Huntbase Hub

Huntbase Hub · All hunts

Threat hunts for Google Workspace

6 hunts covering Google Workspace, each with a hypothesis, the queries that test it and what the hunt cannot see.

6 hunts

  1. critical
    Research by Huntress

    ConnectWise M365 Application Abuse

    An adversary has exploited compromised ConnectWise (SkyKick) vendor credentials to access M365 tenants, escalate directory privileges, and persist by adding secrets to secondary applications.

    4 query2 analytic1 checkpoint1 action2 task
    credential access · initial access · persistence
  2. medium Part 2 of 2
    Research by Huntress

    Identity Compromise and SaaS Persistence

    An adversary has bypassed MFA via session hijacking or proxy usage and is establishing persistence through malicious inbox rules or unauthorized OAuth applications in a SaaS environment.

    3 query1 analytic1 checkpoint1 action2 task
    credential access · exfiltration · impact
  3. medium Part 1 of 2
    Research by Huntress

    AI Social Engineering and Ransomware Operations

    An adversary uses an AI-crafted social engineering lure to execute a loader that performs data staging or ransomware encryption.

    4 query2 analytic2 checkpoint1 action2 task
    credential access · exfiltration · impact
  4. high Part 2 of 2
    Research by Sekoia

    Identity-Led Cloud Abuse and Secret Discovery

    An attacker has used stolen credentials harvested from unmanaged devices to bypass MFA via push fatigue, subsequently discovering cloud secrets and internal shares to exfiltrate data.

    5 query2 analytic1 checkpoint1 action2 task
    credential access · impact · initial access
  5. high Part 1 of 2
    Research by Sekoia

    External Identity Exposure and Credential Leaks

    Adversaries are using corporate credentials harvested from unmanaged personal devices by infostealers to bypass authentication controls and gain initial access to cloud resources.

    3 query1 analytic1 checkpoint1 action2 task
    credential access · impact · initial access
  6. medium Part 1 of 2
    Research by Cisco Talos

    ClickFix Browser Injection and Extension Persistence

    An intruder has used a social engineering lure to trick a user into manually injecting a JavaScript loader or installing a malicious Tampermonkey script that facilitates persistent cryptocurrency theft via the Google Visualization API.

    5 query2 analytic1 checkpoint1 action2 task
    collection · command and control · execution