--- analysis: A single detection rule might flag a vssadmin command, but this hunt correlates that final impact with the preceding VPN logon without MFA and early-stage identity harvesting. It pivots across three telemetry surfaces (authentication, scripting, and DNS) to build the high-confidence context required for an analyst to authorize full-site isolation. blind_spots: - id: missing-vpn-logs question: whether the initial entry came through the VPN requires: VPN provider logs in hb_auth_signin risk: Without these logs, the hunt cannot correlate the start of the intrusion with the endpoint behavior, forcing the analyst to guess the entry point. stage: initial-access-vpn - id: powershell-script-blocks question: what code was executed by the attacker's scripts requires: PowerShell Script Block Logging (Event 4104) risk: If obfuscated commands are used and script block logging is absent, the Kerberoasting and LSASS dumping attempts remain invisible to the hb_script_activity surface. stage: credential-harvesting-and-lateral-movement coverage: - stage: initial-access-vpn status: covered steps: - identify-vpn-hosts - vpn-logons-no-mfa - stage: credential-harvesting-and-lateral-movement status: covered steps: - identity-harvest-scripting - stage: data-staging-and-exfiltration status: covered steps: - cloud-exfiltration-dns - stage: recovery-inhibition-and-impact status: covered steps: - shadow-copy-inhibition guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: Akira and similar ransomware groups can exfiltrate data in as little as two hours. Detecting the identity harvesting and exfiltration phases before the 16-hour mark is a critical business obligation to prevent both data loss and total system encryption. methodology: model-assisted trigger: intel-report hypothesis: An adversary has gained initial access via a VPN without multi-factor authentication and is harvesting credentials via LSASS dumping or Kerberoasting to facilitate exfiltration and eventual disk encryption. labels: - hunt - attack.t1133 - attack.t1078 - attack.t1003.001 - attack.t1558.003 - attack.t1059.001 - attack.t1486 - attack.t1490 - attack.t1567.002 - attack.t1572 - credential access - exfiltration - impact - initial access name: VPN Entry and Identity Harvest parameters: exfil_domains: default: - mega.nz - rclone.org - transfer.sh - dropbox.com - ngrok.io - ngrok.app description: Cloud storage and tunneling domains associated with ransomware exfiltration. from: kind: advisory observed: '2025-11-01' ref: CISA Akira AA23-353A type: list[domain] lookback_days: default: '14' description: Days of history to examine. type: number scope_hosts: default: [] description: Optional list of hosts to narrow the follow-on stages; leave empty to hunt across the estate. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.huntress.com/blog/what-happens-during-a-ransomware-attack gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: Start with VPN gateway hosts and administrative workstations. If VPN logs do not populate hb_auth_signin, check process events for VPN appliance management tools. references: - name: "Huntress \u2014 What Happens During a Ransomware Attack" url: https://www.huntress.com/blog/what-happens-during-a-ransomware-attack - name: 'CISA AA23-353A: Akira Ransomware' url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a related: - hunt: lateral-movement-rdp-identities reason: This hunt focuses on the VPN beachhead and its direct identity harvesting follow-on; internal lateral movement via RDP is covered by identity-specific hunts. relation: out-of-scope-alternative scenario: stages: - name: Initial Access via VPN observables: - VPN service without multi-factor authentication - Compromised user account credentials slug: initial-access-vpn tactic: initial-access techniques: - T1133 - T1078 - name: Credential Dumping and Lateral Movement observables: - mimikatz - lazagne - cobalt strike - lsass.exe memory dumping - Kerberoasting against service accounts - Service Principal Name (SPN) requests slug: credential-harvesting-and-lateral-movement tactic: credential-access techniques: - T1003.001 - T1558.003 - T1059.001 - name: Data Staging and Cloud Exfiltration observables: - filezilla.exe - winrar.exe - winscp.exe - rclone.exe - ngrok.io - ngrok.app - mega.nz - tens of gigabytes pushed to consumer cloud endpoints slug: data-staging-and-exfiltration tactic: exfiltration techniques: - T1567.002 - T1572 - T1041 - name: Recovery Inhibition and Encryption observables: - vssadmin.exe delete shadows /all /quiet - PowerShell commands to remove volume shadow copies - Mass file modification by a single process - Ransom note text files on shared drives slug: recovery-inhibition-and-impact tactic: impact techniques: - T1490 - T1486 summary: Ransomware operators leverage initial access (often from brokers) via VPNs without MFA to perform rapid credential harvesting and data exfiltration, frequently completing the theft within hours. The intrusion culminates in the deletion of volume shadow copies to prevent recovery followed by widespread file encryption. severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent identity: category: identity name: Identity / sign-in telemetry telemetry: - identity tlp: clear type: investigation --- # VPN Entry and Identity Harvest The adversary enters via a VPN that lacks multi-factor authentication, then harvests credentials to move laterally. This hunt identifies the unhardened sign-ins and the subsequent identity-focused script blocks. It then pivots to find evidence of outbound data transfer and the destruction of system backups. By correlating early-stage access with later-stage destructive behavior, the hunt provides the evidence required for an analyst to authorize isolation and identity resets before the encryption phase completes across the estate. ## identify-vpn-hosts Scope the estate to hosts acting as VPN gateways or beachheads based on authentication logs. ```sqlite target=identity role=scoping params=(lookback_days=lookback_days) ~~~yaml expected: A list of hostnames with VPN-related sign-in events. Silence suggests no VPN telemetry is being ingested or no VPN activity occurred. reads: - device_hostname - event_type - auth_protocol - time silence: not_evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-10-04' ~~~ SELECT DISTINCT device_hostname FROM hb_auth_signin WHERE (LOWER(event_type) LIKE '%vpn%' OR LOWER(auth_protocol) LIKE '%vpn%') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## early-stage-parallel parallel: - → vpn-logons-no-mfa - → identity-harvest-scripting join: → triage-early-access ## vpn-logons-no-mfa Find VPN sessions where MFA was absent or bypassed, identifying potential beachhead accounts. ```sqlite target=identity role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: A list of users and source IPs using single-factor VPN access. Silence suggests MFA is enforced or the provider does not report it. reads: - device_hostname - actor_user_name - src_endpoint_ip - mfa - event_type - time silence: not_evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-10-04' ~~~ SELECT device_hostname, actor_user_name, src_endpoint_ip, mfa, event_type, time FROM hb_auth_signin WHERE (mfa IS NULL OR LOWER(mfa) = 'false' OR mfa = '0') AND (LOWER(event_type) LIKE '%vpn%' OR LOWER(auth_protocol) LIKE '%vpn%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## identity-harvest-scripting Detect Kerberoasting or LSASS memory dumping attempts within PowerShell or shell scripts. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Script blocks containing offensive identity keywords. Silence may indicate the use of native binaries or that script logging is absent. reads: - device_hostname - actor_user_name - script_name - script_content - time silence: not_evidence_of_absence source: hb_script_activity verified: dry-run verified_at: '2026-10-04' ~~~ SELECT device_hostname, actor_user_name, script_name, script_content, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%kerberoast%' OR LOWER(script_content) LIKE '%get-domainspnticket%' OR LOWER(script_content) LIKE '%sekurlsa%' OR LOWER(script_content) LIKE '%minidump%lsass%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-early-access ```agent target=hunter cite: required context: - vpn-logons-no-mfa - identity-harvest-scripting max_iterations: 3 objective: Determine if the unhardened VPN logons and identity harvesting scripts occur on the same timeline for any single host. success_criteria: A verdict of malicious | suspicious | benign per host, citing relevant rows. tools: - endpoint - identity ``` ## impact-parallel parallel: - → cloud-exfiltration-dns - → shadow-copy-inhibition join: → triage-full-intrusion ## cloud-exfiltration-dns Find connections to exfiltration and tunneling domains that are rare across the fleet, suggesting targeted staging. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, exfil_domains=exfil_domains, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A small number of hosts resolving mega.nz or ngrok domains. Widespread traffic is likely legitimate software. prevalence: by: device_hostname key: - query_hostname rare_below: 3 reads: - device_hostname - query_hostname - time silence: not_evidence_of_absence source: hb_dns_activity verified: dry-run verified_at: '2026-10-04' ~~~ SELECT device_hostname, query_hostname, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE instr(',' || '{{exfil_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname ``` ## shadow-copy-inhibition Detect the use of native tools to destroy system recovery features, a precursor to widespread encryption. ```sqlite target=endpoint role=triage params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Successful deletion commands. Silence is strong evidence the impact phase has not reached these specific hosts. reads: - device_hostname - process_cmd_line - time silence: evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-10-04' ~~~ SELECT device_hostname, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%vssadmin%delete%shadows%' OR LOWER(process_cmd_line) LIKE '%wmic%shadowcopy%delete%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-full-intrusion ```agent target=hunter cite: required context: - triage-early-access - cloud-exfiltration-dns - shadow-copy-inhibition max_iterations: 5 objective: Determine if any host shows a complete chain from compromised VPN access to exfiltration or shadow copy deletion. success_criteria: A final verdict including recommended isolation priority and the account used for entry. tools: - endpoint - identity ``` ## evaluate-threat if~: "the triage verdict is malicious for at least one host, indicating a confirmed ransomware intrusion" (confidence: high, judge=hunter) then: → contain-intrusion indeterminate: → audit-recovery-safety unavailable: → audit-recovery-safety (blind_spot: missing-vpn-logs) else: → audit-recovery-safety ## contain-intrusion ```action target=endpoint ~~~yaml approval: required ~~~ Network-isolate the compromised hosts from the EDR console. Simultaneously, disable the accounts identified in the VPN logon step and schedule a double reset of the krbtgt account to revoke all existing Kerberos tickets. ``` → audit-recovery-safety ## audit-recovery-safety ```manual target=analyst Restore one production file from the most recent backup and confirm it opens correctly. Verify that immutable storage or object lock is currently active in the backup console. ``` → incident-wrap-up ## incident-wrap-up ```manual target=analyst Document the compromised accounts, the volume of data exfiltrated (if measurable via DNS/network traffic), and any blind spots that delayed detection. Record tuning notes for the VPN sign-in baseline. ``` → end