{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "SafePay is a highly active ransomware variant targeting critical infrastructure. Identifying the initial beachhead and persistence early prevents the catastrophic encryption of the estate."
      },
      "name": "SafePay Ransomware: Perimeter Breach and Account Persistence",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1110",
        "attack.t1133",
        "attack.t1566",
        "attack.t1098",
        "attack.t1136",
        "defense evasion",
        "discovery",
        "exfiltration",
        "impact",
        "initial access",
        "lateral movement",
        "persistence",
        "privilege escalation"
      ],
      "series": {
        "slug": "stopransomware-safepay-ransomware",
        "index": 1,
        "title": "#StopRansomware: SafePay Ransomware",
        "total": 3
      },
      "related": [
        {
          "hunt": "safepay-discovery-lateral-movement",
          "reason": "This hunt focuses on the initial breach; the follow-on hunt examines internal discovery and tool abuse.",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A single rule might catch an admin group change, but this hunt pivots from unpatched vulnerabilities to authentication anomalies from specific VPNs and then to those account changes, providing context that a static rule cannot.",
      "coverage": [
        {
          "stage": "initial-access-vpn-and-phishing",
          "steps": [
            "vulnerable-edge-assets",
            "signins-from-vpn-proxies"
          ],
          "status": "covered"
        },
        {
          "stage": "persistence-via-account-manipulation",
          "steps": [
            "high-privilege-account-changes",
            "new-account-creation"
          ],
          "status": "covered"
        },
        {
          "stage": "discovery-and-credential-dumping",
          "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "lateral-movement-and-rmm-abuse",
          "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "privilege-escalation-uac-bypass",
          "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "defense-evasion-and-stealth",
          "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "exfiltration-and-collection",
          "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "impact-and-encryption",
          "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "VPN Exploitation and Credential Access",
            "slug": "initial-access-vpn-and-phishing",
            "tactic": "initial-access",
            "techniques": [
              "T1190",
              "T1110",
              "T1133",
              "T1566"
            ],
            "observables": [
              "CVE-2020-3259",
              "CVE-2023-20269",
              "Mullvad VPN IP addresses",
              "Brute force password attacks"
            ]
          },
          {
            "name": "Account Creation and Privilege Gain",
            "slug": "persistence-via-account-manipulation",
            "tactic": "persistence",
            "techniques": [
              "T1098",
              "T1136"
            ],
            "observables": [
              "Creation of new administrative accounts",
              "Administrative privileges granted to existing accounts"
            ]
          },
          {
            "name": "Network Discovery and Credential Access",
            "slug": "discovery-and-credential-dumping",
            "tactic": "discovery",
            "techniques": [
              "T1059.001",
              "T1059.003",
              "T1003",
              "T1550.002"
            ],
            "observables": [
              "ShareFinder.ps1",
              "SharpShares.exe",
              "NetExec",
              "Mimikatz",
              "Kerberos ticket extraction"
            ]
          },
          {
            "name": "Remote Command Execution and Lateral Pivot",
            "slug": "lateral-movement-and-rmm-abuse",
            "tactic": "lateral-movement",
            "techniques": [
              "T1021.001",
              "T1021.002",
              "T1021.006",
              "T1569.002",
              "T1218"
            ],
            "observables": [
              "PsExec",
              "WinRM",
              "RDP",
              "ScreenConnect",
              "AnyDesk",
              "TeamViewer"
            ]
          },
          {
            "name": "UAC Bypass and Token Impersonation",
            "slug": "privilege-escalation-uac-bypass",
            "tactic": "privilege-escalation",
            "techniques": [
              "T1548.002",
              "T1134.001"
            ],
            "observables": [
              "Elevated process creation via COM component",
              "Token impersonation methods"
            ]
          },
          {
            "name": "Security Software Impairment and Stealth",
            "slug": "defense-evasion-and-stealth",
            "tactic": "defense-evasion",
            "techniques": [
              "T1685",
              "T1027.002",
              "T1070.004"
            ],
            "observables": [
              "Disabling security software",
              "Software packing or VM-based concealment",
              "Self-deletion from filesystem"
            ]
          },
          {
            "name": "Data Packaging and Exfiltration",
            "slug": "exfiltration-and-collection",
            "tactic": "exfiltration",
            "techniques": [
              "T1560.001",
              "T1048",
              "T1567",
              "T1567.002",
              "T1041"
            ],
            "observables": [
              "7-Zip",
              "WinRAR",
              "FileZilla",
              "RClone",
              "WinSCP",
              "b2.exe (Backblaze CLI)",
              "OneDrive"
            ]
          },
          {
            "name": "Ransomware Encryption and Recovery Inhibition",
            "slug": "impact-and-encryption",
            "tactic": "impact",
            "techniques": [
              "T1486",
              "T1490",
              "T1090.003"
            ],
            "observables": [
              "Files appended with .SafePay",
              "Halting Volume Shadow Copy Service",
              "Resetting NAS to factory settings",
              "Ransom note on desktop",
              "TOR .onion website link in note"
            ]
          }
        ],
        "summary": "SafePay ransomware actors gain initial access through VPN vulnerabilities, brute-force, or phishing, subsequently establishing persistence via account creation and privilege manipulation. They move laterally using LOLBins and RMM tools like ScreenConnect and AnyDesk, before exfiltrating data via cloud-sync utilities and deploying ransomware that encrypts files with a .SafePay extension and disables recovery mechanisms."
      },
      "severity": "high",
      "rationale": "Focus first on edge devices (VPN concentrators, firewalls) and backup servers. Widen scope to all domain controllers if privileged account changes are detected.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has exploited unpatched edge vulnerabilities or use VPN-based brute force to gain initial access, subsequently creating or elevating accounts to secure administrative persistence.",
      "parameters": {
        "mullvad_ips": {
          "from": {
            "ref": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a",
            "kind": "article",
            "observed": "2026-10-20"
          },
          "type": "list[ip]",
          "default": [],
          "description": "Known Mullvad VPN exit node IP addresses used by threat actors."
        },
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Specific hostnames to focus on (leave empty for the entire estate)."
        },
        "target_cves": {
          "from": {
            "ref": "AA26-293A",
            "kind": "article",
            "observed": "2026-10-20"
          },
          "type": "list[string]",
          "default": [
            "CVE-2020-3259",
            "CVE-2023-20269",
            "CVE-2023-27532",
            "CVE-2024-40711",
            "CVE-2024-40766"
          ],
          "description": "CVE identifiers associated with SafePay initial access vectors."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a",
          "name": "CISA AA26-293A: #StopRansomware: SafePay Ransomware"
        }
      ],
      "blind_spots": [
        {
          "id": "missing-vpn-auth-telemetry",
          "risk": "Attackers exploiting unpatched VPN vulnerabilities may bypass standard logging if the appliance does not forward auth events.",
          "stage": "initial-access-vpn-and-phishing",
          "question": "whether the VPN appliance itself is reporting authentication attempts",
          "requires": "VPN device sign-in logs in hb_auth_signin"
        },
        {
          "id": "ephemeral-proxy-ips",
          "risk": "A negative result for the IP list does not prove absence if the actor recently rotated their VPN infrastructure.",
          "stage": "initial-access-vpn-and-phishing",
          "question": "whether the adversary is using a new or unlisted Mullvad IP",
          "requires": "Up-to-date Mullvad exit node lists or robust proxy classification"
        }
      ]
    },
    "name": "SafePay Ransomware: Perimeter Breach and Account Persistence",
    "description": "SafePay ransomware actors frequently use vulnerabilities in edge devices, such as Cisco ASA/FTD or Veeam components, or perform brute-force attacks from known VPN providers like Mullvad to gain a foothold. Once inside, they prioritize the creation of new administrative accounts or the addition of users to local/domain admin groups to ensure long-term control before moving laterally. This hunt identifies vulnerable infrastructure, correlates access attempts from high-risk IP addresses, and monitors for suspicious account management activities that signify a beachhead establishment."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "stopransomware-safepay-ransomware",
          "index": 1,
          "title": "#StopRansomware: SafePay Ransomware",
          "total": 3
        },
        "coverage": [
          {
            "stage": "initial-access-vpn-and-phishing",
            "steps": [
              "vulnerable-edge-assets",
              "signins-from-vpn-proxies"
            ],
            "status": "covered"
          },
          {
            "stage": "persistence-via-account-manipulation",
            "steps": [
              "high-privilege-account-changes",
              "new-account-creation"
            ],
            "status": "covered"
          },
          {
            "stage": "discovery-and-credential-dumping",
            "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "lateral-movement-and-rmm-abuse",
            "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "privilege-escalation-uac-bypass",
            "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "defense-evasion-and-stealth",
            "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "exfiltration-and-collection",
            "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "impact-and-encryption",
            "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary has exploited unpatched edge vulnerabilities or use VPN-based brute force to gain initial access, subsequently creating or elevating accounts to secure administrative persistence.",
        "blind_spots": [
          {
            "id": "missing-vpn-auth-telemetry",
            "risk": "Attackers exploiting unpatched VPN vulnerabilities may bypass standard logging if the appliance does not forward auth events.",
            "stage": "initial-access-vpn-and-phishing",
            "question": "whether the VPN appliance itself is reporting authentication attempts",
            "requires": "VPN device sign-in logs in hb_auth_signin"
          },
          {
            "id": "ephemeral-proxy-ips",
            "risk": "A negative result for the IP list does not prove absence if the actor recently rotated their VPN infrastructure.",
            "stage": "initial-access-vpn-and-phishing",
            "question": "whether the adversary is using a new or unlisted Mullvad IP",
            "requires": "Up-to-date Mullvad exit node lists or robust proxy classification"
          }
        ],
        "scoping_notes": "Focus first on edge devices (VPN concentrators, firewalls) and backup servers. Widen scope to all domain controllers if privileged account changes are detected.",
        "beyond_detection": "A single rule might catch an admin group change, but this hunt pivots from unpatched vulnerabilities to authentication anomalies from specific VPNs and then to those account changes, providing context that a static rule cannot."
      }
    },
    {
      "id": "vulnerable-edge-assets",
      "type": "query",
      "label": "Identify vulnerable edge infrastructure",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_uid, cve_uid, affected_package_name, affected_package_version, severity, status FROM hb_vulnerability_finding WHERE instr(',' || '{{target_cves}}' || ',', ',' || cve_uid || ',') > 0 AND status != 'suppressed'",
        "surface": "hb_vulnerability_finding",
        "description": "Identify hosts or resources in the environment currently reporting vulnerabilities used by SafePay for initial access.",
        "expected_signal": "A list of devices and their unpatched CVEs. A match indicates an exposed surface area matching SafePay's known targeting."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify vulnerable edge infrastructure",
        "reads": [
          "affected_package_name",
          "affected_package_version",
          "cve_uid",
          "device_uid",
          "severity",
          "status"
        ],
        "source": "hb_vulnerability_finding",
        "target": "endpoint",
        "content": "SELECT device_uid, cve_uid, affected_package_name, affected_package_version, severity, status FROM hb_vulnerability_finding WHERE instr(',' || '{{target_cves}}' || ',', ',' || cve_uid || ',') > 0 AND status != 'suppressed'",
        "silence": "not_evidence_of_absence",
        "expected": "A list of devices and their unpatched CVEs. A match indicates an exposed surface area matching SafePay's known targeting.",
        "verified": "dry-run",
        "verified_at": "2026-10-21"
      }
    },
    {
      "id": "signins-from-vpn-proxies",
      "type": "query",
      "label": "VPN and proxy authentication patterns",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "identity",
        "content": "SELECT src_endpoint_ip, actor_user_name, status, COUNT(*) AS attempts, MIN(time) AS first_attempt, MAX(time) AS last_attempt FROM hb_auth_signin WHERE (is_proxy = 'true' OR instr(',' || '{{mullvad_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip, actor_user_name, status",
        "surface": "hb_auth_signin",
        "description": "Find sign-in attempts or successful logons originating from Mullvad VPN or anonymizing proxies.",
        "expected_signal": "A successful logon from a proxy or Mullvad IP is a high-fidelity indicator of account compromise or external unauthorized access."
      },
      "parents": [
        {
          "id": "vulnerable-edge-assets"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "VPN and proxy authentication patterns",
        "reads": [
          "actor_user_name",
          "device_hostname",
          "is_proxy",
          "src_endpoint_ip",
          "status",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT src_endpoint_ip, actor_user_name, status, COUNT(*) AS attempts, MIN(time) AS first_attempt, MAX(time) AS last_attempt FROM hb_auth_signin WHERE (is_proxy = 'true' OR instr(',' || '{{mullvad_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip, actor_user_name, status",
        "silence": "not_evidence_of_absence",
        "expected": "A successful logon from a proxy or Mullvad IP is a high-fidelity indicator of account compromise or external unauthorized access.",
        "verified": "dry-run",
        "verified_at": "2026-10-21"
      }
    },
    {
      "id": "high-privilege-account-changes",
      "type": "query",
      "label": "New administrators and group additions",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, actor_user_name, group_name, user_name, activity_name, time FROM hb_group_management WHERE (LOWER(group_name) LIKE '%admin%' OR group_uid = 'S-1-5-32-544') AND activity_id = 3 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_group_management",
        "description": "Detect the addition of accounts to privileged groups, a key SafePay persistence mechanism.",
        "expected_signal": "A row identifying an account added to an administrative group. If the actor_user_name is a service account or an unusual user, it is highly suspicious."
      },
      "parents": [
        {
          "id": "vulnerable-edge-assets"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "New administrators and group additions",
        "reads": [
          "activity_id",
          "activity_name",
          "actor_user_name",
          "device_hostname",
          "group_name",
          "group_uid",
          "time",
          "user_name"
        ],
        "source": "hb_group_management",
        "target": "endpoint",
        "content": "SELECT device_hostname, actor_user_name, group_name, user_name, activity_name, time FROM hb_group_management WHERE (LOWER(group_name) LIKE '%admin%' OR group_uid = 'S-1-5-32-544') AND activity_id = 3 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A row identifying an account added to an administrative group. If the actor_user_name is a service account or an unusual user, it is highly suspicious.",
        "verified": "dry-run",
        "verified_at": "2026-10-21"
      }
    },
    {
      "id": "new-account-creation",
      "type": "query",
      "label": "Suspicious account creation",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, user_name, actor_user_name, activity_name, time FROM hb_account_change WHERE activity_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_account_change",
        "description": "Detect the creation of new user accounts which SafePay actors use to establish control.",
        "expected_signal": "The creation of a new account not associated with documented provisioning activity."
      },
      "parents": [
        {
          "id": "vulnerable-edge-assets"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Suspicious account creation",
        "reads": [
          "activity_id",
          "activity_name",
          "actor_user_name",
          "device_hostname",
          "time",
          "user_name"
        ],
        "source": "hb_account_change",
        "target": "endpoint",
        "content": "SELECT device_hostname, user_name, actor_user_name, activity_name, time FROM hb_account_change WHERE activity_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "The creation of a new account not associated with documented provisioning activity.",
        "verified": "dry-run",
        "verified_at": "2026-10-21"
      }
    },
    {
      "id": "triage-access-and-persistence",
      "type": "analytic",
      "label": "Weigh perimeter and account evidence",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "vulnerable-edge-assets",
          "signins-from-vpn-proxies",
          "high-privilege-account-changes",
          "new-account-creation"
        ],
        "objective": "Determine if the sign-in patterns from proxies/VPNs and subsequent administrative account changes on vulnerable hosts indicate successful initial access and persistence by SafePay actors.",
        "description": "Evaluate whether the identified vulnerabilities, sign-in anomalies, and account changes suggest an active SafePay intrusion.",
        "max_iterations": 6,
        "expected_signal": "A host-by-host verdict on whether an intrusion has occurred.",
        "success_criteria": "A verdict of malicious | suspicious | benign per host, citing the rows."
      },
      "parents": [
        {
          "id": "signins-from-vpn-proxies",
          "kind": "merge"
        },
        {
          "id": "high-privilege-account-changes",
          "kind": "merge"
        },
        {
          "id": "new-account-creation",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict identifies successful unauthorized administrative account creation or sign-ins on vulnerable hosts",
        "condition": "the triage verdict identifies successful unauthorized administrative account creation or sign-ins on vulnerable hosts",
        "blind_spot": "missing-vpn-auth-telemetry",
        "confidence": "high",
        "description": "Decide whether to isolate affected hosts based on the agent's verdict.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-access-and-persistence"
        }
      ]
    },
    {
      "id": "isolate-and-remediate",
      "type": "action",
      "label": "Isolate host and disable accounts",
      "config": {
        "target": "endpoint",
        "description": "Neutralize the threat by isolating the beachhead and revoking unauthorized administrative access.",
        "instructions": "Isolate the compromised endpoint from the network. Disable the newly created or modified administrative accounts identified in the triage. Revoke active sessions for those users.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Review beachhead findings",
      "config": {
        "assignee": "analyst",
        "description": "Perform manual validation of the evidence to ensure the remediation was targeted and to gather further indicators.",
        "instructions": "Verify the sign-in source IPs against known Mullvad exit nodes. Confirm the legitimacy of the account modifications with the system owner. Check hb_process_activity for the beachhead host, specifically looking for the 'legitimate system tools' (T1059) mentioned in the advisory (e.g., net.exe, powershell.exe) being used to modify accounts. Look for early signs of lateral movement (e.g., SMB connections from the beachhead)."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-and-remediate"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Document the findings and schedule future hunts.",
        "instructions": "Record the vulnerable hosts and IPs found. If no malicious activity was identified, note the status of unpatched edge vulnerabilities for the vulnerability management team."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}