{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Adversaries are using legitimate RMM tools to bypass standard detection. This hunt identifies the specific behavioral chain\u2014social engineering to script execution to persistence\u2014that characterizes this campaign, which a single rule would likely miss." }, "name": "Rogue ScreenConnect Host Execution and Persistence", "type": "investigation", "labels": [ "hunt", "attack.t1566", "attack.t1021.001", "attack.t1059.001", "attack.t1547.001", "attack.t1071.001" ], "series": { "slug": "rogue-screenconnect-installations-across-unrelated-hosts-suggest-worm-like-activity", "index": 1, "title": "Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity", "total": 2 }, "related": [ { "hunt": "secondary-rmm-redundancy-check", "reason": "This hunt focuses specifically on the ScreenConnect VBScript chain; a separate hunt should target other RMM tools like UltraViewer mentioned in the report.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "The hunt correlates three distinct stages\u2014initial access tools, anomalous RMM child processes, and specific registry-based persistence\u2014using multiple surfaces (process, registry, and script activity). This multi-stage context is required to identify the campaign logic and reduce false positives from legitimate IT activity.", "coverage": [ { "stage": "initial-access-social-engineering", "steps": [ "social-engineering-lead" ], "status": "covered" }, { "stage": "rogue-screenconnect-execution", "steps": [ "screenconnect-wscript-chain" ], "status": "covered" }, { "stage": "host-profiling-and-discovery", "steps": [ "rare-script-profiling", "edr-process-presence" ], "status": "covered" }, { "stage": "persistence-via-run-key", "steps": [ "registry-persistence-lead" ], "status": "covered" }, { "stage": "powershell-payload-decryption", "steps": [ "rare-script-profiling" ], "reason": "Script activity captures the execution of the numbered VBScripts and the runner.ps1 block.", "status": "covered" }, { "stage": "network-c2-and-staged-download", "reason": "Belongs to another part of the 'Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity' series.", "status": "out_of_scope" }, { "stage": "secondary-rmm-redundancy", "reason": "Belongs to another part of the 'Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Initial Access via Social Engineering", "slug": "initial-access-social-engineering", "tactic": "initial-access", "techniques": [ "T1566", "T1021.001" ], "observables": [ "Quick Assist", "ScreenConnect.ClientSetup.msi", "Geek Squad refund form" ] }, { "name": "Rogue ScreenConnect and Script Execution", "slug": "rogue-screenconnect-execution", "tactic": "execution", "techniques": [ "T1059.001" ], "observables": [ "ScreenConnect.WindowsClient.exe", "ScreenConnect.Client.exe", "wscript.exe", "1.vbs", "2.vbs", "3.vbs", "4.vbs" ] }, { "name": "Host Profiling and EDR Discovery", "slug": "host-profiling-and-discovery", "tactic": "discovery", "techniques": [ "T1059.001" ], "observables": [ "1.vbs", "value.txt", "Huntress", "Cisco AMP", "CrowdStrike", "SentinelOne", "Sophos", "Malwarebytes", "Microsoft Defender", "RAM check > 5GB" ] }, { "name": "Persistence via Registry Run Key", "slug": "persistence-via-run-key", "tactic": "persistence", "techniques": [ "T1547.001" ], "observables": [ "WindowsServiceHost", "WindowsServiceHost.vbs", "WindowsServiceHost.bat", "AppData" ] }, { "name": "Network C2 and Staged Download", "slug": "network-c2-and-staged-download", "tactic": "command-and-control", "techniques": [ "T1090.003", "T1572" ], "observables": [ "45.13.237.190", "131.123.40.98", "15.204.185.204", "tele-sync.opik.net", "borertors92.anondns.net", "port 8041", "Dropbox", "map.txt", "user.enc", "acc.enc", "combo.enc" ] }, { "name": "PowerShell Payload Decryption and Execution", "slug": "powershell-payload-decryption", "tactic": "execution", "techniques": [ "T1059.001" ], "observables": [ "runner.ps1", "PyTorchFix.ps1", "sys_cache.zip", "out.enc", "AES-CBC" ] }, { "name": "Secondary RMM Deployment", "slug": "secondary-rmm-redundancy", "tactic": "lateral-movement", "techniques": [ "T1021.001" ], "observables": [ "UltraViewer", "146.59.55.107", "45.32.192.150" ] } ], "summary": "Attackers leverage social engineering or phishing to deploy rogue ScreenConnect instances, which then execute a multi-stage VBScript chain to profile the host and bypass security products. The campaign establishes persistence through registry Run keys and downloads encrypted payloads from Dropbox, including secondary RMM tools like UltraViewer and tunneling utilities, with some samples exhibiting worm-like propagation via connected ScreenConnect endpoints." }, "severity": "high", "rationale": "Prioritize workstations and endpoints that show recent MSI installations in Downloads or Temp directories. Servers are lower priority given the social engineering component (Quick Assist/Phishing).", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is using social engineering to deploy rogue ScreenConnect clients that execute a multi-stage VBScript chain for host profiling and persistent access via registry run keys.", "parameters": { "scope_hosts": { "from": { "ref": "User Input", "kind": "manual", "observed": "2026-09-03" }, "type": "list[host]", "default": [], "description": "Limit the hunt to these hostnames; leave empty for fleet-wide." }, "lookback_days": { "from": { "ref": "Huntress Article", "kind": "manual", "observed": "2026-09-03" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "rmm_processes": { "from": { "ref": "Huntress Article", "kind": "article", "observed": "2026-09-03" }, "type": "list[string]", "default": [ "screenconnect.windowsclient.exe", "screenconnect.client.exe" ], "description": "Known ScreenConnect client filenames." }, "vbs_indicators": { "from": { "ref": "Huntress Article", "kind": "article", "observed": "2026-09-03" }, "type": "list[string]", "default": [ "1.vbs", "2.vbs", "3.vbs", "4.vbs", "windowsservicehost.vbs" ], "description": "Filenames of scripts used in the reported staging and persistence phases." }, "profiling_keywords": { "from": { "ref": "Huntress Article", "kind": "article", "observed": "2026-09-03" }, "type": "list[string]", "default": [ "huntress.exe", "ciscoamp.exe", "falcon_sensor.exe", "s1_agent.exe", "sophos_edr.exe", "windefend.exe" ], "description": "Process names of security products the adversary scripts search for." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/rogue-screenconnect-installations", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/rogue-screenconnect-installations", "name": "Huntress \u2014 Rogue ScreenConnect Installations Suggest Worm-Like Activity" } ], "blind_spots": [ { "id": "vbs-script-visibility", "risk": "If the environment does not capture script block content, we cannot differentiate the profiling logic from legitimate administrative scripts.", "stage": "host-profiling-and-discovery", "question": "Can we see the decoded contents of the VBScript blocks?", "requires": "hb_script_activity with full block retention" }, { "id": "encrypted-payload-contents", "risk": "The VBScript chain decrypts a ZIP file; without the AES key from the map.txt file or memory captures, the final 'worm' payload remains unknown.", "stage": "powershell-payload-decryption", "question": "What is the final payload inside sys_cache.zip?", "requires": "EDR memory scanning or forensic file recovery" } ] }, "name": "Rogue ScreenConnect Host Execution and Persistence", "description": "This hunt targets a specific attack pattern where ScreenConnect clients, often deployed after a social engineering prompt like Quick Assist, spawn Windows Script Host (wscript.exe) to execute a series of numbered VBScripts. The hunt follows a phased flow: first identifying initial access beachheads and anomalous process chains, then pivoting to registry-based persistence and host profiling logic. By weighing the presence of EDR processes against the specific VBScript content and persistence keys, an analyst can distinguish between unauthorized RMM tools and legitimate administrative activity." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "rogue-screenconnect-installations-across-unrelated-hosts-suggest-worm-like-activity", "index": 1, "title": "Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity", "total": 2 }, "coverage": [ { "stage": "initial-access-social-engineering", "steps": [ "social-engineering-lead" ], "status": "covered" }, { "stage": "rogue-screenconnect-execution", "steps": [ "screenconnect-wscript-chain" ], "status": "covered" }, { "stage": "host-profiling-and-discovery", "steps": [ "rare-script-profiling", "edr-process-presence" ], "status": "covered" }, { "stage": "persistence-via-run-key", "steps": [ "registry-persistence-lead" ], "status": "covered" }, { "stage": "powershell-payload-decryption", "steps": [ "rare-script-profiling" ], "reason": "Script activity captures the execution of the numbered VBScripts and the runner.ps1 block.", "status": "covered" }, { "stage": "network-c2-and-staged-download", "reason": "Belongs to another part of the 'Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity' series.", "status": "out_of_scope" }, { "stage": "secondary-rmm-redundancy", "reason": "Belongs to another part of the 'Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity' series.", "status": "out_of_scope" } ], "rationale": "An adversary is using social engineering to deploy rogue ScreenConnect clients that execute a multi-stage VBScript chain for host profiling and persistent access via registry run keys.", "blind_spots": [ { "id": "vbs-script-visibility", "risk": "If the environment does not capture script block content, we cannot differentiate the profiling logic from legitimate administrative scripts.", "stage": "host-profiling-and-discovery", "question": "Can we see the decoded contents of the VBScript blocks?", "requires": "hb_script_activity with full block retention" }, { "id": "encrypted-payload-contents", "risk": "The VBScript chain decrypts a ZIP file; without the AES key from the map.txt file or memory captures, the final 'worm' payload remains unknown.", "stage": "powershell-payload-decryption", "question": "What is the final payload inside sys_cache.zip?", "requires": "EDR memory scanning or forensic file recovery" } ], "scoping_notes": "Prioritize workstations and endpoints that show recent MSI installations in Downloads or Temp directories. Servers are lower priority given the social engineering component (Quick Assist/Phishing).", "beyond_detection": "The hunt correlates three distinct stages\u2014initial access tools, anomalous RMM child processes, and specific registry-based persistence\u2014using multiple surfaces (process, registry, and script activity). This multi-stage context is required to identify the campaign logic and reduce false positives from legitimate IT activity." } }, { "id": "scoping-screenconnect", "type": "query", "label": "Identify ScreenConnect installations", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%screenconnect%' OR LOWER(vendor_name) LIKE '%connectwise%')", "surface": "hb_software_inventory", "description": "Scope the estate to hosts with ScreenConnect or ConnectWise software to focus the behavioral queries.", "expected_signal": "A list of hosts with the relevant software. This does not confirm a rogue installation but narrows the scope." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify ScreenConnect installations", "reads": [ "device_hostname", "package_name", "package_version", "vendor_name" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%screenconnect%' OR LOWER(vendor_name) LIKE '%connectwise%')", "silence": "not_evidence_of_absence", "expected": "A list of hosts with the relevant software. This does not confirm a rogue installation but narrows the scope.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "social-engineering-lead", "type": "query", "label": "Quick Assist and suspicious installers", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%quickassist.exe' OR LOWER(process_cmd_line) LIKE '%screenconnect.clientsetup.msi%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify the reported social engineering tools (Quick Assist) and ScreenConnect setup files in non-standard paths.", "expected_signal": "Quick Assist usage or MSI execution followed by a ScreenConnect deployment. Silence proves absence of these specific launchers." }, "parents": [ { "id": "scoping-screenconnect" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Quick Assist and suspicious installers", "reads": [ "device_hostname", "process_name", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%quickassist.exe' OR LOWER(process_cmd_line) LIKE '%screenconnect.clientsetup.msi%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "Quick Assist usage or MSI execution followed by a ScreenConnect deployment. Silence proves absence of these specific launchers.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "screenconnect-wscript-chain", "type": "query", "label": "ScreenConnect spawning wscript.exe", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%wscript.exe') AND (instr(',' || '{{rmm_processes}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 OR LOWER(parent_process_name) LIKE '%screenconnect%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Detect the anomalous core behavior where a ScreenConnect process launches the Windows Script Host.", "expected_signal": "Anomalous parent-child process chains where the RMM client executes scripts. This is the primary behavioral detection candidate." }, "parents": [ { "id": "scoping-screenconnect" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "ScreenConnect spawning wscript.exe", "reads": [ "device_hostname", "process_name", "process_cmd_line", "parent_process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%wscript.exe') AND (instr(',' || '{{rmm_processes}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 OR LOWER(parent_process_name) LIKE '%screenconnect%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Anomalous parent-child process chains where the RMM client executes scripts. This is the primary behavioral detection candidate.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "early-stage-read", "type": "analytic", "label": "Evaluate initial beachhead", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "social-engineering-lead", "screenconnect-wscript-chain" ], "objective": "Determine if the Quick Assist or MSI activity correlates with ScreenConnect spawning wscript.exe to launch VBScripts.", "description": "Assess whether the combined social engineering and process chain evidence suggests a rogue deployment.", "max_iterations": 3, "expected_signal": "A per-host verdict on whether early-stage activity was malicious.", "success_criteria": "A clear assessment of which hosts require follow-on hunting for persistence." }, "parents": [ { "id": "social-engineering-lead", "kind": "merge" }, { "id": "screenconnect-wscript-chain", "kind": "merge" } ] }, { "id": "registry-persistence-lead", "type": "query", "label": "WindowsServiceHost Run key persistence", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_data, time FROM hb_registry_activity WHERE LOWER(reg_target) LIKE '%\\run\\windowsservicehost' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_registry_activity", "description": "Find the registry Run key used by the adversary to maintain persistence across reboots.", "expected_signal": "Registry values pointing to VBScript or batch files in AppData or Temp folders." }, "parents": [ { "id": "early-stage-read" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "WindowsServiceHost Run key persistence", "reads": [ "device_hostname", "reg_target", "reg_value_data", "time" ], "source": "hb_registry_activity", "target": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_data, time FROM hb_registry_activity WHERE LOWER(reg_target) LIKE '%\\run\\windowsservicehost' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Registry values pointing to VBScript or batch files in AppData or Temp folders.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "rare-script-profiling", "type": "query", "label": "Rare profiling VBScripts", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT script_name, device_hostname, script_content, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_script_activity WHERE (instr(',' || '{{vbs_indicators}}' || ',', ',' || LOWER(script_name) || ',') > 0 OR instr(LOWER(script_content), 'value.txt') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY script_name, device_hostname, script_content HAVING host_count <= 3 ORDER BY host_count ASC", "surface": "hb_script_activity", "description": "Identify rare VBScripts executed in the environment that match the report's filenames or logic.", "expected_signal": "Rare scripts containing 'value.txt' or the numbered filenames. These indicate the worm-like profiling logic is present." }, "parents": [ { "id": "early-stage-read" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare profiling VBScripts", "reads": [ "script_name", "device_hostname", "script_content", "time" ], "source": "hb_script_activity", "target": "endpoint", "content": "SELECT script_name, device_hostname, script_content, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_script_activity WHERE (instr(',' || '{{vbs_indicators}}' || ',', ',' || LOWER(script_name) || ',') > 0 OR instr(LOWER(script_content), 'value.txt') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY script_name, device_hostname, script_content HAVING host_count <= 3 ORDER BY host_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Rare scripts containing 'value.txt' or the numbered filenames. These indicate the worm-like profiling logic is present.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "script_name", "script_content" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "edr-process-presence", "type": "query", "label": "Check presence of enumerated security software", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_original_file_name, time FROM hb_process_activity WHERE instr(',' || '{{profiling_keywords}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Determine if the security products listed in the profiling script actually exist on the target hosts.", "expected_signal": "A list of EDR processes present on the hosts. This context explains the 'state variable' logic the adversary script uses." }, "parents": [ { "id": "early-stage-read" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Check presence of enumerated security software", "reads": [ "device_hostname", "process_name", "process_original_file_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_original_file_name, time FROM hb_process_activity WHERE instr(',' || '{{profiling_keywords}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A list of EDR processes present on the hosts. This context explains the 'state variable' logic the adversary script uses.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "follow-on-read", "type": "analytic", "label": "Full chain assessment", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "early-stage-read", "registry-persistence-lead", "rare-script-profiling", "edr-process-presence" ], "objective": "Combine the early-stage read with the presence of registry persistence keys and rare profiling VBScripts to determine if a host has been successfully compromised by the rogue ScreenConnect worm.", "description": "Correlate early access with follow-on persistence and profiling to confirm the full attack chain.", "max_iterations": 6, "expected_signal": "A final malicious verdict for hosts showing the complete chain of activity.", "success_criteria": "A final verdict citing rows across the entry, execution, and persistence stages." }, "parents": [ { "id": "registry-persistence-lead", "kind": "merge" }, { "id": "rare-script-profiling", "kind": "merge" }, { "id": "edr-process-presence", "kind": "merge" } ] }, { "id": "route-on-risk", "type": "checkpoint", "label": "Route based on compromise confidence", "config": { "fuzzy": true, "judge": "hunter", "question": "the follow-on-read verdict is malicious for at least one host, with evidence of anomalous RMM execution and persistent registry keys", "condition": "the follow-on-read verdict is malicious for at least one host, with evidence of anomalous RMM execution and persistent registry keys", "blind_spot": "vbs-script-visibility", "confidence": "high", "description": "Direct the response toward host isolation if the full chain is confirmed.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "follow-on-read" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Prevent further worm-like propagation or remote access.", "instructions": "Isolate the host from the network. Collect all files in the user's Temp and AppData folders for forensic analysis, then remove the rogue registry Run key.", "action_approval": "required" }, "parents": [ { "id": "route-on-risk", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Forensic validation", "config": { "assignee": "analyst", "description": "Verify the findings manually and ensure no secondary RMM tools (UltraViewer) remain.", "instructions": "Review the ScreenConnect client installation path; if not in Program Files, it is highly suspect. Check for the presence of secondary tools like UltraViewer or the recovered sys_cache.zip." }, "parents": [ { "id": "route-on-risk", "branch": "default" }, { "id": "route-on-risk", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Document findings and complete the hunt.", "instructions": "Record all identified C2 infrastructure and any recovered VBScript content in the incident report." }, "parents": [ { "id": "route-on-risk", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }