{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Static Tundra specifically targets unpatched legacy infrastructure for long-term intelligence collection; identifying these assets and protocol activity is a core defense against Russian state-sponsored espionage."
      },
      "name": "Vulnerable Cisco Asset Exposure",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190"
      ],
      "series": {
        "slug": "static-tundra-long-term-exploitation-of-end-of-life-network-devices",
        "index": 1,
        "title": "Static Tundra: long-term exploitation of end-of-life network devices",
        "total": 2
      },
      "related": [
        {
          "hunt": "cisco-config-exfiltration-tftp",
          "reason": "The exfiltration of configuration data using TFTP following initial access is a separate behavioural stage involving hb_network_connection with different port logic.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A simple rule for port 4786 traffic lacks the context of whether the device is actually vulnerable or if it was discovered by an external scanner. This hunt pivots across vulnerability management, attack surface management, and traffic logs to provide a high-confidence verdict.",
      "coverage": [
        {
          "stage": "vulnerability-identification",
          "steps": [
            "cisco-vulnerability-scope"
          ],
          "status": "covered"
        },
        {
          "stage": "initial-access-smart-install",
          "steps": [
            "rare-smart-install-traffic",
            "external-asset-exposure"
          ],
          "status": "covered"
        },
        {
          "stage": "configuration-extraction-tftp",
          "reason": "Belongs to another part of the 'Static Tundra: long-term exploitation of end-of-life network devices' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "snmp-abuse-and-execution",
          "reason": "Belongs to another part of the 'Static Tundra: long-term exploitation of end-of-life network devices' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "persistence-firmware-implant",
          "reason": "Belongs to another part of the 'Static Tundra: long-term exploitation of end-of-life network devices' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "defense-evasion-and-discovery",
          "reason": "Belongs to another part of the 'Static Tundra: long-term exploitation of end-of-life network devices' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "End-of-Life Device Vulnerability Identification",
            "slug": "vulnerability-identification",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "CVE-2018-0171",
              "Cisco IOS Software",
              "Cisco IOS XE Software",
              "End-of-life (EoL) network devices"
            ]
          },
          {
            "name": "Smart Install Exploitation",
            "slug": "initial-access-smart-install",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "TCP port 4786",
              "Cisco Smart Install protocol activity"
            ]
          },
          {
            "name": "Configuration Exfiltration via TFTP",
            "slug": "configuration-extraction-tftp",
            "tactic": "exfiltration",
            "techniques": [
              "T1041"
            ],
            "observables": [
              "tftp-server nvram:startup-config",
              "UDP port 69",
              "startup-config file retrieval"
            ]
          },
          {
            "name": "SNMP Community String Abuse",
            "slug": "snmp-abuse-and-execution",
            "tactic": "execution",
            "techniques": [
              "T1090.003"
            ],
            "observables": [
              "UDP port 161",
              "SNMP community string 'public'",
              "SNMP community string 'anonymous'",
              "Spoofed SNMP source IP addresses"
            ]
          },
          {
            "name": "Firmware Persistence via SYNful Knock",
            "slug": "persistence-firmware-implant",
            "tactic": "persistence",
            "observables": [
              "SYNful Knock implant",
              "TCP SYN 'magic packet' to non-standard ports",
              "Privileged local user account creation"
            ]
          },
          {
            "name": "Logging Evasion and Lateral Discovery",
            "slug": "defense-evasion-and-discovery",
            "tactic": "defense-evasion",
            "observables": [
              "TACACS+ configuration modification",
              "Access Control List (ACL) modifications",
              "show cdp neighbors"
            ]
          }
        ],
        "summary": "Static Tundra, a Russian FSB-linked actor, targets end-of-life Cisco devices by exploiting the Smart Install vulnerability (CVE-2018-0171) or abusing SNMP with guessed community strings to exfiltrate configurations. They maintain multi-year persistence using the SYNful Knock firmware implant and by creating local accounts, while evading detection by disabling TACACS+ logging."
      },
      "severity": "high",
      "rationale": "The hunt focuses on Cisco IOS/XE devices. Start with assets known to have external exposure in Shodan to prioritize risk.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is identifying and exploiting end-of-life Cisco devices via the Smart Install feature on port 4786 to extract configuration files and establish persistence.",
      "parameters": {
        "cve_id": {
          "from": {
            "ref": "Static Tundra",
            "kind": "article",
            "observed": "2024-05-20"
          },
          "type": "string",
          "default": "CVE-2018-0171",
          "description": "The Cisco Smart Install remote code execution vulnerability ID."
        },
        "scope_hosts": {
          "from": {
            "ref": "analyst-input",
            "kind": "manual",
            "observed": "2024-05-20"
          },
          "type": "list[host]",
          "default": [],
          "description": "List of hostnames to focus the hunt on, usually from the scoping step."
        },
        "lookback_days": {
          "from": {
            "ref": "hunt-standard",
            "kind": "manual",
            "observed": "2024-05-20"
          },
          "type": "number",
          "default": "14",
          "description": "Days of network history to examine for protocol activity."
        },
        "smart_install_port": {
          "from": {
            "ref": "Static Tundra",
            "kind": "article",
            "observed": "2024-05-20"
          },
          "type": "number",
          "default": "4786",
          "description": "The TCP port used by the Cisco Smart Install feature."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://blog.talosintelligence.com/static-tundra/",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://blog.talosintelligence.com/static-tundra/",
          "name": "Static Tundra: long-term exploitation of end-of-life network devices"
        }
      ],
      "blind_spots": [
        {
          "id": "missing-network-logs",
          "risk": "Lateral movement exploiting Smart Install from a compromised internal host would be invisible if logs only cover the perimeter.",
          "stage": "initial-access-smart-install",
          "question": "whether any internal scanning or exploitation of port 4786 occurred",
          "requires": "hb_network_connection with full coverage of management subnets"
        },
        {
          "id": "eol-inventory-staleness",
          "risk": "End-of-life devices often fall out of managed inventory but remain reachable via the network, creating a silent entry point.",
          "stage": "vulnerability-identification",
          "question": "whether legacy devices that do not report to a vulnerability scanner are present",
          "requires": "hb_software_inventory with up-to-date EoL data for Cisco hardware"
        }
      ]
    },
    "name": "Vulnerable Cisco Asset Exposure",
    "description": "Static Tundra (FSB Center 16) has exploited CVE-2018-0171 for over a decade to compromise network infrastructure. This hunt identifies vulnerable Cisco assets by cross-referencing vulnerability findings with external exposure data and internal network traffic on the Smart Install protocol port. The agent weighs the presence of the vulnerability against active protocol traffic to determine if exploitation or scanning is occurring."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "static-tundra-long-term-exploitation-of-end-of-life-network-devices",
          "index": 1,
          "title": "Static Tundra: long-term exploitation of end-of-life network devices",
          "total": 2
        },
        "coverage": [
          {
            "stage": "vulnerability-identification",
            "steps": [
              "cisco-vulnerability-scope"
            ],
            "status": "covered"
          },
          {
            "stage": "initial-access-smart-install",
            "steps": [
              "rare-smart-install-traffic",
              "external-asset-exposure"
            ],
            "status": "covered"
          },
          {
            "stage": "configuration-extraction-tftp",
            "reason": "Belongs to another part of the 'Static Tundra: long-term exploitation of end-of-life network devices' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "snmp-abuse-and-execution",
            "reason": "Belongs to another part of the 'Static Tundra: long-term exploitation of end-of-life network devices' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "persistence-firmware-implant",
            "reason": "Belongs to another part of the 'Static Tundra: long-term exploitation of end-of-life network devices' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "defense-evasion-and-discovery",
            "reason": "Belongs to another part of the 'Static Tundra: long-term exploitation of end-of-life network devices' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary is identifying and exploiting end-of-life Cisco devices via the Smart Install feature on port 4786 to extract configuration files and establish persistence.",
        "blind_spots": [
          {
            "id": "missing-network-logs",
            "risk": "Lateral movement exploiting Smart Install from a compromised internal host would be invisible if logs only cover the perimeter.",
            "stage": "initial-access-smart-install",
            "question": "whether any internal scanning or exploitation of port 4786 occurred",
            "requires": "hb_network_connection with full coverage of management subnets"
          },
          {
            "id": "eol-inventory-staleness",
            "risk": "End-of-life devices often fall out of managed inventory but remain reachable via the network, creating a silent entry point.",
            "stage": "vulnerability-identification",
            "question": "whether legacy devices that do not report to a vulnerability scanner are present",
            "requires": "hb_software_inventory with up-to-date EoL data for Cisco hardware"
          }
        ],
        "scoping_notes": "The hunt focuses on Cisco IOS/XE devices. Start with assets known to have external exposure in Shodan to prioritize risk.",
        "beyond_detection": "A simple rule for port 4786 traffic lacks the context of whether the device is actually vulnerable or if it was discovered by an external scanner. This hunt pivots across vulnerability management, attack surface management, and traffic logs to provide a high-confidence verdict."
      }
    },
    {
      "id": "cisco-vulnerability-scope",
      "type": "query",
      "label": "Identify devices with Smart Install vulnerability",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_uid, resource_uid, cve_uid, severity, status, first_seen, last_seen FROM hb_vulnerability_finding WHERE cve_uid = '{{cve_id}}' AND status != 'suppressed'",
        "surface": "hb_vulnerability_finding",
        "description": "The query finds devices explicitly flagged with CVE-2018-0171 in the vulnerability inventory so the hunt focuses on known exposures.",
        "expected_signal": "Rows indicating specific assets that are unpatched against the Smart Install vulnerability. Silence means no known vulnerable devices are currently tracked."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify devices with Smart Install vulnerability",
        "reads": [
          "device_uid",
          "resource_uid",
          "cve_uid",
          "severity",
          "status",
          "first_seen",
          "last_seen"
        ],
        "source": "hb_vulnerability_finding",
        "target": "endpoint",
        "content": "SELECT device_uid, resource_uid, cve_uid, severity, status, first_seen, last_seen FROM hb_vulnerability_finding WHERE cve_uid = '{{cve_id}}' AND status != 'suppressed'",
        "silence": "not_evidence_of_absence",
        "expected": "Rows indicating specific assets that are unpatched against the Smart Install vulnerability. Silence means no known vulnerable devices are currently tracked.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "rare-smart-install-traffic",
      "type": "query",
      "label": "Rare Smart Install network traffic",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "network",
        "content": "SELECT device_hostname, src_endpoint_ip, dst_endpoint_ip, COUNT(*) AS connection_count, MIN(time) AS first_seen FROM hb_network_connection WHERE dst_endpoint_port = {{smart_install_port}} AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, src_endpoint_ip, dst_endpoint_ip HAVING COUNT(DISTINCT device_hostname) <= 3 ORDER BY connection_count DESC",
        "surface": "hb_network_connection",
        "description": "The hunt stack-counts connections to port 4786 across the fleet to identify rare or unauthorized protocol usage that deviates from typical management traffic.",
        "expected_signal": "Connections to port 4786 on a small number of hosts. Silence proof that no such traffic was logged."
      },
      "parents": [
        {
          "id": "cisco-vulnerability-scope"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare Smart Install network traffic",
        "reads": [
          "device_hostname",
          "src_endpoint_ip",
          "dst_endpoint_ip",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, src_endpoint_ip, dst_endpoint_ip, COUNT(*) AS connection_count, MIN(time) AS first_seen FROM hb_network_connection WHERE dst_endpoint_port = {{smart_install_port}} AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, src_endpoint_ip, dst_endpoint_ip HAVING COUNT(DISTINCT device_hostname) <= 3 ORDER BY connection_count DESC",
        "silence": "evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Connections to port 4786 on a small number of hosts. Silence proof that no such traffic was logged.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "src_endpoint_ip",
            "dst_endpoint_ip"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "external-asset-exposure",
      "type": "query",
      "label": "Check for external Smart Install exposure",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT domain_or_ip, port, product, version, discovered_at FROM hb_exposed_assets WHERE port = {{smart_install_port}}",
        "surface": "hb_exposed_assets",
        "description": "The query identifies if organizational assets are visible to internet scanners on port 4786 by checking external attack surface data.",
        "expected_signal": "Asset records confirmed as exposed by Shodan or crt.sh. Silence means no assets are currently known to be exposed on this port."
      },
      "parents": [
        {
          "id": "cisco-vulnerability-scope"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Check for external Smart Install exposure",
        "reads": [
          "domain_or_ip",
          "port",
          "product",
          "version",
          "discovered_at"
        ],
        "source": "hb_exposed_assets",
        "target": "endpoint",
        "content": "SELECT domain_or_ip, port, product, version, discovered_at FROM hb_exposed_assets WHERE port = {{smart_install_port}}",
        "silence": "not_evidence_of_absence",
        "expected": "Asset records confirmed as exposed by Shodan or crt.sh. Silence means no assets are currently known to be exposed on this port.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "triage-risk",
      "type": "analytic",
      "label": "Weigh vulnerability and activity",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "cisco-vulnerability-scope",
          "rare-smart-install-traffic",
          "external-asset-exposure"
        ],
        "objective": "Determine if any vulnerable Cisco devices are being actively exploited based on recent network activity or high-risk exposure.",
        "description": "The agent correlates identified vulnerable devices with observed network traffic and external exposure.",
        "max_iterations": 4,
        "expected_signal": "A prioritized list of devices with a risk verdict (High if vulnerable + exposed + traffic).",
        "success_criteria": "A per-device verdict of malicious, suspicious, or benign based on the overlap of vulnerability and traffic."
      },
      "parents": [
        {
          "id": "rare-smart-install-traffic",
          "kind": "merge"
        },
        {
          "id": "external-asset-exposure",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-risk",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious for at least one host",
        "condition": "the triage verdict is malicious for at least one host",
        "blind_spot": "missing-network-logs",
        "confidence": "high",
        "description": "The analyst decides whether to isolate devices or perform a manual review of unverified software versions.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-risk"
        }
      ]
    },
    {
      "id": "isolate-and-disable",
      "type": "action",
      "label": "Restrict Smart Install access",
      "config": {
        "target": "endpoint",
        "description": "The analyst immediately blocks traffic to the vulnerable service to prevent further exploitation.",
        "instructions": "Disable the Smart Install feature on the identified Cisco devices or apply a firewall rule to block all ingress traffic to TCP port 4786.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-risk",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-manual-review",
      "type": "task",
      "label": "Forensic log review",
      "config": {
        "assignee": "analyst",
        "description": "Confirm if configuration data was extracted during the identified protocol activity window.",
        "instructions": "Examine flow logs for outbound TFTP or SNMP activity following the Smart Install connections to determine if startup-configurations were successfully exfiltrated."
      },
      "parents": [
        {
          "id": "route-on-risk",
          "branch": "default"
        },
        {
          "id": "route-on-risk",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-and-disable"
        }
      ]
    },
    {
      "id": "remediation-task",
      "type": "task",
      "label": "Permanent remediation",
      "config": {
        "assignee": "analyst",
        "description": "The analyst ensures a permanent fix for the identified vulnerability.",
        "instructions": "Coordinate with the network team to apply the patch for CVE-2018-0171 or decommission any end-of-life hardware that cannot be secured."
      },
      "parents": [
        {
          "id": "analyst-manual-review"
        }
      ]
    },
    {
      "id": "close-out-negative",
      "type": "task",
      "label": "Close out negative result",
      "config": {
        "assignee": "analyst",
        "description": "Record that no active exploitation was found for the identified vulnerabilities.",
        "instructions": "Record the list of vulnerable devices identified in the scoping step and note the absence of protocol activity on port 4786. Schedule a re-run of the hunt."
      },
      "parents": [
        {
          "id": "route-on-risk",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}