{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Edge appliances are frequently targeted by state actors because they often lack standard endpoint security and provide a stable pivot into corporate networks and M365 environments."
      },
      "name": "VERDANTBAMBOO Edge Appliance Post-Exploitation",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1059.004",
        "attack.t1078",
        "attack.t1548.003",
        "attack.t1053.003",
        "attack.t1071.001",
        "attack.t1090.003"
      ],
      "series": {
        "slug": "verdantbamboo-just-another-brickstorm-in-the-firewall",
        "index": 1,
        "title": "VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall",
        "total": 2
      },
      "related": [
        {
          "hunt": "lateral-movement-and-nas-compromise",
          "reason": "This hunt identifies the initial appliance compromise; the follow-on lateral movement to Synology NAS and ESXi is handled in the next hunt.",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "This hunt contextually joins privilege escalation, rare binary deployment, and the specific use of DoH to confirm the VerdantBamboo attack chain. A single detection rule on sudo tee or network connections to 8.8.8.8 would generate excessive noise without the multi-surface correlation used here.",
      "coverage": [
        {
          "stage": "local-privilege-escalation-sudo-tee",
          "steps": [
            "sudo-tee-write"
          ],
          "status": "covered"
        },
        {
          "stage": "persistence-via-scheduled-cron",
          "steps": [
            "cron-persistence-check"
          ],
          "status": "covered"
        },
        {
          "stage": "malware-deployment-brickstorm-agentpsd",
          "steps": [
            "rare-appliance-binaries"
          ],
          "status": "covered"
        },
        {
          "stage": "c2-proxying-via-doh-and-cloudflare",
          "steps": [
            "doh-c2-check"
          ],
          "status": "covered"
        },
        {
          "stage": "initial-access-stolen-appliance-credentials",
          "reason": "Belongs to another part of the 'VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "lateral-movement-and-nas-compromise",
          "reason": "Belongs to another part of the 'VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Access via Stolen Appliance Credentials",
            "slug": "initial-access-stolen-appliance-credentials",
            "tactic": "initial-access",
            "techniques": [
              "T1078",
              "T1133"
            ],
            "observables": [
              "egnyteservice",
              "SSH logins to Egnyte Storage Sync",
              "VPN IP address source for administrative logins"
            ]
          },
          {
            "name": "Local Privilege Escalation via Sudo Tee",
            "slug": "local-privilege-escalation-sudo-tee",
            "tactic": "privilege-escalation",
            "techniques": [
              "T1059"
            ],
            "observables": [
              "sudo /usr/bin/tee",
              "/usr/local/bin/egnyte/rsync_data_migration.sh",
              "/usr/bin/systemctl restart networking"
            ]
          },
          {
            "name": "Persistence via Scheduled Cron Jobs",
            "slug": "persistence-via-scheduled-cron",
            "tactic": "persistence",
            "techniques": [
              "T1059"
            ],
            "observables": [
              "/etc/cron.d/ssync",
              "/home/egnyteservice/ssync.sh",
              "/etc/crontab entry for egnyte_host_monitor_client",
              "/etc/rc.d/cron modification on pfSense"
            ]
          },
          {
            "name": "Deployment of BRICKSTORM and AGENTPSD",
            "slug": "malware-deployment-brickstorm-agentpsd",
            "tactic": "execution",
            "techniques": [
              "T1059",
              "T1505.003"
            ],
            "observables": [
              "/usr/sbin/ (BRICKSTORM directory)",
              "/usr/local/bin/egnyte/egnyte_host_monitor_client",
              "/usr/local/libexec/ipsec/blacklist"
            ]
          },
          {
            "name": "C2 and Proxying via DoH and Cloudflare",
            "slug": "c2-proxying-via-doh-and-cloudflare",
            "tactic": "command-and-control",
            "techniques": [
              "T1071",
              "T1090.003"
            ],
            "observables": [
              "8.8.8.8:443",
              "TLS connections to Google Public DNS",
              "Cloudflare IP addresses",
              "M365 access via internal proxy traffic"
            ]
          },
          {
            "name": "Lateral Movement to Synology NAS",
            "slug": "lateral-movement-and-nas-compromise",
            "tactic": "lateral-movement",
            "techniques": [
              "T1078",
              "T1133"
            ],
            "observables": [
              "Synology NAS web interface admin logins",
              "PLENET malware deployment",
              "SSH enabled via web interface"
            ]
          }
        ],
        "summary": "VerdantBamboo compromised an MSP to obtain administrative credentials, which were then used to breach edge appliances including Egnyte Storage Sync, pfSense firewalls, and Synology NAS systems. The actor deployed BRICKSTORM and AGENTPSD malware to establish persistence and create proxy tunnels into internal networks and Microsoft 365 environments, effectively bypassing conditional access policies by appearing as internal traffic."
      },
      "severity": "high",
      "rationale": "Focus on Linux and BSD hosts identified as Storage Sync or pfSense appliances. Use the user_name 'egnyteservice' as a high-fidelity anchor for Storage Sync virtual machines.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary compromises an edge appliance, uses an inadvertent sudo configuration to escalate to root, and creates persistence via cron to tunnel traffic through DNS-over-HTTPS.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "List of specific appliances to hunt; leave empty to scan the full estate."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "google_dns_ips": {
          "from": {
            "ref": "https://www.volexity.com/blog/2026/06/04/verdantbamboo-just-another-brickstorm-in-the-firewall/",
            "kind": "article",
            "observed": "2026-06-04"
          },
          "type": "list[ip]",
          "default": [
            "8.8.8.8",
            "8.8.4.4"
          ],
          "description": "Google Public DNS IPs used for DNS-over-HTTPS tunneling."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.volexity.com/blog/2026/06/04/verdantbamboo-just-another-brickstorm-in-the-firewall/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.volexity.com/blog/2026/06/04/verdantbamboo-just-another-brickstorm-in-the-firewall/",
          "name": "Volexity \u2014 VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall"
        }
      ],
      "blind_spots": [
        {
          "id": "no-appliance-telemetry",
          "risk": "An unmanaged or legacy appliance could host the BRICKSTORM proxy without any behavioral telemetry reaching our surfaces.",
          "question": "whether a compromised appliance exists if it does not report to our EDR",
          "requires": "endpoint agent coverage on third-party appliances"
        },
        {
          "id": "encrypted-doh-traffic",
          "risk": "We can identify traffic to Google DNS but cannot verify the specific C2 domain without decrypting the HTTPS session, potentially leading to false positives if DoH is used for legitimate purposes.",
          "stage": "c2-proxying-via-doh-and-cloudflare",
          "question": "what domain is being resolved via DNS-over-HTTPS",
          "requires": "TLS inspection or proxy logs with URI visibility"
        }
      ]
    },
    "name": "VERDANTBAMBOO Edge Appliance Post-Exploitation",
    "description": "This hunt follows the tradecraft of VerdantBamboo on edge appliances like Egnyte Storage Sync and pfSense firewalls. The hunt identifies appliances and searches for high-fidelity privilege escalation via sudo tee abuse. It then corroborates these findings with rare binaries in system directories, persistence in cron configurations, and command-and-control traffic created via DNS-over-HTTPS (DoH) to Google Public DNS. This phased approach ensures that later network behaviors are evaluated in the context of early-stage compromise indicators."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "verdantbamboo-just-another-brickstorm-in-the-firewall",
          "index": 1,
          "title": "VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall",
          "total": 2
        },
        "coverage": [
          {
            "stage": "local-privilege-escalation-sudo-tee",
            "steps": [
              "sudo-tee-write"
            ],
            "status": "covered"
          },
          {
            "stage": "persistence-via-scheduled-cron",
            "steps": [
              "cron-persistence-check"
            ],
            "status": "covered"
          },
          {
            "stage": "malware-deployment-brickstorm-agentpsd",
            "steps": [
              "rare-appliance-binaries"
            ],
            "status": "covered"
          },
          {
            "stage": "c2-proxying-via-doh-and-cloudflare",
            "steps": [
              "doh-c2-check"
            ],
            "status": "covered"
          },
          {
            "stage": "initial-access-stolen-appliance-credentials",
            "reason": "Belongs to another part of the 'VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "lateral-movement-and-nas-compromise",
            "reason": "Belongs to another part of the 'VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary compromises an edge appliance, uses an inadvertent sudo configuration to escalate to root, and creates persistence via cron to tunnel traffic through DNS-over-HTTPS.",
        "blind_spots": [
          {
            "id": "no-appliance-telemetry",
            "risk": "An unmanaged or legacy appliance could host the BRICKSTORM proxy without any behavioral telemetry reaching our surfaces.",
            "question": "whether a compromised appliance exists if it does not report to our EDR",
            "requires": "endpoint agent coverage on third-party appliances"
          },
          {
            "id": "encrypted-doh-traffic",
            "risk": "We can identify traffic to Google DNS but cannot verify the specific C2 domain without decrypting the HTTPS session, potentially leading to false positives if DoH is used for legitimate purposes.",
            "stage": "c2-proxying-via-doh-and-cloudflare",
            "question": "what domain is being resolved via DNS-over-HTTPS",
            "requires": "TLS inspection or proxy logs with URI visibility"
          }
        ],
        "scoping_notes": "Focus on Linux and BSD hosts identified as Storage Sync or pfSense appliances. Use the user_name 'egnyteservice' as a high-fidelity anchor for Storage Sync virtual machines.",
        "beyond_detection": "This hunt contextually joins privilege escalation, rare binary deployment, and the specific use of DoH to confirm the VerdantBamboo attack chain. A single detection rule on sudo tee or network connections to 8.8.8.8 would generate excessive noise without the multi-surface correlation used here."
      }
    },
    {
      "id": "scoping-appliances",
      "type": "query",
      "label": "Identify edge appliances and appliance users",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT device_hostname FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%egnyte%' OR LOWER(process_path) LIKE '%pfsense%' OR LOWER(process_path) LIKE '%synology%' OR LOWER(user_name) = 'egnyteservice') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Identify Linux-based appliances and default service accounts that are targets for VerdantBamboo.",
        "expected_signal": "A list of hostnames belonging to network or storage appliances. Silence suggests these devices are not reporting telemetry."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify edge appliances and appliance users",
        "reads": [
          "device_hostname",
          "process_path",
          "time",
          "user_name"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT DISTINCT device_hostname FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%egnyte%' OR LOWER(process_path) LIKE '%pfsense%' OR LOWER(process_path) LIKE '%synology%' OR LOWER(user_name) = 'egnyteservice') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames belonging to network or storage appliances. Silence suggests these devices are not reporting telemetry.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "sudo-tee-write",
      "type": "query",
      "label": "Sudo tee abuse for system path writes",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND LOWER(process_cmd_line) LIKE '%sudo %' AND LOWER(process_cmd_line) LIKE '%tee %' AND (LOWER(process_cmd_line) LIKE '%/etc/%' OR LOWER(process_cmd_line) LIKE '%/usr/%' OR LOWER(process_cmd_line) LIKE '%/bin/%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Find instances where sudo tee was used to write to protected directories, matching the Egnyte appliance LPE technique.",
        "expected_signal": "Command lines where an unprivileged user writes to system configuration or binary paths. Silence proof of absence for this specific command pattern."
      },
      "parents": [
        {
          "id": "scoping-appliances"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Sudo tee abuse for system path writes",
        "reads": [
          "device_hostname",
          "process_cmd_line",
          "time",
          "user_name"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND LOWER(process_cmd_line) LIKE '%sudo %' AND LOWER(process_cmd_line) LIKE '%tee %' AND (LOWER(process_cmd_line) LIKE '%/etc/%' OR LOWER(process_cmd_line) LIKE '%/usr/%' OR LOWER(process_cmd_line) LIKE '%/bin/%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Command lines where an unprivileged user writes to system configuration or binary paths. Silence proof of absence for this specific command pattern.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "rare-appliance-binaries",
      "type": "query",
      "label": "Rare processes in appliance system directories",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_path) LIKE '/usr/sbin/%' OR LOWER(process_path) LIKE '/usr/local/libexec/%' OR LOWER(process_path) LIKE '/home/egnyteservice/%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY path HAVING hosts <= 2",
        "surface": "hb_process_activity",
        "description": "Stack-count processes running from system directories to identify one-off implants.",
        "expected_signal": "Binaries running from protected system paths that appear on very few hosts. Silence is evidence of absence for these specific paths."
      },
      "parents": [
        {
          "id": "scoping-appliances"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare processes in appliance system directories",
        "reads": [
          "device_hostname",
          "process_path",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_path) LIKE '/usr/sbin/%' OR LOWER(process_path) LIKE '/usr/local/libexec/%' OR LOWER(process_path) LIKE '/home/egnyteservice/%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY path HAVING hosts <= 2",
        "silence": "evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Binaries running from protected system paths that appear on very few hosts. Silence is evidence of absence for these specific paths.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "path"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "agent-early-triage",
      "type": "analytic",
      "label": "Triage early compromise evidence",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "sudo-tee-write",
          "rare-appliance-binaries"
        ],
        "objective": "Assess whether any appliance shows signs of both privilege escalation (sudo tee) and rare binary execution in system directories.",
        "description": "Evaluate if sudo abuse and rare binary activity on the same host indicate a compromised edge appliance.",
        "max_iterations": 4,
        "expected_signal": "A per-host verdict linking the escalation method to the executed malware.",
        "success_criteria": "A list of potentially compromised hosts citing process and command line rows."
      },
      "parents": [
        {
          "id": "sudo-tee-write",
          "kind": "merge"
        },
        {
          "id": "rare-appliance-binaries",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "cron-persistence-check",
      "type": "query",
      "label": "Scheduled cron persistence for implants",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_hostname, job_cmd_line, job_definition_path, time FROM hb_scheduled_job WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(job_cmd_line) LIKE '/home/%' OR LOWER(job_cmd_line) LIKE '/tmp/%' OR LOWER(job_cmd_line) LIKE '/var/tmp/%' OR LOWER(job_cmd_line) LIKE '/usr/local/bin/egnyte/%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_scheduled_job",
        "description": "Find cron jobs pointing to world-writable or user-controlled paths identified in earlier stages.",
        "expected_signal": "Cron jobs defined in system paths that execute user-mode scripts or binaries in non-standard directories."
      },
      "parents": [
        {
          "id": "agent-early-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Scheduled cron persistence for implants",
        "reads": [
          "device_hostname",
          "job_cmd_line",
          "job_definition_path",
          "time"
        ],
        "source": "hb_scheduled_job",
        "target": "endpoint",
        "content": "SELECT device_hostname, job_cmd_line, job_definition_path, time FROM hb_scheduled_job WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(job_cmd_line) LIKE '/home/%' OR LOWER(job_cmd_line) LIKE '/tmp/%' OR LOWER(job_cmd_line) LIKE '/var/tmp/%' OR LOWER(job_cmd_line) LIKE '/usr/local/bin/egnyte/%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Cron jobs defined in system paths that execute user-mode scripts or binaries in non-standard directories.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "doh-c2-check",
      "type": "query",
      "label": "DNS-over-HTTPS to Google Public DNS",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "network",
        "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{google_dns_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND dst_endpoint_port = 443 AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_network_connection",
        "description": "Detect network connections on port 443 to Google Public DNS, matching the BRICKSTORM DoH proxying pattern, limited to scoped appliances.",
        "expected_signal": "Any scoped appliance initiating HTTPS traffic directly to Google DNS IPs. Silence suggests this specific C2 method is not in use."
      },
      "parents": [
        {
          "id": "agent-early-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "DNS-over-HTTPS to Google Public DNS",
        "reads": [
          "device_hostname",
          "dst_endpoint_ip",
          "dst_endpoint_port",
          "process_name",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{google_dns_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND dst_endpoint_port = 443 AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Any scoped appliance initiating HTTPS traffic directly to Google DNS IPs. Silence suggests this specific C2 method is not in use.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "agent-follow-on-triage",
      "type": "analytic",
      "label": "Follow-on compromise analysis",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "agent-early-triage",
          "cron-persistence-check",
          "doh-c2-check"
        ],
        "objective": "Identify hosts that exhibit the full chain of VerdantBamboo post-exploitation activity by weighing early triage findings against cron persistence and DoH traffic.",
        "description": "Assess the full attack chain including persistence and C2 to provide a definitive verdict.",
        "max_iterations": 6,
        "expected_signal": "Confirmation of compromise for specific hosts with the complete chain documented.",
        "success_criteria": "A per-host verdict of malicious | suspicious | benign, citing rows from all involved steps."
      },
      "parents": [
        {
          "id": "cron-persistence-check",
          "kind": "merge"
        },
        {
          "id": "doh-c2-check",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "The agent identifies at least one host as malicious or suspicious with evidence of the attack chain.",
        "condition": "The agent identifies at least one host as malicious or suspicious with evidence of the attack chain.",
        "blind_spot": "no-appliance-telemetry",
        "confidence": "high",
        "description": "Route the hunt based on the agent's full-chain analysis.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "agent-follow-on-triage"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate compromised appliance",
      "config": {
        "target": "endpoint",
        "description": "Prevent further C2 proxying or lateral movement by isolating the identified appliance.",
        "instructions": "Isolate the compromised edge appliance and revoke any active administrative sessions. Collect logs from the appliance local file system before remediation.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-remediation",
      "type": "task",
      "label": "Analyst remediation and forensics",
      "config": {
        "assignee": "analyst",
        "description": "Manually verify the findings and search for lateral movement aftermath.",
        "instructions": "Review the identified malicious rows. Verify if the host performed internal lateral movement via SSH or accessed M365 environments via proxy traffic. Identify the source of the initial appliance login."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "final-close-out",
      "type": "task",
      "label": "Final close out",
      "config": {
        "assignee": "analyst",
        "description": "Record findings and determine if this hunt should be recurring.",
        "instructions": "Document the findings, including any gaps in appliance logging or agent coverage. Recommend updating sudoers policies on similar appliances."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-remediation"
        }
      ]
    }
  ]
}