{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "WMI lateral movement is a core technique for internal propagation, and multi-hop proxies are used to bypass perimeter C2 blocks. Coordinating these independent signals across process and network surfaces provides a high-confidence indicator of an active intruder."
      },
      "name": "WMI Lateral Movement and Proxy-based C2",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1047",
        "attack.t1090.003"
      ],
      "related": [
        {
          "hunt": "wmi-event-consumer-persistence",
          "reason": "WMI event consumers represent a related persistence technique that uses the same infrastructure as this lateral movement hunt.",
          "relation": "sibling"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A single rule on WMI execution or proxy DNS queries often generates high noise from administrative tools or browser extensions. This hunt uses a funnel flow to combine these signals, utilizing an agent to confirm the relationship between the execution lineage and the networking behavior before a decision is reached.",
      "coverage": [
        {
          "stage": "lateral-movement-wmi",
          "steps": [
            "identify-windows-hosts",
            "wmi-activity-search"
          ],
          "status": "covered"
        },
        {
          "stage": "command-and-control-proxy",
          "steps": [
            "proxy-dns-search"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Lateral Movement via WMI",
            "slug": "lateral-movement-wmi",
            "tactic": "execution",
            "techniques": [
              "T1047"
            ],
            "observables": [
              "wmic.exe",
              "wmiprvse.exe",
              "Process creation with parent wmiprvse.exe",
              "Network connections on port 135, 5985, or 5986"
            ]
          },
          {
            "name": "Multi-hop Proxy Command and Control",
            "slug": "command-and-control-proxy",
            "tactic": "command-and-control",
            "techniques": [
              "T1090.003"
            ],
            "observables": [
              "DNS queries for .onion domains",
              "DNS queries for hiddenservice.net",
              "Traffic to known Tor entry/exit nodes",
              "Chained proxy connection attempts"
            ]
          }
        ],
        "summary": "This report details the implementation of AI-driven alert triage and attack investigation within a security operations center. It uses a scenario where an attacker leverages Windows Management Instrumentation (WMI) for lateral movement and multi-hop proxies for command and control to illustrate how automated agents can correlate disparate alerts into a single attack narrative."
      },
      "severity": "medium",
      "rationale": "The hunt scopes every Windows host because WMI lateral movement can target any system with RPC or WinRM enabled. The behavioral queries focus on the WMI provider (wmiprvse.exe), which is the standard host for remote-triggered execution.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An intruder has moved laterally using WMI to execute code on internal Windows hosts and is maintaining command-and-control through multi-hop proxies or Tor to obfuscate traffic.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "analyst-input",
            "kind": "manual",
            "observed": "2025-01-01"
          },
          "type": "list[host]",
          "default": [],
          "description": "Optional list of hosts to narrow the behavioral queries; empty checks all Windows hosts."
        },
        "lookback_days": {
          "from": {
            "ref": "default-retention",
            "kind": "manual",
            "observed": "2025-01-01"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "proxy_indicators": {
          "from": {
            "ref": "elastic-security-labs-agentic-soc",
            "kind": "article",
            "observed": "2026-07-31"
          },
          "type": "list[domain]",
          "default": [
            "hiddenservice.net",
            "onion.link",
            "onion.cab",
            "onion.casa"
          ],
          "description": "Known domains associated with Tor or multi-hop proxy infrastructure."
        },
        "suspicious_wmi_apps": {
          "from": {
            "ref": "elastic-security-labs-agentic-soc",
            "kind": "article",
            "observed": "2026-07-31"
          },
          "type": "list[string]",
          "default": [
            "cmd.exe",
            "powershell.exe",
            "pwsh.exe",
            "scrcons.exe",
            "cscript.exe",
            "wscript.exe"
          ],
          "description": "Standard shells or script engines often used by attackers via WMI."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.elastic.co/security-labs/blog/agentic-soc-alert-triage-alertzero",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.elastic.co/security-labs/blog/agentic-soc-alert-triage-alertzero",
          "name": "Alert Zero: AI-driven alert triage and attack investigation for the agentic SOC"
        }
      ],
      "blind_spots": [
        {
          "id": "no-dns-process-correlation",
          "risk": "If the DNS source does not attribute queries to a PID, correlating the C2 traffic to the WMI-spawned shell requires manual alignment of timestamps.",
          "stage": "command-and-control-proxy",
          "question": "Which process initiated the proxy DNS query?",
          "requires": "process context in hb_dns_activity"
        },
        {
          "id": "dns-over-https-bypass",
          "risk": "Standard DNS logging cannot see proxy resolutions performed over encrypted HTTPS tunnels, leaving a gap in the network-side evidence.",
          "stage": "command-and-control-proxy",
          "question": "Are proxy domains being resolved via DoH?",
          "requires": "TLS inspection or endpoint DoH monitoring"
        }
      ]
    },
    "name": "WMI Lateral Movement and Proxy-based C2",
    "description": "This hunt identifies the dual behavior of internal lateral movement via Windows Management Instrumentation (WMI) and external command-and-control (C2) obfuscation via multi-hop proxies. It begins by scoping the environment for Windows-based systems that could be targets of WMI execution. A fan-out investigation then searches for suspicious child processes of the legitimate WMI provider (wmiprvse.exe) while simultaneously identifying DNS resolutions for known proxy and Tor infrastructure. An agent weighs these signals together to identify the complete attack chain described in the Alert Zero research, specifically looking for process-level relationships between WMI execution and proxy networking."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "lateral-movement-wmi",
            "steps": [
              "identify-windows-hosts",
              "wmi-activity-search"
            ],
            "status": "covered"
          },
          {
            "stage": "command-and-control-proxy",
            "steps": [
              "proxy-dns-search"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An intruder has moved laterally using WMI to execute code on internal Windows hosts and is maintaining command-and-control through multi-hop proxies or Tor to obfuscate traffic.",
        "blind_spots": [
          {
            "id": "no-dns-process-correlation",
            "risk": "If the DNS source does not attribute queries to a PID, correlating the C2 traffic to the WMI-spawned shell requires manual alignment of timestamps.",
            "stage": "command-and-control-proxy",
            "question": "Which process initiated the proxy DNS query?",
            "requires": "process context in hb_dns_activity"
          },
          {
            "id": "dns-over-https-bypass",
            "risk": "Standard DNS logging cannot see proxy resolutions performed over encrypted HTTPS tunnels, leaving a gap in the network-side evidence.",
            "stage": "command-and-control-proxy",
            "question": "Are proxy domains being resolved via DoH?",
            "requires": "TLS inspection or endpoint DoH monitoring"
          }
        ],
        "scoping_notes": "The hunt scopes every Windows host because WMI lateral movement can target any system with RPC or WinRM enabled. The behavioral queries focus on the WMI provider (wmiprvse.exe), which is the standard host for remote-triggered execution.",
        "beyond_detection": "A single rule on WMI execution or proxy DNS queries often generates high noise from administrative tools or browser extensions. This hunt uses a funnel flow to combine these signals, utilizing an agent to confirm the relationship between the execution lineage and the networking behavior before a decision is reached."
      }
    },
    {
      "id": "identify-windows-hosts",
      "type": "query",
      "label": "Identify Windows hosts",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT hostname AS device_hostname FROM hb_devices WHERE LOWER(platform) = 'windows' AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_devices",
        "description": "Identify every Windows system reporting inventory to focus the lateral movement search.",
        "expected_signal": "A list of hostnames. Silence indicates no Windows systems are reporting in the window."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify Windows hosts",
        "reads": [
          "hostname",
          "platform",
          "time"
        ],
        "source": "hb_devices",
        "target": "endpoint",
        "content": "SELECT DISTINCT hostname AS device_hostname FROM hb_devices WHERE LOWER(platform) = 'windows' AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames. Silence indicates no Windows systems are reporting in the window.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "wmi-activity-search",
      "type": "query",
      "label": "Suspicious WMI child processes",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, pid, user_name, time FROM hb_process_activity WHERE LOWER(parent_process_name) LIKE '%\\\\wmiprvse.exe' AND (instr(',' || '{{suspicious_wmi_apps}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_path) NOT LIKE 'c:\\\\windows\\\\system32\\\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Identify instances where the WMI provider process (wmiprvse.exe) spawns shells, scripts, or binaries from non-system paths.",
        "expected_signal": "Processes spawned by WMI. Legitimate administrative tools may appear; rarity and command context are the primary signals."
      },
      "parents": [
        {
          "id": "identify-windows-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Suspicious WMI child processes",
        "reads": [
          "device_hostname",
          "process_name",
          "process_cmd_line",
          "parent_process_name",
          "pid",
          "user_name",
          "time",
          "process_path"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, pid, user_name, time FROM hb_process_activity WHERE LOWER(parent_process_name) LIKE '%\\\\wmiprvse.exe' AND (instr(',' || '{{suspicious_wmi_apps}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_path) NOT LIKE 'c:\\\\windows\\\\system32\\\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Processes spawned by WMI. Legitimate administrative tools may appear; rarity and command context are the primary signals.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "proxy-dns-search",
      "type": "query",
      "label": "Proxy and Tor DNS prevalence",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT query_hostname, device_hostname, process_name, pid, COUNT(*) as query_count, MIN(time) as first_seen FROM hb_dns_activity WHERE (query_hostname LIKE '%.onion' OR query_hostname LIKE '%.hiddenservice.net' OR instr(',' || '{{proxy_indicators}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY query_hostname, device_hostname, process_name, pid",
        "surface": "hb_dns_activity",
        "description": "Find DNS resolutions for .onion domains or known proxy gateways and stack-count them to isolate rare outliers.",
        "expected_signal": "DNS queries to proxy domains. Any hit on a host that also shows suspicious WMI activity is the primary indicator of the attack chain."
      },
      "parents": [
        {
          "id": "identify-windows-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Proxy and Tor DNS prevalence",
        "reads": [
          "device_hostname",
          "query_hostname",
          "process_name",
          "pid",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT query_hostname, device_hostname, process_name, pid, COUNT(*) as query_count, MIN(time) as first_seen FROM hb_dns_activity WHERE (query_hostname LIKE '%.onion' OR query_hostname LIKE '%.hiddenservice.net' OR instr(',' || '{{proxy_indicators}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY query_hostname, device_hostname, process_name, pid",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "DNS queries to proxy domains. Any hit on a host that also shows suspicious WMI activity is the primary indicator of the attack chain.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "query_hostname"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "triage-findings",
      "type": "analytic",
      "label": "Triage findings",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint"
        ],
        "context": [
          "wmi-activity-search",
          "proxy-dns-search"
        ],
        "objective": "Correlate the process identity (PID or process name) from the DNS findings with the WMI child process tree to determine if the same lineage or user context is performing both lateral movement and external C2.",
        "description": "Weigh the evidence from WMI execution and proxy networking to identify hosts showing the complete intrusion narrative.",
        "max_iterations": 4,
        "expected_signal": "A per-host verdict linking suspicious execution to proxy-based networking.",
        "success_criteria": "A verdict of malicious | suspicious | benign per host, citing matching PIDs or process names."
      },
      "parents": [
        {
          "id": "wmi-activity-search",
          "kind": "merge"
        },
        {
          "id": "proxy-dns-search",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "verdict-decision",
      "type": "checkpoint",
      "label": "Verdict decision",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious for at least one host involving suspicious WMI execution and proxy DNS activity",
        "condition": "the triage verdict is malicious for at least one host involving suspicious WMI execution and proxy DNS activity",
        "blind_spot": "no-dns-process-correlation",
        "confidence": "high",
        "description": "Route the hunt based on the agent correlation of execution and networking.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-findings"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate host",
      "config": {
        "target": "endpoint",
        "description": "Contain the affected endpoint to prevent further lateral movement or data exfiltration.",
        "instructions": "Isolate the host identified as malicious and terminate the PIDs associated with the suspicious WMI activity and proxy connections.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "verdict-decision",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst review and network pivot",
      "config": {
        "assignee": "analyst",
        "description": "Verify the agent findings and identify the source of the WMI connection.",
        "instructions": "Review the cited rows from the triage step. Pivot to hb_network_connection to identify the source IP address that initiated the RPC (port 135) or WinRM (5985/5986) connection to the target host to find the upstream beachhead."
      },
      "parents": [
        {
          "id": "verdict-decision",
          "branch": "default"
        },
        {
          "id": "verdict-decision",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out-task",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Document the hunt result and recommend tuning for administrative noise.",
        "instructions": "Document whether the activity represented a true positive intrusion. If the activity was legitimate administrative WMI use, record the specific process command lines to tune the detection candidate."
      },
      "parents": [
        {
          "id": "verdict-decision",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-review"
        }
      ]
    }
  ]
}