{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The adversary exploits PAN-OS vulnerabilities to breach the perimeter, directly threatening critical virtualization and backup assets. A negative result across these high-value systems provides the business with assurance that the most impactful stages of a ransomware campaign are not currently active." }, "name": "Virtualization Pivot and Host Encryption", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1021.001", "attack.t1562.001", "attack.t1003", "attack.t1046", "attack.t1486", "credential access", "defense evasion", "discovery", "impact", "initial access", "lateral movement", "persistence" ], "series": { "slug": "threat-brief-active-exploitation-of-pan-os-cve-2026-0257-updated-october-19", "index": 2, "title": "Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)", "total": 2 }, "related": [ { "hunt": "initial-access-pan-os-exploit", "reason": "Initial access occurs via the PAN-OS VPN gateway before the virtualization pivot.", "relation": "precedes" }, { "hunt": "vpn-gateway-exploitation-unauthorized-auth", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A single detection rule cannot distinguish between administrative maintenance and a coordinated ransomware pivot to the hypervisor. This hunt joins early reconnaissance tools with lateral movement toward virtualization management and follow-on hypervisor configuration changes, providing the context necessary to confirm a sophisticated multi-stage intrusion.", "coverage": [ { "stage": "lateral-movement-vcenter-pivot", "steps": [ "infrastructure-pivots" ], "status": "covered" }, { "stage": "defense-evasion-esxi-security", "steps": [ "esxi-security-changes" ], "status": "covered" }, { "stage": "credential-access-offline-vmdk", "steps": [ "identify-vulnerable-targets", "vmdk-offline-access" ], "status": "covered" }, { "stage": "discovery-rmm-recon", "steps": [ "rare-rmm-activity" ], "status": "covered" }, { "stage": "impact-ransomware-encryption", "steps": [ "ransomware-impact" ], "status": "covered" }, { "stage": "initial-access-pan-os-exploit", "reason": "Belongs to another part of the 'Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)' series.", "status": "out_of_scope" }, { "stage": "unauthorized-vpn-persistence", "reason": "Belongs to another part of the 'Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "PAN-OS GlobalProtect Exploitation", "slug": "initial-access-pan-os-exploit", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "CVE-2026-0257", "23.128.228.6", "104.207.144.154", "146.19.216.119", "146.19.216.120", "146.19.216.125", "179.43.172.213", "185.195.232.139", "198.12.106.60", "202.144.192.47" ] }, { "name": "Unauthorized VPN Session Establishment", "slug": "unauthorized-vpn-persistence", "tactic": "persistence", "techniques": [ "T1133" ], "observables": [ "aa:bb:cc:dd:ee:ff", "00:11:22:33:44:55", "WINDOWS-LAPTOP-001", "DESKTOP-GP01", "GP-CLIENT", "Microsoft Windows 10 Pro 64-bit" ] }, { "name": "Pivot to Virtualization Layer", "slug": "lateral-movement-vcenter-pivot", "tactic": "lateral-movement", "techniques": [ "T1021.001" ], "observables": [ "RDP to vCenter management appliance", "SMB lateral movement" ] }, { "name": "Disabling ESXi Security Controls", "slug": "defense-evasion-esxi-security", "tactic": "defense-evasion", "techniques": [ "T1562.001" ], "observables": [ "execInstalledOnly disabled on ESXi hypervisors" ] }, { "name": "Offline Virtual Disk Credential Dumping", "slug": "credential-access-offline-vmdk", "tactic": "credential-access", "techniques": [ "T1003" ], "observables": [ "Custom tool for VMDK dumping", "Dumping Domain Controller virtual disks", "CVE-2023-27532", "Veeam backup infrastructure exploitation" ] }, { "name": "Internal Reconnaissance with RMM", "slug": "discovery-rmm-recon", "tactic": "discovery", "techniques": [ "T1046" ], "observables": [ "Dual-use RMM tools" ] }, { "name": "Data Encryption for Impact", "slug": "impact-ransomware-encryption", "tactic": "impact", "techniques": [ "T1486" ], "observables": [ "Qilin ransomware", "Inc ransomware", "Settra ransomware" ] } ], "summary": "Ransomware operators including Qilin and Inc exploit CVE-2026-0257 to bypass authentication on Palo Alto Networks GlobalProtect gateways, establishing unauthorized VPN sessions. Attackers then pivot to the virtualization layer (vCenter/ESXi) to disable security controls and perform offline credential dumping against domain controller virtual disks before deploying ransomware." }, "severity": "critical", "rationale": "Focus on servers, domain controllers, and backup infrastructure (Veeam). Use the vulnerability scoping step to identify the most likely beachheads before fanning out.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "The adversary has exploited a VPN gateway to breach the perimeter and is now pivoting to the virtualization layer to disable security controls and deploy ransomware via virtual disk manipulation.", "parameters": { "rmm_tools": { "from": { "ref": "common-rmm-list", "kind": "manual", "observed": "2024-05-20" }, "type": "list[string]", "default": [ "anydesk.exe", "screenconnect.exe", "atera.exe", "splashtop.exe", "rustdesk.exe", "teamviewer.exe", "logmein.exe" ], "description": "Common dual-use RMM executable names used for persistence and recon." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hostnames to focus the hunt; leave empty to scan the full estate." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of telemetry to examine." }, "infra_keywords": { "type": "list[string]", "default": [ "vcenter", "vpxd", "esxi", "backup", "veeam", "domain-controller", "dc01" ], "description": "Keywords identifying critical infrastructure targets." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/", "name": "Unit 42 \u2014 Active Exploitation of PAN-OS CVE-2026-0257" } ], "blind_spots": [ { "id": "esxi-visibility-gap", "risk": "Attackers can run custom compiled tools on the hypervisor that are invisible to guest-level EDR.", "stage": "defense-evasion-esxi-security", "question": "What specifically was run after execInstalledOnly was disabled?", "requires": "Direct hypervisor audit logs or host-based agent on ESXi" }, { "id": "veeam-database-access", "risk": "CVE-2023-27532 allows direct credential extraction; without DB logs, the extraction itself is invisible, only the subsequent use of those credentials is seen.", "stage": "credential-access-offline-vmdk", "question": "Was the Veeam configuration database queried directly?", "requires": "hb_datastore_activity with full SQL auditing" } ] }, "name": "Virtualization Pivot and Host Encryption", "description": "The adversary exploits PAN-OS and pivots from the VPN gateway to the virtualization and backup infrastructure. This hunt targets the sophisticated post-access tradecraft observed following this exploitation. It examines the use of dual-use RMM tools for reconnaissance, identifies lateral movement toward vCenter and backup infrastructure, and detects the pivot to the ESXi hypervisor layer where security controls are disabled. Finally, it looks for the characteristic file encryption patterns of ransomware families like Qilin and Inc that occur after credentials have been harvested from virtual disks. The analyst reviews these correlated signals to stop the impact before it reaches the full fleet." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "threat-brief-active-exploitation-of-pan-os-cve-2026-0257-updated-october-19", "index": 2, "title": "Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)", "total": 2 }, "coverage": [ { "stage": "lateral-movement-vcenter-pivot", "steps": [ "infrastructure-pivots" ], "status": "covered" }, { "stage": "defense-evasion-esxi-security", "steps": [ "esxi-security-changes" ], "status": "covered" }, { "stage": "credential-access-offline-vmdk", "steps": [ "identify-vulnerable-targets", "vmdk-offline-access" ], "status": "covered" }, { "stage": "discovery-rmm-recon", "steps": [ "rare-rmm-activity" ], "status": "covered" }, { "stage": "impact-ransomware-encryption", "steps": [ "ransomware-impact" ], "status": "covered" }, { "stage": "initial-access-pan-os-exploit", "reason": "Belongs to another part of the 'Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)' series.", "status": "out_of_scope" }, { "stage": "unauthorized-vpn-persistence", "reason": "Belongs to another part of the 'Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)' series.", "status": "out_of_scope" } ], "rationale": "The adversary has exploited a VPN gateway to breach the perimeter and is now pivoting to the virtualization layer to disable security controls and deploy ransomware via virtual disk manipulation.", "blind_spots": [ { "id": "esxi-visibility-gap", "risk": "Attackers can run custom compiled tools on the hypervisor that are invisible to guest-level EDR.", "stage": "defense-evasion-esxi-security", "question": "What specifically was run after execInstalledOnly was disabled?", "requires": "Direct hypervisor audit logs or host-based agent on ESXi" }, { "id": "veeam-database-access", "risk": "CVE-2023-27532 allows direct credential extraction; without DB logs, the extraction itself is invisible, only the subsequent use of those credentials is seen.", "stage": "credential-access-offline-vmdk", "question": "Was the Veeam configuration database queried directly?", "requires": "hb_datastore_activity with full SQL auditing" } ], "scoping_notes": "Focus on servers, domain controllers, and backup infrastructure (Veeam). Use the vulnerability scoping step to identify the most likely beachheads before fanning out.", "beyond_detection": "A single detection rule cannot distinguish between administrative maintenance and a coordinated ransomware pivot to the hypervisor. This hunt joins early reconnaissance tools with lateral movement toward virtualization management and follow-on hypervisor configuration changes, providing the context necessary to confirm a sophisticated multi-stage intrusion." } }, { "id": "identify-vulnerable-targets", "type": "query", "label": "Identify vulnerable backup infrastructure", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_uid, resource_uid, affected_package_name, affected_package_version, severity FROM hb_vulnerability_finding WHERE cve_uid = 'CVE-2023-27532' AND status != 'suppressed'", "surface": "hb_vulnerability_finding", "description": "Find Veeam infrastructure hosts affected by CVE-2023-27532 that serve as primary targets for credential theft.", "expected_signal": "Rows identify specific hosts running vulnerable Veeam components. Silence means the estate is patched or not running Veeam." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify vulnerable backup infrastructure", "reads": [ "device_uid", "resource_uid", "affected_package_name", "affected_package_version", "severity" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT device_uid, resource_uid, affected_package_name, affected_package_version, severity FROM hb_vulnerability_finding WHERE cve_uid = 'CVE-2023-27532' AND status != 'suppressed'", "silence": "not_evidence_of_absence", "expected": "Rows identify specific hosts running vulnerable Veeam components. Silence means the estate is patched or not running Veeam.", "verified": "dry-run", "verified_at": "2026-10-20" } }, { "id": "rare-rmm-activity", "type": "query", "label": "Rare RMM tool activity", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_name) AS rmm_bin, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (instr(',' || '{{rmm_tools}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING host_count <= 3", "surface": "hb_process_activity", "description": "Detect dual-use RMM tools that are rare across the fleet, suggesting they were dropped by an attacker for persistence or recon.", "expected_signal": "A list of hosts running an RMM tool that is not part of standard IT operations. Silence means no known RMM binaries were executed." }, "parents": [ { "id": "identify-vulnerable-targets" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare RMM tool activity", "reads": [ "process_name", "device_hostname", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_name) AS rmm_bin, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (instr(',' || '{{rmm_tools}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING host_count <= 3", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A list of hosts running an RMM tool that is not part of standard IT operations. Silence means no known RMM binaries were executed.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_name" ], "rare_below": 3 }, "verified_at": "2026-10-20" } }, { "id": "infrastructure-pivots", "type": "query", "label": "Lateral logons to virtualization infrastructure", "config": { "dsl": "sqlite", "role": "enrichment", "source": "identity", "content": "SELECT device_hostname, actor_user_name, dst_endpoint_hostname, logon_type, src_endpoint_ip, time FROM hb_auth_signin WHERE (logon_type_id IN (3, 10)) AND (instr(',' || '{{infra_keywords}}' || ',', LOWER(dst_endpoint_hostname)) > 0 OR instr(',' || '{{infra_keywords}}' || ',', LOWER(device_hostname)) > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_auth_signin", "description": "Identify RDP or Network logons from unexpected source workstations to sensitive infrastructure like vCenter or domain controllers.", "expected_signal": "Logon events to servers containing infrastructure keywords. Silence proofs no remote interactive sessions occurred to these targets within the window." }, "parents": [ { "id": "identify-vulnerable-targets" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Lateral logons to virtualization infrastructure", "reads": [ "device_hostname", "actor_user_name", "dst_endpoint_hostname", "logon_type", "src_endpoint_ip", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT device_hostname, actor_user_name, dst_endpoint_hostname, logon_type, src_endpoint_ip, time FROM hb_auth_signin WHERE (logon_type_id IN (3, 10)) AND (instr(',' || '{{infra_keywords}}' || ',', LOWER(dst_endpoint_hostname)) > 0 OR instr(',' || '{{infra_keywords}}' || ',', LOWER(device_hostname)) > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "Logon events to servers containing infrastructure keywords. Silence proofs no remote interactive sessions occurred to these targets within the window.", "verified": "dry-run", "verified_at": "2026-10-20" } }, { "id": "triage-early-beachhead", "type": "analytic", "label": "Triage early-stage beachhead", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "identify-vulnerable-targets", "rare-rmm-activity", "infrastructure-pivots" ], "objective": "Determine if the combination of rare RMM tools and lateral movement to infrastructure indicates a high-confidence intrusion on specific hosts.", "description": "Synthesize recon tool findings and lateral movement to determine if an intruder is actively expanding their access.", "max_iterations": 4, "expected_signal": "A verdict on whether recon and pivot behaviors warrant investigation of the follow-on virtualization stages.", "success_criteria": "Verdicts (Malicious | Suspicious | Benign) per host with citations." }, "parents": [ { "id": "rare-rmm-activity", "kind": "merge" }, { "id": "infrastructure-pivots", "kind": "merge" } ] }, { "id": "vmdk-offline-access", "type": "query", "label": "Offline virtual disk access and dumping", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%vmdk%' OR LOWER(process_cmd_line) LIKE '%mount%' OR LOWER(process_cmd_line) LIKE '%vmtools%') AND (LOWER(process_cmd_line) LIKE '%ntds%' OR LOWER(process_cmd_line) LIKE '%sam%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Detect the use of tools or commands aimed at mounting or dumping virtual disks (VMDKs) to harvest credentials offline.", "expected_signal": "Commands linking virtual disk files to credential storage locations. Silence proofs no such shell commands were executed." }, "parents": [ { "id": "triage-early-beachhead" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Offline virtual disk access and dumping", "reads": [ "device_hostname", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%vmdk%' OR LOWER(process_cmd_line) LIKE '%mount%' OR LOWER(process_cmd_line) LIKE '%vmtools%') AND (LOWER(process_cmd_line) LIKE '%ntds%' OR LOWER(process_cmd_line) LIKE '%sam%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "Commands linking virtual disk files to credential storage locations. Silence proofs no such shell commands were executed.", "verified": "dry-run", "verified_at": "2026-10-20" } }, { "id": "esxi-security-changes", "type": "query", "label": "ESXi security control modification", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, message, syslog_tag, time FROM hb_syslog WHERE (LOWER(message) LIKE '%execinstalledonly%' AND LOWER(message) LIKE '%disabled%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_syslog", "description": "Search syslog records for modifications to ESXi security settings like execInstalledOnly that attackers use to run custom tooling.", "expected_signal": "A log message indicating a security control on the hypervisor was disabled. Silence suggests no such configuration change was logged to this syslog collector." }, "parents": [ { "id": "triage-early-beachhead" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "ESXi security control modification", "reads": [ "device_hostname", "message", "syslog_tag", "time" ], "source": "hb_syslog", "target": "endpoint", "content": "SELECT device_hostname, message, syslog_tag, time FROM hb_syslog WHERE (LOWER(message) LIKE '%execinstalledonly%' AND LOWER(message) LIKE '%disabled%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A log message indicating a security control on the hypervisor was disabled. Silence suggests no such configuration change was logged to this syslog collector.", "verified": "dry-run", "verified_at": "2026-10-20" } }, { "id": "ransomware-impact", "type": "query", "label": "Mass file renaming (Ransomware behavior)", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, COUNT(*) AS file_ops, MIN(time) AS start_time FROM hb_file_activity WHERE activity_id IN (3, 5) AND (LOWER(file_path) LIKE '%.locked' OR LOWER(file_path) LIKE '%.inc' OR LOWER(file_path) LIKE '%.qilin' OR LOWER(file_path) LIKE '%recovery%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name HAVING file_ops > 50", "surface": "hb_file_activity", "description": "Identify high-frequency file modification or renaming activity typical of Qilin or Inc ransomware deployment.", "expected_signal": "Hosts where a single process has touched dozens of files with ransom extensions. None means no such large-scale encryption was visible." }, "parents": [ { "id": "triage-early-beachhead" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Mass file renaming (Ransomware behavior)", "reads": [ "device_hostname", "process_name", "file_path", "time", "activity_id" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, COUNT(*) AS file_ops, MIN(time) AS start_time FROM hb_file_activity WHERE activity_id IN (3, 5) AND (LOWER(file_path) LIKE '%.locked' OR LOWER(file_path) LIKE '%.inc' OR LOWER(file_path) LIKE '%.qilin' OR LOWER(file_path) LIKE '%recovery%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name HAVING file_ops > 50", "silence": "not_evidence_of_absence", "expected": "Hosts where a single process has touched dozens of files with ransom extensions. None means no such large-scale encryption was visible.", "verified": "dry-run", "verified_at": "2026-10-20" } }, { "id": "full-chain-analysis", "type": "analytic", "label": "Full chain analysis", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "triage-early-beachhead", "vmdk-offline-access", "esxi-security-changes", "ransomware-impact" ], "objective": "Integrate findings from RMM usage, lateral movement, vCenter access, VMDK dumping, and ransomware encryption patterns to confirm a full-scale compromise.", "description": "Final assessment of the attack progress, combining the early stage beachhead evidence with follow-on virtualization and ransomware markers.", "max_iterations": 6, "expected_signal": "A high-confidence determination of a complete ransomware chain.", "success_criteria": "A detailed verdict citing the full path from initial internal pivot to impact." }, "parents": [ { "id": "vmdk-offline-access", "kind": "merge" }, { "id": "esxi-security-changes", "kind": "merge" }, { "id": "ransomware-impact", "kind": "merge" } ] }, { "id": "threat-routing", "type": "checkpoint", "label": "Decision: Active ransomware chain detected", "config": { "fuzzy": true, "judge": "hunter", "question": "the full-chain-analysis verdict is malicious for at least one host", "condition": "the full-chain-analysis verdict is malicious for at least one host", "blind_spot": "esxi-visibility-gap", "confidence": "high", "description": "Route to immediate host isolation if the evidence indicates an active ransomware deployment.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "full-chain-analysis" } ] }, { "id": "containment", "type": "action", "label": "Isolate compromised hosts", "config": { "target": "endpoint", "description": "Prevent further encryption or data exfiltration by severing network connectivity for compromised endpoints.", "instructions": "Isolate the hosts identified by the agent and revoke any credentials used from those systems.", "action_approval": "required" }, "parents": [ { "id": "threat-routing", "branch": "on_supports" } ] }, { "id": "analyst-validation", "type": "task", "label": "Analyst review and tuning", "config": { "assignee": "analyst", "description": "Final validation of the hunt results and identification of false positives to tune future detection rules.", "instructions": "Review the RMM and lateral movement citations. Confirm if the RMM usage is sanctioned and document the source of any virtualization-layer modifications." }, "parents": [ { "id": "threat-routing", "branch": "default" }, { "id": "threat-routing", "branch": "on_unavailable" }, { "id": "threat-routing", "branch": "on_refutes" }, { "id": "containment" } ] }, { "id": "close-out", "type": "task", "label": "Hunt close-out", "config": { "assignee": "analyst", "description": "Record findings and ensure all remediation steps are complete.", "instructions": "Record the hunt results. If Ransomware behavior was confirmed, transition to the full Ransomware Incident Response playbook." }, "parents": [ { "id": "analyst-validation" } ] } ] }