{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "VerdantBamboo targets edge appliances as a bridge into cloud and internal environments, using stolen credentials to bypass MFA. A negative result across these critical systems validates the security of the administrative plane."
      },
      "name": "VerdantBamboo Stolen Credential and Pivot Hunt",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1078",
        "attack.t1133",
        "attack.t1059",
        "attack.t1090.003",
        "attack.t1505.003"
      ],
      "series": {
        "slug": "verdantbamboo-just-another-brickstorm-in-the-firewall",
        "index": 2,
        "title": "VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall",
        "total": 2
      },
      "related": [
        {
          "hunt": "verdantbamboo-malware-persistence",
          "reason": "Persistence via cron and BRICKSTORM binary deployment requires file and scheduled task surfaces which are covered in a companion hunt.",
          "relation": "out-of-scope-alternative"
        },
        {
          "hunt": "verdantbamboo-edge-appliance-post-exploitation",
          "relation": "follows"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "This is a hunt because a single 'admin login' alert is too noisy for storage appliances. We combine scoping of specific vulnerable appliance types with a stack-count of source IPs and identifying specific web management URIs to differentiate actor behavior from MSP maintenance.",
      "coverage": [
        {
          "stage": "initial-access-stolen-appliance-credentials",
          "steps": [
            "rare-admin-auth-sources",
            "triage-appliance-access"
          ],
          "status": "covered"
        },
        {
          "stage": "lateral-movement-and-nas-compromise",
          "steps": [
            "appliance-management-web-access",
            "triage-appliance-access"
          ],
          "status": "covered"
        },
        {
          "stage": "local-privilege-escalation-sudo-tee",
          "reason": "Belongs to another part of the 'VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "persistence-via-scheduled-cron",
          "reason": "Belongs to another part of the 'VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "malware-deployment-brickstorm-agentpsd",
          "reason": "Belongs to another part of the 'VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "c2-proxying-via-doh-and-cloudflare",
          "reason": "Belongs to another part of the 'VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Access via Stolen Appliance Credentials",
            "slug": "initial-access-stolen-appliance-credentials",
            "tactic": "initial-access",
            "techniques": [
              "T1078",
              "T1133"
            ],
            "observables": [
              "egnyteservice",
              "SSH logins to Egnyte Storage Sync",
              "VPN IP address source for administrative logins"
            ]
          },
          {
            "name": "Local Privilege Escalation via Sudo Tee",
            "slug": "local-privilege-escalation-sudo-tee",
            "tactic": "privilege-escalation",
            "techniques": [
              "T1059"
            ],
            "observables": [
              "sudo /usr/bin/tee",
              "/usr/local/bin/egnyte/rsync_data_migration.sh",
              "/usr/bin/systemctl restart networking"
            ]
          },
          {
            "name": "Persistence via Scheduled Cron Jobs",
            "slug": "persistence-via-scheduled-cron",
            "tactic": "persistence",
            "techniques": [
              "T1059"
            ],
            "observables": [
              "/etc/cron.d/ssync",
              "/home/egnyteservice/ssync.sh",
              "/etc/crontab entry for egnyte_host_monitor_client",
              "/etc/rc.d/cron modification on pfSense"
            ]
          },
          {
            "name": "Deployment of BRICKSTORM and AGENTPSD",
            "slug": "malware-deployment-brickstorm-agentpsd",
            "tactic": "execution",
            "techniques": [
              "T1059",
              "T1505.003"
            ],
            "observables": [
              "/usr/sbin/ (BRICKSTORM directory)",
              "/usr/local/bin/egnyte/egnyte_host_monitor_client",
              "/usr/local/libexec/ipsec/blacklist"
            ]
          },
          {
            "name": "C2 and Proxying via DoH and Cloudflare",
            "slug": "c2-proxying-via-doh-and-cloudflare",
            "tactic": "command-and-control",
            "techniques": [
              "T1071",
              "T1090.003"
            ],
            "observables": [
              "8.8.8.8:443",
              "TLS connections to Google Public DNS",
              "Cloudflare IP addresses",
              "M365 access via internal proxy traffic"
            ]
          },
          {
            "name": "Lateral Movement to Synology NAS",
            "slug": "lateral-movement-and-nas-compromise",
            "tactic": "lateral-movement",
            "techniques": [
              "T1078",
              "T1133"
            ],
            "observables": [
              "Synology NAS web interface admin logins",
              "PLENET malware deployment",
              "SSH enabled via web interface"
            ]
          }
        ],
        "summary": "VerdantBamboo compromised an MSP to obtain administrative credentials, which were then used to breach edge appliances including Egnyte Storage Sync, pfSense firewalls, and Synology NAS systems. The actor deployed BRICKSTORM and AGENTPSD malware to establish persistence and create proxy tunnels into internal networks and Microsoft 365 environments, effectively bypassing conditional access policies by appearing as internal traffic."
      },
      "severity": "high",
      "rationale": "Start by identifying all Egnyte Storage Sync and Synology NAS systems using software inventory. Focus on administrative subnets and systems where administrative interfaces are exposed to the VPN network or public internet.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has used stolen administrative or service account credentials to access edge appliances via VPN or SSH, subsequently using web-based management interfaces to pivot further or deploy persistence.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "analyst-scoping",
            "kind": "manual",
            "observed": "2026-06-04"
          },
          "type": "list[host]",
          "default": [],
          "description": "Optional: List of storage appliance hostnames to focus the hunt; leave empty for whole estate."
        },
        "target_users": {
          "from": {
            "ref": "Volexity VERDANTBAMBOO",
            "kind": "article",
            "observed": "2026-06-04"
          },
          "type": "list[string]",
          "default": [
            "egnyteservice",
            "admin",
            "root"
          ],
          "description": "Administrative and service accounts targeted in this campaign."
        },
        "lookback_days": {
          "from": {
            "ref": "standard-lookback",
            "kind": "manual",
            "observed": "2026-06-04"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine for authentication and web activity."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.volexity.com/blog/2026/06/04/verdantbamboo-just-another-brickstorm-in-the-firewall/",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.volexity.com/blog/2026/06/04/verdantbamboo-just-another-brickstorm-in-the-firewall/",
          "name": "Volexity \u2014 VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall"
        }
      ],
      "blind_spots": [
        {
          "id": "missing-appliance-telemetry",
          "risk": "Without process telemetry from the NAS itself, we rely on HTTP logs to see the activity, which may miss command execution if it occurs outside the web interface.",
          "stage": "lateral-movement-and-nas-compromise",
          "question": "whether commands were executed on the appliance after the web login",
          "requires": "EDR agent or Syslog from the storage appliance"
        },
        {
          "id": "vpn-source-anonymity",
          "risk": "If hb_auth_signin logs only the internal VPN IP, we cannot distinguish between a compromised employee and a compromised MSP user without joining to external VPN gateway logs.",
          "stage": "initial-access-stolen-appliance-credentials",
          "question": "which external actor is tied to an internal IP in the sign-in logs",
          "requires": "VPN session logs correlated with internal IP assignments"
        }
      ]
    },
    "name": "VerdantBamboo Stolen Credential and Pivot Hunt",
    "description": "This hunt identifies VerdantBamboo tradecraft focusing on edge appliances like Egnyte Storage Sync and Synology NAS. The actor uses compromised credentials for the egnyteservice account and other administrative logins, often bypassing MFA by connecting through established VPN tunnels. The hunt first scopes the environment for these appliances using software inventory, then fans out to stack-count authentication source IPs and investigate suspicious web-based management activity. An agent correlates these signals to identify lateral movement or unauthorized appliance configuration."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "verdantbamboo-just-another-brickstorm-in-the-firewall",
          "index": 2,
          "title": "VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall",
          "total": 2
        },
        "coverage": [
          {
            "stage": "initial-access-stolen-appliance-credentials",
            "steps": [
              "rare-admin-auth-sources",
              "triage-appliance-access"
            ],
            "status": "covered"
          },
          {
            "stage": "lateral-movement-and-nas-compromise",
            "steps": [
              "appliance-management-web-access",
              "triage-appliance-access"
            ],
            "status": "covered"
          },
          {
            "stage": "local-privilege-escalation-sudo-tee",
            "reason": "Belongs to another part of the 'VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "persistence-via-scheduled-cron",
            "reason": "Belongs to another part of the 'VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "malware-deployment-brickstorm-agentpsd",
            "reason": "Belongs to another part of the 'VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "c2-proxying-via-doh-and-cloudflare",
            "reason": "Belongs to another part of the 'VERDANTBAMBOO: Just Another BRICKSTORM in the Firewall' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary has used stolen administrative or service account credentials to access edge appliances via VPN or SSH, subsequently using web-based management interfaces to pivot further or deploy persistence.",
        "blind_spots": [
          {
            "id": "missing-appliance-telemetry",
            "risk": "Without process telemetry from the NAS itself, we rely on HTTP logs to see the activity, which may miss command execution if it occurs outside the web interface.",
            "stage": "lateral-movement-and-nas-compromise",
            "question": "whether commands were executed on the appliance after the web login",
            "requires": "EDR agent or Syslog from the storage appliance"
          },
          {
            "id": "vpn-source-anonymity",
            "risk": "If hb_auth_signin logs only the internal VPN IP, we cannot distinguish between a compromised employee and a compromised MSP user without joining to external VPN gateway logs.",
            "stage": "initial-access-stolen-appliance-credentials",
            "question": "which external actor is tied to an internal IP in the sign-in logs",
            "requires": "VPN session logs correlated with internal IP assignments"
          }
        ],
        "scoping_notes": "Start by identifying all Egnyte Storage Sync and Synology NAS systems using software inventory. Focus on administrative subnets and systems where administrative interfaces are exposed to the VPN network or public internet.",
        "beyond_detection": "This is a hunt because a single 'admin login' alert is too noisy for storage appliances. We combine scoping of specific vulnerable appliance types with a stack-count of source IPs and identifying specific web management URIs to differentiate actor behavior from MSP maintenance."
      }
    },
    {
      "id": "scope-appliances",
      "type": "query",
      "label": "Scope storage and firewall appliances",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, package_name, vendor_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%egnyte%' OR LOWER(package_name) LIKE '%synology%' OR LOWER(package_name) LIKE '%pfsense%' OR LOWER(vendor_name) LIKE '%egnyte%' OR LOWER(vendor_name) LIKE '%synology%')",
        "surface": "hb_software_inventory",
        "description": "Identify hosts running software associated with the targeted appliances to focus subsequent queries.",
        "expected_signal": "A list of hostnames belonging to storage or firewall appliances. If empty, the hunt can still run but will lack specific appliance context."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Scope storage and firewall appliances",
        "reads": [
          "device_hostname",
          "package_name",
          "package_version",
          "vendor_name"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT device_hostname, package_name, vendor_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%egnyte%' OR LOWER(package_name) LIKE '%synology%' OR LOWER(package_name) LIKE '%pfsense%' OR LOWER(vendor_name) LIKE '%egnyte%' OR LOWER(vendor_name) LIKE '%synology%')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames belonging to storage or firewall appliances. If empty, the hunt can still run but will lack specific appliance context.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "rare-admin-auth-sources",
      "type": "query",
      "label": "Rare admin authentication sources",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "identity",
        "content": "SELECT src_endpoint_ip, actor_user_name, COUNT(DISTINCT dst_endpoint_name) AS host_count, COUNT(*) AS login_total, MIN(time) AS first_login, MAX(time) AS last_login FROM hb_auth_signin WHERE (instr(',' || '{{target_users}}' || ',', ',' || LOWER(actor_user_name) || ',') > 0) AND status_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip, actor_user_name HAVING host_count <= 2 ORDER BY host_count ASC",
        "surface": "hb_auth_signin",
        "description": "Stack-count source IPs for administrative logins to find external or rare actors.",
        "expected_signal": "Administrative logins from a source IP seen on only one or two hosts. This isolates potentially malicious VPN or SSH access from legitimate broad MSP usage."
      },
      "parents": [
        {
          "id": "scope-appliances"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare admin authentication sources",
        "reads": [
          "actor_user_name",
          "dst_endpoint_name",
          "src_endpoint_ip",
          "status_id",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT src_endpoint_ip, actor_user_name, COUNT(DISTINCT dst_endpoint_name) AS host_count, COUNT(*) AS login_total, MIN(time) AS first_login, MAX(time) AS last_login FROM hb_auth_signin WHERE (instr(',' || '{{target_users}}' || ',', ',' || LOWER(actor_user_name) || ',') > 0) AND status_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip, actor_user_name HAVING host_count <= 2 ORDER BY host_count ASC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Administrative logins from a source IP seen on only one or two hosts. This isolates potentially malicious VPN or SSH access from legitimate broad MSP usage.",
        "verified": "dry-run",
        "prevalence": {
          "by": "dst_endpoint_name",
          "key": [
            "src_endpoint_ip"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "appliance-management-web-access",
      "type": "query",
      "label": "Appliance management web access",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "web",
        "content": "SELECT device_hostname, url_path, src_endpoint_ip, user_agent, time FROM hb_http_activity WHERE (LOWER(url_path) LIKE '%/webman/%' OR LOWER(url_path) LIKE '%/syno/%' OR LOWER(url_path) LIKE '%/egnyte/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_http_activity",
        "description": "Detect access to administrative web paths on storage appliances.",
        "expected_signal": "Direct access to management URLs. Unauthorized source IPs accessing these paths suggests an actor is reconfiguring the device via the web interface."
      },
      "parents": [
        {
          "id": "scope-appliances"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Appliance management web access",
        "reads": [
          "device_hostname",
          "src_endpoint_ip",
          "time",
          "url_path",
          "user_agent"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_path, src_endpoint_ip, user_agent, time FROM hb_http_activity WHERE (LOWER(url_path) LIKE '%/webman/%' OR LOWER(url_path) LIKE '%/syno/%' OR LOWER(url_path) LIKE '%/egnyte/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Direct access to management URLs. Unauthorized source IPs accessing these paths suggests an actor is reconfiguring the device via the web interface.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "triage-appliance-access",
      "type": "analytic",
      "label": "Triage appliance access",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "web"
        ],
        "context": [
          "scope-appliances",
          "rare-admin-auth-sources",
          "appliance-management-web-access"
        ],
        "objective": "Determine if any host shows evidence of administrative credential abuse from a rare source IP followed by web-based reconfiguration or SSH access.",
        "description": "Analyze the scope, authentication prevalence, and web activity together to find the lateral movement chain.",
        "max_iterations": 4,
        "expected_signal": "A per-host verdict citing specific authentication events and web management requests.",
        "success_criteria": "A verdict of malicious | suspicious | benign per host, citing the specific rows from auth and http activity."
      },
      "parents": [
        {
          "id": "rare-admin-auth-sources",
          "kind": "merge"
        },
        {
          "id": "appliance-management-web-access",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious for at least one host showing both a rare authentication source and web management access",
        "condition": "the triage verdict is malicious for at least one host showing both a rare authentication source and web management access",
        "blind_spot": "missing-appliance-telemetry",
        "confidence": "high",
        "description": "Route the hunt based on the agent's judgement.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-appliance-access"
        }
      ]
    },
    {
      "id": "contain-host",
      "type": "action",
      "label": "Isolate appliance",
      "config": {
        "target": "endpoint",
        "description": "Stop the adversary's lateral movement by isolating the compromised storage or firewall device.",
        "instructions": "Isolate the identified appliance hostname. Rotate passwords for egnyteservice and administrative accounts. Terminate all active VPN and SSH sessions associated with these accounts.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "forensic-verification",
      "type": "task",
      "label": "Forensic verification",
      "config": {
        "assignee": "analyst",
        "description": "Verify the presence of PLENET or AGENTPSD implants as described in the research.",
        "instructions": "Perform forensic analysis on the isolated appliance. Search for the PLENET backdoor or AGENTPSD (Python reverse shell). Check /usr/sbin, /home/egnyteservice, and /etc/crontab for unauthorized modifications. Review sudoers for the tee privilege escalation vulnerability."
      },
      "parents": [
        {
          "id": "contain-host"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst review",
      "config": {
        "assignee": "analyst",
        "description": "Record findings and confirm the verdict.",
        "instructions": "Review the agent's triage and forensic findings. Verify if the source IPs for the SSH/VPN logins match known MSP infrastructure. Document any discovered indicators for the broader SOC and close out the hunt."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "forensic-verification"
        }
      ]
    }
  ]
}