],
        "scoping_notes": "Focus on clinical endpoints and accounting workstations identified by user profiles or software inventory. Start with a 14-day lookback.",
        "beyond_detection": "A simple detection rule fires on a browser spawning a shell; this hunt correlates that event with subsequent proxy-based DNS traffic and high-volume file touches, providing the multi-stage context required to confirm an intrusion."
      }
    },
    {
      "id": "browser-interpreter-launch",
      "type": "query",
      "label": "Browser-spawned shell leads",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, parent_process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{browsers}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 OR LOWER(parent_process_name) LIKE '%\\chrome.exe' OR LOWER(parent_process_name) LIKE '%\\msedge.exe') AND (instr(',' || '{{interpreters}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_name) LIKE '%\\powershell.exe' OR LOWER(process_name) LIKE '%\\cmd.exe') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Identify potential phishing payload execution where a web browser launches a command interpreter. This query uses LIKE fallbacks to handle full process paths.",
        "expected_signal": "A list of hosts where a browser spawned a shell. The agent must verify if the command line indicates malicious script activity or payload delivery."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Browser-spawned shell leads",
        "reads": [
          "device_hostname",
          "parent_process_name",
          "process_cmd_line",
          "process_name",
          "time",
          "user_name"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, parent_process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{browsers}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 OR LOWER(parent_process_name) LIKE '%\\chrome.exe' OR LOWER(parent_process_name) LIKE '%\\msedge.exe') AND (instr(',' || '{{interpreters}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_name) LIKE '%\\powershell.exe' OR LOWER(process_name) LIKE '%\\cmd.exe') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hosts where a browser spawned a shell. The agent must verify if the command line indicates malicious script activity or payload delivery.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "lead-assessment",
      "type": "analytic",
      "label": "Assess browser shell leads",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint"
        ],
        "context": [
          "browser-interpreter-launch"
        ],
        "objective": "Determine if command line arguments indicate payload execution. Specifically check for parent-child relationship timing to ensure the interpreter was indeed spawned by the browser process and not just an unrelated process running on the same host.",
        "description": "Determine if the shell launch from the browser appears malicious or related to an automated phishing attempt.",
        "max_iterations": 3,
        "expected_signal": "A per-host verdict on whether the lead indicates a successful phishing delivery.",
        "success_criteria": "A verdict of suspicious or benign for each identified host."
      },
      "parents": [
        {
          "id": "browser-interpreter-launch"
        }
      ]
    },
    {
      "id": "gate-on-suspicious",
      "type": "checkpoint",
      "label": "Gate on lead verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the lead assessment verdict is suspicious for at least one host",
        "condition": "the lead assessment verdict is suspicious for at least one host",
        "blind_spot": "no-process-visibility",
        "confidence": "high",
        "description": "Open expensive telemetry searches only if a suspicious lead is confirmed by the agent.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "lead-assessment"
        }
      ]
    },
    {
      "id": "proxy-c2-discovery",
      "type": "query",
      "label": "Identify proxy-based C2",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{proxy_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR query_hostname LIKE '%.onion%' OR query_hostname LIKE '%.tor%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_dns_activity",
        "description": "Find DNS lookups to multi-hop proxy domains or Tor bridges that disguise the original source of malicious traffic. Note: this query misses direct-to-IP proxy or Tor communication, as it is strictly limited to DNS activity.",
        "expected_signal": "Any DNS traffic to known proxies or onion domains. Silence on this step is not evidence of absence if proxies use IP addresses directly."
      },
      "parents": [
        {
          "id": "gate-on-suspicious",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Identify proxy-based C2",
        "reads": [
          "device_hostname",
          "process_name",
          "query_hostname",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{proxy_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR query_hostname LIKE '%.onion%' OR query_hostname LIKE '%.tor%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Any DNS traffic to known proxies or onion domains. Silence on this step is not evidence of absence if proxies use IP addresses directly.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "encryption-impact-search",
      "type": "query",
      "label": "Search for ransomware impact",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, COUNT(DISTINCT file_path) AS unique_files, MIN(time) AS first_touch, MAX(time) AS last_touch FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id IN (1, 3, 5) AND instr(',' || '{{ransomware_extensions}}' || ',', ',' || LOWER(SUBSTR(file_name, INSTR(file_name, '.'))) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name HAVING unique_files > 50",
        "surface": "hb_file_activity",
        "description": "Detect the final stage of the ransomware lifecycle by searching for processes touching a high volume of unique files with suspicious extensions.",
        "expected_signal": "Multiple file touches by a single process using suspicious extensions on a single host. This confirms the impact stage."
      },
      "parents": [
        {
          "id": "gate-on-suspicious",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Search for ransomware impact",
        "reads": [
          "activity_id",
          "device_hostname",
          "file_name",
          "file_path",
          "process_name",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, COUNT(DISTINCT file_path) AS unique_files, MIN(time) AS first_touch, MAX(time) AS last_touch FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND activity_id IN (1, 3, 5) AND instr(',' || '{{ransomware_extensions}}' || ',', ',' || LOWER(SUBSTR(file_name, INSTR(file_name, '.'))) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name HAVING unique_files > 50",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Multiple file touches by a single process using suspicious extensions on a single host. This confirms the impact stage.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "process_name"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "full-chain-triage",
      "type": "analytic",
      "label": "Correlate full attack chain",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint"
        ],
        "context": [
          "lead-assessment",
          "proxy-c2-discovery",
          "encryption-impact-search"
        ],
        "objective": "Determine if a single host exhibits a temporal chain from the suspicious browser launch to either proxy C2 traffic or mass file touches with ransomware extensions.",
        "description": "Unify the initial phishing lead with the command-and-control and encryption telemetry to confirm an active ransomware session.",
        "max_iterations": 5,
        "expected_signal": "A unified verdict identifying which hosts are currently undergoing an intrusion chain.",
        "success_criteria": "A detailed verdict citing process paths, domains, and file touch counts per host."
      },
      "parents": [
        {
          "id": "proxy-c2-discovery",
          "kind": "merge"
        },
        {
          "id": "encryption-impact-search",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "final-route",
      "type": "checkpoint",
      "label": "Final route on intrusion",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious for at least one host exhibiting a complete chain from browser launch to proxy traffic or file encryption",
        "condition": "the triage verdict is malicious for at least one host exhibiting a complete chain from browser launch to proxy traffic or file encryption",
        "blind_spot": "no-file-activity-logs",
        "confidence": "high",
        "description": "Route to host isolation for confirmed intrusions or analyst review for ambiguous findings.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "full-chain-triage"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate host and preserve state",
      "config": {
        "target": "endpoint",
        "description": "Immediately sever network connectivity to stop the encryption process and prevent further data leakage.",
        "instructions": "Isolate the host via the EDR platform. Record the current system time to coordinate with backup teams for restoration to a pre-infection state.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "final-route",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst manual review",
      "config": {
        "assignee": "analyst",
        "description": "Investigate the root cause and ensure no other hosts were affected via lateral movement.",
        "instructions": "Review the browser history and downloaded files on the isolated host. Pivot to hb_auth_signin to check if the user's credentials were used from unusual source IPs."
      },
      "parents": [
        {
          "id": "gate-on-suspicious",
          "branch": "default"
        },
        {
          "id": "gate-on-suspicious",
          "branch": "on_unavailable"
        },
        {
          "id": "final-route",
          "branch": "default"
        },
        {
          "id": "final-route",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Hunt close-out",
      "config": {
        "assignee": "analyst",
        "description": "Document findings and tune parameters for future runs.",
        "instructions": "If no intrusions were found, record the negative result. If many benign browser-to-shell launches were observed, consider refining the interpreters list or matching logic."
      },
      "parents": [
        {
          "id": "gate-on-suspicious",
          "branch": "on_refutes"
        },
        {
          "id": "final-route",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}