{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Torrent Servers manage sensitive genomic and healthcare data. File disclosure via path traversal leads to significant regulatory violations and breach of privacy. Verifying exploitation status is critical for patient data safety."
      },
      "name": "Thermo Fisher Torrent Suite Path Traversal Exposure",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1133",
        "attack.t1090.003",
        "attack.t1566",
        "collection",
        "initial access"
      ],
      "related": [
        {
          "hunt": "credential-harvesting-phishing-analysis",
          "reason": "Phishing detection requires email and network proxy surfaces not focused on in this vulnerability-centric hunt.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "This hunt correlates software versions (inventory) with authenticated access anomalies (prevalence) and multi-surface behavior (HTTP traversal and file reads) to distinguish exploitation from benign administrative activity.",
      "coverage": [
        {
          "stage": "path-traversal-exploitation",
          "steps": [
            "inventory-vulnerable-torrent-suite",
            "http-path-traversal-activity"
          ],
          "status": "covered"
        },
        {
          "stage": "unauthorized-file-disclosure",
          "steps": [
            "web-service-file-reads"
          ],
          "status": "covered"
        },
        {
          "stage": "external-remote-service-access",
          "steps": [
            "rare-auth-on-torrent-servers"
          ],
          "status": "covered"
        },
        {
          "stage": "initial-access-phishing",
          "reason": "No email or messaging telemetry is provided in the available surfaces.",
          "status": "not_visible",
          "blind_spot": "phishing-telemetry-gap"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Phishing for Credentials",
            "slug": "initial-access-phishing",
            "tactic": "initial-access",
            "techniques": [
              "T1566"
            ],
            "observables": [
              "Links in unsolicited email messages",
              "Attachments in unsolicited email messages",
              "Social engineering lures"
            ]
          },
          {
            "name": "Access via Remote Services",
            "slug": "external-remote-service-access",
            "tactic": "initial-access",
            "techniques": [
              "T1133"
            ],
            "observables": [
              "VPN connection attempts",
              "Successful authenticated logins to remote access gateways"
            ]
          },
          {
            "name": "Exploitation of CVE-2026-107777",
            "slug": "path-traversal-exploitation",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "Torrent Suite Software version <= 5.18",
              "HTTP requests with dot-dot-slash (../) sequences in the URL path or query",
              "Targeting Thermo Fisher Torrent Suite Server"
            ]
          },
          {
            "name": "Arbitrary File Read",
            "slug": "unauthorized-file-disclosure",
            "tactic": "collection",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "Web service account accessing system files (e.g., /etc/passwd)",
              "Web service account accessing configuration files outside the web root",
              "Reads of arbitrary files on the Torrent Server"
            ]
          }
        ],
        "summary": "Authenticated attackers exploit a path traversal vulnerability (CVE-2026-107777) in Thermo Fisher Torrent Suite Software versions 5.18 and earlier to read arbitrary files accessible to the web service account. Access is typically gained through stolen credentials via phishing or by leveraging external remote services like VPNs."
      },
      "severity": "high",
      "rationale": "Focus on servers running Torrent Suite Software. Prioritize internet-exposed servers or those accessible via VPN, as authenticated traversal is the primary risk.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An authenticated intruder is exploiting a path traversal vulnerability (CVE-2026-107777) in Thermo Fisher Torrent Suite Software to exfiltrate sensitive configuration and system files from healthcare servers.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "List of hostnames running Torrent Suite Software; leave empty to search the whole estate."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "sensitive_files": {
          "type": "list[path]",
          "default": [
            "/etc/passwd",
            "/etc/shadow",
            "/etc/hosts",
            "c:\\windows\\win.ini",
            "c:\\windows\\system32\\drivers\\etc\\hosts",
            "web.config",
            ".env"
          ],
          "description": "Sensitive files an attacker might target; provided defaults are lowercase for exact matching."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01",
          "name": "CISA Advisory ICSMA-26-288-01"
        }
      ],
      "blind_spots": [
        {
          "id": "missing-web-logs",
          "risk": "Unsuccessful traversal probes or probes targeting cached data would not be seen without complete HTTP telemetry.",
          "stage": "path-traversal-exploitation",
          "question": "whether path traversal attempts occurred without triggering file system events",
          "requires": "hb_http_activity (full access logs)"
        },
        {
          "id": "phishing-telemetry-gap",
          "risk": "The hunt begins at the authentication stage; the precursor phishing activity is invisible to the provided surfaces.",
          "stage": "initial-access-phishing",
          "question": "how the initial credentials for the authenticated traversal were acquired",
          "requires": "email_activity or proxy_logs"
        }
      ]
    },
    "name": "Thermo Fisher Torrent Suite Path Traversal Exposure",
    "description": "This hunt identifies servers running vulnerable versions (<= 5.18) of Thermo Fisher Torrent Suite Software and examines them for exploitation. It first scopes the estate using software inventory data, then baselines user authentication to identify rare or anomalous access. Finally, it searches for behavioral indicators: HTTP requests containing traversal sequences and the web service account reading files in sensitive system paths. This multi-surface approach ensures that even if web logs are missing or traversal characters are obfuscated, the downstream file access behavior is captured."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "path-traversal-exploitation",
            "steps": [
              "inventory-vulnerable-torrent-suite",
              "http-path-traversal-activity"
            ],
            "status": "covered"
          },
          {
            "stage": "unauthorized-file-disclosure",
            "steps": [
              "web-service-file-reads"
            ],
            "status": "covered"
          },
          {
            "stage": "external-remote-service-access",
            "steps": [
              "rare-auth-on-torrent-servers"
            ],
            "status": "covered"
          },
          {
            "stage": "initial-access-phishing",
            "reason": "No email or messaging telemetry is provided in the available surfaces.",
            "status": "not_visible",
            "blind_spot": "phishing-telemetry-gap"
          }
        ],
        "rationale": "An authenticated intruder is exploiting a path traversal vulnerability (CVE-2026-107777) in Thermo Fisher Torrent Suite Software to exfiltrate sensitive configuration and system files from healthcare servers.",
        "blind_spots": [
          {
            "id": "missing-web-logs",
            "risk": "Unsuccessful traversal probes or probes targeting cached data would not be seen without complete HTTP telemetry.",
            "stage": "path-traversal-exploitation",
            "question": "whether path traversal attempts occurred without triggering file system events",
            "requires": "hb_http_activity (full access logs)"
          },
          {
            "id": "phishing-telemetry-gap",
            "risk": "The hunt begins at the authentication stage; the precursor phishing activity is invisible to the provided surfaces.",
            "stage": "initial-access-phishing",
            "question": "how the initial credentials for the authenticated traversal were acquired",
            "requires": "email_activity or proxy_logs"
          }
        ],
        "scoping_notes": "Focus on servers running Torrent Suite Software. Prioritize internet-exposed servers or those accessible via VPN, as authenticated traversal is the primary risk.",
        "beyond_detection": "This hunt correlates software versions (inventory) with authenticated access anomalies (prevalence) and multi-surface behavior (HTTP traversal and file reads) to distinguish exploitation from benign administrative activity."
      }
    },
    {
      "id": "inventory-vulnerable-torrent-suite",
      "type": "query",
      "label": "Inventory vulnerable Torrent Suite installations",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%torrent suite%' AND package_version < '5.2'",
        "surface": "hb_software_inventory",
        "description": "Identify hosts running Thermo Fisher Torrent Suite Software version 5.18 or lower to narrow the hunt scope.",
        "expected_signal": "A list of hosts running versions prior to 5.2. Silence means no vulnerable software is installed or the inventory is out of date."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Inventory vulnerable Torrent Suite installations",
        "reads": [
          "device_hostname",
          "package_name",
          "package_version",
          "install_path"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%torrent suite%' AND package_version < '5.2'",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hosts running versions prior to 5.2. Silence means no vulnerable software is installed or the inventory is out of date.",
        "verified": "dry-run",
        "verified_at": "2026-10-16"
      }
    },
    {
      "id": "rare-auth-on-torrent-servers",
      "type": "query",
      "label": "Rare authentication on Torrent servers",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "identity",
        "content": "SELECT actor_user_name, device_hostname, src_location_country, src_endpoint_ip, COUNT(*) AS login_count, MIN(time) AS first_login, MAX(time) AS last_login FROM hb_auth_signin WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, device_hostname, src_location_country, src_endpoint_ip HAVING login_count < 5 ORDER BY login_count ASC",
        "surface": "hb_auth_signin",
        "description": "Identify anomalous authenticated access, as the vulnerability requires a valid account for exploitation.",
        "expected_signal": "Accounts with very few successful logins to the targeted servers. In healthcare systems, even a single login from an unusual geography is more significant than the raw count."
      },
      "parents": [
        {
          "id": "inventory-vulnerable-torrent-suite"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare authentication on Torrent servers",
        "reads": [
          "actor_user_name",
          "device_hostname",
          "src_location_country",
          "src_endpoint_ip",
          "status_id",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, device_hostname, src_location_country, src_endpoint_ip, COUNT(*) AS login_count, MIN(time) AS first_login, MAX(time) AS last_login FROM hb_auth_signin WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, device_hostname, src_location_country, src_endpoint_ip HAVING login_count < 5 ORDER BY login_count ASC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Accounts with very few successful logins to the targeted servers. In healthcare systems, even a single login from an unusual geography is more significant than the raw count.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "actor_user_name"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-10-16"
      }
    },
    {
      "id": "http-path-traversal-activity",
      "type": "query",
      "label": "HTTP path traversal attempts",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "web",
        "content": "SELECT device_hostname, src_endpoint_ip, url_full, status_code, user_agent, time FROM hb_http_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND (instr(LOWER(url_full), '../') > 0 OR instr(LOWER(url_full), '..\\') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Find HTTP requests containing dot-dot-slash sequences that attempt to break out of the web root.",
        "expected_signal": "HTTP requests targeting the Torrent Suite servers that include traversal characters. Requests returning a 200 OK status are highly suspicious as they indicate successful processing."
      },
      "parents": [
        {
          "id": "rare-auth-on-torrent-servers"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "HTTP path traversal attempts",
        "reads": [
          "device_hostname",
          "src_endpoint_ip",
          "url_full",
          "status_code",
          "user_agent",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, src_endpoint_ip, url_full, status_code, user_agent, time FROM hb_http_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND (instr(LOWER(url_full), '../') > 0 OR instr(LOWER(url_full), '..\\') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "HTTP requests targeting the Torrent Suite servers that include traversal characters. Requests returning a 200 OK status are highly suspicious as they indicate successful processing.",
        "verified": "dry-run",
        "verified_at": "2026-10-16"
      }
    },
    {
      "id": "web-service-file-reads",
      "type": "query",
      "label": "Sensitive file reads by web service",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_hostname, actor_user_name, process_name, file_path, time FROM hb_file_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND (instr(LOWER(actor_user_name), 'www') > 0 OR instr(LOWER(actor_user_name), 'apache') > 0 OR instr(LOWER(actor_user_name), 'nginx') > 0 OR instr(LOWER(process_name), 'torrent') > 0) AND instr(',' || '{{sensitive_files}}' || ',', ',' || LOWER(file_path) || ',') > 0 AND activity_id = 2 AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_file_activity",
        "description": "Confirm successful traversal by identifying the web service account reading files from the sensitive files list.",
        "expected_signal": "The web service account or Torrent process reading files that should not be accessible via the application. This confirms successful arbitrary file disclosure."
      },
      "parents": [
        {
          "id": "http-path-traversal-activity"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Sensitive file reads by web service",
        "reads": [
          "device_hostname",
          "actor_user_name",
          "process_name",
          "file_path",
          "activity_id",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, actor_user_name, process_name, file_path, time FROM hb_file_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND (instr(LOWER(actor_user_name), 'www') > 0 OR instr(LOWER(actor_user_name), 'apache') > 0 OR instr(LOWER(actor_user_name), 'nginx') > 0 OR instr(LOWER(process_name), 'torrent') > 0) AND instr(',' || '{{sensitive_files}}' || ',', ',' || LOWER(file_path) || ',') > 0 AND activity_id = 2 AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "The web service account or Torrent process reading files that should not be accessible via the application. This confirms successful arbitrary file disclosure.",
        "verified": "dry-run",
        "verified_at": "2026-10-16"
      }
    },
    {
      "id": "triage-exposure",
      "type": "analytic",
      "label": "Analyze exposure and activity",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "web"
        ],
        "context": [
          "inventory-vulnerable-torrent-suite",
          "rare-auth-on-torrent-servers",
          "http-path-traversal-activity",
          "web-service-file-reads"
        ],
        "objective": "Review the authentication trends, HTTP requests, and file access events to determine if any Thermo Fisher Torrent Suite Servers have been exploited via CVE-2026-107777.",
        "description": "Assess whether vulnerable hosts show evidence of path traversal exploitation.",
        "max_iterations": 5,
        "expected_signal": "A per-host verdict of exposed (vulnerable version only), suspicious (traversal probes), or compromised (successful file disclosure).",
        "success_criteria": "A verdict per host citing specific rows that indicate software version, rare login activity, and specific file or HTTP indicators."
      },
      "parents": [
        {
          "id": "web-service-file-reads"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage-exposure verdict indicates successful traversal attempts (HTTP 200) or sensitive file reads by a web service account",
        "condition": "the triage-exposure verdict indicates successful traversal attempts (HTTP 200) or sensitive file reads by a web service account",
        "blind_spot": "missing-web-logs",
        "confidence": "high",
        "description": "Direct the hunt to remediation review if active exploitation is identified.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-exposure"
        }
      ]
    },
    {
      "id": "remediation-review",
      "type": "task",
      "label": "Remediation and access review",
      "config": {
        "assignee": "analyst",
        "description": "Instructions for the analyst to coordinate patching and audit accounts.",
        "instructions": "1. Prioritize updating all Thermo Fisher Torrent Suite Software to version 5.22 or later. 2. Audit the logins identified in the rare authentication step; rotate credentials for any account that shows unusual activity or geographic anomalies. 3. Audit file system permissions to ensure the web service account cannot read sensitive system directories like /etc."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        },
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Finalize the hunt when no active exploitation is observed.",
        "instructions": "Document the vulnerable hosts found in the scoping step and ensure they are scheduled for patching. Confirm that no active traversal strings or sensitive file reads were detected during the lookback period."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}