{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "SafePay is a top-tier ransomware threat targeting critical infrastructure with rapid post-exploitation consolidation. Identifying these early stages prevents the transition to full encryption."
      },
      "name": "SafePay: External Access and Identity Consolidation",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1110",
        "attack.t1133",
        "attack.t1098",
        "attack.t1136",
        "attack.t1548.002",
        "attack.t1134.001",
        "defense evasion",
        "discovery",
        "exfiltration",
        "impact",
        "initial access",
        "lateral movement",
        "persistence",
        "privilege escalation"
      ],
      "series": {
        "slug": "stopransomware-safepay-ransomware",
        "index": 1,
        "title": "#StopRansomware: SafePay Ransomware",
        "total": 3
      },
      "related": [
        {
          "hunt": "safepay-discovery-and-lateral-movement",
          "reason": "This hunt identifies the beachhead; the next hunt focuses on ShareFinder and PsExec activity.",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A simple rule for UAC bypass or account creation often triggers false positives for legitimate administrative tasks. This hunt uses a gated vulnerability check and an agent-led triage to correlate vulnerable state with suspicious behavior, providing higher confidence before containment.",
      "coverage": [
        {
          "stage": "initial-access-exploitation-and-brute-force",
          "steps": [
            "vulnerable-gate",
            "brute-force-triage"
          ],
          "status": "covered"
        },
        {
          "stage": "persistence-account-manipulation",
          "steps": [
            "account-persistence"
          ],
          "status": "covered"
        },
        {
          "stage": "privilege-escalation-uac-bypass",
          "steps": [
            "uac-bypass-check"
          ],
          "status": "covered"
        },
        {
          "stage": "discovery-share-enumeration",
          "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "lateral-movement-rmm-psexec",
          "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "defense-evasion-security-impairment",
          "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "collection-exfiltration-utilities",
          "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "impact-encryption-recovery-inhibition",
          "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Edge Device Exploitation and Brute Force",
            "slug": "initial-access-exploitation-and-brute-force",
            "tactic": "initial-access",
            "techniques": [
              "T1190",
              "T1110",
              "T1133"
            ],
            "observables": [
              "CVE-2020-3259",
              "CVE-2023-20269",
              "CVE-2023-27532",
              "CVE-2024-40711",
              "CVE-2024-40766",
              "Mullvad VPN IP addresses",
              "VPN authentication failures"
            ]
          },
          {
            "name": "Account Persistence and Privilege Gain",
            "slug": "persistence-account-manipulation",
            "tactic": "persistence",
            "techniques": [
              "T1098",
              "T1136"
            ],
            "observables": [
              "net user /add",
              "Password changes for existing system users",
              "Creation of new administrative accounts"
            ]
          },
          {
            "name": "Local Privilege Escalation",
            "slug": "privilege-escalation-uac-bypass",
            "tactic": "privilege-escalation",
            "techniques": [
              "T1548.002",
              "T1134.001"
            ],
            "observables": [
              "UAC bypass via COM component objects",
              "Token impersonation activity"
            ]
          },
          {
            "name": "Active Directory and Share Discovery",
            "slug": "discovery-share-enumeration",
            "tactic": "discovery",
            "techniques": [
              "T1059.001",
              "T1059.003"
            ],
            "observables": [
              "ShareFinder.ps1",
              "SharpShares.exe",
              "NetExec"
            ]
          },
          {
            "name": "Lateral Movement and Remote Management",
            "slug": "lateral-movement-rmm-psexec",
            "tactic": "lateral-movement",
            "techniques": [
              "T1021.001",
              "T1021.002",
              "T1021.006",
              "T1569.002"
            ],
            "observables": [
              "psexec.exe",
              "winrm.exe",
              "AnyDesk.exe",
              "TeamViewer.exe",
              "ScreenConnect",
              "RDP connections"
            ]
          },
          {
            "name": "Defense Impairment and Stealth",
            "slug": "defense-evasion-security-impairment",
            "tactic": "defense-evasion",
            "techniques": [
              "T1685",
              "T1027.002"
            ],
            "observables": [
              "Set-MpPreference -DisableRealtimeMonitoring",
              "Disabling security software",
              "Software packing or VM protection"
            ]
          },
          {
            "name": "Data Collection and Exfiltration",
            "slug": "collection-exfiltration-utilities",
            "tactic": "exfiltration",
            "techniques": [
              "T1560.001",
              "T1048",
              "T1567",
              "T1567.002"
            ],
            "observables": [
              "7z.exe",
              "WinRAR.exe",
              "rclone.exe",
              "FileZilla.exe",
              "WinSCP.exe",
              "b2.exe (Backblaze)",
              "OneDrive exfiltration"
            ]
          },
          {
            "name": "Encryption and Recovery Inhibition",
            "slug": "impact-encryption-recovery-inhibition",
            "tactic": "impact",
            "techniques": [
              "T1486",
              "T1490",
              "T1070.004"
            ],
            "observables": [
              ".SafePay extension",
              "vssadmin.exe delete shadows",
              "Resetting NAS to factory settings",
              "Self-deletion of ransomware binary"
            ]
          }
        ],
        "summary": "SafePay ransomware actors gain initial access through credential harvesting, brute-force attacks, and exploitation of vulnerabilities in VPN and edge devices like Cisco and Veeam. Once inside, they escalate privileges via UAC bypass, move laterally using RDP and PsExec, and utilize RMM tools for persistence before exfiltrating data and deploying encryption."
      },
      "severity": "high",
      "rationale": "Focus on internet-facing assets including VPN gateways, backup servers (Veeam), and firewalls. Expand to administrative workstations if account manipulation is detected.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has exploited a known edge vulnerability to gain a foothold and is consolidating control by creating administrative accounts and escalating local privileges via UAC bypass.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Limit analysis to specific hostnames identified in the scoping step."
        },
        "safepay_cves": {
          "from": {
            "ref": "AA26-293A",
            "kind": "article",
            "observed": "2026-10-20"
          },
          "type": "list[string]",
          "default": [
            "CVE-2020-3259",
            "CVE-2023-20269",
            "CVE-2023-27532",
            "CVE-2024-40711",
            "CVE-2024-40766"
          ],
          "description": "CVEs associated with SafePay initial access vectors."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "History of history to examine."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a",
          "name": "CISA Advisory AA26-293A: #StopRansomware: SafePay Ransomware"
        }
      ],
      "blind_spots": [
        {
          "id": "incomplete-vuln-scoping",
          "risk": "A host missing from the vulnerability inventory will bypass the lead gate and be excluded from behavioral analysis.",
          "stage": "initial-access-exploitation-and-brute-force",
          "question": "Are all firewalls and VPN gateways currently reporting their vulnerability status?",
          "requires": "Complete coverage of edge devices in hb_vulnerability_finding"
        },
        {
          "id": "agent-visibility-gap",
          "risk": "Account manipulation on an unmonitored DC will be invisible to the hb_account_change surface.",
          "question": "Can we observe account changes if they occur directly on a domain controller not enrolled in the hunt?",
          "requires": "Endpoint agents on all domain controllers"
        }
      ]
    },
    "name": "SafePay: External Access and Identity Consolidation",
    "description": "SafePay actors use vulnerabilities in Cisco VPNs, Veeam backups, and SonicWall firewalls to enter the network. The hunt identifies exposed assets and monitors for brute-force attacks against the beachhead. The gated structure ensures the analyst only performs expensive behavioral analysis on hosts that show a real exposure. The hunt then checks for new account creations and privilege escalation attempts before an agent weighs the combined evidence and an analyst confirms the threat."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "stopransomware-safepay-ransomware",
          "index": 1,
          "title": "#StopRansomware: SafePay Ransomware",
          "total": 3
        },
        "coverage": [
          {
            "stage": "initial-access-exploitation-and-brute-force",
            "steps": [
              "vulnerable-gate",
              "brute-force-triage"
            ],
            "status": "covered"
          },
          {
            "stage": "persistence-account-manipulation",
            "steps": [
              "account-persistence"
            ],
            "status": "covered"
          },
          {
            "stage": "privilege-escalation-uac-bypass",
            "steps": [
              "uac-bypass-check"
            ],
            "status": "covered"
          },
          {
            "stage": "discovery-share-enumeration",
            "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "lateral-movement-rmm-psexec",
            "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "defense-evasion-security-impairment",
            "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "collection-exfiltration-utilities",
            "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "impact-encryption-recovery-inhibition",
            "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary has exploited a known edge vulnerability to gain a foothold and is consolidating control by creating administrative accounts and escalating local privileges via UAC bypass.",
        "blind_spots": [
          {
            "id": "incomplete-vuln-scoping",
            "risk": "A host missing from the vulnerability inventory will bypass the lead gate and be excluded from behavioral analysis.",
            "stage": "initial-access-exploitation-and-brute-force",
            "question": "Are all firewalls and VPN gateways currently reporting their vulnerability status?",
            "requires": "Complete coverage of edge devices in hb_vulnerability_finding"
          },
          {
            "id": "agent-visibility-gap",
            "risk": "Account manipulation on an unmonitored DC will be invisible to the hb_account_change surface.",
            "question": "Can we observe account changes if they occur directly on a domain controller not enrolled in the hunt?",
            "requires": "Endpoint agents on all domain controllers"
          }
        ],
        "scoping_notes": "Focus on internet-facing assets including VPN gateways, backup servers (Veeam), and firewalls. Expand to administrative workstations if account manipulation is detected.",
        "beyond_detection": "A simple rule for UAC bypass or account creation often triggers false positives for legitimate administrative tasks. This hunt uses a gated vulnerability check and an agent-led triage to correlate vulnerable state with suspicious behavior, providing higher confidence before containment."
      }
    },
    {
      "id": "vulnerable-gate",
      "type": "query",
      "label": "Identify vulnerable edge infrastructure",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_uid, cve_uid, severity, resource_uid, status FROM hb_vulnerability_finding WHERE (instr(',' || '{{safepay_cves}}' || ',', ',' || cve_uid || ',') > 0) AND status != 'suppressed'",
        "surface": "hb_vulnerability_finding",
        "description": "Find devices currently reporting vulnerabilities used by SafePay for initial access.",
        "expected_signal": "A list of device UIDs and resource paths vulnerable to the specified CVEs. Silence means no known-vulnerable assets are reporting."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify vulnerable edge infrastructure",
        "reads": [
          "cve_uid",
          "device_uid",
          "resource_uid",
          "severity",
          "status"
        ],
        "source": "hb_vulnerability_finding",
        "target": "endpoint",
        "content": "SELECT device_uid, cve_uid, severity, resource_uid, status FROM hb_vulnerability_finding WHERE (instr(',' || '{{safepay_cves}}' || ',', ',' || cve_uid || ',') > 0) AND status != 'suppressed'",
        "silence": "not_evidence_of_absence",
        "expected": "A list of device UIDs and resource paths vulnerable to the specified CVEs. Silence means no known-vulnerable assets are reporting.",
        "verified": "dry-run",
        "verified_at": "2026-10-22"
      }
    },
    {
      "id": "lead-assessment",
      "type": "analytic",
      "label": "Evaluate exposure gate",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "vulnerable-gate"
        ],
        "objective": "Summarize the exposure: how many hosts are vulnerable to SafePay-linked CVEs and which CVEs are most prevalent.",
        "description": "Read the scoping results to determine if follow-on behavioral queries are justified.",
        "max_iterations": 3,
        "expected_signal": "A summary of vulnerable assets.",
        "success_criteria": "A per-host vulnerability summary."
      },
      "parents": [
        {
          "id": "vulnerable-gate"
        }
      ]
    },
    {
      "id": "gate-decision",
      "type": "checkpoint",
      "label": "Gate on vulnerability results",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "vulnerable-gate finds at least one host or resource with a critical or high severity vulnerability",
        "condition": "vulnerable-gate finds at least one host or resource with a critical or high severity vulnerability",
        "blind_spot": "incomplete-vuln-scoping",
        "confidence": "high",
        "description": "Stop the hunt if no vulnerable assets are found, or fan out to behavioral queries.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "lead-assessment"
        }
      ]
    },
    {
      "id": "brute-force-triage",
      "type": "query",
      "label": "Brute-force and logon anomalies",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "identity",
        "content": "SELECT src_endpoint_ip, actor_user_name, device_hostname, COUNT(*) as attempts, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_auth_signin WHERE status_id = 2 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip, actor_user_name, device_hostname HAVING attempts > 20 ORDER BY attempts DESC",
        "surface": "hb_auth_signin",
        "description": "Identify external brute-force attempts targeting administrative or phished accounts.",
        "expected_signal": "A high volume of failed sign-ins from a single source IP, potentially targeting multiple accounts."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Brute-force and logon anomalies",
        "reads": [
          "actor_user_name",
          "device_hostname",
          "src_endpoint_ip",
          "status_id",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT src_endpoint_ip, actor_user_name, device_hostname, COUNT(*) as attempts, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_auth_signin WHERE status_id = 2 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip, actor_user_name, device_hostname HAVING attempts > 20 ORDER BY attempts DESC",
        "silence": "not_evidence_of_absence",
        "expected": "A high volume of failed sign-ins from a single source IP, potentially targeting multiple accounts.",
        "verified": "dry-run",
        "verified_at": "2026-10-22"
      }
    },
    {
      "id": "account-persistence",
      "type": "query",
      "label": "Suspicious account manipulation",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, user_name, actor_user_name, activity_name, time FROM hb_account_change WHERE activity_id IN (1, 3, 4) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_account_change",
        "description": "Detect the creation of new accounts or unauthorized password resets used for persistence.",
        "expected_signal": "Account creation (activity_id 1) or password changes/resets (3, 4) on critical servers, especially by unexpected actors."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Suspicious account manipulation",
        "reads": [
          "activity_id",
          "activity_name",
          "actor_user_name",
          "device_hostname",
          "time",
          "user_name"
        ],
        "source": "hb_account_change",
        "target": "endpoint",
        "content": "SELECT device_hostname, user_name, actor_user_name, activity_name, time FROM hb_account_change WHERE activity_id IN (1, 3, 4) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Account creation (activity_id 1) or password changes/resets (3, 4) on critical servers, especially by unexpected actors.",
        "verified": "dry-run",
        "verified_at": "2026-10-22"
      }
    },
    {
      "id": "uac-bypass-check",
      "type": "query",
      "label": "Local privilege escalation via UAC bypass",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, integrity_level, time FROM hb_process_activity WHERE integrity_level = 'High' AND (LOWER(parent_process_name) LIKE '%\\\\explorer.exe' OR LOWER(parent_process_name) LIKE '%\\\\cmd.exe' OR LOWER(parent_process_name) LIKE '%\\\\powershell.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Find high-integrity processes spawned from interactive or shell-based parents, indicating UAC bypass.",
        "expected_signal": "High integrity processes with command-line arguments that imply interactive shell execution. Silence proves the absence of this specific behavior on the monitored hosts."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Local privilege escalation via UAC bypass",
        "reads": [
          "device_hostname",
          "integrity_level",
          "parent_process_name",
          "process_cmd_line",
          "process_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, integrity_level, time FROM hb_process_activity WHERE integrity_level = 'High' AND (LOWER(parent_process_name) LIKE '%\\\\explorer.exe' OR LOWER(parent_process_name) LIKE '%\\\\cmd.exe' OR LOWER(parent_process_name) LIKE '%\\\\powershell.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "evidence_of_absence",
        "expected": "High integrity processes with command-line arguments that imply interactive shell execution. Silence proves the absence of this specific behavior on the monitored hosts.",
        "verified": "dry-run",
        "verified_at": "2026-10-22"
      }
    },
    {
      "id": "triage-investigation",
      "type": "analytic",
      "label": "Triage initial access and consolidation",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "lead-assessment",
          "brute-force-triage",
          "account-persistence",
          "uac-bypass-check"
        ],
        "objective": "Determine if any host showing initial access indicators (vuln + brute force) has also progressed to persistence or privilege escalation.",
        "description": "Synthesize vulnerability state with behavioral evidence to determine if a host is compromised.",
        "max_iterations": 6,
        "expected_signal": "A detailed verdict per host.",
        "success_criteria": "A verdict of malicious, suspicious, or benign per host, citing specific rows for each stage of the attack chain."
      },
      "parents": [
        {
          "id": "brute-force-triage",
          "kind": "merge"
        },
        {
          "id": "account-persistence",
          "kind": "merge"
        },
        {
          "id": "uac-bypass-check",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-to-response",
      "type": "checkpoint",
      "label": "Route for containment or review",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "The triage verdict is malicious for at least one host showing both account manipulation and privilege escalation.",
        "condition": "The triage verdict is malicious for at least one host showing both account manipulation and privilege escalation.",
        "blind_spot": "agent-visibility-gap",
        "confidence": "high",
        "description": "Trigger host isolation for confirmed intrusions or manual review for ambiguous signals.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-investigation"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate compromised host",
      "config": {
        "target": "endpoint",
        "description": "Contain the threat before it moves to share enumeration or exfiltration.",
        "instructions": "Isolate the host immediately. Lock the actor's session and revoke the credentials used for the suspicious account activity.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-to-response",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst manual review",
      "config": {
        "assignee": "analyst",
        "description": "Investigate suspicious findings that did not meet the immediate isolation threshold.",
        "instructions": "Review the triage verdicts. For suspicious hosts, verify the source IPs of the auth failures and the process tree of the UAC bypass. Confirm if the account changes were authorized."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "default"
        },
        {
          "id": "gate-decision",
          "branch": "on_unavailable"
        },
        {
          "id": "route-to-response",
          "branch": "default"
        },
        {
          "id": "route-to-response",
          "branch": "on_unavailable"
        },
        {
          "id": "route-to-response",
          "branch": "on_refutes"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Hunt close-out",
      "config": {
        "assignee": "analyst",
        "description": "Document findings and update vulnerability posture.",
        "instructions": "Record the vulnerable hosts identified. If the behavioral queries were empty, document the negative result as evidence of absence of post-exploitation activity on the exposed surface."
      },
      "parents": [
        {
          "id": "gate-decision",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-review"
        }
      ]
    }
  ]
}