{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Turla's Cereal toolset targets governmental and sensitive institutional email traffic by co-opting the victim's own infrastructure. Identifying these stealthy in-memory and file-based techniques is critical for defending against long-term, high-impact espionage." }, "name": "Turla Cereal: Exchange Transport Hijack and .NET Stealth", "type": "investigation", "labels": [ "hunt", "attack.t1041", "attack.t1047", "attack.t1071", "attack.t1574", "collection", "command and control", "execution", "persistence" ], "series": { "slug": "exchange-for-breakfast-turla-s-cereal-tricks-are-not-for-kids", "index": 1, "title": "Exchange for breakfast: Turla\u2019s Cereal tricks are not for kids", "total": 2 }, "related": [ { "hunt": "turla-cereal-passive-web-backdoor", "reason": "This hunt focuses on endpoint hijacking and email collection; the passive web backdoor on OWA paths is a distinct network/HTTP investigation.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "This is a hunt because standard detection rules often fail to catch .NET native image cache abuse or process injection that mimics legitimate Exchange service behavior. By stack-counting rare unsigned modules and correlating them with local file markers in Exchange paths, an analyst can distinguish an active intrusion from legitimate administrator activity that a single rule might miss or alert on excessively.", "coverage": [ { "stage": "dotnet-stealth-execution", "steps": [ "rare-unsigned-native-images" ], "status": "covered" }, { "stage": "offline-command-processing", "steps": [ "cereal-hermit-command-files" ], "status": "covered" }, { "stage": "mail-pipeline-hijacking", "steps": [ "edge-transport-hijack" ], "status": "covered" }, { "stage": "espionage-data-staging", "steps": [ "staged-espionage-data" ], "status": "covered" }, { "stage": "passive-web-backdoor", "reason": "Belongs to another part of the 'Exchange for breakfast: Turla\u2019s Cereal tricks are not for kids' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Sophisticated .NET Execution", "slug": "dotnet-stealth-execution", "tactic": "execution", "techniques": [ "T1047" ], "observables": [ "unmanaged entry points", "native image cache abuse", "nested .NET assemblies", "suspicious DLLs loaded by legitimate Windows processes" ] }, { "name": "Passive Web Service Backdoor", "slug": "passive-web-backdoor", "tactic": "command-and-control", "techniques": [ "T1071", "T1572" ], "observables": [ "https://*:443/owa/sdds/", "HTTPS://*:443/AUTODISCOVER/PROXYSERVICE/", "HTTPS://*:443/MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/", "CerealNeuron" ] }, { "name": "File-based Command Interface", "slug": "offline-command-processing", "tactic": "command-and-control", "techniques": [ "T1071" ], "observables": [ "encrypted command files on disk", "CerealHermit" ] }, { "name": "Exchange Transport Hijack", "slug": "mail-pipeline-hijacking", "tactic": "persistence", "techniques": [ "T1574" ], "observables": [ "EdgeTransport.exe", "injection into EdgeTransport.exe", "memory hijacking of transport agents", "VTable Fixups", "CerealBox" ] }, { "name": "Email Collection and Staging", "slug": "espionage-data-staging", "tactic": "collection", "techniques": [ "T1041" ], "observables": [ "compressed and encrypted files on disk", ".doc attachments", ".docx attachments", ".pdf attachments" ] } ], "summary": "The Turla-linked Cereal campaign targets government Exchange servers, utilizing a modular .NET toolset that operates without external C&C infrastructure by co-opting the victim server as a passive listener. The toolset intercepts mail by injecting into the EdgeTransport.exe process to hijack transport agents and uses specialized .NET tradecraft, such as native image cache abuse, to maintain stealthy execution." }, "severity": "critical", "rationale": "Focus on Client Access and Edge Transport roles within the Exchange infrastructure. Expand to mailbox servers if data staging is detected.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is using sophisticated .NET tradecraft to hijack an Exchange server's mail transport pipeline in memory, using local file markers for command processing and staging encrypted archives of collected emails.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-defined-scope", "kind": "manual", "observed": "2024-01-01" }, "type": "list[host]", "default": [], "description": "Specific Exchange servers to target; leave empty to hunt across the entire estate." }, "lookback_days": { "from": { "ref": "hunt-standard-lookback", "kind": "manual", "observed": "2024-01-01" }, "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.welivesecurity.com/en/eset-research/exchange-for-breakfast-turlas-cereal-tricks-are-not-for-kids/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.welivesecurity.com/en/eset-research/exchange-for-breakfast-turlas-cereal-tricks-are-not-for-kids/", "name": "ESET Research \u2014 Exchange for breakfast: Turla\u2019s Cereal tricks are not for kids" } ], "blind_spots": [ { "id": "module-logging-gaps", "risk": "Without comprehensive module load logging, the primary indicator of Turla's .NET tradecraft is invisible.", "stage": "dotnet-stealth-execution", "question": "whether the unsigned native image loads are observable on all Exchange servers", "requires": "hb_module_activity with Sysmon 7 or advanced EDR telemetry" }, { "id": "vtable-fixup-visibility", "risk": "standard endpoint telemetry will not see the hijacking of internal structures, only the initial injection of the malicious module.", "stage": "mail-pipeline-hijacking", "question": "whether VTable fixups were used to hijack legitimate transport agents without loading a new module", "requires": "Memory forensics or deep process inspection" } ] }, "name": "Turla Cereal: Exchange Transport Hijack and .NET Stealth", "description": "This hunt targets the endpoint behavior of Turla's Cereal toolset. It identifies the early indicators of .NET stealth, such as unsigned DLLs loaded from the native image cache, and the presence of encrypted command files used by the CerealHermit variant. It then pivots to look for active exploitation: the injection of malicious modules into EdgeTransport.exe and the creation of encrypted data archives in Exchange installation paths. Because the toolset is designed to run in memory and avoid external C2 beacons by co-opting the Exchange server itself, the hunt focuses on prevalence-based detection of rare module loads and file-based staging patterns that deviate from normal Exchange activity." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "exchange-for-breakfast-turla-s-cereal-tricks-are-not-for-kids", "index": 1, "title": "Exchange for breakfast: Turla\u2019s Cereal tricks are not for kids", "total": 2 }, "coverage": [ { "stage": "dotnet-stealth-execution", "steps": [ "rare-unsigned-native-images" ], "status": "covered" }, { "stage": "offline-command-processing", "steps": [ "cereal-hermit-command-files" ], "status": "covered" }, { "stage": "mail-pipeline-hijacking", "steps": [ "edge-transport-hijack" ], "status": "covered" }, { "stage": "espionage-data-staging", "steps": [ "staged-espionage-data" ], "status": "covered" }, { "stage": "passive-web-backdoor", "reason": "Belongs to another part of the 'Exchange for breakfast: Turla\u2019s Cereal tricks are not for kids' series.", "status": "out_of_scope" } ], "rationale": "An adversary is using sophisticated .NET tradecraft to hijack an Exchange server's mail transport pipeline in memory, using local file markers for command processing and staging encrypted archives of collected emails.", "blind_spots": [ { "id": "module-logging-gaps", "risk": "Without comprehensive module load logging, the primary indicator of Turla's .NET tradecraft is invisible.", "stage": "dotnet-stealth-execution", "question": "whether the unsigned native image loads are observable on all Exchange servers", "requires": "hb_module_activity with Sysmon 7 or advanced EDR telemetry" }, { "id": "vtable-fixup-visibility", "risk": "standard endpoint telemetry will not see the hijacking of internal structures, only the initial injection of the malicious module.", "stage": "mail-pipeline-hijacking", "question": "whether VTable fixups were used to hijack legitimate transport agents without loading a new module", "requires": "Memory forensics or deep process inspection" } ], "scoping_notes": "Focus on Client Access and Edge Transport roles within the Exchange infrastructure. Expand to mailbox servers if data staging is detected.", "beyond_detection": "This is a hunt because standard detection rules often fail to catch .NET native image cache abuse or process injection that mimics legitimate Exchange service behavior. By stack-counting rare unsigned modules and correlating them with local file markers in Exchange paths, an analyst can distinguish an active intrusion from legitimate administrator activity that a single rule might miss or alert on excessively." } }, { "id": "exchange-server-inventory", "type": "query", "label": "Identify potential Exchange servers", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%microsoft exchange server%' OR LOWER(vendor_name) LIKE '%microsoft%exchange%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_software_inventory", "description": "Scope the hunt to hosts running Microsoft Exchange Server or exhibiting mail transport characteristics.", "expected_signal": "A list of hostnames belonging to the Exchange infrastructure. Silence means no Exchange servers were found in the current inventory." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify potential Exchange servers", "reads": [ "package_name", "vendor_name", "device_hostname" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%microsoft exchange server%' OR LOWER(vendor_name) LIKE '%microsoft%exchange%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "A list of hostnames belonging to the Exchange infrastructure. Silence means no Exchange servers were found in the current inventory.", "verified": "dry-run", "verified_at": "2026-11-12" } }, { "id": "rare-unsigned-native-images", "type": "query", "label": "Rare unsigned native images", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT module_path, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_module_activity WHERE module_signed = 'false' AND (LOWER(module_path) LIKE '%\\nativeimages_%' OR LOWER(module_path) LIKE '%\\assembly\\nativeimages%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY module_path HAVING hosts <= 3", "surface": "hb_module_activity", "description": "Stack-count unsigned DLLs loaded from the .NET Native Image cache to find rare execution markers.", "expected_signal": "Unsigned modules in the native image cache that appear on very few hosts. Legitimate Microsoft native images are signed." }, "parents": [ { "id": "exchange-server-inventory" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare unsigned native images", "reads": [ "module_path", "device_hostname", "module_signed", "time" ], "source": "hb_module_activity", "target": "endpoint", "content": "SELECT module_path, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_module_activity WHERE module_signed = 'false' AND (LOWER(module_path) LIKE '%\\nativeimages_%' OR LOWER(module_path) LIKE '%\\assembly\\nativeimages%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY module_path HAVING hosts <= 3", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Unsigned modules in the native image cache that appear on very few hosts. Legitimate Microsoft native images are signed.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "module_path" ], "rare_below": 3 }, "verified_at": "2026-11-12" } }, { "id": "cereal-hermit-command-files", "type": "query", "label": "CerealHermit command and results", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, file_path, file_name, time FROM hb_file_activity WHERE LOWER(file_path) LIKE '%microsoft\\exchange server\\v15%' AND (LOWER(file_name) LIKE '%.dat' OR LOWER(file_name) LIKE '%.bin') AND activity_id IN (1, 3) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_file_activity", "description": "Find encrypted command and result files on disk used by the offline variant of the Cereal backdoor.", "expected_signal": "Creation or modification of data files in Exchange installation directories that do not match known log or configuration schemas." }, "parents": [ { "id": "exchange-server-inventory" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "CerealHermit command and results", "reads": [ "device_hostname", "file_path", "file_name", "time", "activity_id" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_path, file_name, time FROM hb_file_activity WHERE LOWER(file_path) LIKE '%microsoft\\exchange server\\v15%' AND (LOWER(file_name) LIKE '%.dat' OR LOWER(file_name) LIKE '%.bin') AND activity_id IN (1, 3) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "Creation or modification of data files in Exchange installation directories that do not match known log or configuration schemas.", "verified": "dry-run", "verified_at": "2026-11-12" } }, { "id": "triage-early-indicators", "type": "analytic", "label": "Triage early indicators", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "rare-unsigned-native-images", "cereal-hermit-command-files" ], "objective": "Determine if any host shows a combination of rare unsigned .NET native images and suspicious command file markers in Exchange directories.", "description": "Evaluate whether the unsigned module loads and unusual file markers suggest the presence of Turla's stealth tradecraft.", "max_iterations": 3, "expected_signal": "A per-host verdict on whether early stealth indicators are present.", "success_criteria": "A verdict of malicious | suspicious | benign per host based on the correlation of module and file events." }, "parents": [ { "id": "rare-unsigned-native-images", "kind": "merge" }, { "id": "cereal-hermit-command-files", "kind": "merge" } ] }, { "id": "edge-transport-hijack", "type": "query", "label": "EdgeTransport module hijack", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, module_path, module_signed, time FROM hb_module_activity WHERE LOWER(process_name) LIKE '%edgetransport.exe%' AND LOWER(module_path) NOT LIKE '%\\microsoft\\exchange server%' AND LOWER(module_path) NOT LIKE '%\\windows\\assembly%' AND LOWER(module_path) NOT LIKE '%\\windows\\microsoft.net%' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_module_activity", "description": "Identify injection into EdgeTransport.exe, the Exchange service that handles email flow, by finding modules loaded from non-standard paths.", "expected_signal": "A module load into the Exchange transport process from an unexpected path (e.g., ProgramData or a temp directory), indicating potential injection." }, "parents": [ { "id": "triage-early-indicators" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "EdgeTransport module hijack", "reads": [ "device_hostname", "process_name", "module_path", "module_signed", "time" ], "source": "hb_module_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, module_path, module_signed, time FROM hb_module_activity WHERE LOWER(process_name) LIKE '%edgetransport.exe%' AND LOWER(module_path) NOT LIKE '%\\microsoft\\exchange server%' AND LOWER(module_path) NOT LIKE '%\\windows\\assembly%' AND LOWER(module_path) NOT LIKE '%\\windows\\microsoft.net%' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "A module load into the Exchange transport process from an unexpected path (e.g., ProgramData or a temp directory), indicating potential injection.", "verified": "dry-run", "verified_at": "2026-11-12" } }, { "id": "staged-espionage-data", "type": "query", "label": "Staged espionage data", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, actor_user_name, file_path, file_name, time FROM hb_file_activity WHERE (LOWER(file_name) LIKE '%.zip' OR LOWER(file_name) LIKE '%.enc' OR LOWER(file_name) LIKE '%.7z') AND LOWER(file_path) LIKE '%microsoft\\exchange server\\v15%' AND activity_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_file_activity", "description": "Look for the compressed and encrypted files that stage collected emails before exfiltration.", "expected_signal": "Creation of archive files in the Exchange directory, which serves as the staging area for Turla's email collection module." }, "parents": [ { "id": "triage-early-indicators" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Staged espionage data", "reads": [ "device_hostname", "actor_user_name", "file_path", "file_name", "time", "activity_id" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, actor_user_name, file_path, file_name, time FROM hb_file_activity WHERE (LOWER(file_name) LIKE '%.zip' OR LOWER(file_name) LIKE '%.enc' OR LOWER(file_name) LIKE '%.7z') AND LOWER(file_path) LIKE '%microsoft\\exchange server\\v15%' AND activity_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "Creation of archive files in the Exchange directory, which serves as the staging area for Turla's email collection module.", "verified": "dry-run", "verified_at": "2026-11-12" } }, { "id": "triage-full-intrusion", "type": "analytic", "label": "Triage full intrusion", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "triage-early-indicators", "edge-transport-hijack", "staged-espionage-data" ], "objective": "Confirm if hijacking of EdgeTransport.exe and data staging are present, building on the initial stealth indicators.", "description": "Synthesize the module hijacking and data staging evidence with the early-stage read to confirm the compromise.", "max_iterations": 5, "expected_signal": "A detailed verdict per host citing specific hijacks and staged archives.", "success_criteria": "A final verdict citing both the early-stage stealth indicators and the confirmed hijacking evidence." }, "parents": [ { "id": "edge-transport-hijack", "kind": "merge" }, { "id": "staged-espionage-data", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "The triage-full-intrusion verdict is malicious for at least one host, indicating confirmed EdgeTransport hijack or the staging of exfiltration-ready archives.", "condition": "The triage-full-intrusion verdict is malicious for at least one host, indicating confirmed EdgeTransport hijack or the staging of exfiltration-ready archives.", "blind_spot": "module-logging-gaps", "confidence": "high", "description": "Route the hunt based on the agent's confidence in the full-intrusion verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-full-intrusion" } ] }, { "id": "isolate-server", "type": "action", "label": "Isolate Exchange server", "config": { "target": "endpoint", "description": "Halt further email collection and potential exfiltration by isolating the compromised server.", "instructions": "Isolate the compromised host and initiate memory forensics to identify the in-memory hooking of transport agents.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-forensics", "type": "task", "label": "Analyst forensics and review", "config": { "assignee": "analyst", "description": "Manually verify the findings, review the staged data, and determine the extent of the compromise.", "instructions": "Examine the Exchange installation directory for unusual data files. Review the EdgeTransport.exe memory space for injected modules. If archives are found, determine which accounts were targeted for email collection." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-server" } ] }, { "id": "hunt-close-out", "type": "task", "label": "Hunt close out", "config": { "assignee": "analyst", "description": "Finalize the hunt and record findings for future tuning.", "instructions": "Record the results of the hunt. If the EdgeTransport module hijack query was successful, promote it to a standing detection rule." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-forensics" } ] } ] }