{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Settra ransomware uses legitimate RMM tools for persistence to survive standard security measures; detecting this channel before the launcher executes provides the best opportunity to prevent impact." }, "name": "Settra Persistence via MeshAgent and Remote Access", "type": "investigation", "labels": [ "hunt", "attack.t1133", "attack.t1021.001", "attack.t1219" ], "series": { "slug": "ready-settra-go-new-settra-ransomware-variant-deploys-meshagent-rmm", "index": 1, "title": "Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM", "total": 2 }, "related": [ { "hunt": "settra-ransomware-evasion-and-encryption", "reason": "This hunt targets the persistence stage; the following hunt covers the BYOVD evasion and file encryption stages.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A standard rule might detect MeshAgent, but this hunt pivots between authentication logs to establish a beachhead and uses prevalence stack-counting to identify renamed RMM binaries that would otherwise blend in.", "coverage": [ { "stage": "initial-access-remote-services", "steps": [ "remote-access-signins" ], "status": "covered" }, { "stage": "persistence-rmm-meshagent", "steps": [ "rare-rmm-processes", "meshagent-c2-traffic" ], "status": "covered" }, { "stage": "defense-evasion-byovd", "reason": "Covered in the following hunt in the Settra series.", "status": "out_of_scope" }, { "stage": "execution-ransomware-launcher", "reason": "Covered in the following hunt in the Settra series.", "status": "out_of_scope" }, { "stage": "anti-recovery-and-evasion", "reason": "Covered in the following hunt in the Settra series.", "status": "out_of_scope" }, { "stage": "impact-data-encryption", "reason": "Covered in the following hunt in the Settra series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "External Remote Service Compromise", "slug": "initial-access-remote-services", "tactic": "initial-access", "techniques": [ "T1133", "T1021.001" ], "observables": [ "VPN credential compromise", "RDP session usage" ] }, { "name": "Persistence via MeshAgent RMM", "slug": "persistence-rmm-meshagent", "tactic": "persistence", "observables": [ "mvtcs.exe", "MeshAgent RMM installation", "45.13.122.7", "193.5.65.114", "Workstation name WIN-LIVFRVQFMKO" ] }, { "name": "BYOVD Security Tool Disabling", "slug": "defense-evasion-byovd", "tactic": "defense-evasion", "observables": [ "gdrv.sys", "Disable antivirus services" ] }, { "name": "Settra Ransomware Execution", "slug": "execution-ransomware-launcher", "tactic": "execution", "observables": [ "*_win64.exe", "C:\\Perflogs", "\\Documents\\*_win64.exe" ] }, { "name": "Inhibit Recovery and Clear Logs", "slug": "anti-recovery-and-evasion", "tactic": "defense-evasion", "techniques": [ "T1059.001" ], "observables": [ "reagentc /disable", "ipconfig /flushdns", "diskpart.exe execution with recovery partition script", "cipher /w:", "wevtutil log clearing (Application, Security, System, Setup, ForwardedEvents)", "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational", "Microsoft-Windows-TerminalServices-RDPClient/Operational", "Microsoft-Windows-Sysmon/Operational", "Microsoft-Windows-PowerShell/Operational", "Microsoft-Windows-WinRM/Operational", "Microsoft-Windows-TaskScheduler/Operational", "Microsoft-Windows-Windows-Defender/Operational" ] }, { "name": "Data Encrypted for Impact", "slug": "impact-data-encryption", "tactic": "impact", "techniques": [ "T1486" ], "observables": [ ".locked extension", ".locked_wip extension", "RESTORE_FILES.txt" ] } ], "summary": "Settra ransomware incidents involve initial persistence via MeshAgent RMM and the use of BYOVD (gdrv.sys) to disable security tools before executing a ransomware binary named after the victim domain. The threat actor employs extensive anti-recovery measures including clearing multiple event logs, disabling the Windows Recovery Environment, and overwriting free disk space using native Windows utilities." }, "severity": "high", "rationale": "Start by identifying all successful RDP and VPN sign-ins. If you find high-volume access from unusual IPs, use those hostnames as the scope_hosts parameter to narrow the expensive process and network queries.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has established a beachhead via compromised external remote services and installed MeshAgent, potentially renamed, to maintain persistent command-and-control access.", "parameters": { "c2_ips": { "from": { "ref": "huntress-settra-ransomware", "kind": "article", "observed": "2026-09-17" }, "type": "list[ip]", "default": [ "45.13.122.7", "193.5.65.114" ], "description": "C2 IP addresses associated with MeshAgent in Settra incidents; no spaces between entries." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "A list of hostnames to focus the hunt on, typically derived from the scoping step." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "meshagent_metadata": { "from": { "ref": "huntress-settra-ransomware", "kind": "article", "observed": "2026-09-17" }, "type": "string", "default": "MeshAgent", "description": "The expected original filename or product name in the PE metadata." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/new-settra-ransomware-variant", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/new-settra-ransomware-variant", "name": "Huntress \u2014 New Settra Ransomware Variant Deploys MeshAgent RMM" } ], "blind_spots": [ { "id": "missing-network-logs", "risk": "If the endpoint agent or network fabric does not capture flow logs, we only see the process execution and not the confirmation of active C2.", "stage": "persistence-rmm-meshagent", "question": "Did the MeshAgent binary successfully establish a C2 channel?", "requires": "hb_network_connection with state_kind = 'log'" }, { "id": "vpn-auth-visibility", "risk": "If the VPN provider is not integrated with the authentication surface, we cannot correlate the entry point with the internal persistence.", "stage": "initial-access-remote-services", "question": "Which VPN logins are tied to the intrusion?", "requires": "hb_auth_signin with VPN provider integration" } ] }, "name": "Settra Persistence via MeshAgent and Remote Access", "description": "This hunt identifies the early stages of a Settra ransomware intrusion by correlating remote access sign-ins with the subsequent deployment of the MeshAgent RMM tool. MeshAgent is a legitimate remote management utility that Settra operators use for persistence, often renaming the binary to mvtcs.exe. The hunt pivots from scoping successful RDP or VPN sessions to stack-counting rare binaries and identifying network telemetry reaching out to specific C2 infrastructure reported in recent Settra incidents." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "ready-settra-go-new-settra-ransomware-variant-deploys-meshagent-rmm", "index": 1, "title": "Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM", "total": 2 }, "coverage": [ { "stage": "initial-access-remote-services", "steps": [ "remote-access-signins" ], "status": "covered" }, { "stage": "persistence-rmm-meshagent", "steps": [ "rare-rmm-processes", "meshagent-c2-traffic" ], "status": "covered" }, { "stage": "defense-evasion-byovd", "reason": "Covered in the following hunt in the Settra series.", "status": "out_of_scope" }, { "stage": "execution-ransomware-launcher", "reason": "Covered in the following hunt in the Settra series.", "status": "out_of_scope" }, { "stage": "anti-recovery-and-evasion", "reason": "Covered in the following hunt in the Settra series.", "status": "out_of_scope" }, { "stage": "impact-data-encryption", "reason": "Covered in the following hunt in the Settra series.", "status": "out_of_scope" } ], "rationale": "An adversary has established a beachhead via compromised external remote services and installed MeshAgent, potentially renamed, to maintain persistent command-and-control access.", "blind_spots": [ { "id": "missing-network-logs", "risk": "If the endpoint agent or network fabric does not capture flow logs, we only see the process execution and not the confirmation of active C2.", "stage": "persistence-rmm-meshagent", "question": "Did the MeshAgent binary successfully establish a C2 channel?", "requires": "hb_network_connection with state_kind = 'log'" }, { "id": "vpn-auth-visibility", "risk": "If the VPN provider is not integrated with the authentication surface, we cannot correlate the entry point with the internal persistence.", "stage": "initial-access-remote-services", "question": "Which VPN logins are tied to the intrusion?", "requires": "hb_auth_signin with VPN provider integration" } ], "scoping_notes": "Start by identifying all successful RDP and VPN sign-ins. If you find high-volume access from unusual IPs, use those hostnames as the scope_hosts parameter to narrow the expensive process and network queries.", "beyond_detection": "A standard rule might detect MeshAgent, but this hunt pivots between authentication logs to establish a beachhead and uses prevalence stack-counting to identify renamed RMM binaries that would otherwise blend in." } }, { "id": "remote-access-signins", "type": "query", "label": "Remote access sign-ins", "config": { "dsl": "sqlite", "role": "scoping", "source": "identity", "content": "SELECT dst_endpoint_name AS device_hostname, actor_user_name, src_endpoint_ip, auth_protocol, MIN(time) AS first_signin, MAX(time) AS last_signin FROM hb_auth_signin WHERE status_id = 1 AND (LOWER(auth_protocol) LIKE '%rdp%' OR LOWER(auth_protocol) LIKE '%vpn%' OR LOWER(activity_name) LIKE '%remote%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_name, actor_user_name, src_endpoint_ip, auth_protocol ORDER BY last_signin DESC", "surface": "hb_auth_signin", "description": "Identify successful logins via RDP or VPN that may represent the initial beachhead for the threat actor.", "expected_signal": "A list of hosts and users accessing the network remotely. Silence suggests either no remote access occurred or the activity is outside the logging visibility of the authentication surface." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Remote access sign-ins", "reads": [ "dst_endpoint_name", "actor_user_name", "src_endpoint_ip", "auth_protocol", "status_id", "activity_name", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT dst_endpoint_name AS device_hostname, actor_user_name, src_endpoint_ip, auth_protocol, MIN(time) AS first_signin, MAX(time) AS last_signin FROM hb_auth_signin WHERE status_id = 1 AND (LOWER(auth_protocol) LIKE '%rdp%' OR LOWER(auth_protocol) LIKE '%vpn%' OR LOWER(activity_name) LIKE '%remote%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_name, actor_user_name, src_endpoint_ip, auth_protocol ORDER BY last_signin DESC", "silence": "not_evidence_of_absence", "expected": "A list of hosts and users accessing the network remotely. Silence suggests either no remote access occurred or the activity is outside the logging visibility of the authentication surface.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "rare-rmm-processes", "type": "query", "label": "Rare MeshAgent-related processes", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT LOWER(process_name) AS path, process_original_file_name, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_name) LIKE '%\\mvtcs.exe' OR LOWER(process_name) LIKE '%\\meshagent.exe' OR LOWER(process_original_file_name) LIKE '%' || LOWER('{{meshagent_metadata}}') || '%' OR LOWER(process_cmd_line) LIKE '%meshagent%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2 HAVING hosts <= 3 ORDER BY hosts, runs", "surface": "hb_process_activity", "description": "Find rare processes associated with MeshAgent binaries by checking paths and original file name metadata across the estate.", "expected_signal": "The binary mvtcs.exe or meshagent.exe appearing on a very small number of hosts, or any process with MeshAgent original metadata. Silence proves no such processes ran on the scoped hosts." }, "parents": [ { "id": "remote-access-signins" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Rare MeshAgent-related processes", "reads": [ "device_hostname", "process_name", "process_original_file_name", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_name) AS path, process_original_file_name, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_name) LIKE '%\\mvtcs.exe' OR LOWER(process_name) LIKE '%\\meshagent.exe' OR LOWER(process_original_file_name) LIKE '%' || LOWER('{{meshagent_metadata}}') || '%' OR LOWER(process_cmd_line) LIKE '%meshagent%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2 HAVING hosts <= 3 ORDER BY hosts, runs", "silence": "evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "The binary mvtcs.exe or meshagent.exe appearing on a very small number of hosts, or any process with MeshAgent original metadata. Silence proves no such processes ran on the scoped hosts.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "path", "process_original_file_name" ], "rare_below": 3 }, "verified_at": "2026-09-23" } }, { "id": "meshagent-c2-traffic", "type": "query", "label": "MeshAgent C2 traffic", "config": { "dsl": "sqlite", "role": "enrichment", "source": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, direction, time FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND state_kind = 'log' AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY time DESC", "surface": "hb_network_connection", "description": "Detect network connections from scoped hosts to the specific MeshAgent C2 IPs reported for Settra.", "expected_signal": "Outbound connections to 45.13.122.7 or 193.5.65.114. Any matching connection is highly suspicious if paired with an unrecognized RMM binary." }, "parents": [ { "id": "remote-access-signins" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "MeshAgent C2 traffic", "reads": [ "device_hostname", "process_name", "dst_endpoint_ip", "dst_endpoint_port", "direction", "state_kind", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, direction, time FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND state_kind = 'log' AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY time DESC", "silence": "not_evidence_of_absence", "expected": "Outbound connections to 45.13.122.7 or 193.5.65.114. Any matching connection is highly suspicious if paired with an unrecognized RMM binary.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "triage-verdict", "type": "analytic", "label": "Triage verdict", "config": { "cite": "required", "tools": [ "endpoint", "identity", "network" ], "context": [ "remote-access-signins", "rare-rmm-processes", "meshagent-c2-traffic" ], "objective": "Determine if the remote access session led to the installation of MeshAgent RMM and whether that RMM is communicating with known-malicious infrastructure.", "description": "Assess whether the remote access session on a specific host is followed by MeshAgent deployment and C2 traffic.", "max_iterations": 5, "expected_signal": "A per-host verdict linking a recent remote login to the installation of an RMM tool communicating with malicious IPs.", "success_criteria": "A verdict of malicious if MeshAgent is found connecting to the report's IPs on the same host where a remote sign-in occurred." }, "parents": [ { "id": "rare-rmm-processes", "kind": "merge" }, { "id": "meshagent-c2-traffic", "kind": "merge" } ] }, { "id": "routing-decision", "type": "checkpoint", "label": "Routing decision", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one host, citing the presence of a rare MeshAgent binary and connections to Settra C2 IPs", "condition": "the triage verdict is malicious for at least one host, citing the presence of a rare MeshAgent binary and connections to Settra C2 IPs", "blind_spot": "missing-network-logs", "confidence": "high", "description": "Route the hunt based on the triage verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-verdict" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Immediately contain the host to prevent the next stage of the ransomware attack.", "instructions": "Isolate the host from the network. Kill any running instances of mvtcs.exe or meshagent.exe. Revoke active sessions for the user account identified in the sign-in step.", "action_approval": "required" }, "parents": [ { "id": "routing-decision", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review", "config": { "assignee": "analyst", "description": "Conduct a manual review of the suspicious activity and prepare for recovery.", "instructions": "Review the full process tree for the rare binary. Check for scheduled tasks or registry run keys that might restart MeshAgent. Pivot to the next stage hunt (BYOVD and Ransomware Launcher) to check for further progression." }, "parents": [ { "id": "routing-decision", "branch": "default" }, { "id": "routing-decision", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out-report", "type": "task", "label": "Close-out report", "config": { "assignee": "analyst", "description": "Document the findings and update detection rules.", "instructions": "Record all confirmed IPs and filenames. If mvtcs.exe was found, promote the process query to a standing detection rule." }, "parents": [ { "id": "routing-decision", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }