Synthetic Elastic replay for the Hugging Face incident

HF INCIDENT REPLAY

▸ emulate the public incident safely.

Safely replay the public Hugging Face agent intrusion with Elastic detections.

Generate synthetic telemetry shaped from the public Hugging Face incident, exercise OOTB Elastic Security and Elastic Defend coverage, and produce a coherent attack narrative from the resulting alerts.

Inspired by and credited to Hugging Face's public incident materials: technical timeline and interactive attack replay. This project is an independent synthetic Elastic emulation and is not affiliated with Hugging Face.

view runner coverage map → optional rules →

// replay diagram

Five stages to a coherent attack narrative.

Attack chain across trust boundaries

nodes ignite as the synthetic agent reaches them

Live action stream

representative events

01 ›dataset_config_processed file.path=/proc/self/environfoothold

02 ›python3 -c "gzip/base64 staged execution marker"c2/dropper

03 ›env; cat /proc/self/mountinfo; getent hosts internal connectorrecon

04 ›create serviceaccounts/token; create selfsubjectrulesreviewsk8s rbac

05 ›create privileged pod hostPath=/; chroot /hostnode pivot

06 ›GetCallerIdentity; DescribeVpcs; ListClusters; GetAuthorizationTokencloud iam

07 ›tailscaled --tun=userspace-networking --state=mem: --socks5-server=127.0.0.1:1055tailscale

08 ›integration_installation_token.create; pull_request.creategithub

09 ›POST encoded chunks to capture, dataset, paste, and proxy destinationsexfil

Out-of-the-box Elastic coverage that would help

primary story: SIEM + endpoint protections

Elastic Security / SIEM rules

Rules marked fired live are actively exercised: the kit writes precisely-shaped ECS telemetry to the real integration data streams and confirms each one produces alerts — 25 verified firing against the Elastic 9.x prebuilt package. Rules under reference coverage are relevant to this incident and stay listed for context, but this kit does not trigger them via synthetic ingestion on this stack (the per-item note says why).

Worker & host execution — fired live 8

Kubernetes audit & API — fired live 13

Cloud / AWS identity — fired live 4

Reference coverage — not triggered by this kit 8

GenAI Process Accessing Sensitive Files — needs endpoint file events
GenAI Process Connection to Unusual Domain — new_terms, macOS network
GenAI Process Connection to Suspicious Top Level Domain — Windows/macOS network only
GenAI Process Performing Encoding/Chunking Prior to Network Activity — process→network sequence
Connection to Common Large Language Model Endpoints — Windows/macOS DNS only
Unusual Process Modifying GenAI Configuration File — new_terms, endpoint file events
Elastic Defend Alert from GenAI Utility or Descendant — ES|QL, needs Elastic Defend endpoint alerts
LLM-Based Attack Chain Triage by Host — ES|QL, needs an LLM inference connector

Elastic Defend endpoint protections

Execution and payload behavior 5

Credential collection and persistence 5

Egress and suspicious binaries 2

MITRE ATT&CK coverage matrix

SIEM + endpoint + optional generated rules

Card color: more synthetic activity in this tactic some activity lower activity

Coverage badge: SIEMalert rules from Elastic Security EDRendpoint protections from Elastic Defend OPToptional generated rules from this kit

Initial Access3

Exploit Public-Facing AppT119011

Supply Chain CompromiseT11955

External Remote ServicesT11333

Execution4

Command and Scripting InterpreterT105915

PythonT1059.0068

Unix ShellT1059.0046

User ExecutionT12043

Persistence2

External ProxyT10904

Create Account / TokenT11362

Privilege Esc.4

Escape to HostT16118

Additional Cloud RolesT1098.0035

Valid AccountsT10784

Sudo Chroot AttemptCVE-2025-324632

Stealth0

No activity

Credential Access6

Unsecured CredentialsT155216

Cloud CredentialsT1552.0059

Proc Filesystemprocfs7

Secrets ManagerGetSecretValue5

Discovery5

Cloud Service DiscoveryT152616

Permission Groups DiscoveryT106912

System Information DiscoveryT10826

Lateral Movement3

Proxy / TunnelT109011

Remote ServicesT10214

C25

Ingress Tool TransferT110515

ProxyT109011

Web ServiceT11026

Exfiltration3

Exfiltration Over C2 ChannelT104120

Exfiltration to Cloud StorageT15377

Source Code Exfiltrationgit.clone5

Impact0

No destructive activity

Optional generated SIEM rules

add-on content

Dataset Worker Local File Disclosure via External Referencegenerated locally

Python Gzip Base64 Payload Executiongenerated locally

Linux Service Account Token and Environment Discoverygenerated locally

Kubernetes Service Account TokenRequest and RBAC Reviewgenerated locally

Kubernetes Privileged Pod Created With HostPath Mountgenerated locally

Cloud Metadata Credential Access Followed by IAM Enumerationgenerated locally

Tailscale Userspace Networking Proxy Startedgenerated locally

GitHub App Installation Token Created and Repository Accessgenerated locally

Chunked Exfiltration to Public Dead-Drop Servicesgenerated locally

Run this replay against Elastic

self-hosted · API driven · tagged

Creates: logs-frontier_lab_agent_emulation.* data streams designed to exercise OOTB coverage first.

Scopes: every run with frontier-lab-agent-emulation-run-<timestamp>.

Optional: add --include-custom-rules to create the generated gap-filler rules shown above.

Connector: run --list-connectors, then choose one with --connector-name or --connector-id/--connector-type.

recommended command

export ELASTIC_USERNAME="elastic-user"
export ELASTIC_PASSWORD="elastic-password"

python3 scripts/run_hf_emulation.py \
  --es-url http://localhost:9200 \
  --kibana-url http://localhost:5601 \
  --space default

View full Python runner script

language: python open script source

Loading scripts/run_hf_emulation.py...