{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The Spring Ring campaign targets domain controllers via NTLM relay after establishing a beachhead via vishing. A negative result confirms that the known technical execution phase has not occurred on the enrolled estate." }, "name": "Spring Ring: NTLM Relay and RAT C2", "type": "investigation", "labels": [ "hunt", "attack.t1557.001", "attack.t1210", "attack.t1071.001" ], "series": { "slug": "spring-ring-an-inside-look-at-voice-phishing-campaigns-in-microsoft-teams", "index": 2, "title": "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams", "total": 2 }, "related": [ { "hunt": "spring-ring-initial-access-vishing", "reason": "This hunt focuses on technical execution after a potential vishing breach.", "relation": "follows" }, { "hunt": "teams-vishing-payload-execution", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple detection rule on the Python path can be evaded by renaming the binary. This hunt pivots to the behavioral impact (SMB scanning) and network indicators (DNS) to confirm the intrusion's intent.", "coverage": [ { "stage": "lateral-movement-ntlm-relay", "steps": [ "find-custom-python", "smb-scanning" ], "status": "covered" }, { "stage": "command-and-control-rat", "steps": [ "c2-beaconing" ], "status": "covered" }, { "stage": "initial-access-teams-vishing", "reason": "Belongs to another part of the 'Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams' series.", "status": "out_of_scope" }, { "stage": "execution-rmm-and-custom-payloads", "reason": "Belongs to another part of the 'Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams' series.", "status": "out_of_scope" }, { "stage": "persistence-staging-temp", "reason": "Belongs to another part of the 'Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams' series.", "status": "out_of_scope" }, { "stage": "defense-evasion-obfuscation-and-hijack", "reason": "Belongs to another part of the 'Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams' series.", "status": "out_of_scope" }, { "stage": "discovery-host-and-domain", "reason": "Belongs to another part of the 'Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Teams Vishing and Impersonation", "slug": "initial-access-teams-vishing", "tactic": "initial-access", "techniques": [ "T1566.003" ], "observables": [ "internalsystemsdaily.onmicrosoft.com", "itprotectiondepartment.onmicrosoft.com", "mandatorynetworkmonitoring.onmicrosoft.com", "internalusahelpdeskit.onmicrosoft.com", "certifiedupdatenetwork.onmicrosoft.com", "infrastructureopsdesk.onmicrosoft.com", "systemdeploymentcenter.onmicrosoft.com", "systemsupportoperations.onmicrosoft.com" ] }, { "name": "User Execution of RMM and Payloads", "slug": "execution-rmm-and-custom-payloads", "tactic": "execution", "techniques": [ "T1204.002", "T1219" ], "observables": [ "Quick Assist", "s3.us-west-2.amazonaws.com", "*-org-filters-update-*.exe", "san-sid.com" ] }, { "name": "Staging and Persistence", "slug": "persistence-staging-temp", "tactic": "persistence", "techniques": [ "T1547" ], "observables": [ "\\Temp\\vhlp-*.exe", "\\Temp\\scnr-*.exe" ] }, { "name": "Bypassing AMSI and Browser Hijacking", "slug": "defense-evasion-obfuscation-and-hijack", "tactic": "defense-evasion", "techniques": [ "T1027", "T1562.001", "T1176" ], "observables": [ "amsiInitFailed", "Headless Microsoft Edge", "Sideloaded Edge extension", "Obfuscated PowerShell script" ] }, { "name": "Host and Domain Discovery", "slug": "discovery-host-and-domain", "tactic": "discovery", "techniques": [ "T1033", "T1069.002" ], "observables": [ "whoami /groups", "net group /dom" ] }, { "name": "NTLM Relay and PetitPotam", "slug": "lateral-movement-ntlm-relay", "tactic": "lateral-movement", "techniques": [ "T1557.001", "T1210" ], "observables": [ "C:\\ProgramData\\IntegrityData\\python.exe", "Port 445 SMB scanning", "PetitPotam coercion against Domain Controllers" ] }, { "name": "PowerShell RAT C2 Beaconing", "slug": "command-and-control-rat", "tactic": "command-and-control", "techniques": [ "T1071.001" ], "observables": [ "san-sid.com" ] } ], "summary": "Spring Ring is a social engineering campaign that leverages external Microsoft Teams accounts to impersonate IT help desks via vishing calls. Attackers coerce employees into running remote management tools or custom malware, leading to domain enumeration and NTLM relay attacks (PetitPotam) intended to compromise domain controllers." }, "severity": "high", "rationale": "Start with general endpoints. If the find-custom-python step identifies hits, use those hostnames in the scope_hosts parameter for the scanning and C2 steps.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An attacker has deployed a custom Python environment to facilitate NTLM relay attacks and a PowerShell-based RAT that beacons to external command-and-control infrastructure.", "parameters": { "c2_domains": { "from": { "ref": "Spring Ring", "kind": "article", "observed": "2026-08-31" }, "type": "list[domain]", "default": [ "san-sid.com" ], "description": "C2 domains for the PowerShell RAT." }, "python_path": { "from": { "ref": "Spring Ring", "kind": "article", "observed": "2026-08-31" }, "type": "path", "default": "C:\\ProgramData\\IntegrityData\\python.exe", "description": "The specific Python path used for PetitPotam coercion." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Paste hosts from the scoping step here to narrow subsequent queries." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/", "name": "Unit 42 \u2014 Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams" } ], "blind_spots": [ { "id": "no-smb-visibility", "risk": "We see the outbound scan from the beachhead but cannot confirm if the relay attack succeeded without server-side logs.", "stage": "lateral-movement-ntlm-relay", "question": "whether the DC successfully authenticated back to the attacker", "requires": "hb_network_connection with log visibility on domain controllers" }, { "id": "ephemeral-c2-infrastructure", "risk": "DNS lookups show intent but not the content of the payload delivery, which may use arithmetic obfuscation that automated tools miss.", "stage": "command-and-control-rat", "question": "whether the PowerShell RAT received further payloads", "requires": "TLS inspection of outbound web traffic" } ] }, "name": "Spring Ring: NTLM Relay and RAT C2", "description": "This hunt targets the lateral movement and command-and-control phases of the Spring Ring campaign. It identifies the execution of a tailored Python interpreter used for NTLM coercion (PetitPotam) and correlates it with outbound SMB scanning and DNS resolutions for known C2 domains. By pivoting from a specific process path to network-layer behaviors, the hunt detects attempts to escalate privileges to the domain level." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "spring-ring-an-inside-look-at-voice-phishing-campaigns-in-microsoft-teams", "index": 2, "title": "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams", "total": 2 }, "coverage": [ { "stage": "lateral-movement-ntlm-relay", "steps": [ "find-custom-python", "smb-scanning" ], "status": "covered" }, { "stage": "command-and-control-rat", "steps": [ "c2-beaconing" ], "status": "covered" }, { "stage": "initial-access-teams-vishing", "reason": "Belongs to another part of the 'Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams' series.", "status": "out_of_scope" }, { "stage": "execution-rmm-and-custom-payloads", "reason": "Belongs to another part of the 'Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams' series.", "status": "out_of_scope" }, { "stage": "persistence-staging-temp", "reason": "Belongs to another part of the 'Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams' series.", "status": "out_of_scope" }, { "stage": "defense-evasion-obfuscation-and-hijack", "reason": "Belongs to another part of the 'Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams' series.", "status": "out_of_scope" }, { "stage": "discovery-host-and-domain", "reason": "Belongs to another part of the 'Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams' series.", "status": "out_of_scope" } ], "rationale": "An attacker has deployed a custom Python environment to facilitate NTLM relay attacks and a PowerShell-based RAT that beacons to external command-and-control infrastructure.", "blind_spots": [ { "id": "no-smb-visibility", "risk": "We see the outbound scan from the beachhead but cannot confirm if the relay attack succeeded without server-side logs.", "stage": "lateral-movement-ntlm-relay", "question": "whether the DC successfully authenticated back to the attacker", "requires": "hb_network_connection with log visibility on domain controllers" }, { "id": "ephemeral-c2-infrastructure", "risk": "DNS lookups show intent but not the content of the payload delivery, which may use arithmetic obfuscation that automated tools miss.", "stage": "command-and-control-rat", "question": "whether the PowerShell RAT received further payloads", "requires": "TLS inspection of outbound web traffic" } ], "scoping_notes": "Start with general endpoints. If the find-custom-python step identifies hits, use those hostnames in the scope_hosts parameter for the scanning and C2 steps.", "beyond_detection": "A simple detection rule on the Python path can be evaded by renaming the binary. This hunt pivots to the behavioral impact (SMB scanning) and network indicators (DNS) to confirm the intrusion's intent." } }, { "id": "find-custom-python", "type": "query", "label": "Find custom Python interpreter", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, process_path, process_cmd_line, user_name, MIN(time) AS first_seen FROM hb_process_activity WHERE LOWER(process_path) = LOWER('{{python_path}}') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3, 4", "surface": "hb_process_activity", "description": "Identify hosts running the tailored Python environment used to initiate NTLM relay attacks.", "expected_signal": "A list of hosts and users executing the specific Python binary. Silence indicates the environment has not been deployed on any enrolled Windows endpoint." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Find custom Python interpreter", "reads": [ "device_hostname", "process_cmd_line", "process_path", "time", "user_name" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_path, process_cmd_line, user_name, MIN(time) AS first_seen FROM hb_process_activity WHERE LOWER(process_path) = LOWER('{{python_path}}') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3, 4", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A list of hosts and users executing the specific Python binary. Silence indicates the environment has not been deployed on any enrolled Windows endpoint.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_path" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "smb-scanning", "type": "query", "label": "Outbound SMB scanning on port 445", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, COUNT(*) AS connections, MIN(time) AS first_seen FROM hb_network_connection WHERE dst_endpoint_port = 445 AND direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3 HAVING connections > 5 ORDER BY connections DESC", "surface": "hb_network_connection", "description": "Identify potential PetitPotam coercion attempts by finding hosts contacting many internal targets over SMB.", "expected_signal": "A host connecting to multiple internal IP addresses on port 445. The presence of the suspicious python.exe as the originating process is a critical signal." }, "parents": [ { "id": "find-custom-python" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Outbound SMB scanning on port 445", "reads": [ "device_hostname", "direction", "dst_endpoint_ip", "dst_endpoint_port", "process_name", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, COUNT(*) AS connections, MIN(time) AS first_seen FROM hb_network_connection WHERE dst_endpoint_port = 445 AND direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3 HAVING connections > 5 ORDER BY connections DESC", "silence": "not_evidence_of_absence", "expected": "A host connecting to multiple internal IP addresses on port 445. The presence of the suspicious python.exe as the originating process is a critical signal.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "c2-beaconing", "type": "query", "label": "DNS lookups for Spring Ring C2", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, COUNT(*) AS lookups, MAX(time) AS last_seen FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3", "surface": "hb_dns_activity", "description": "Verify if hosts are beaconing to the PowerShell RAT command-and-control infrastructure.", "expected_signal": "Resolutions for the known C2 domains from the beachhead hosts. Silence means no DNS activity for these specific indicators was captured." }, "parents": [ { "id": "find-custom-python" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "DNS lookups for Spring Ring C2", "reads": [ "device_hostname", "process_name", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, COUNT(*) AS lookups, MAX(time) AS last_seen FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3", "silence": "evidence_of_absence", "expected": "Resolutions for the known C2 domains from the beachhead hosts. Silence means no DNS activity for these specific indicators was captured.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "triage-verdict", "type": "analytic", "label": "Evaluate Spring Ring intrusion", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "find-custom-python", "smb-scanning", "c2-beaconing" ], "objective": "Decide whether the combined evidence of custom python execution, SMB scanning, and C2 beaconing indicates an active Spring Ring campaign on any host.", "description": "Correlate the findings from all three surfaces to determine if a host is compromised and attempting lateral movement.", "max_iterations": 5, "expected_signal": "A per-host verdict citing specific process paths, connection patterns, and DNS resolutions.", "success_criteria": "A verdict of malicious for any host showing the custom python execution alongside scanning or C2 activity." }, "parents": [ { "id": "smb-scanning", "kind": "merge" }, { "id": "c2-beaconing", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on malicious verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-verdict identifies at least one host as malicious", "condition": "the triage-verdict identifies at least one host as malicious", "blind_spot": "no-smb-visibility", "confidence": "high", "description": "Direct the hunt to containment or manual review based on the agent's findings.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-verdict" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Sever the attacker's connection and prevent further lateral movement attempts.", "instructions": "Isolate the host and terminate any processes running from C:\\ProgramData\\IntegrityData\\.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "investigate-lateral-movement", "type": "task", "label": "Forensic review of SMB scanning", "config": { "assignee": "analyst", "description": "Verify the targets of the SMB scanning to confirm if Domain Controllers were targeted.", "instructions": "Examine the destination IPs from the smb-scanning step. Check Domain Controller logs for NTLM authentication attempts or coercion errors around the same time." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "cleanup-and-report", "type": "task", "label": "Cleanup and report", "config": { "assignee": "analyst", "description": "Document the findings and close the hunt.", "instructions": "Summarize the hosts identified and the specific behaviors observed. Note any gaps in SMB visibility on servers." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "investigate-lateral-movement" } ] } ] }