Ursnif Malware Targeting Italy — Threat Hunt (Case Lab 1/4)

Case Context

Part of a 4-lab investigation case on Threat Hunting Labs built around a single incident: a high-severity alert on a Windows workstation triggered by a signed binary loading a DLL from a user-writable path. This lab is the Threat Hunt angle — hunting through EDR and network telemetry to build the attack chain from initial proxy execution through to command-and-control, without a pre-built detection rule to lean on.

The case runs four separate investigation angles against the same incident: Threat Hunt, Incident Response, Detection Engineering, and Malware Analysis. This lab is 1 of 4 — I’ll be posting the full case once all four are complete rather than piecemeal.

Threat Hunting Labs has a strict no-public-writeup policy on active labs to protect scoring and leaderboards for other users, so this page is intentionally an overview: what I did and what I found, not the queries or the specific answers that got me there.

Techniques Encountered

Nine MITRE ATT&CK techniques surfaced across the hunt, spanning proxy execution, scripting, registry-based staging, and layered C2:

Prioritising Findings — Pyramid of Pain

Fifteen findings came out of the hunt, weighted by how costly each is for the attacker to change — hash values are trivial to burn, TTPs are what actually hurt:

What I Practiced

• Building an attack chain from raw EDR process telemetry with no pre-scoped alert to start from
• Differentiating periodic beaconing from interactive remote-control C2 channels in network telemetry
• Tracing registry-based payload staging back to the process that planted it
• Prioritising indicators by durability (Pyramid of Pain) rather than just chronology
• Writing a detection query generalised enough to catch the technique, not just this sample