{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "The shift toward consent loopholes and the weaponization of trusted first-party applications allows adversaries to maintain long-term persistent access that survives MFA and password resets. Identifying this abuse requires correlating identity logs with cloud API activity, which a negative result over the estate confirms is not actively occurring."
      },
      "name": "SaaS Identity and Consent Loophole Abuse",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1566",
        "attack.t1555",
        "attack.t1190",
        "attack.t1572",
        "command and control",
        "credential access",
        "execution",
        "initial access",
        "persistence"
      ],
      "series": {
        "slug": "when-trust-becomes-the-payload-inside-the-threats-etc-quarterly-report",
        "index": 1,
        "title": "When trust becomes the payload: Inside the threats, etc quarterly report",
        "total": 2
      },
      "related": [
        {
          "hunt": "first-party-app-privilege-escalation",
          "reason": "Adversaries can also use consent to escalate privileges within a tenant rather than just maintaining access.",
          "relation": "sibling"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A standard detection rule can alert on a proxy login, but it cannot easily correlate that login with the fleet-wide prevalence of the applications that user subsequently interacted with. This hunt uses the baseline of rare app consents to find the needle in the haystack across three identity and cloud telemetry surfaces.",
      "coverage": [
        {
          "stage": "initial-access-aitm-phishing",
          "steps": [
            "auth-risk-leads",
            "proxy-session-details"
          ],
          "status": "covered"
        },
        {
          "stage": "identity-consent-mfa-bypass",
          "steps": [
            "rare-app-consents",
            "triage-identity-threat"
          ],
          "status": "covered"
        },
        {
          "stage": "execution-msi-dll-sideloading",
          "reason": "Belongs to another part of the 'When trust becomes the payload: Inside the threats, etc quarterly report' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "persistence-rmm-abuse",
          "reason": "Belongs to another part of the 'When trust becomes the payload: Inside the threats, etc quarterly report' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "c2-proxy-tunneling",
          "reason": "Belongs to another part of the 'When trust becomes the payload: Inside the threats, etc quarterly report' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "execution-ai-agent-automation",
          "reason": "Belongs to another part of the 'When trust becomes the payload: Inside the threats, etc quarterly report' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Adversary-in-the-Middle Phishing",
            "slug": "initial-access-aitm-phishing",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "Adversary-in-the-Middle (AiTM) phishing kits",
              "Credential theft targeting cloud/SaaS tenants"
            ]
          },
          {
            "name": "Consent Loophole and Rapid Login",
            "slug": "identity-consent-mfa-bypass",
            "tactic": "credential-access",
            "techniques": [
              "T1190",
              "T1555"
            ],
            "observables": [
              "Abuse of first-party application consent",
              "8-minute delay between infostealer infection and login",
              "Bypassing MFA hurdles via session theft"
            ]
          },
          {
            "name": "Signed MSI and DLL Sideloading",
            "slug": "execution-msi-dll-sideloading",
            "tactic": "execution",
            "techniques": [
              "T1574.002"
            ],
            "observables": [
              "Microsoft Software Installer (MSI) delivery",
              "Dynamic link library (DLL) sideloading",
              "16-second execution window from lure to sideload"
            ]
          },
          {
            "name": "RMM Persistence via ScreenConnect",
            "slug": "persistence-rmm-abuse",
            "tactic": "persistence",
            "techniques": [
              "T1195"
            ],
            "observables": [
              "ScreenConnect",
              "Signed remote monitoring and management (RMM) agents",
              "Interactive access on endpoints"
            ]
          },
          {
            "name": "Network Proxy Tunneling",
            "slug": "c2-proxy-tunneling",
            "tactic": "command-and-control",
            "techniques": [
              "T1572"
            ],
            "observables": [
              "Proxy tunneling",
              "Memory tampering outcomes"
            ]
          },
          {
            "name": "AI Agent-Driven Attack Actions",
            "slug": "execution-ai-agent-automation",
            "tactic": "execution",
            "techniques": [
              "T1195"
            ],
            "observables": [
              "AI coding assistants",
              "17,600 reconstructed actions over four days",
              "High-frequency automated activity from AI application processes"
            ]
          }
        ],
        "summary": "Adversaries are weaponizing trust across the enterprise stack by abusing legitimate tools like ScreenConnect, AI coding assistants, and Microsoft first-party clients. Intrusions leverage AiTM phishing to bypass MFA and deploy signed payloads via DLL sideloading, often achieving full compromise from infection to cloud login in just eight minutes."
      },
      "severity": "medium",
      "rationale": "Prioritize users with privileged roles (hb_users privileged = true) or those who have signed in from unusual geographic locations recently. Focus the parallel queries by pasting usernames with proxy sign-ins into the scope_users list.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has bypassed MFA by stealing a session cookie via AiTM phishing or an infostealer, then logged into a cloud tenant and granted permissions to a malicious or rare application to ensure persistent access.",
      "parameters": {
        "scope_users": {
          "from": {
            "ref": "analyst-defined-scope",
            "kind": "manual",
            "observed": "2026-11-04"
          },
          "type": "list[string]",
          "default": [],
          "description": "Usernames identified in the lead query to focus the enrichment steps; leave empty for a full-tenant scan."
        },
        "lookback_days": {
          "from": {
            "ref": "hunt-standard-lookback",
            "kind": "manual",
            "observed": "2026-11-04"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine for suspicious sign-ins and API activity."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.elastic.co/security-labs/reports/threats-etc-report-november-2026-trouble-with-trust",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.elastic.co/security-labs/reports/threats-etc-report-november-2026-trouble-with-trust",
          "name": "When trust becomes the payload: Inside the threats, etc quarterly report"
        }
      ],
      "blind_spots": [
        {
          "id": "cloud-api-retention-gap",
          "risk": "A persistent malicious application granted consent 30 days ago would not be visible in a 14-day hunt.",
          "owner": "Cloud Infrastructure Team",
          "stage": "identity-consent-mfa-bypass",
          "question": "whether consent was granted outside of the examined lookback window",
          "requires": "long-term cloud control plane logs (hb_cloud_api_activity)",
          "remediation": "Extend log retention for Entra/Office 365 audit logs to at least 90 days."
        },
        {
          "id": "unreported-mfa-bypass",
          "risk": "Some SaaS providers do not explicitly report if a session was established via cookie theft versus a fresh MFA challenge, leading to potential indeterminate verdicts.",
          "owner": "Identity Architecture Team",
          "stage": "identity-consent-mfa-bypass",
          "question": "whether MFA was actually bypassed or just not required for that specific session",
          "requires": "hb_auth_signin mfa and auth_requirement fields",
          "remediation": "Enable Conditional Access policies that strictly enforce MFA and device compliance for all sessions."
        }
      ]
    },
    "name": "SaaS Identity and Consent Loophole Abuse",
    "description": "This hunt examines the identity and cloud control plane for signs of the consent loophole and AiTM phishing observed in the Nov 2026 report. It identifies successful logins originating from anonymizing proxies or carrying high-risk states, then corroborates these by looking for rare OAuth application consent events associated with those same users. The hunt focuses on the critical 8-minute window where session theft transitions to persistent cloud access through first-party app abuse."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "when-trust-becomes-the-payload-inside-the-threats-etc-quarterly-report",
          "index": 1,
          "title": "When trust becomes the payload: Inside the threats, etc quarterly report",
          "total": 2
        },
        "coverage": [
          {
            "stage": "initial-access-aitm-phishing",
            "steps": [
              "auth-risk-leads",
              "proxy-session-details"
            ],
            "status": "covered"
          },
          {
            "stage": "identity-consent-mfa-bypass",
            "steps": [
              "rare-app-consents",
              "triage-identity-threat"
            ],
            "status": "covered"
          },
          {
            "stage": "execution-msi-dll-sideloading",
            "reason": "Belongs to another part of the 'When trust becomes the payload: Inside the threats, etc quarterly report' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "persistence-rmm-abuse",
            "reason": "Belongs to another part of the 'When trust becomes the payload: Inside the threats, etc quarterly report' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "c2-proxy-tunneling",
            "reason": "Belongs to another part of the 'When trust becomes the payload: Inside the threats, etc quarterly report' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "execution-ai-agent-automation",
            "reason": "Belongs to another part of the 'When trust becomes the payload: Inside the threats, etc quarterly report' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary has bypassed MFA by stealing a session cookie via AiTM phishing or an infostealer, then logged into a cloud tenant and granted permissions to a malicious or rare application to ensure persistent access.",
        "blind_spots": [
          {
            "id": "cloud-api-retention-gap",
            "risk": "A persistent malicious application granted consent 30 days ago would not be visible in a 14-day hunt.",
            "owner": "Cloud Infrastructure Team",
            "stage": "identity-consent-mfa-bypass",
            "question": "whether consent was granted outside of the examined lookback window",
            "requires": "long-term cloud control plane logs (hb_cloud_api_activity)",
            "remediation": "Extend log retention for Entra/Office 365 audit logs to at least 90 days."
          },
          {
            "id": "unreported-mfa-bypass",
            "risk": "Some SaaS providers do not explicitly report if a session was established via cookie theft versus a fresh MFA challenge, leading to potential indeterminate verdicts.",
            "owner": "Identity Architecture Team",
            "stage": "identity-consent-mfa-bypass",
            "question": "whether MFA was actually bypassed or just not required for that specific session",
            "requires": "hb_auth_signin mfa and auth_requirement fields",
            "remediation": "Enable Conditional Access policies that strictly enforce MFA and device compliance for all sessions."
          }
        ],
        "scoping_notes": "Prioritize users with privileged roles (hb_users privileged = true) or those who have signed in from unusual geographic locations recently. Focus the parallel queries by pasting usernames with proxy sign-ins into the scope_users list.",
        "beyond_detection": "A standard detection rule can alert on a proxy login, but it cannot easily correlate that login with the fleet-wide prevalence of the applications that user subsequently interacted with. This hunt uses the baseline of rare app consents to find the needle in the haystack across three identity and cloud telemetry surfaces."
      }
    },
    {
      "id": "auth-risk-leads",
      "type": "query",
      "label": "Suspect sign-ins from proxies or high-risk states",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "identity",
        "content": "SELECT time, actor_user_name, src_endpoint_ip, src_location_country, client_app, risk_state, is_proxy, auth_requirement, device_trust_type FROM hb_auth_signin WHERE status_id = 1 AND (risk_state IN ('atRisk', 'confirmedCompromised') OR is_proxy = 'true') AND ('{{scope_users}}' = '' OR instr(',' || '{{scope_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_auth_signin",
        "description": "Identify successful logins that are marked at risk or originate from anonymizing proxies, which are common indicators of AiTM phishing kits.",
        "expected_signal": "Rows indicating successful logins despite high risk states or proxy origin. Silence indicates no obvious AiTM-style session usage was detected by the provider's risk engine."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Suspect sign-ins from proxies or high-risk states",
        "reads": [
          "actor_user_name",
          "auth_requirement",
          "client_app",
          "device_trust_type",
          "is_proxy",
          "risk_state",
          "src_endpoint_ip",
          "src_location_country",
          "status_id",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT time, actor_user_name, src_endpoint_ip, src_location_country, client_app, risk_state, is_proxy, auth_requirement, device_trust_type FROM hb_auth_signin WHERE status_id = 1 AND (risk_state IN ('atRisk', 'confirmedCompromised') OR is_proxy = 'true') AND ('{{scope_users}}' = '' OR instr(',' || '{{scope_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Rows indicating successful logins despite high risk states or proxy origin. Silence indicates no obvious AiTM-style session usage was detected by the provider's risk engine.",
        "verified": "dry-run",
        "verified_at": "2026-11-05"
      }
    },
    {
      "id": "proxy-session-details",
      "type": "query",
      "label": "Detail session attributes for the suspect users",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "identity",
        "content": "SELECT time, actor_user_name, src_endpoint_ip, src_location_country, user_agent, client_app, auth_protocol, auth_requirement, device_trust_type, status_detail FROM hb_auth_signin WHERE status_id = 1 AND ('{{scope_users}}' = '' OR instr(',' || '{{scope_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_auth_signin",
        "description": "Collect detailed attributes for the sign-ins of the users identified in the lead, focusing on device trust and user agents.",
        "expected_signal": "A history of sign-ins for the target users, allowing for comparison of location and device trust between normal and suspicious logins."
      },
      "parents": [
        {
          "id": "auth-risk-leads"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Detail session attributes for the suspect users",
        "reads": [
          "actor_user_name",
          "auth_protocol",
          "auth_requirement",
          "client_app",
          "device_trust_type",
          "src_endpoint_ip",
          "src_location_country",
          "status_detail",
          "status_id",
          "time",
          "user_agent"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT time, actor_user_name, src_endpoint_ip, src_location_country, user_agent, client_app, auth_protocol, auth_requirement, device_trust_type, status_detail FROM hb_auth_signin WHERE status_id = 1 AND ('{{scope_users}}' = '' OR instr(',' || '{{scope_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A history of sign-ins for the target users, allowing for comparison of location and device trust between normal and suspicious logins.",
        "verified": "dry-run",
        "verified_at": "2026-11-05"
      }
    },
    {
      "id": "rare-app-consents",
      "type": "query",
      "label": "Stack-count rare OAuth application consents",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT resource_name AS app_name, api_operation, COUNT(DISTINCT actor_user_name) AS distinct_users, MIN(time) AS first_consent_time, MAX(time) AS last_consent_time FROM hb_cloud_api_activity WHERE (LOWER(api_operation) LIKE '%consent%' OR LOWER(api_operation) LIKE '%add app role assignment%' OR LOWER(api_operation) LIKE '%update application%') AND provider IN ('azure_ad', 'm365') AND ('{{scope_users}}' = '' OR instr(',' || '{{scope_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY resource_name, api_operation HAVING distinct_users <= 5",
        "surface": "hb_cloud_api_activity",
        "description": "Identify OAuth application consents or app role assignments for the targeted users that are rare across the fleet, highlighting potential malicious apps used for the consent loophole.",
        "expected_signal": "Applications that have been granted consent by only a few users, specifically those in our scope. If a user from the lead query is in this list, it strongly suggests identity abuse."
      },
      "parents": [
        {
          "id": "auth-risk-leads"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Stack-count rare OAuth application consents",
        "reads": [
          "actor_user_name",
          "api_operation",
          "provider",
          "resource_name",
          "time"
        ],
        "source": "hb_cloud_api_activity",
        "target": "endpoint",
        "content": "SELECT resource_name AS app_name, api_operation, COUNT(DISTINCT actor_user_name) AS distinct_users, MIN(time) AS first_consent_time, MAX(time) AS last_consent_time FROM hb_cloud_api_activity WHERE (LOWER(api_operation) LIKE '%consent%' OR LOWER(api_operation) LIKE '%add app role assignment%' OR LOWER(api_operation) LIKE '%update application%') AND provider IN ('azure_ad', 'm365') AND ('{{scope_users}}' = '' OR instr(',' || '{{scope_users}}' || ',', ',' || actor_user_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY resource_name, api_operation HAVING distinct_users <= 5",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Applications that have been granted consent by only a few users, specifically those in our scope. If a user from the lead query is in this list, it strongly suggests identity abuse.",
        "verified": "dry-run",
        "prevalence": {
          "by": "actor_user_name",
          "key": [
            "resource_name"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-11-05"
      }
    },
    {
      "id": "triage-identity-threat",
      "type": "analytic",
      "label": "Analyze identity and consent patterns",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "auth-risk-leads",
          "proxy-session-details",
          "rare-app-consents"
        ],
        "objective": "Evaluate whether any user has a successful proxy sign-in followed by a rare application consent or role assignment, paying specific attention to the timestamp correlation.",
        "description": "The agent determines whether the sign-ins and rare app consents constitute a session theft and persistence attempt.",
        "max_iterations": 6,
        "expected_signal": "A per-user verdict indicating whether the proxy login was followed by a rare application consent within the reported 8-minute window.",
        "success_criteria": "A verdict of malicious | suspicious | benign per user, citing specific login and API rows."
      },
      "parents": [
        {
          "id": "proxy-session-details",
          "kind": "merge"
        },
        {
          "id": "rare-app-consents",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-identity-risk",
      "type": "checkpoint",
      "label": "Route based on identity threat verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "The triage-identity-threat verdict is malicious for at least one user.",
        "condition": "The triage-identity-threat verdict is malicious for at least one user.",
        "blind_spot": "cloud-api-retention-gap",
        "confidence": "high",
        "description": "Initiate containment for malicious activity or refer suspicious cases to an analyst.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-identity-threat"
        }
      ]
    },
    {
      "id": "revoke-sessions",
      "type": "action",
      "label": "Revoke active sessions and tokens",
      "config": {
        "target": "identity",
        "description": "Stop active adversary access by revoking all refresh tokens and active sessions for the compromised account.",
        "instructions": "Revoke all refresh tokens and sessions for the users identified as malicious. Review and remove any recently consented applications in the tenant.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-identity-risk",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "remediation-verification",
      "type": "task",
      "label": "Verify remediation and check for persistence",
      "config": {
        "assignee": "analyst",
        "description": "Ensure the adversary has no other persistence mechanisms like new administrative accounts or hidden enterprise applications.",
        "instructions": "Manually verify the removal of malicious app registrations. Check for any new administrative roles assigned during the compromise window. Review hb_account_change for password resets."
      },
      "parents": [
        {
          "id": "route-on-identity-risk",
          "branch": "default"
        },
        {
          "id": "route-on-identity-risk",
          "branch": "on_unavailable"
        },
        {
          "id": "revoke-sessions"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out hunt",
      "config": {
        "assignee": "analyst",
        "description": "Document findings and update any detection tuning based on the results.",
        "instructions": "Summarize the users affected. If any false positives occurred due to legitimate rare first-party apps, add them to a tuning exclusion list for future iterations."
      },
      "parents": [
        {
          "id": "route-on-identity-risk",
          "branch": "on_refutes"
        },
        {
          "id": "remediation-verification"
        }
      ]
    }
  ]
}