Threat Hunts

#1 Jul 6, 2026

Hunt TeamPCP package tampering that turns CI tokens into cloud access

Hypothesis: An adversary poisons CI and Python packages to harvest pipeline credentials, then reuses those tokens for cloud control-plane access from outside the runner context.

Why it matters: Vectra reported TeamPCP tampering against Trivy, Checkmarx KICS, LiteLLM, and the Telnyx Python SDK, with more than 500,000 cloud credentials collected before ransomware targeting. The durable discriminator is package or runner execution tied to credential file access, then token use for privileged cloud actions.

Starter hunt: Start in EDR process/file telemetry from CI runners and developer hosts, plus CloudTrail, Azure Activity, GCP Admin Activity, and identity logs. Correlate litellm_init.pth, affected scanner or SDK execution, or docs-tpcp repo creation with CreateAccessKey, AssumeRole, iam:PassRole, serviceAccountKeys.create, or federated credential changes by the same automation identity.

Endpoint T1195 T1552 T1528 T1078 T1098

Source: VECT and TeamPCP: The Ransomware Kill Chain, Reversed by Lucie Cardiet

#2 Jul 6, 2026

Hunt Scattered Spider help-desk resets that turn into tunneled exfiltration

Hypothesis: Scattered Spider operators socially engineer password and MFA resets, then use the recovered identity to reach privileged systems and stage data through ngrok, Teleport, or cloud storage.

Why it matters: Vectra reported that the FBI complaint documented vishing, MFA reset, access to cloud and virtualization systems, ngrok installation, Teleport use, and S3 exfiltration. The durable control is the ordered chain of account recovery, privileged access, tunnel creation, and bulk transfer, not sign-in success alone.

Starter hunt: Start in identity provider audit logs, Windows security events, EDR process/network telemetry, and cloud audit logs. Correlate `password reset`, `MFA method change`, `source IP address`, `session ID`, `process command line`, and `destination domain` when account recovery is followed by privileged access, `ngrok` or `teleport` execution, and object storage uploads by the same identity or host.

Endpoint T1078 T1098 T1572 T1567.002

Source: The FBI wrote down the Scattered Spider playbook, and it starts with a phone call by Lucie Cardiet

#3 Jul 6, 2026

Hunt Miasma npm install scripts that steal developer tokens

Hypothesis: A malicious npm package install script runs under npm or node, reads developer credential files, then uses stolen registry or GitHub tokens to publish poisoned packages.

Why it matters: SOCRadar reported 96 malicious versions across 32 @redhat-cloud-services packages published through Red Hat's GitHub Actions OIDC path. The durable discriminator is install-time package-manager lineage plus credential-file reads and publish or cloud-token use, not the package namespace or provenance alone.

Starter hunt: Start in EDR process, file, and network telemetry on developer workstations and CI runners. Correlate npm, yarn, pnpm, or node postinstall children spawning shells, curl, wget, git, or cloud CLIs with reads of `.npmrc`, `.ssh`, `.git-credentials`, `.aws`, `.config/gcloud`, or `.azure`, then npm publish or cloud API use from the same process tree.

Endpoint T1195 T1059.007 T1552.001 T1528 T1105

Source: June 2026: FortiBleed Cracks Fortinet Firewalls, Supply Chain Worms Hit npm and PyPI

#4 Jul 6, 2026

Hunt SharePoint CVE-2026-45659 server-side execution from low-privileged access

Hypothesis: An adversary with Site Member access exploits CVE-2026-45659 so SharePoint worker processes execute code under the farm context and create a web shell, scheduled task, or service.

Why it matters: SOCRadar reported CISA KEV active exploitation and low-privilege authenticated RCE. The discriminator is the server-side execution chain from SharePoint worker or timer process into shell, web shell, or persistence activity. SharePoint patching can be noisy, but it should not produce those child processes or service-account web root writes.

Starter hunt: Start in EDR process/file telemetry on SharePoint servers and AD authentication logs. Correlate a low-privileged SharePoint login with w3wp.exe or OWSTIMER.EXE spawning cmd.exe, powershell.exe, cscript.exe, mshta.exe, rundll32.exe, or certutil.exe, then ASPX or config writes under SharePoint web roots, a scheduled task, service, WMI persistence, or access to web.config secrets.

Endpoint T1190 T1505.003 T1053.005 T1059.001

Source: CISA Flags SharePoint RCE (CVE-2026-45659) for Active Exploitation

#5 Jul 6, 2026

Hunt BlueHammer privilege escalation before ransomware staging

Hypothesis: An adversary with local code execution abuses Microsoft Defender CVE-2026-33825 during remediation to move from a user context to SYSTEM, then touches local credential stores or stages ransomware.

Why it matters: SecurityWeek and BleepingComputer reported that CISA now flags CVE-2026-33825 as exploited in ransomware campaigns after earlier zero-day use. The discriminator is the ordered remediation abuse to SYSTEM execution and credential or staging behavior, not Defender activity by itself.

Starter hunt: Start in EDR process, file, registry, and Microsoft Defender remediation telemetry. Correlate a user-writable path that triggers Defender cleanup with NTFS junction behavior or writes into System32, then a new SYSTEM-owned cmd.exe, powershell.exe, service, or scheduled task that accesses SAM, SECURITY, or shadow copy data.

Endpoint T1068 T1059 T1003.002 T1543.003

Source: BlueHammer Vulnerability Exploited in Ransomware Attacks

#6 Jul 6, 2026

Hunt SimpleHelp sessions that launch TaskWeaver and touch developer secrets

Hypothesis: An adversary abuses a SimpleHelp technician session to launch a Node.js loader named jquery.js, then reads developer and cloud credential stores before sending encrypted outbound C2.

Why it matters: SOCRadar reported active CVE-2026-48558 exploitation against SimpleHelp with TaskWeaver and Djinn Stealer. The control is the ordered chain of abused remote support, Node loader staging, secret store reads, and non SimpleHelp C2, not whether SimpleHelp is installed.

Starter hunt: Start in EDR process, file, and network telemetry on developer or admin endpoints. Correlate SimpleHelp service lineage spawning `node.exe`, script hosts, PowerShell, or a user-writable executable with `jquery.js` or `jsquery.js` staging, then rapid reads of browser cookies, `.ssh`, `.aws`, `.npmrc`, Docker config, source-control tokens, or AI tool config files.

Endpoint T1219 T1059.007 T1105 T1555 T1005

Source: CVE-2026-48558: SimpleHelp OIDC Auth Bypass Used to Deploy Infostealer Payloads

#7 Jul 6, 2026

Hunt GigaWiper fake OneDrive persistence before destructive commands

Hypothesis: An adversary deploys GigaWiper as a post-compromise backdoor, keeps state under a fake OneDrive registry key, and uses a recurring task to reach destructive disk, boot, or fake-ransomware commands.

Why it matters: Microsoft reported GigaWiper as a Go backdoor that keeps persistence through a OneDrive Update scheduled task and can trigger raw disk wiping, fake ransomware encryption, boot sabotage, screen capture, and remote control. The durable pivot is the ordered chain of fake OneDrive persistence, registry state, C2, and destructive disk or boot activity, not the IPs or hashes.

Starter hunt: Start in Windows scheduled task, EDR process, registry, file, and network telemetry. Correlate a task named `OneDrive Update` running a non-OneDrive binary with `HKCU\SOFTWARE\OneDrive\Environment`, AMQP or Redis connections, `C:\ProgramData\output`, raw `\\.\PHYSICALDRIVE*` writes, `.candy` renames, or boot recovery deletion.

Endpoint T1053.005 T1112 T1485 T1490 T1486 T1113

Source: GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

#8 Jul 6, 2026

Hunt device code token replay into M365 resource access

Hypothesis: An adversary abuses Device Authorization Grant to capture OAuth tokens, then replays them into M365 resources without a fresh interactive sign-in.

Why it matters: Securelist reported an active device code flow where the victim enters the code on a legitimate login page and completes MFA. The durable discriminator is the ordered chain of DeviceCodeSignIn, token reuse from a different ASN or user agent, and mailbox or file access tied to the same user.

Starter hunt: Start in Entra sign-in logs, non-interactive sign-in logs, and M365 audit logs. Correlate DeviceCodeSignIn with later Exchange, SharePoint, OneDrive, or Teams access from a different ASN or user agent without fresh interactive auth, then pivot on session ID, client request ID, app ID, scopes, and MailItemsAccessed.

Identity T1528 T1550 T1078 T1114

Source: When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website

#9 Jul 6, 2026

Hunt ConsentFix token redemption into Microsoft 365 resource access

Hypothesis: An adversary tricks a user into dragging a localhost OAuth callback into the browser, then replays the resulting Microsoft 365 token from a new ASN without a fresh interactive sign-in.

Why it matters: Malwarebytes reported ConsentFix as a malwareless account theft flow that can hand attackers Microsoft 365 tokens after a user drags a localhost callback link into the browser. The durable discriminator is token replay from a new ASN followed by resource access tied to the same session ID or client request ID, not the phishing theme.

Starter hunt: Start in Entra interactive and non-interactive sign-in logs plus M365 audit logs. Correlate by session ID or client request ID when an OAuth localhost callback such as `http://localhost:<port>/?code=` is followed by same-user token replay from a new ASN, no fresh interactive auth, then MailItemsAccessed, Graph, SharePoint, or OneDrive reads.

Identity T1528 T1550.001 T1114.002

Source: Verified X ad spreads Mac malware, while ConsentFix steals Microsoft accounts

#10 Jul 6, 2026

Hunt ClickFix PowerShell staging into ResiLoader and StealC

Hypothesis: A ClickFix page convinces a user to run PowerShell, which stages payloads in C:\ProgramData\Zooms and uses DLL sideloading and process hollowing to deploy StealC.

Why it matters: Malwarebytes reported active ClickFix pages distributing ResiLoader, StealC, and other malware. The durable discriminator is the copied PowerShell to Zooms staging, DLL hijack, tamper, and persistence chain, not the verification page text.

Starter hunt: Start in EDR process, file, registry, module-load, driver-load, and network telemetry. Correlate user-run PowerShell containing `iex` with `irm`, `iwr`, `wget`, or `curl`, creation of `C:\ProgramData\Zooms` or `tmp*.tmp.ps1`, `ssh-add.exe` with msys DLLs from Temp, pcdhost.sys driver activity, a fake Google Update Run key, or ServiceModelReg.exe hollowing.

Endpoint T1059.001 T1105 T1574.002 T1547.001 T1055 T1562.001

Source: Fake Google and Cloudflare verification pages spread multiple malware families

#11 Jul 6, 2026

Hunt Qilin Svchosts.exe staging before recovery impairment

Hypothesis: A Qilin operator stages a lookalike Svchosts.exe from a non-system path, then destroys shadow copies and recovery data before encryption spreads to more hosts.

Why it matters: Halcyon reported Qilin used a one-character svchost.exe masquerade and reached 30 endpoints before encryption was stopped. The durable pivot is a non-system service-host lookalike chained to recovery impairment and spread, not a backup command by itself.

Starter hunt: Start in EDR process/file telemetry and Windows security events. Correlate Svchosts.exe or close svchost.exe lookalikes running from user profile, ProgramData, Temp, Public, or admin shares with vssadmin delete shadows, wmic shadowcopy delete, wbadmin delete catalog, bcdedit recovery changes, or diskshadow scripts across more than one host.

Endpoint T1036 T1490 T1486 T1021 T1569 T1053

Source: How One Letter Hid a Ransomware Army

#12 Jul 6, 2026

Hunt GodDamn credential theft into BYOVD impairment and PsExec fan-out

Hypothesis: A GodDamn operator harvests local credential stores, uses PsExec for lateral movement, then loads a signed driver or masqueraded security binary to impair endpoint defenses before encryption.

Why it matters: GBHackers reported GodDamn activity using PsExec lateral movement and NirSoft credential theft. Additional reporting tied the chain to AnyDesk deployment, symantec.exe, and g11.sys. The durable discriminator is the ordered chain of credential-store collection, remote execution, driver or security-binary impairment, then encryption.

Starter hunt: Start in EDR process, file, driver load, service creation, and Windows remote logon telemetry. Correlate NirSoft-style utilities or browser credential-store reads with PsExec service creation across hosts, then g11.sys, symantec.exe, security process termination, AnyDesk service creation, and ransomware file renames.

Endpoint T1555 T1003 T1021 T1569 T1570 T1562

Source: GodDamn Ransomware Attack Uses PsExec Lateral Movement and NirSoft Toolkit for Credential Theft

#13 Jul 6, 2026

Hunt ROPC token minting through Azure CLI into Microsoft 365 access

Hypothesis: An adversary uses valid passwords in the OAuth ROPC flow as Azure CLI to mint Microsoft 365 tokens without an interactive MFA challenge, then reads mail or admin resources.

Why it matters: Huntress reported 81 million login attempts from an LSHIY IPv6 range, with 78 compromised accounts across 64 organizations and 55 of those accounts covered by MFA Conditional Access policies. The durable discriminator is password-grant token issuance by a public client followed by resource access without fresh interactive auth, not the source IPv6 range.

Starter hunt: Start in Entra sign-in logs, non-interactive sign-in logs, and M365 audit logs. Correlate successful ROPC or password-grant sign-ins where the client app is Azure CLI with no MFA challenge, then same-user Exchange, Graph, SharePoint, OneDrive, or admin activity tied by session ID or client request ID.

Identity T1078 T1110 T1528

Source: Conditional Access Misconfigurations Exposed 55 Orgs with MFA On

#14 Jul 6, 2026

Hunt helpdesk MFA re-enrollment that turns into mailbox and file access

Hypothesis: An adversary social engineers a helpdesk reset, enrolls or transfers MFA to an attacker device, then uses the new factor to access mail or shared files from that session.

Why it matters: Field Effect described helpdesk-driven incidents where attackers impersonate employees, reset passwords, transfer MFA, then scrape email and document shares. The false-positive control is the full chain of support action, new-factor use, and immediate data access, which separates it from normal device replacement.

Starter hunt: Start in Entra audit and sign-in logs plus Microsoft 365 audit logs. Correlate password reset, admin password reset, phone add, FIDO or passkey registration, or MFA method transfer with the first sign-in using that method, then MailItemsAccessed, inbox rule creation, SharePoint or OneDrive enumeration, or external sharing by the same user.

Identity T1098 T1556.006 T1078.004 T1114 T1621

Source: Anatomy of a helpdesk social engineering attack (and how to stop MFA bypass)

#15 Jul 6, 2026

Hunt attacker-controlled Entra passkey registration into Microsoft 365 data access

Hypothesis: A vishing operator registers an attacker-controlled FIDO or passkey method on a victim account, then uses that method to read SharePoint or OneDrive from a new ASN.

Why it matters: GBHackers reported an operator-controlled vishing campaign abusing Entra passkey enrollment for account takeover and extortion. The durable discriminator is registered new FIDO or passkey authentication followed by resource access from attacker infrastructure, not the page branding or call script.

Starter hunt: Start in Entra sign-in logs, authentication-method audit logs, and Microsoft 365 audit logs. Correlate successful MFA with registered new FIDO or passkey authentication, then SharePoint or OneDrive enumeration or downloads from a new ASN, device, or user agent. Pivot by session ID and client request ID.

Identity T1566 T1078 T1098 T1530

Source: Microsoft Entra Passkey Enrollment Abused in Operator-Controlled Vishing Campaign

#1 Jun 29, 2026

Hunt Miasma npm install scripts that steal developer tokens

Hypothesis: A malicious npm package install script runs under npm or node, reads developer credential files, then uses stolen registry or GitHub tokens to publish poisoned packages.

Why it matters: SOCRadar reported 96 malicious versions across 32 @redhat-cloud-services packages published through Red Hat's GitHub Actions OIDC path. The durable discriminator is install-time package-manager lineage plus credential-file reads and publish or cloud-token use, not the package namespace or provenance alone.

Starter hunt: Start in EDR process, file, and network telemetry on developer workstations and CI runners. Correlate npm, yarn, pnpm, or node postinstall children spawning shells, curl, wget, git, or cloud CLIs with reads of `.npmrc`, `.ssh`, `.git-credentials`, `.aws`, `.config/gcloud`, or `.azure`, then npm publish or cloud API use from the same process tree.

Endpoint T1195 T1059.007 T1552.001 T1528 T1105

Source: June 2026: FortiBleed Cracks Fortinet Firewalls, Supply Chain Worms Hit npm and PyPI

#2 Jun 29, 2026

Hunt SharePoint CVE-2026-45659 server-side execution from low-privileged access

Hypothesis: An adversary with Site Member access exploits CVE-2026-45659 so SharePoint worker processes execute code under the farm context and create a web shell, scheduled task, or service.

Why it matters: SOCRadar reported CISA KEV active exploitation and low-privilege authenticated RCE. The discriminator is the server-side execution chain from SharePoint worker or timer process into shell, web shell, or persistence activity. SharePoint patching can be noisy, but it should not produce those child processes or service-account web root writes.

Starter hunt: Start in EDR process/file telemetry on SharePoint servers and AD authentication logs. Correlate a low-privileged SharePoint login with w3wp.exe or OWSTIMER.EXE spawning cmd.exe, powershell.exe, cscript.exe, mshta.exe, rundll32.exe, or certutil.exe, then ASPX or config writes under SharePoint web roots, a scheduled task, service, WMI persistence, or access to web.config secrets.

Endpoint T1190 T1505.003 T1053.005 T1059.001

Source: CISA Flags SharePoint RCE (CVE-2026-45659) for Active Exploitation

#3 Jun 29, 2026

Hunt BlueHammer privilege escalation before ransomware staging

Hypothesis: An adversary with local code execution abuses Microsoft Defender CVE-2026-33825 during remediation to move from a user context to SYSTEM, then touches local credential stores or stages ransomware.

Why it matters: SecurityWeek and BleepingComputer reported that CISA now flags CVE-2026-33825 as exploited in ransomware campaigns after earlier zero-day use. The discriminator is the ordered remediation abuse to SYSTEM execution and credential or staging behavior, not Defender activity by itself.

Starter hunt: Start in EDR process, file, registry, and Microsoft Defender remediation telemetry. Correlate a user-writable path that triggers Defender cleanup with NTFS junction behavior or writes into System32, then a new SYSTEM-owned cmd.exe, powershell.exe, service, or scheduled task that accesses SAM, SECURITY, or shadow copy data.

Endpoint T1068 T1059 T1003.002 T1543.003

Source: BlueHammer Vulnerability Exploited in Ransomware Attacks

#4 Jun 29, 2026

Hunt SimpleHelp sessions that launch TaskWeaver and touch developer secrets

Hypothesis: An adversary abuses a SimpleHelp technician session to launch a Node.js loader named jquery.js, then reads developer and cloud credential stores before sending encrypted outbound C2.

Why it matters: SOCRadar reported active CVE-2026-48558 exploitation against SimpleHelp with TaskWeaver and Djinn Stealer. The control is the ordered chain of abused remote support, Node loader staging, secret store reads, and non SimpleHelp C2, not whether SimpleHelp is installed.

Starter hunt: Start in EDR process, file, and network telemetry on developer or admin endpoints. Correlate SimpleHelp service lineage spawning `node.exe`, script hosts, PowerShell, or a user-writable executable with `jquery.js` or `jsquery.js` staging, then rapid reads of browser cookies, `.ssh`, `.aws`, `.npmrc`, Docker config, source-control tokens, or AI tool config files.

Endpoint T1219 T1059.007 T1105 T1555 T1005

Source: CVE-2026-48558: SimpleHelp OIDC Auth Bypass Used to Deploy Infostealer Payloads

#5 Jun 29, 2026

Hunt ConsentFix token redemption into Microsoft 365 resource access

Hypothesis: An adversary tricks a user into dragging a localhost OAuth callback into the browser, then replays the resulting Microsoft 365 token from a new ASN without a fresh interactive sign-in.

Why it matters: Malwarebytes reported ConsentFix as a malwareless account theft flow that can hand attackers Microsoft 365 tokens after a user drags a localhost callback link into the browser. The durable discriminator is token replay from a new ASN followed by resource access tied to the same session ID or client request ID, not the phishing theme.

Starter hunt: Start in Entra interactive and non-interactive sign-in logs plus M365 audit logs. Correlate by session ID or client request ID when an OAuth localhost callback such as `http://localhost:<port>/?code=` is followed by same-user token replay from a new ASN, no fresh interactive auth, then MailItemsAccessed, Graph, SharePoint, or OneDrive reads.

Identity T1528 T1550.001 T1114.002

Source: Verified X ad spreads Mac malware, while ConsentFix steals Microsoft accounts

#6 Jun 29, 2026

Hunt ClickFix PowerShell staging into ResiLoader and StealC

Hypothesis: A ClickFix page convinces a user to run PowerShell, which stages payloads in C:\ProgramData\Zooms and uses DLL sideloading and process hollowing to deploy StealC.

Why it matters: Malwarebytes reported active ClickFix pages distributing ResiLoader, StealC, and other malware. The durable discriminator is the copied PowerShell to Zooms staging, DLL hijack, tamper, and persistence chain, not the verification page text.

Starter hunt: Start in EDR process, file, registry, module-load, driver-load, and network telemetry. Correlate user-run PowerShell containing `iex` with `irm`, `iwr`, `wget`, or `curl`, creation of `C:\ProgramData\Zooms` or `tmp*.tmp.ps1`, `ssh-add.exe` with msys DLLs from Temp, pcdhost.sys driver activity, a fake Google Update Run key, or ServiceModelReg.exe hollowing.

Endpoint T1059.001 T1105 T1574.002 T1547.001 T1055 T1562.001

Source: Fake Google and Cloudflare verification pages spread multiple malware families

#7 Jun 29, 2026

Hunt Qilin Svchosts.exe staging before recovery impairment

Hypothesis: A Qilin operator stages a lookalike Svchosts.exe from a non-system path, then destroys shadow copies and recovery data before encryption spreads to more hosts.

Why it matters: Halcyon reported Qilin used a one-character svchost.exe masquerade and reached 30 endpoints before encryption was stopped. The durable pivot is a non-system service-host lookalike chained to recovery impairment and spread, not a backup command by itself.

Starter hunt: Start in EDR process/file telemetry and Windows security events. Correlate Svchosts.exe or close svchost.exe lookalikes running from user profile, ProgramData, Temp, Public, or admin shares with vssadmin delete shadows, wmic shadowcopy delete, wbadmin delete catalog, bcdedit recovery changes, or diskshadow scripts across more than one host.

Endpoint T1036 T1490 T1486 T1021 T1569 T1053

Source: How One Letter Hid a Ransomware Army

#8 Jun 29, 2026

Hunt Anubis tunnel and exfil tooling before .anubis staging

Hypothesis: Anubis ransomware operators move over RDP or SMB to high value servers, open cloudflared or SSH SOCKS tunnels, then run exfiltration tools before .anubis encryption staging.

Why it matters: Arctic Wolf reported 2026 Anubis intrusions using RDP or SMB movement, cloudflared, SSH SOCKS, rclone, s5cmd, WinSCP, PuTTY, and .anubis encryption artifacts. The durable discriminator is the ordered tunnel, exfiltration, and staging chain, not whether any single admin tool is approved.

Starter hunt: Start in EDR process/file/network telemetry and Windows security logon events on servers. Correlate RDP or SMB logons with `cloudflared`, SSH SOCKS, `rclone`, `s5cmd`, `WinSCP`, or `PuTTY`, then pivot to `RESTORE FILES.html`, `.anubis` file writes, `ntds.dit` access, or shadow copy deletion on the same host.

Endpoint T1021.001 T1021.002 T1572 T1090 T1003 T1003.003

Source: From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks

#9 Jun 29, 2026

Hunt ARToken device code phishing that turns into M365 resource access

Hypothesis: An adversary uses OAuth device code phishing to obtain M365 tokens, then replays the refresh token or PRT from a different ASN to read mail, create inbox rules, or pull SharePoint and OneDrive files without fresh interactive auth.

Why it matters: Talos reported ARToken endpoints for device code phishing, PRT persistence, mailbox access, BEC, and SharePoint exfiltration. The durable discriminator is token replay from a different ASN plus same-user resource access without fresh auth, not the lure that got the user to enter the code.

Starter hunt: Start in Entra sign-in logs, non-interactive sign-in logs, M365 unified audit logs, mailbox audit, and SharePoint audit. Correlate OAuth device code auth with later refresh or PRT use from a new ASN, same session ID or client request ID, no fresh interactive auth, then MailItemsAccessed, inbox rule changes, external send, or SharePoint and OneDrive downloads.

Identity T1528 T1078.004 T1114.002 T1114.003 T1530

Source: ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365

#10 Jun 29, 2026

Hunt Azure CLI ROPC token issuance after password spraying

Hypothesis: An adversary validates breached passwords through Azure CLI's OAuth ROPC flow, then mints Entra ID user tokens without a fresh interactive MFA challenge.

Why it matters: CybersecurityNews reported active password spraying against Microsoft Azure CLI and legacy OAuth flows. The durable discriminator is the ordered chain of many failed password attempts from a new ASN, a successful Azure CLI ROPC token, and no fresh interactive MFA challenge, not a generic failed login spike.

Starter hunt: Start in Entra ID sign-in logs, token issuance logs, and Conditional Access details. Correlate many failed password attempts by source IP address or new ASN with a successful Azure CLI OAuth ROPC grant for the same user, then require no fresh interactive MFA event and pivot by session ID or client request ID into Graph or Azure management access.

Identity T1110.003 T1078.004 T1550.001 T1528

Source: Massive Automated Password Spray Attack Targeting Microsoft’s Azure Command-Line Interface

#11 Jun 29, 2026

Hunt fake freeware installers that side-load ScreenConnect into AsyncRAT

Hypothesis: An adversary delivers a fake freeware ZIP that side-loads install.res.1033.dll, installs ScreenConnect from a hidden Assets folder, then uses the RMM session to weaken Defender and run AsyncRAT.

Why it matters: Securelist reported the campaign using fake freeware sites, a Microsoft-signed install.exe, install.res.1033.dll side-loading, hidden ScreenConnect, Defender exclusions, C:\Users\Public staging, and AsyncRAT. The discriminator is the installer lineage plus RMM child behavior, not ScreenConnect by itself.

Starter hunt: Start in EDR process/file/module/registry telemetry, Windows scheduled task telemetry, Defender config changes, and DNS logs. Correlate browser-downloaded ZIP extraction with install.exe loading install.res.1033.dll from a user-writable path, hidden ScreenConnect install, scripts from C:\Users\Public, Defender exclusions, MasterPackager.Updater, and RegAsm.exe injection.

Endpoint T1204.002 T1574.002 T1219 T1059.001 T1562.001 T1055.012

Source: The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign

#12 Jun 29, 2026

Hunt Bumblebee MSI side-loads that become AdaptixC2 before Akira

Hypothesis: An adversary delivers a trojanized enterprise-tool MSI, uses consent.exe to load msimg32.dll outside Windows system paths, then runs a renamed WAB binary as an AdaptixC2 beacon before ransomware staging.

Why it matters: DFIR Report tied this chain to Bumblebee and AdaptixC2 leading to Akira. The discriminator is the ordered MSI, non-system msimg32.dll side-load, renamed WAB beacon, and ransomware prep, not the presence of RustDesk or FileZilla.

Starter hunt: Start in EDR process, file, module, and network telemetry. Correlate msiexec.exe from Downloads or a network share with consent.exe loading msimg32.dll outside System32 or SysWOW64, then AdgNsy.exe or a renamed WAB.exe beaconing. Pivot to new privileged AD accounts, NTDS.dit access, Veeam credential access, FileZilla SFTP, RustDesk, or Akira staging.

Endpoint T1204 T1574 T1055 T1078 T1003 T1486

Source: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

#13 Jun 29, 2026

Hunt Klue OAuth token replay that drains Salesforce through trusted app access

Hypothesis: An adversary replays Salesforce OAuth tokens through the trusted Klue Battlecards connected app to query CRM objects without a fresh interactive sign-in from the user or service account.

Why it matters: SOCRadar reported the Klue breach and named Salesforce access. The durable discriminator is trusted-app OAuth replay paired with CRM object queries and no fresh sign-in, which separates exfiltration from normal connected-app use.

Starter hunt: Start in Salesforce Event Monitoring, setup audit, and IdP sign-in logs. Correlate Klue Battlecards OAuth activity against `/services/data/.../query` or `QueryMore` for `Account`, `Contact`, `Opportunity`, `Case`, quote, or support objects with no fresh interactive sign-in for the user or service account.

Identity T1528 T1550.001 T1078.004 T1213

Source: Klue Breach: What You Need to Know

#14 Jun 29, 2026

Hunt Windchill RCE that drops JSP web shells and spawns shells

Hypothesis: An adversary exploits PTC Windchill or FlexPLM to write JSP web shells, then uses the application server service account to spawn command interpreters or transfer tools.

Why it matters: Field Effect and CISA KEV tie this flaw to active exploitation. The discriminator is the web-shell file write followed by same-service-account execution or transfer behavior, not an exposure check.

Starter hunt: Start in EDR process/file telemetry on Windchill or FlexPLM servers. Pivot on `java.exe`, Tomcat, Windchill, or FlexPLM service processes writing `.jsp` under application, webroot, temp, or work directories, then correlate same-service-account `cmd.exe`, `powershell.exe`, `curl`, `wget`, archive tools, or outbound network activity.

Endpoint T1190 T1505.003 T1059 T1105 T1560 T1041

Source: Actively exploited PTC Windchill flaw allows unauthenticated RCE

#15 Jun 29, 2026

Hunt Chrome Native Messaging cookie theft followed by token replay

Hypothesis: An adversary uses an email-delivered JavaScript attachment to force-install a Chrome extension and native host so stolen browser session cookies can be replayed against cloud apps.

Why it matters: Malwarebytes reported browser session-cookie theft through forced Chrome extension and native-host abuse. The durable discriminator is endpoint cookie access paired with same-user cloud session reuse and resource reads without fresh sign-in.

Starter hunt: Start in EDR process/file/registry telemetry and Entra sign-in logs. Correlate `wscript.exe`, `cscript.exe`, or `powershell.exe` writing `NativeMessagingHosts`, `ExtensionInstallForcelist`, or `ExtensionSettings` under `AppData` or `ProgramData` with Chrome `Cookies` access, then same-user Graph, SharePoint, or OneDrive reads from a new ASN without fresh interactive auth.

Identity T1539 T1550.004 T1528 T1114

Source: Malware steals Chrome session cookies to take over your accounts

#16 Jun 29, 2026

Hunt photo ZIP shortcuts that install a Node.js implant and write dual Run keys

Hypothesis: An adversary uses a fake photo ZIP and PNG shortcut to run obfuscated PowerShell, stage a Node.js implant, weaken Defender controls, and write HKCU Run and RunOnce persistence.

Why it matters: Microsoft reported an active hospitality campaign. The durable discriminator is the ordered endpoint chain: photo ZIP, PNG-named LNK, PowerShell staging, Node.js execution, Defender tamper, and dual Run-key persistence.

Starter hunt: Start in EDR process/file/registry telemetry. Pivot on browser or Explorer extraction creating `photo-*.zip`, then `IMG-*.png.lnk` or `PHOTO-*.png.lnk` launching `powershell.exe`. Require Temp `.ps1` staging, `node.exe` or `csc.exe`/`cvtres.exe`, Defender exclusion changes, and `HKCU\...\Run` or `RunOnce` writes from the same chain.

Endpoint T1204.002 T1059.001 T1059.007 T1547.001 T1562.001 T1127

Source: Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

#17 Jun 29, 2026

Hunt WinRAR ADS extraction that plants Startup LNK loaders

Hypothesis: An adversary uses a crafted WinRAR archive to write a Startup shortcut through NTFS ADS traversal, then launches hidden PowerShell and in-memory stealer activity at logon.

Why it matters: CybersecurityNews reported the GIFTEDCROOK chain. The discriminator is WinRAR ADS traversal into Startup followed by hidden PowerShell and memory-loaded stealer behavior that reads browser data.

Starter hunt: Start in EDR process/file/registry telemetry. Pivot on `winrar.exe` or `rar.exe` creating `.lnk`, `.hta`, `.bat`, or script files under the user Startup folder after a downloaded archive opens. Correlate ADS traversal indicators with hidden `powershell.exe`, ProgramData payload writes, reflective loading, or browser credential-store reads.

Endpoint T1204.002 T1564.004 T1547.001 T1059.001 T1620 T1555.003

Source: New GIFTEDCROOK Chain Abuses WinRAR ADS and Reflective Loading to Steal Browser Data

#18 Jun 29, 2026

Hunt ToddyCat headless browser OAuth grants against Gmail

Hypothesis: An adversary copies an authenticated Chrome or Edge profile, launches it headless with remote debugging, and uses the live session to grant Google OAuth access to Gmail or Drive without a fresh interactive login.

Why it matters: Securelist reported ToddyCat's Umbrij using Shadow Token via Remote Debug against Google Workspace. The discriminator is copied browser profile, headless remote debugging, side-loaded loader ancestry, and a broad OAuth grant followed by Gmail or Drive API access, not a generic risky login.

Starter hunt: Start in EDR process and Windows scheduled task telemetry plus Google Workspace OAuth and Gmail audit logs. Correlate process lineage where `KasperskyEndpointSecurityEDRAvp` or side-loaded `BDSubWiz.exe`, `VSTestVideoRecorder.exe`, or `GoogleDesktop.exe` launches Chrome or Edge with `--remote-debugging-port`, `--headless`, and copied `--user-data-dir`, then Gmail or Drive API access without fresh interactive login.

Endpoint T1528 T1550.001 T1550.004 T1114.002 T1053.005 T1574.002

Source: ToddyCat: your hidden email assistant. Part 2

#19 Jun 29, 2026

Hunt AI coding agents that self-extend before touching developer secrets

Hypothesis: An adversary abuses an AI coding agent or MCP server to install a new runtime capability, then uses that same agent lineage to read developer credentials or source-control material.

Why it matters: Snyk reported agentic development risk across nearly 10,000 developer environments. The durable discriminator is self-extension followed by credential or repository access from the same process lineage, which cuts out normal package-manager use.

Starter hunt: Start in EDR process, file, and network telemetry on developer workstations. Correlate IDE, agent, or MCP server processes spawning npm, pip, npx, node, python, curl, wget, git, docker, bash, or zsh with user config or cache writes, then reads of .ssh, .aws, .gcloud, .npmrc, .pypirc, .git-credentials, browser cookies, or keychain files. Pivot to repo, workflow, token, or cloud CLI activity from the same lineage.

Endpoint T1195 T1059 T1105 T1552 T1555

Source: What nearly 10,000 developer environments reveal about agentic development risk

#20 Jun 29, 2026

Hunt The Gentlemen netsh trace captures written through ADMIN$

Hypothesis: The Gentlemen affiliates run netsh trace through cmd during ransomware staging, redirect trace output to remote ADMIN$ paths, then move into PsExec, GPO, or other lateral deployment.

Why it matters: Kaspersky tied this to The Gentlemen RaaS. The discriminator is the exact netsh trace command shape with remote ADMIN$ output plus adjacent lateral movement or staging from the same account.

Starter hunt: Start in EDR process and network telemetry. Pivot on `cmd.exe` launching `netsh trace start capture=yes report=no filemode=circular overwrite=yes maxSize=4` with output to `\\<host>\ADMIN$\...`, then correlate `netsh trace stop`, SMB admin-share writes, PsExec-style service creation, GPO changes, or ransomware staging by the same account.

Endpoint T1040 T1059.003 T1021.002 T1482 T1486

Source: The Gentlemen are knocking: сustom backdoors and evolving tactics

#21 Jun 29, 2026

Hunt WhatsApp VBScript that stages Endpoint Central from Public Documents

Hypothesis: Adversaries deliver VBS or VBE attachments over WhatsApp, then use WScript to stage hidden files under Public Documents and silently install a preconfigured Endpoint Central agent.

Why it matters: SOCRadar reported the WhatsApp VBScript campaign. The discriminator is chat-client or browser delivery into WScript, Public Documents staging, LOLBin download, and silent preconfigured RMM install.

Starter hunt: Start in EDR process/file telemetry. Correlate `WhatsApp.exe`, WhatsApp Web, or Explorer opening `.vbs` or `.vbe` with `wscript.exe` creating `C:\Users\Public\Documents\Temp_*` or `MSUpdate_*`, then `curl.exe`, `bitsadmin.exe`, `certutil.exe`, `powershell.exe`, or `msiexec.exe` staging a silent Endpoint Central install.

Endpoint T1566 T1204 T1059 T1105 T1036 T1219

Source: WhatsApp VBScript Campaign Installs ManageEngine Endpoint Central for Persistent Remote Access

#22 Jun 29, 2026

Hunt AWS AiTM capture that turns into IAM or S3 changes

Hypothesis: An adversary uses a Cloudflare-hosted AWS Console clone to capture credentials and MFA, then turns the resulting ConsoleLogin into IAM, STS, or S3 control-plane changes.

Why it matters: The source gives the useful first half of the chain: AWS Console clones, input_24 gating, /api/login and /api/auth collection, real-time MFA handling, and CloudTrail ConsoleLogin review. I would not stop at the login. Pair it with concrete cloud actions so the alert is about captured access being used, not a generic AWS sign-in.

Starter hunt: Hunt DNS or HTTP access to the source-listed AWS phishing domains followed within 60 minutes by CloudTrail ConsoleLogin for the same user. Escalate only if the same principal then runs CreateAccessKey, AttachUserPolicy, AssumeRole, PutBucketPolicy, PutBucketAcl, or changes S3 public access.

Identity T1566 T1557 T1078 T1098.001 T1537

Source: Hackers Abuse Cloudflare-Hosted AWS Phishing Domains to Steal Console Logins

#1 Jun 22, 2026

Hunt Klue OAuth token replay that drains Salesforce through trusted app access

Hypothesis: An adversary replays Salesforce OAuth tokens through the trusted Klue Battlecards connected app to query CRM objects without a fresh interactive sign-in from the user or service account.

Why it matters: SOCRadar reported the Klue breach and named Salesforce access. The durable discriminator is trusted-app OAuth replay paired with CRM object queries and no fresh sign-in, which separates exfiltration from normal connected-app use.

Starter hunt: Start in Salesforce Event Monitoring, setup audit, and IdP sign-in logs. Correlate Klue Battlecards OAuth activity against `/services/data/.../query` or `QueryMore` for `Account`, `Contact`, `Opportunity`, `Case`, quote, or support objects with no fresh interactive sign-in for the user or service account.

Identity T1528 T1550.001 T1078.004 T1213

Source: Klue Breach: What You Need to Know

#2 Jun 22, 2026

Hunt Windchill RCE that drops JSP web shells and spawns shells

Hypothesis: An adversary exploits PTC Windchill or FlexPLM to write JSP web shells, then uses the application server service account to spawn command interpreters or transfer tools.

Why it matters: Field Effect and CISA KEV tie this flaw to active exploitation. The discriminator is the web-shell file write followed by same-service-account execution or transfer behavior, not an exposure check.

Starter hunt: Start in EDR process/file telemetry on Windchill or FlexPLM servers. Pivot on `java.exe`, Tomcat, Windchill, or FlexPLM service processes writing `.jsp` under application, webroot, temp, or work directories, then correlate same-service-account `cmd.exe`, `powershell.exe`, `curl`, `wget`, archive tools, or outbound network activity.

Endpoint T1190 T1505.003 T1059 T1105 T1560 T1041

Source: Actively exploited PTC Windchill flaw allows unauthenticated RCE

#3 Jun 22, 2026

Hunt Chrome Native Messaging cookie theft followed by token replay

Hypothesis: An adversary uses an email-delivered JavaScript attachment to force-install a Chrome extension and native host so stolen browser session cookies can be replayed against cloud apps.

Why it matters: Malwarebytes reported browser session-cookie theft through forced Chrome extension and native-host abuse. The durable discriminator is endpoint cookie access paired with same-user cloud session reuse and resource reads without fresh sign-in.

Starter hunt: Start in EDR process/file/registry telemetry and Entra sign-in logs. Correlate `wscript.exe`, `cscript.exe`, or `powershell.exe` writing `NativeMessagingHosts`, `ExtensionInstallForcelist`, or `ExtensionSettings` under `AppData` or `ProgramData` with Chrome `Cookies` access, then same-user Graph, SharePoint, or OneDrive reads from a new ASN without fresh interactive auth.

Identity T1539 T1550.004 T1528 T1114

Source: Malware steals Chrome session cookies to take over your accounts

#4 Jun 22, 2026

Hunt photo ZIP shortcuts that install a Node.js implant and write dual Run keys

Hypothesis: An adversary uses a fake photo ZIP and PNG shortcut to run obfuscated PowerShell, stage a Node.js implant, weaken Defender controls, and write HKCU Run and RunOnce persistence.

Why it matters: Microsoft reported an active hospitality campaign. The durable discriminator is the ordered endpoint chain: photo ZIP, PNG-named LNK, PowerShell staging, Node.js execution, Defender tamper, and dual Run-key persistence.

Starter hunt: Start in EDR process/file/registry telemetry. Pivot on browser or Explorer extraction creating `photo-*.zip`, then `IMG-*.png.lnk` or `PHOTO-*.png.lnk` launching `powershell.exe`. Require Temp `.ps1` staging, `node.exe` or `csc.exe`/`cvtres.exe`, Defender exclusion changes, and `HKCU\...\Run` or `RunOnce` writes from the same chain.

Endpoint T1204.002 T1059.001 T1059.007 T1547.001 T1562.001 T1127

Source: Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

#5 Jun 22, 2026

Hunt WinRAR ADS extraction that plants Startup LNK loaders

Hypothesis: An adversary uses a crafted WinRAR archive to write a Startup shortcut through NTFS ADS traversal, then launches hidden PowerShell and in-memory stealer activity at logon.

Why it matters: CybersecurityNews reported the GIFTEDCROOK chain. The discriminator is WinRAR ADS traversal into Startup followed by hidden PowerShell and memory-loaded stealer behavior that reads browser data.

Starter hunt: Start in EDR process/file/registry telemetry. Pivot on `winrar.exe` or `rar.exe` creating `.lnk`, `.hta`, `.bat`, or script files under the user Startup folder after a downloaded archive opens. Correlate ADS traversal indicators with hidden `powershell.exe`, ProgramData payload writes, reflective loading, or browser credential-store reads.

Endpoint T1204.002 T1564.004 T1547.001 T1059.001 T1620 T1555.003

Source: New GIFTEDCROOK Chain Abuses WinRAR ADS and Reflective Loading to Steal Browser Data

#6 Jun 22, 2026

Hunt Splunk sidecar recovery abuse that writes files and spawns shells

Hypothesis: An unauthenticated attacker abuses Splunk sidecar recovery endpoints to write outside backup paths, then executes code under the Splunk service account.

Why it matters: CISA KEV makes this current, but the hunt is not an exposure check. The discriminator is the exploit chain on the Splunk host: recovery/backup path, blank Basic auth, backupFile traversal, file writes outside backup directories, and service-account shell or script execution.

Starter hunt: Start in CloudTrail, DNS/HTTP logs, and identity sign-in logs. On Splunk Enterprise hosts, hunt endpoint URL or process telemetry for /en-US/splunkd/__raw/v1/postgres/recovery/backup or /v1/postgres/recovery/backup with Authorization: Basic Og== or backupFile=../. Correlate splunkd, postgres, or pg_dump writing outside backup paths with sh, bash, python, cmd.exe, or powershell.exe under the Splunk service account...

Endpoint T1190 T1059 T1105 T1565.001

Source: CVE-2026-20253: CISA Warns of Actively Exploited Splunk Enterprise RCE

#7 Jun 22, 2026

Hunt WhatsApp VBScript that stages Endpoint Central from Public Documents

Hypothesis: Adversaries deliver VBS or VBE attachments over WhatsApp, then use WScript to stage hidden files under Public Documents and silently install a preconfigured Endpoint Central agent.

Why it matters: SOCRadar reported the WhatsApp VBScript campaign. The discriminator is chat-client or browser delivery into WScript, Public Documents staging, LOLBin download, and silent preconfigured RMM install.

Starter hunt: Start in EDR process/file telemetry. Correlate `WhatsApp.exe`, WhatsApp Web, or Explorer opening `.vbs` or `.vbe` with `wscript.exe` creating `C:\Users\Public\Documents\Temp_*` or `MSUpdate_*`, then `curl.exe`, `bitsadmin.exe`, `certutil.exe`, `powershell.exe`, or `msiexec.exe` staging a silent Endpoint Central install.

Endpoint T1566 T1204 T1059 T1105 T1036 T1219

Source: WhatsApp VBScript Campaign Installs ManageEngine Endpoint Central for Persistent Remote Access

#8 Jun 22, 2026

Hunt AWS AiTM capture that turns into IAM or S3 changes

Hypothesis: An adversary uses a Cloudflare-hosted AWS Console clone to capture credentials and MFA, then turns the resulting ConsoleLogin into IAM, STS, or S3 control-plane changes.

Why it matters: The source gives the useful first half of the chain: AWS Console clones, input_24 gating, /api/login and /api/auth collection, real-time MFA handling, and CloudTrail ConsoleLogin review. I would not stop at the login. Pair it with concrete cloud actions so the alert is about captured access being used, not a generic AWS sign-in.

Starter hunt: Hunt DNS or HTTP access to the source-listed AWS phishing domains followed within 60 minutes by CloudTrail ConsoleLogin for the same user. Escalate only if the same principal then runs CreateAccessKey, AttachUserPolicy, AssumeRole, PutBucketPolicy, PutBucketAcl, or changes S3 public access.

Identity T1566 T1557 T1078 T1098.001 T1537

Source: Hackers Abuse Cloudflare-Hosted AWS Phishing Domains to Steal Console Logins

#9 Jun 22, 2026

Hunt Shai-Hulud install hooks that steal developer credentials

Hypothesis: A compromised npm or PyPI package runs install-hook payloads before normal package use to read developer or CI credentials and use package, cloud, or runner access for persistence.

Why it matters: cybersecuritynews source reporting ties this to observed TTPs. This is the same class of supply-chain problem that keeps showing up, but the install edge is concrete. The signal is not that a developer installed a new package. It is package-manager ancestry spawning a runtime, reading credential files, and touching GitHub or CI objects in the same chain.

Starter hunt: Start in EDR process/file telemetry on developer workstations and CI/CD audit logs. Pivot on npm, pnpm, yarn, node-gyp, pip, or python install processes that spawn bun, node, bash, sh, pwsh, curl, wget, or python, then read .npmrc, .pypirc, SSH keys, cloud credential files, GitHub tokens, or CI secrets before GitHub API activity, npm publishing, or workflow changes.

Endpoint T1195 T1059 T1552 T1105 T1098

Source: Shai-Hulud Payload Steals GitHub, npm, Cloud, CI/CD, and SSH Credentials From Developers

#10 Jun 22, 2026

Hunt Edgecution native messaging hosts launched by headless Edge

Hypothesis: An initial access broker stages Edgecution by registering a browser native messaging host and launching headless Edge with a malicious extension so Python can execute host commands.

Why it matters: gbhackers source reporting ties this to observed TTPs. The detection pivot is the browser abuse chain, not Teams or Outlook lure text. Headless msedge.exe loading a non-store extension, new NativeMessagingHosts registration, Python execution, and scheduled task staging gives an MDR endpoint artifacts that do not depend on knowing the customer's normal browser extensions.

Starter hunt: Start in CloudTrail, DNS/HTTP logs, and identity sign-in logs. Pivot on msedge.exe launched with --headless and --load-extension from a scheduled task or script parent. Require a new Chrome or Edge NativeMessagingHosts registry key or manifest, python.exe execution, and extension or ZIP files created by AutoHotKey, cmd.exe, or powershell.exe in the same window.

Endpoint T1059.001 T1059.003 T1059.006 T1176 T1053.005 T1112

Source: Payouts King Initial Access Broker Deploys Edgecution Malware Through Malicious Edge Extension

#11 Jun 22, 2026

Hunt WhatsApp VBS that silently installs Endpoint Central

Hypothesis: An adversary uses WhatsApp Desktop transfer-cache scripts to stage secondary payloads, tamper with UAC, and install an Endpoint Central agent pointed at attacker-controlled UEMS infrastructure.

Why it matters: securelist source reporting ties this to observed TTPs. Endpoint Central can be legitimate, so the hunt cannot start with the agent install. The signal is WhatsApp.Root.exe spawning WScript.exe from the exact transfer-cache path, then script-staged downloads, UAC registry changes, msiexec.exe, and the agent install in one chain.

Starter hunt: Start in Entra sign-in logs, audit logs, Microsoft Graph activity logs, and M365 audit logs. Pivot on WhatsApp.Root.exe spawning WScript.exe or cscript.exe with a script under LocalState\Sessions\*\Transfers\. Require hidden working directory creation, secondary VBS downloads, UAC registry changes, ZIP extraction or msiexec.exe, and Endpoint Central agent install from that ancestry.

Endpoint T1059.005 T1204.002 T1105 T1548.002 T1219 T1543.003

Source: A VBScript campaign distributed through WhatsApp deploying RMM software

#12 Jun 22, 2026

Hunt Miasma npm installs that harvest developer and CI credentials

Hypothesis: A poisoned npm package runs during install as the Miasma worm, reads developer and CI credential stores, exfiltrates them, and modifies AI coding assistant configs for persistence.

Why it matters: Tenable tied Miasma to stolen developer credentials weaponized after seven weeks and npm package poisoning across multiple waves. The durable discriminator is the install-time process tree reading credential stores and writing agent config files before outbound transfer.

Starter hunt: Start in CloudTrail, DNS/HTTP logs, and identity sign-in logs. Pivot on npm, yarn, pnpm, or node install descendants that read two or more credential stores such as .npmrc, GitHub CLI hosts.yml, SSH keys, cloud credential files, CI environment variables, or .env, then perform outbound HTTPS or GitHub API activity or write .claude, .cursor, .gemini, .vscode, or .github agent config files.

Endpoint T1195.002 T1552.001 T1005 T1041 T1059.007

Source: What the Miasma campaign reveals about the new supply chain threat model and the underground market for developer credentials

#13 Jun 22, 2026

Hunt stolen integration OAuth token replay into Salesforce export

Hypothesis: An adversary replays OAuth tokens stolen from a SaaS integration provider to query and export Salesforce CRM objects without a fresh login or authorization event.

Why it matters: Field Effect reported that attackers stole OAuth tokens from Klue integration infrastructure and used them to pull Salesforce data from connected customer environments. The durable discriminator is token replay tied to delegated data access, not app presence.

Starter hunt: Start in Salesforce Event Monitoring, setup audit, and IdP sign-in logs. Pivot on Salesforce REST, Bulk API, and ReportExport events for OAuth token replay where a third-party connected app token queries Account, Contact, Lead, Opportunity, Case, or User objects with no matching interactive login or OAuth authorization event in the prior 24 hours. Correlate client request ID, session key, Bulk API job creation, an...

Identity T1528 T1550.001 T1530 T1567.002

Source: Klue integration breach exposes Salesforce customer data

#14 Jun 22, 2026

Hunt poisoned coding test repos that make AI agents steal cloud credentials

Hypothesis: An adversary hides instructions in a coding assessment repo so an AI coding agent reads local cloud, Kubernetes, or Terraform secrets and sends the results through MCP tooling.

Why it matters: Mitiga observed this exact chain in a fake coding test with no malware. The clearest hunting angle is the ordered agent behavior: repository instruction files loaded, local cloud credential and Kubernetes files read, STS and Terraform discovery run, then MCP exfiltration or later use of the same long lived CI/CD key from a second source.

Starter hunt: Start in CloudTrail, DNS/HTTP logs, and identity sign-in logs. hunt cursor, claude, code, node, or python reading ~/.aws/credentials, ~/.kube/config, Terraform state, or secret files within 10 minutes of loading CLAUDE.md, .cursor/rules, README comments, or .cursor/mcp.json. Require aws sts get-caller-identity, kubectl context reads, Terraform state enumeration, or project-setup.env_check to an external host.

Identity T1552.001 T1528 T1078.004 T1580 T1538

Source: How a Poisoned Coding Test Turned an AI Agent Into an Attacker

#15 Jun 22, 2026

Hunt RoguePlanet Defender race that gives a user SYSTEM

Hypothesis: An adversary abuses a Defender race so MsMpEng.exe or WinDefend spawns a SYSTEM shell or LOLBin tree from user-writable path activity, then runs discovery or tampering commands.

Why it matters: Malwarebytes reported a public CVE-2026-50656 exploit and Microsoft confirmed a fix is still in progress. The discriminator is not Defender noise. It is an interactive shell or LOLBin tree with MsMpEng.exe parentage and a SYSTEM token after user-writable path race activity.

Starter hunt: Start in EDR process/file telemetry. Pivot on MsMpEng.exe or WinDefend spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe, reg.exe, schtasks.exe, sc.exe, or net.exe as SYSTEM from a user-writable path. Correlate with RoguePlanet.exe execution or reparse point activity in the prior 10 minutes, then follow the child tree for Add-MpPreference, service creation, admin group changes, or whoami /all.

Endpoint T1068 T1059.003 T1059.001 T1562.001

Source: Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control

#16 Jun 22, 2026

Hunt @mastra easy-day-js postinstall that drops a stealer

Hypothesis: A compromised npm contributor account publishes easy-day-js with a postinstall hook that disables TLS validation, downloads a second stage, and reads developer credential stores.

Why it matters: snyk source reporting ties this to observed TTPs. This is not a package-presence hunt. The durable discriminator is the install-time process lineage: node or npm executing easy-day-js setup.cjs, TLS disabled through NODE_TLS_REJECT_UNAUTHORIZED, raw IP download, marker files, hidden temp execution, then credential store reads.

Starter hunt: Start in EDR process/file telemetry on developer workstations and CI/CD audit logs. On developer workstations and CI runners, hunt npm, pnpm, yarn, node, or a CI process executing easy-day-js setup.cjs. Require the postinstall child process to set NODE_TLS_REJECT_UNAUTHORIZED, write ~/.pkg_history or ~/.pkg_logs, connect to 23.254.164.92:8000/update/49890878, spawn a detached temp payload, or read credential stores.

Endpoint T1195.002 T1059.007 T1105 T1552 T1005

Source: A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope

#17 Jun 22, 2026

Hunt DragonForce Backdoor.Turn injected into DbgView64

Hypothesis: DragonForce stages Backdoor.Turn through VirtualBox DLL hijacking and DbgView64 injection, then uses Teams TURN relay traffic while performing LDAP search, credential access, or lateral movement.

Why it matters: This is better than a generic Teams traffic hunt. The source names Backdoor.Turn, DbgView64.exe, vboxrt.dll, vulnerable driver loading, LDAP search, browser credential access, and Teams TURN relay use in the same intrusion chain.

Starter hunt: Start in EDR process/file telemetry. Pivot on DbgView64.exe making Teams or Skype TURN relay connections, then performing LDAP queries, spawning shells, reading browser credential stores, or starting remote execution. Correlate with nearby VirtualBox vboxrt.dll sideloading and vulnerable driver loads.

Endpoint T1574.001 T1068 T1562.001 T1055 T1059 T1087.002

Source: Cybercriminals mask malicious communications through Microsoft Teams relays

#18 Jun 22, 2026

Hunt Claude Code MCP rewrites that lead to OAuth token replay

Hypothesis: An adversary rewrites Claude Code MCP configuration so delegated traffic routes through attacker infrastructure and OAuth bearer tokens can be refreshed against connected SaaS APIs.

Why it matters: Mitiga described Claude Code MCP token theft through a local configuration change that can leave provider-side activity looking valid. the durable discriminator is non-Claude install ancestry touching ~/.claude.json, followed by delegated token use.

Starter hunt: Start in EDR process/file telemetry on developer workstations and CI/CD audit logs. Pivot on npm, node, pip, brew, curl, bash, or zsh writing or reading ~/.claude.json and changing mcpServers, token fields, or trust settings. Require follow-on Claude Code MCP traffic to the inserted host or OAuth refresh and API activity by the same user without a fresh consent event.

Endpoint T1195 T1552.001 T1528 T1550.001

Source: MCP Token Theft in Claude Code: A Man-in-the-Middle Attack Chain

#19 Jun 22, 2026

Hunt forged SimpleHelp OIDC technician access that launches endpoint scripts

Hypothesis: An adversary forges a SimpleHelp OIDC technician session, then launches shells or scripts on managed endpoints without the matching identity sign-in or MFA event.

Why it matters: The durable discriminator is the ordered telemetry chain, not a generic artifact. Field Effect's CVE-2026-48558 writeup gives the useful shape: forged OIDC tokens, privileged technician creation, MFA bypass in affected configs, and remote access to managed endpoints. The hunt does not ask whether SimpleHelp is approved. It looks for endpoint execution missing the identity event that should precede it.

Starter hunt: Start in CloudTrail, DNS/HTTP logs, and identity sign-in logs. Pivot on SimpleHelp server or agent processes that spawn cmd.exe, powershell.exe, pwsh, wscript, cscript, mshta, bash, sh, curl, or wget on managed endpoints when Entra shows no matching successful sign-in or MFA event to the SimpleHelp app. Raise priority when the same lineage runs whoami /all, nltest, net group, Get-ADUser, az, gcloud, aws sts, kubec...

Endpoint T1550 T1550.001 T1136 T1078 T1219 T1059

Source: SimpleHelp flaw could enable broader compromise across managed environments

#20 Jun 22, 2026

Hunt Gentlemen EDR killer staging before ransomware deployment

Hypothesis: Gentlemen affiliates stage EDR killer tools, create or load driver services from non-vendor paths, terminate security processes, and run backup-deletion or ransomware-prep commands.

Why it matters: ESET's research, reported by CSO, ties the Gentlemen affiliate kit to EDR killer tooling for hundreds of security processes. The clearest hunting angle is the sequence, not the driver name by itself: named kit artifacts, vulnerable driver loading, security tool tampering, then pre-encryption commands.

Starter hunt: Start in EDR process/file telemetry. Pivot on process ancestry where GentleKiller, HexKiller, ThrottleBlood, HavocKiller, or OxideHarvest creates a driver service or loads googleApiUtil64.sys, ThrottleBlood.sys, Baidu BdApi, or Huawei audio driver components from ProgramData, Temp, Users, or Downloads. Require follow-on taskkill, sc stop, fltmc unload, wevtutil cl, vssadmin delete shadows, wbadmin, or bcdedit.

Endpoint T1562.001 T1068 T1543.003 T1490 T1486

Source: Threat actor adds advanced ‘EDR killer’ tools to ransomware-as-a-service platform

#21 Jun 22, 2026

Hunt Sinobi service hijack that turns cbdefense into C:\ProgramData\bin.exe

Hypothesis: Sinobi operators create a fallback Assistance admin account, hijack the cbdefense service to run C:\ProgramData\bin.exe after reboot, then use rclone before encryption.

Why it matters: picussecurity source reporting ties this to observed TTPs. The durable discriminator is the ordered chain: Assistance account creation, cbdefense service tampering, reboot, services.exe launching a user-writable payload, then rclone staging and .SINOBI or README.txt file activity. That chain carries the malicious-vs-benign discriminator inside the telemetry.

Starter hunt: Start in EDR process/file telemetry. Pivot on net.exe or cmd.exe creating Assistance, then sc.exe changing cbdefense start= disabled or binpath= C:\programdata\bin.exe, followed by shutdown /r /t 0, services.exe launching that payload, rclone.exe using c:\programdata\rclone-ssh.conf with --max-age=2y, and .SINOBI or README.txt file writes.

Endpoint T1078 T1136.001 T1098 T1562.001 T1543.003 T1048

Source: How Sinobi Ransomware Encrypts Files and Destroys Backups

#1 Jun 15, 2026

Hunt Splunk sidecar recovery abuse that writes files and spawns shells

Hypothesis: An unauthenticated attacker abuses Splunk sidecar recovery endpoints to write outside backup paths, then executes code under the Splunk service account.

Why it matters: CISA KEV makes this current, but the hunt is not an exposure check. The discriminator is the exploit chain on the Splunk host: recovery/backup path, blank Basic auth, backupFile traversal, file writes outside backup directories, and service-account shell or script execution.

Starter hunt: Start in CloudTrail, DNS/HTTP logs, and identity sign-in logs. On Splunk Enterprise hosts, hunt endpoint URL or process telemetry for /en-US/splunkd/__raw/v1/postgres/recovery/backup or /v1/postgres/recovery/backup with Authorization: Basic Og== or backupFile=../. Correlate splunkd, postgres, or pg_dump writing outside backup paths with sh, bash, python, cmd.exe, or powershell.exe under the Splunk service account...

Endpoint T1190 T1059 T1105 T1565.001

Source: CVE-2026-20253: CISA Warns of Actively Exploited Splunk Enterprise RCE

#2 Jun 15, 2026

Hunt RoguePlanet Defender race that gives a user SYSTEM

Hypothesis: An adversary abuses a Defender race so MsMpEng.exe or WinDefend spawns a SYSTEM shell or LOLBin tree from user-writable path activity, then runs discovery or tampering commands.

Why it matters: Malwarebytes reported a public CVE-2026-50656 exploit and Microsoft confirmed a fix is still in progress. The discriminator is not Defender noise. It is an interactive shell or LOLBin tree with MsMpEng.exe parentage and a SYSTEM token after user-writable path race activity.

Starter hunt: Start in EDR process/file telemetry. Pivot on MsMpEng.exe or WinDefend spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe, reg.exe, schtasks.exe, sc.exe, or net.exe as SYSTEM from a user-writable path. Correlate with RoguePlanet.exe execution or reparse point activity in the prior 10 minutes, then follow the child tree for Add-MpPreference, service creation, admin group changes, or whoami /all.

Endpoint T1068 T1059.003 T1059.001 T1562.001

Source: Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control

#3 Jun 15, 2026

Hunt @mastra easy-day-js postinstall that drops a stealer

Hypothesis: A compromised npm contributor account publishes easy-day-js with a postinstall hook that disables TLS validation, downloads a second stage, and reads developer credential stores.

Why it matters: snyk source reporting ties this to observed TTPs. This is not a package-presence hunt. The durable discriminator is the install-time process lineage: node or npm executing easy-day-js setup.cjs, TLS disabled through NODE_TLS_REJECT_UNAUTHORIZED, raw IP download, marker files, hidden temp execution, then credential store reads.

Starter hunt: Start in EDR process/file telemetry on developer workstations and CI/CD audit logs. On developer workstations and CI runners, hunt npm, pnpm, yarn, node, or a CI process executing easy-day-js setup.cjs. Require the postinstall child process to set NODE_TLS_REJECT_UNAUTHORIZED, write ~/.pkg_history or ~/.pkg_logs, connect to 23.254.164.92:8000/update/49890878, spawn a detached temp payload, or read credential stores.

Endpoint T1195.002 T1059.007 T1105 T1552 T1005

Source: A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope

#4 Jun 15, 2026

Hunt DragonForce Backdoor.Turn injected into DbgView64

Hypothesis: DragonForce stages Backdoor.Turn through VirtualBox DLL hijacking and DbgView64 injection, then uses Teams TURN relay traffic while performing LDAP search, credential access, or lateral movement.

Why it matters: This is better than a generic Teams traffic hunt. The source names Backdoor.Turn, DbgView64.exe, vboxrt.dll, vulnerable driver loading, LDAP search, browser credential access, and Teams TURN relay use in the same intrusion chain.

Starter hunt: Start in EDR process/file telemetry. Pivot on DbgView64.exe making Teams or Skype TURN relay connections, then performing LDAP queries, spawning shells, reading browser credential stores, or starting remote execution. Correlate with nearby VirtualBox vboxrt.dll sideloading and vulnerable driver loads.

Endpoint T1574.001 T1068 T1562.001 T1055 T1059 T1087.002

Source: Cybercriminals mask malicious communications through Microsoft Teams relays

#5 Jun 15, 2026

Hunt forged SimpleHelp OIDC technician access that launches endpoint scripts

Hypothesis: An adversary forges a SimpleHelp OIDC technician session, then launches shells or scripts on managed endpoints without the matching identity sign-in or MFA event.

Why it matters: The durable discriminator is the ordered telemetry chain, not a generic artifact. Field Effect's CVE-2026-48558 writeup gives the useful shape: forged OIDC tokens, privileged technician creation, MFA bypass in affected configs, and remote access to managed endpoints. The hunt does not ask whether SimpleHelp is approved. It looks for endpoint execution missing the identity event that should precede it.

Starter hunt: Start in CloudTrail, DNS/HTTP logs, and identity sign-in logs. Pivot on SimpleHelp server or agent processes that spawn cmd.exe, powershell.exe, pwsh, wscript, cscript, mshta, bash, sh, curl, or wget on managed endpoints when Entra shows no matching successful sign-in or MFA event to the SimpleHelp app. Raise priority when the same lineage runs whoami /all, nltest, net group, Get-ADUser, az, gcloud, aws sts, kubec...

Endpoint T1550 T1550.001 T1136 T1078 T1219 T1059

Source: SimpleHelp flaw could enable broader compromise across managed environments

#6 Jun 15, 2026

Hunt Gentlemen EDR killer staging before ransomware deployment

Hypothesis: Gentlemen affiliates stage EDR killer tools, create or load driver services from non-vendor paths, terminate security processes, and run backup-deletion or ransomware-prep commands.

Why it matters: ESET's research, reported by CSO, ties the Gentlemen affiliate kit to EDR killer tooling for hundreds of security processes. The clearest hunting angle is the sequence, not the driver name by itself: named kit artifacts, vulnerable driver loading, security tool tampering, then pre-encryption commands.

Starter hunt: Start in EDR process/file telemetry. Pivot on process ancestry where GentleKiller, HexKiller, ThrottleBlood, HavocKiller, or OxideHarvest creates a driver service or loads googleApiUtil64.sys, ThrottleBlood.sys, Baidu BdApi, or Huawei audio driver components from ProgramData, Temp, Users, or Downloads. Require follow-on taskkill, sc stop, fltmc unload, wevtutil cl, vssadmin delete shadows, wbadmin, or bcdedit.

Endpoint T1562.001 T1068 T1543.003 T1490 T1486

Source: Threat actor adds advanced ‘EDR killer’ tools to ransomware-as-a-service platform

#7 Jun 15, 2026

Hunt Sinobi service hijack that turns cbdefense into C:\ProgramData\bin.exe

Hypothesis: Sinobi operators create a fallback Assistance admin account, hijack the cbdefense service to run C:\ProgramData\bin.exe after reboot, then use rclone before encryption.

Why it matters: picussecurity source reporting ties this to observed TTPs. The durable discriminator is the ordered chain: Assistance account creation, cbdefense service tampering, reboot, services.exe launching a user-writable payload, then rclone staging and .SINOBI or README.txt file activity. That chain carries the malicious-vs-benign discriminator inside the telemetry.

Starter hunt: Start in EDR process/file telemetry. Pivot on net.exe or cmd.exe creating Assistance, then sc.exe changing cbdefense start= disabled or binpath= C:\programdata\bin.exe, followed by shutdown /r /t 0, services.exe launching that payload, rclone.exe using c:\programdata\rclone-ssh.conf with --max-age=2y, and .SINOBI or README.txt file writes.

Endpoint T1078 T1136.001 T1098 T1562.001 T1543.003 T1048

Source: How Sinobi Ransomware Encrypts Files and Destroys Backups

#8 Jun 15, 2026

Hunt backdoored Checkmarx Jenkins plugin activity that harvests CI secrets

Hypothesis: A backdoored Checkmarx Jenkins AST plugin runs in a Jenkins controller or agent context, reads repository, cloud, Kubernetes, SSH, or API credentials, and uses them for follow-on access.

Why it matters: SOCRadar source reporting ties this to observed CI/CD supply-chain TTPs. The durable discriminator is plugin or Jenkins `java` activity followed by broad secret-file reads, outbound egress, and token use from CI credentials, not a normal plugin update.

Starter hunt: Start in Jenkins controller logs, CI/CD audit logs, and EDR process/file telemetry. Correlate Checkmarx Jenkins AST plugin execution or update with `java`, `sh`, `bash`, `curl`, `wget`, `node`, or `npm` reading `.aws`, `.config/gcloud`, `.azure`, `.kube`, `.ssh`, Jenkins credential stores, or workspace secrets, then outbound GitHub or cloud API use from CI credentials.

Endpoint T1195.002 T1552.001 T1552.004 T1528 T1083 T1041

Source: May 2026: TeamPCP’s Supply Chain Blitz Hits Checkmarx, GitHub, and npm

#9 Jun 15, 2026

USB shortcut clipper staging JavaScript and renamed Tor

Hypothesis: An adversary uses removable-media shortcuts to stage JavaScript under Public Documents, create scheduled tasks, run renamed Tor locally, and collect clipboard or screenshot data.

Why it matters: Microsoft described an active crypto clipper campaign with removable-media shortcuts, Public Documents JavaScript staging, scheduled tasks, ugate.exe, local Tor proxying, clipboard theft, screenshots, curl uploads, and Defender exclusions. The hunt follows that chain instead of treating USB use or Tor by itself as the signal.

Starter hunt: Start in EDR process/file telemetry. On endpoints, correlate explorer.exe or cmd.exe opening .lnk from removable media to wscript or cscript running C:\Users\Public\Documents\<five-character-folder>\*.js, schtasks task creation, ugate.exe, and localhost:9050 connections. Escalate when clipboard access, screenshots, curl uploads, or Defender exclusions follow.

Endpoint T1091 T1204.002 T1059.007 T1053.005 T1115 T1113

Source: Crypto Clipper uses Tor and worm-like propagation for persistence and control

#10 Jun 15, 2026

Hunt M365 MFA method enrollment followed by BEC mailbox activity

Hypothesis: An adversary uses an already MFA-satisfied Microsoft 365 session to add a second authentication method, then works the mailbox for BEC without another MFA prompt.

Why it matters: Mitiga saw the attacker enter My Access, change authentication details, and rely on the existing MFA state. The signal is the method change tied to mailbox actions, not a strange login by itself.

Starter hunt: Start in Entra sign-in, audit, Microsoft Graph, and M365 audit logs. Pivot on Microsoft Authenticator or phone-app MFA method registration after an MFA-satisfied sign-in. Within 24 hours require same-user Exchange activity: MailItemsAccessed, inbox-rule changes, forwarding, SendAs, or payment-thread replies.

Identity T1550 T1556 T1098 T1114

Source: Advisory: Persistent MFA Circumvention in an Advanced BEC Campaign on Microsoft 365 Targets

#11 Jun 15, 2026

Hunt OXLOADER fake Node.js installs that elevate a Storj batch chain

Hypothesis: An adversary uses fake Node.js advertising to deliver a Storj-hosted batch chain that elevates with PowerShell and loads OXLOADER before CASTLESTEALER execution.

Why it matters: elastic.co source reporting ties this to observed TTPs. The hunt follows the delivery chain, not Node.js installation. The discriminators are the named Storj /ruslan/ paths, BATPackageBuilderSetup.bat, aBsvwbdas.exe, -Verb RunAs, and CLR loading from an installer-themed native process.

Starter hunt: Start in EDR process/file telemetry. Pivot on browser or archive downloads of BATPackageBuilderSetup.bat, then cmd.exe or powershell.exe fetching link.storjshare.io/raw/.../ruslan/aBsvwbdas.exe and launching it with -Verb RunAs. Add network pivots for node-js.prentiva99.info and app.miloyannopoulos.com before a native installer process loads CLR or runs CASTLESTEALER.

Endpoint T1189 T1204.002 T1059.001 T1105 T1036 T1027

Source: Lost in relocation: analysis of a new loader distributing CASTLESTEALER

#12 Jun 15, 2026

Hunt vishing driven MFA changes followed by M365 collection

Hypothesis: A ShinyHunters or Scattered Spider collaborator uses vishing to change MFA or recovery state, then turns the changed identity state into SSO-backed M365 or SaaS collection.

Why it matters: picussecurity source reporting ties this to observed TTPs. This is not a hunt for odd sign-ins. The pivot is an identity control change followed by data collection or OAuth access in the same account or session. Legitimate recovery happens, but recovery that immediately turns into M365 collection is the hunting angle.

Starter hunt: Start in Entra sign-in, audit, Microsoft Graph, and M365 audit logs. Pivot on MFA registration/reset, Temporary Access Pass creation, or password reset followed within 60 minutes by sign-in with the changed method. Require SharePoint, OneDrive, Exchange, eDiscovery, OAuth consent, or Graph activity from a different IP, device, user agent, or app.

Identity T1566.004 T1078 T1098 T1114.002 T1530

Source: Defending Against ShinyHunters: Tactics and Breaches

#13 Jun 15, 2026

Hunt GentleKiller driver loads followed by security process kills

Hypothesis: Gentlemen ransomware operators stage GentleKiller or related EDR killers, load vulnerable or malicious drivers, and terminate security tools before theft or encryption.

Why it matters: ESET documented the Gentlemen EDR-killer framework and companion tools. The durable discriminator is vulnerable-driver loading paired with multi-product security termination in the same chain, not a driver filename by itself.

Starter hunt: Start in EDR process/file telemetry. Correlate new driver service creation or driver load for `googleApiUtil64.sys`, `ThrottleBlood.sys`, Baidu `BdApi`, Huawei audio driver components, or `.sys` files under `ProgramData`, `Temp`, `Users`, or `Downloads` with follow-on security-process kills from the same host or process chain.

Endpoint T1562.001 T1068 T1543.003 T1014 T1486

Source: Killing me gently: Inside Gentlemen’s EDR killer framework

#14 Jun 15, 2026

Hunt Dropping Elephant Fondue.exe sideloading from C:\Users\Public

Hypothesis: Dropping Elephant uses a China-themed shortcut to stage payloads under C:\Users\Public, create GoogleErrorReport persistence, and sideload APPWIZ.cpl through Fondue.exe.

Why it matters: Rapid7 gave the artifacts that matter: GoogleErrorReport, Fondue.exe, APPWIZ.cpl in C:\Users\Public, Donut shellcode, and AMSI, WLDP, or ETW patching. That chain separates the hunt from normal Fondue.exe activity.

Starter hunt: Start in EDR process and network telemetry. Pivot on .lnk or document process trees that spawn PowerShell and write to C:\Users\Public. Require a scheduled task named GoogleErrorReport, Fondue.exe loading APPWIZ.cpl from that same path, or AMSI, WLDP, or ETW patching before HTTPS beacons to gcl-power.org or /prjozifvkpkfhkr/gedhagammgjvvva/.

Endpoint T1204.002 T1059.001 T1053.005 T1574.001 T1620 T1562.001

Source: Malware à la Mode: Tracking Dropping Elephant Tradecraft Through a China-Themed Loader Chain

#15 Jun 15, 2026

Hunt PeopleSoft PSEMHUB staging followed by Azure-themed MeshCentral

Hypothesis: An adversary exploits Oracle PeopleSoft EMHub to stage JSP or XML content under PSEMHUB paths, then uses Azure-themed MeshCentral agents to run commands and read PeopleSoft or WebLogic configs.

Why it matters: GTIG gave path names, filenames, C2 infrastructure, and recon files. The clearest hunting angle is the exploit follow-on chain on the application server, not perimeter logs or a generic vulnerable server list.

Starter hunt: On PeopleSoft or WebLogic servers, search EDR for new JSP files under PSEMHUB.war, files under envmetadata/transactions, or directories named logs, persistantstorage, or scratchpad. Correlate to meshagent32-azure-ops.exe, meshagent64-azure-ops.exe, meshagent64-v2.exe, azurenetfiles.net, psappsrv.cfg, config.xml, or fanout.sh.

Endpoint T1190 T1059 T1105 T1219 T1083 T1021

Source: ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit

#16 Jun 15, 2026

ROADrecon style enumeration through legacy Azure AD Graph

Hypothesis: An adversary with a valid Entra token enumerates legacy Azure AD Graph paths across users, groups, apps, service principals, and devices using ROADrecon-style tooling.

Why it matters: Elastic published new coverage for Azure AD Graph Activity Logs, which exposes a directory enumeration path that was hard to see before. ROADrecon, AADInternals, MSOLSpray, and Microburst still use the legacy API, and the hunt keys on the API version, user agent, path breadth, and error pattern rather than the login location or rarity.

Starter hunt: In Azure AD Graph activity logs, find graph.windows.net sessions where one user, app, or IP hits users, groups, servicePrincipals, applications, devices, roles, or oauth2PermissionGrants in a short window with ROADrecon, AADInternals, MSOLSpray, Microburst, PowerShell, Python, FOCI mismatch, or 4xx-heavy probing. Correlate by same user, host, process lineage, request ID, or session.

Identity T1087.004 T1069.003 T1526 T1580

Source: Azure AD Graph Activity Logs: Ingestion and threat detection to close the visibility gap

#17 Jun 15, 2026

Hunt APT28 DNS rewrites that lead to M365 token replay

Hypothesis: APT28 uses router DNS rewrites to steer Microsoft 365 authentication through adversary infrastructure, then replays the resulting tokens into Exchange or Graph mailbox activity.

Why it matters: Sekoia reported APT28 using compromised routers and DNS rewrites to funnel Microsoft 365 authentication through an adversary-in-the-middle path. The hunt stays in Entra and M365 audit data by looking for token replay tied to concrete mailbox actions, not generic sign-in noise.

Starter hunt: Correlate Entra sign-ins and M365 audit logs for a user who completes browser MFA, then has non-interactive Exchange or Graph activity from a different ASN within 5 to 30 minutes with no fresh MFA prompt. Require MailItemsAccessed, SearchQueryInitiatedExchange, New-InboxRule, Set-InboxRule, or bulk downloads in that same chain.

Identity T1557 T1528 T1550.001 T1114

Source: APT28, an evolution of tradecraft

#18 Jun 15, 2026

Hunt AUR PKGBUILDs that pull atomic-lockfile or js-digest and touch secrets

Hypothesis: An adversary injects AUR build commands that make yay, paru, or makepkg spawn npm or Bun packages, then reads secrets and writes persistence or eBPF artifacts from the build chain.

Why it matters: Truesec reported injected AUR build commands that pulled those packages and delivered an infostealer and rootkit. The discriminator is secret access or rootkit persistence from the package build process, so it does not depend on knowing which AUR packages a tenant normally uses.

Starter hunt: Start in Linux EDR process/file telemetry and package-manager logs. Pivot on yay, paru, or makepkg spawning npm, npx, bun, or node with atomic-lockfile or js-digest in the command line. Require one child in that lineage to read ~/.npmrc, SSH keys, cloud credential files, browser stores, or .env, then write /etc/systemd/system, /etc/cron.d, /etc/ld.so.preload, /sys/fs/bpf, or make outbound HTTPS.

Endpoint T1195 T1059 T1552 T1543 T1014 T1105

Source: Supply Chain Attack Compromising Arch Linux AUR Packages with Infostealer and Rootkit

#19 Jun 15, 2026

Hunt RoguePlanet Defender link race to SYSTEM shell

Hypothesis: An adversary abuses Defender link resolution with reparse-point activity so a low-privileged user process leads to a SYSTEM shell without a normal service, task, PsExec, or WMI parent.

Why it matters: The strongest angle is the privilege transition tied to Defender file handling, not a generic SYSTEM shell. Link, hardlink, symlink, junction, or reparse-point creation near Defender scans gives the hunt something concrete to test.

Starter hunt: Start in EDR process/file telemetry. Pivot on low-privileged user processes creating hardlinks, symlinks, junctions, or reparse points in Defender-scanned paths, followed within minutes by cmd.exe, powershell.exe, or conhost.exe running as SYSTEM. Require parentage outside services.exe, taskeng.exe, PsExec, and WMI, then pivot on whoami /priv, net user, sc.exe, or reg.exe.

Endpoint T1068 T1059.003 T1222 T1562.001

Source: CVE-2026-50656 Microsoft Defender Elevation of Privilege Vulnerability

#20 Jun 15, 2026

Hunt Pink vishing that changes MFA methods before M365 collection

Hypothesis: A vishing operator manipulates Okta or Entra MFA recovery state, then uses the compromised account to collect M365 data and send extortion messages from collaboration tools.

Why it matters: The source gives a full identity to cloud chain: vishing, Okta or Entra phishing kits, MFA bypass, passkey or recovery manipulation, M365 collection, and extortion over compromised collaboration tools. That is specific enough to hunt without asking whether the login is normal.

Starter hunt: Start in Entra sign-in logs, audit logs, Microsoft Graph activity logs, and M365 audit logs. Pivot in Okta or Entra logs, find a successful user sign-in followed within 60 minutes by user-initiated MFA, passkey, FIDO2, or recovery method changes. Require SharePoint or OneDrive bulk access and Exchange or Teams messages with qTox, Tox ID, DLS, ransom, extortion, or 72-hour language from the same account.

Identity T1598 T1539 T1098 T1528 T1530 T1567

Source: New Data Extortion Group “Pink” Goes Big Game Hunting With Evasive Phishing Kits

#21 Jun 15, 2026

Hunt EvilTokens device code phishing that turns MFA into M365 access

Hypothesis: An adversary uses device-code phishing to make a user complete MFA for the attacker session, then uses the issued tokens to access M365 data or create mailbox persistence.

Why it matters: The discriminator is the chain: Microsoft device code authentication, then cloud access from a separate client or IP using the token issued by that flow. That is huntable in Entra, M365, Exchange, SharePoint, and OneDrive telemetry without asking whether the sign-in is normal for the user.

Starter hunt: Start in Entra sign-in, audit, Microsoft Graph, and M365 audit logs. Pivot on successful device-code authentication to Graph, Exchange, SharePoint, Teams, or OneDrive. Require same-user MailItemsAccessed, file downloads, sync downloads, inbox-rule, or forwarding changes from a non-browser client within 30 minutes.

Identity T1566 T1528 T1550 T1114 T1530

Source: EvilTokens: A phishing attack that doesn’t steal your password

#22 Jun 15, 2026

Hunt Workspace compliance rules that BCC mail to external inboxes

Hypothesis: An adversary with Google Workspace admin access creates a domain-level compliance or routing rule that silently BCCs targeted mail to an external inbox.

Why it matters: fieldeffect source reporting ties this to observed TTPs. The hunt has concrete pivots: domain-level content compliance or routing changes, BCC or add-recipient actions, the Patroit rule name, the external Gmail sink, and message trace showing copied mail. It does not depend on knowing a normal admin baseline.

Starter hunt: Hunt Google Workspace admin audit logs for domain-level content compliance or routing rules that add BCC, redirect, or add-recipient delivery to external mailboxes. Pivot on Patroit, Patriot misspellings, BebitaBarefoot774@gmail.com, and message traces where matching mail is silently copied.

Identity T1114.003 T1098 T1567.002

Source: China-nexus actor abuses domain-level compliance rules

#23 Jun 15, 2026

Hunt Tengu exfiltration before vssadmin and .tengu encryption

Hypothesis: Tengu operators use PowerShell, cmd, or rundll32 to stage Rclone or WinSCP exfiltration, then inhibit recovery and mass-rename files with the .tengu extension.

Why it matters: Each tool can be legitimate alone. The source gives the ordered ransomware chain, so the hunt keys on exfiltration, recovery inhibition, log clearing, and the .tengu extension together.

Starter hunt: Search EDR for Rclone or WinSCP activity followed by MEGA connections, then vssadmin shadow copy deletion, wevtutil log clearing, or sc service changes on the same host or account. Escalate when high-volume file writes or renames to .tengu land after those commands.

Endpoint T1059.001 T1059.003 T1218.011 T1003.001 T1562.001 T1070.001

Source: Tengu Ransomware: Attack Chain From Initial Access to Encryption

#24 Jun 15, 2026

Hunt cloud logging changes followed by concrete access expansion

Hypothesis: An adversary changes AWS CloudTrail or Google Cloud Logging resources to impair audit capture, then creates keys, grants roles, opens storage policy, or reads data in the same window.

Why it matters: Unit 42 names the control plane actions. The clearest hunting angle is exact logging API activity tied to concrete access expansion or data access, not a generic admin change review.

Starter hunt: In CloudTrail and GCP Admin Activity, alert on StopLogging, DeleteTrail, UpdateTrail to an account-external bucket or KMS key, DeleteSink, logging.sinks.update/create to an external destination, or log bucket deletion. Require CreateAccessKey, CreateUser, AttachUserPolicy, SetIamPolicy owner grants, public storage policy changes, or bulk object reads in the same window.

Cloud T1562.008 T1530 T1526 T1098

Source: Blinding the Watchmen: Abusing Cloud Logging Services for Visibility Loss

#25 Jun 15, 2026

Hunt Entra Agent ID access_agent grants that turn into Graph mailbox actions

Hypothesis: An adversary abuses an Entra access_agent delegated grant and federated identity credential to obtain an agent token that performs mailbox actions through Microsoft Graph.

Why it matters: The durable discriminator is the ordered telemetry chain, not a generic artifact. Red Canary gave the exact Entra and Graph fields needed to separate agent-driven mailbox access from normal user mail. The clearest hunting angle is the access_agent grant tied to the same token lineage as Mail.Send, Mail.ReadWrite, or mailbox settings activity.

Starter hunt: In Entra audit logs, find Add delegated permission grant events where delegated permission grant scope contains access_agent. Join to Graph activity by AppAccessContext.UniqueTokenId or token identifier, then require agentic app token fields plus Mail.Send, Mail.ReadWrite, MailboxSettings.ReadWrite, sendMail, or mailbox settings requests.

Identity T1098 T1114.002

Source: Investigating suspicious AI workflows in Microsoft Entra Agent ID: Assistive agents

#26 Jun 15, 2026

Hunt AUR PKGBUILD hooks that spawn npm malware and eBPF loading

Hypothesis: An adversary changes orphaned AUR PKGBUILDs so makepkg runs npm or Bun payloads, executes a Rust ELF hook, steals developer secrets, and may load eBPF components.

Why it matters: This is active supply-chain tradecraft with concrete artifacts: AUR package adoption, PKGBUILD changes, atomic-lockfile, js-digest, lockfile-js, the herbsobering npm publisher, a deps ELF hook, and eBPF rootkit behavior. An MDR can hunt the process tree and file events on developer or build hosts.

Starter hunt: Search Linux EDR for makepkg or pacman spawning npm install or bun install, then require atomic-lockfile, js-digest, lockfile-js, or an executable named deps under src/hooks. Escalate if that child reads browser or developer secrets, writes an ELF in a build path, or calls bpf() from the package build chain.

Endpoint T1195.002 T1059.006 T1204.002 T1554 T1071.001 T1555

Source: Atomic Arch Campaign Hijacks 20+ Linux AUR Packages to Deliver Malware

#27 Jun 15, 2026

Hunt Graph payroll recon chained to broad delegated scopes

Hypothesis: An adversary uses Microsoft Graph directory queries to bulk enumerate users, filter payroll-related fields, and support HR or direct-deposit fraud through broad delegated permissions.

Why it matters: The source names the Graph request path, searched fields, payroll goal, and delegated permissions. That gives a discriminator: bulk Graph directory harvest plus payroll-focused filtering, not a vague bad login.

Starter hunt: In Graph activity logs, find one user or app making requests to /v1.0/users?$top=999, then filter or search requests over displayName, jobTitle, mail, or userPrincipalName for payroll terms with $skiptoken pagination. Correlate by request id and require delegated permissions such as Directory.Read.All or Files.ReadWrite.All.

Identity T1087 T1114 T1530 T1098

Source: Hackers Use Microsoft Graph Reconnaissance to Target Payroll and HR Employees

#28 Jun 15, 2026

Hunt Microsoft Defender spawning a SYSTEM shell

Hypothesis: An adversary abuses a Microsoft Defender file-processing race so MsMpEng.exe spawns a SYSTEM-integrity shell or LOLBin child after standard-user activity on the same host.

Why it matters: Picus described a direct parent-child and integrity-level pattern. MsMpEng.exe starting cmd, PowerShell, rundll32, reg, or net as SYSTEM is specific enough to hunt without knowing what is normal for the tenant.

Starter hunt: Search EDR process events for MsMpEng.exe spawning cmd.exe, powershell.exe, pwsh.exe, conhost.exe, rundll32.exe, reg.exe, or net.exe with SYSTEM integrity. Correlate to prior standard-user execution on the same host and review descendants for discovery, credential access, persistence, or lateral movement.

Endpoint T1068 T1059 T1134

Source: RoguePlanet: Anatomy of the Nightmare Eclipse Microsoft Defender Zero-Day

#29 Jun 15, 2026

Hunt phishing-delivered NinjaOne that spawns an interactive shell

Hypothesis: An adversary delivers a preconfigured NinjaOne MSI through phishing, then turns the RMM agent into shell execution, recon commands, and relay traffic from a single endpoint.

Why it matters: The source describes a live RMM abuse chain with phishing delivery, browser fingerprinting, geofencing, hidden download behavior, and a legitimate NinjaOne agent used for remote access. The discriminator is the sequence from click to installer to hands-on-keyboard activity.

Starter hunt: Search EDR for a browser writing an MSI to a user path and msiexec installing it within minutes. Require NinjaRMMAgent.exe or ninja.exe to spawn cmd.exe, powershell.exe, whoami.exe, net.exe, or ipconfig.exe within 30 minutes, plus HTTPS to a NinjaOne relay not seen on other managed endpoints.

Endpoint T1219 T1566.001 T1204.002 T1059.001 T1059.003 T1071.001

Source: Hackers Abuse NinjaOne RMM Agent to Gain Remote Access to Brazilian Organizations

#30 Jun 15, 2026

Hunt BlueHammer staging EICAR then reading SAM through VSS

Hypothesis: An adversary abuses the BlueHammer Defender update race by staging an EICAR trigger and filesystem redirection, then reads SAM or SYSTEM hives through VSS and gains a SYSTEM shell.

Why it matters: The source gives an ordered exploit chain with Defender update retrieval, EICAR staging, filesystem redirection, VSS hive access, and token elevation. The hunt keys on the sequence, not a vulnerable version or normal Defender updates.

Starter hunt: In Windows EDR, find a non-Defender user process retrieving go.microsoft.com/fwlink/?LinkID=121721&arch=x64, then creating foo.exe with EICAR content, reading SAM or SYSTEM through HarddiskVolumeShadowCopy paths, and spawning cmd.exe or powershell.exe as SYSTEM in the same session. Correlate the activity by same user, host, process lineage, request ID, or session within the source-reported window.

Endpoint T1068 T1003.002 T1562.001 T1059.003

Source: BlueHammer: The Unpatched Windows Privilege Escalation Exploit

#31 Jun 15, 2026

Hunt ConfigurationRemotingServer.exe spawning a script interpreter after a LNK open

Hypothesis: An adversary uses a self-referencing LNK to trigger Winget DSC, then makes ConfigurationRemotingServer.exe spawn a script interpreter with encoded or download behavior.

Why it matters: Picus documented the Winget DSC self-referencing LNK technique. ConfigurationRemotingServer.exe executing script interpreters is a specific, rare LOLBin abuse named in the source, not normal Winget usage, so it discriminates attacker behavior without needing the customer baseline.

Starter hunt: Start in EDR process telemetry. Pivot on ConfigurationRemotingServer.exe as the parent of powershell.exe, pwsh.exe, cmd.exe, mshta.exe, wscript.exe, or rundll32.exe, especially with encoded commands, Invoke-WebRequest, curl, or writes to user-writable paths. Tie it back to a .lnk opened from Downloads, Temp, or an attachment cache followed within minutes by winget.exe configure.

Endpoint T1204.002 T1059.001 T1218 T1105

Source: Winget DSC and Self-Referencing LNK File Attack Explained

#32 Jun 15, 2026

Hunt token replay that turns into Copilot data pulls

Hypothesis: An adversary reuses a stolen Microsoft 365 token, then uses Copilot or Azure AI to query SharePoint, OneDrive, or mailbox content and access the referenced files in the same window.

Why it matters: Microsoft published investigation guidance for reconstructing Copilot and Azure AI activity from identity, time, and resource context. That gives an MDR a concrete way to join token abuse to AI interactions and content access without guessing whether Copilot use is normal.

Starter hunt: Start in CloudTrail, DNS/HTTP logs, and identity sign-in logs. Pivot in Entra and M365 audit, find a session cookie or refresh token reused from two ASNs or countries inside an impossible-travel window. Require CopilotInteraction or Azure AI requests that reference SharePoint, OneDrive, or mail content, then FileAccessed, FileDownloaded, or send activity by the same user.

Identity T1567 T1528 T1071.001 T1213 T1556.006

Source: Reconstructing AI activity in investigations