Reconnaissance threat hunts
6 hunts covering reconnaissance, each with a hypothesis, the queries that test it and what the hunt cannot see.
6 hunts
-
high Part 3 of 3Research by Microsoft
Zimbra secrets theft and cluster propagation
An intruder is using Zimbra administrative utilities to dump service credentials and move laterally to peer nodes using the zimbra service account's SSH identity.
5 query2 analytic1 checkpoint1 action2 taskCVE-2026-73570 -
high Part 2 of 3Research by Microsoft
Zimbra Privilege Escalation and Root Persistence
An intruder has escalated from the Zimbra service account to root by symlinking application logs to PAM configurations and established persistence through a rare systemd service.
3 query1 analytic1 checkpoint1 action2 taskCVE-2026-73570 -
high Part 1 of 3Research by Microsoft
Zimbra CVE-2026-73570 RCE and JSP Web Shell Entry
An attacker is exploiting CVE-2026-73570 on internet-facing Zimbra servers to execute commands via the SNMP path and drop JSP web shells in the webroot for persistence.
4 query2 analytic2 checkpoint1 action2 taskCVE-2026-73570 -
mediumResearch by Microsoft
Interaction with BEC Lookalike Infrastructure
An employee has received a BEC email and is interacting with lookalike infrastructure to view a fake invoice or initiate a fraudulent payment.
3 query2 analytic2 checkpoint1 action2 taskinitial access · reconnaissance · resource development -
high Part 2 of 2Research by Huntress
RMM-Driven Endpoint Lateral Movement and Masquerading
An intruder who has compromised an N-central appliance is abusing the Take Control feature to drop masqueraded binaries in user folders and perform process enumeration on managed hosts.
3 query1 analytic1 checkpoint1 action2 taskCVE-2026-18556 · CVE-2026-18577 -
high Part 1 of 2Research by Huntress
N-central Web Exploitation and Persistence
An attacker has exploited unauthenticated N-central web vulnerabilities to gain administrative control, subsequently establishing persistence through rogue user accounts and Cloudflare protocol tunnels.
5 query2 analytic1 checkpoint1 action2 taskCVE-2026-18556 · CVE-2026-18577