{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The rapid self-correction of agentic AI frameworks allows attackers to bypass errors and exfiltrate data in minutes. This hunt identifies the specific behavioral signature of AI agents, providing a negative result against automated intrusion frameworks." }, "name": "Agentic AI Cloud Resource Abuse (ARTEX)", "type": "investigation", "labels": [ "hunt", "attack.t1078", "attack.t1071", "attack.t1041", "attack.t1090.003", "attack.t1110.003", "defense evasion", "discovery", "exfiltration", "initial access" ], "series": { "slug": "threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets", "index": 1, "title": "Threat actors use agentic AI tooling to find and abuse exposed secrets", "total": 2 }, "related": [ { "hunt": "leaked-secret-scanning-github", "reason": "That hunt focuses on the discovery of secrets in repositories; this hunt focuses on the abuse of those secrets in the cloud environment.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A standard rule might fire on a single sign-in from a Tor IP, but this hunt uses a multi-stage behavioral pivot: correlating that sign-in with the unique pattern of automated API troubleshooting (rapid 400-to-200 transitions), which confirms the presence of an active AI agent.", "coverage": [ { "stage": "service-principal-compromise", "steps": [ "signins-from-malicious-ips", "triage-initial-compromise" ], "status": "covered" }, { "stage": "cloud-resource-discovery", "steps": [ "automated-discovery-patterns" ], "status": "covered" }, { "stage": "adaptive-api-probing", "steps": [ "adaptive-api-troubleshooting" ], "status": "covered" }, { "stage": "credential-and-data-exfiltration", "steps": [ "evaluate-agentic-lifecycle", "secret-rotation-audit" ], "status": "covered" }, { "stage": "initial-secret-exposure", "reason": "Belongs to another part of the 'Threat actors use agentic AI tooling to find and abuse exposed secrets' series.", "status": "out_of_scope" }, { "stage": "web-vulnerability-exploitation", "reason": "Belongs to another part of the 'Threat actors use agentic AI tooling to find and abuse exposed secrets' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Secret Exposure in Public Repositories", "slug": "initial-secret-exposure", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "GitHub repositories containing OAuth client secrets", "Azure API keys", "AI inference-related API keys", "ARTEX offensive framework scanning patterns" ] }, { "name": "Credential Abuse via Entra ID", "slug": "service-principal-compromise", "tactic": "initial-access", "techniques": [ "T1078" ], "observables": [ "IP address 199.19.77.84", "IP address 199.19.77.18", "Service principal sign-ins for multitenant applications", "Logins from Tor exit nodes" ] }, { "name": "Automated Cloud Reconnaissance", "slug": "cloud-resource-discovery", "tactic": "discovery", "techniques": [ "T1071" ], "observables": [ "Enumeration of Azure subscriptions", "Enumeration of resource groups", "Mapping of AI model deployments", "Graph API search requests for sensitive content" ] }, { "name": "Adaptive API Troubleshooting", "slug": "adaptive-api-probing", "tactic": "defense-evasion", "techniques": [ "T1071" ], "observables": [ "ARM requests returning HTTP 400 followed by HTTP 200 within 30-60 seconds", "Rapid changes to api-version parameters (e.g., switching to 2023-07-01)", "Switching between HTTP methods (GET/POST) after failure", "Mixing Key Vault data-plane and control-plane API versions" ] }, { "name": "Cloud Data Exfiltration", "slug": "credential-and-data-exfiltration", "tactic": "exfiltration", "techniques": [ "T1041" ], "observables": [ "Retrieval of Storage Account keys", "Accessing Azure Key Vault secrets and metadata", "SharePoint and OneDrive file downloads", "Mailbox item access", "Downloading App Service publishing credentials" ] }, { "name": "Embedded Shell Command Injection", "slug": "web-vulnerability-exploitation", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "IP address 65.87.223.26", "Shell commands embedded in HTTP User-Agent headers", "Attempts to obtain App Service authentication tokens" ] } ], "summary": "Threat actors use the ARTEX agentic AI framework to harvest exposed secrets from GitHub and automate the compromise of Entra ID service principals. Once authenticated, the AI agents perform cloud resource discovery and adaptive API troubleshooting to exfiltrate sensitive data from Azure Key Vault, Storage Accounts, and Microsoft 365 environments." }, "severity": "high", "rationale": "The hunt focuses on Entra ID (azure_ad) authentication and Azure Resource Manager (ARM) activity. Use the reporting hosts in the auth logs to narrow the blast radius.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is using an agentic AI framework to automate cloud discovery and data exfiltration, identified by rapid, self-correcting API probing patterns and service principal abuse from campaign-associated infrastructure.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of reporting hosts to narrow the initial sign-in scope." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of cloud and authentication history to examine." }, "suspicious_ips": { "from": { "ref": "ms-artex-2026", "kind": "article", "observed": "2026-11-05" }, "type": "list[ip]", "default": [ "199.19.77.84", "199.19.77.18", "65.87.223.26", "157.22.126.128" ], "description": "IP addresses associated with ARTEX activity and observed reconnaissance." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/", "name": "Microsoft \u2014 Threat actors use agentic AI tooling to find and abuse exposed secrets" } ], "blind_spots": [ { "id": "cloud-audit-latency", "risk": "Azure and Entra audit logs can have significant ingestion latency (15-60 minutes); an AI agent can exfiltrate data in under 5 minutes.", "stage": "adaptive-api-probing", "question": "whether an agent is operating in real-time", "requires": "low-latency cloud control plane logs" }, { "id": "vault-data-plane-visibility", "risk": "Without data plane logging, we see that the vault was accessed, but not which specific secrets were downloaded.", "stage": "credential-and-data-exfiltration", "question": "exactly which secret values were retrieved by the agent", "requires": "Key Vault Data Plane logging" } ] }, "name": "Agentic AI Cloud Resource Abuse (ARTEX)", "description": "This phased hunt targets the automated behaviors of agentic AI frameworks like ARTEX. It begins by identifying service principal sign-ins originating from known campaign IPs or Tor exit nodes. It then pivots to find the behavioral hallmark of AI agents: adaptive API troubleshooting, where the agent identifies and corrects its own API version or method errors (400 to 200 transitions) within seconds. Finally, an agent weighs the full lifecycle from compromise to discovery to exfiltration." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets", "index": 1, "title": "Threat actors use agentic AI tooling to find and abuse exposed secrets", "total": 2 }, "coverage": [ { "stage": "service-principal-compromise", "steps": [ "signins-from-malicious-ips", "triage-initial-compromise" ], "status": "covered" }, { "stage": "cloud-resource-discovery", "steps": [ "automated-discovery-patterns" ], "status": "covered" }, { "stage": "adaptive-api-probing", "steps": [ "adaptive-api-troubleshooting" ], "status": "covered" }, { "stage": "credential-and-data-exfiltration", "steps": [ "evaluate-agentic-lifecycle", "secret-rotation-audit" ], "status": "covered" }, { "stage": "initial-secret-exposure", "reason": "Belongs to another part of the 'Threat actors use agentic AI tooling to find and abuse exposed secrets' series.", "status": "out_of_scope" }, { "stage": "web-vulnerability-exploitation", "reason": "Belongs to another part of the 'Threat actors use agentic AI tooling to find and abuse exposed secrets' series.", "status": "out_of_scope" } ], "rationale": "An adversary is using an agentic AI framework to automate cloud discovery and data exfiltration, identified by rapid, self-correcting API probing patterns and service principal abuse from campaign-associated infrastructure.", "blind_spots": [ { "id": "cloud-audit-latency", "risk": "Azure and Entra audit logs can have significant ingestion latency (15-60 minutes); an AI agent can exfiltrate data in under 5 minutes.", "stage": "adaptive-api-probing", "question": "whether an agent is operating in real-time", "requires": "low-latency cloud control plane logs" }, { "id": "vault-data-plane-visibility", "risk": "Without data plane logging, we see that the vault was accessed, but not which specific secrets were downloaded.", "stage": "credential-and-data-exfiltration", "question": "exactly which secret values were retrieved by the agent", "requires": "Key Vault Data Plane logging" } ], "scoping_notes": "The hunt focuses on Entra ID (azure_ad) authentication and Azure Resource Manager (ARM) activity. Use the reporting hosts in the auth logs to narrow the blast radius.", "beyond_detection": "A standard rule might fire on a single sign-in from a Tor IP, but this hunt uses a multi-stage behavioral pivot: correlating that sign-in with the unique pattern of automated API troubleshooting (rapid 400-to-200 transitions), which confirms the presence of an active AI agent." } }, { "id": "scope-reporting-devices", "type": "query", "label": "Scope active reporting devices", "config": { "dsl": "sqlite", "role": "scoping", "source": "identity", "content": "SELECT DISTINCT device_hostname FROM hb_auth_signin WHERE provider = 'azure_ad' AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_auth_signin", "description": "Identify the reporting devices recorded in the authentication logs to establish a hunt scope.", "expected_signal": "A list of hostnames that have reported Entra ID sign-in events. Silence suggests a gap in cloud-to-host log forwarding." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope active reporting devices", "reads": [ "device_hostname", "provider", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT DISTINCT device_hostname FROM hb_auth_signin WHERE provider = 'azure_ad' AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A list of hostnames that have reported Entra ID sign-in events. Silence suggests a gap in cloud-to-host log forwarding.", "verified": "dry-run", "verified_at": "2026-11-06" } }, { "id": "signins-from-malicious-ips", "type": "query", "label": "Sign-ins from campaign IPs and Tor", "config": { "dsl": "sqlite", "role": "triage", "source": "identity", "content": "SELECT time, actor_user_name, app_id, src_endpoint_ip, device_hostname, status FROM hb_auth_signin WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{suspicious_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_auth_signin", "description": "Correlate Entra ID authentication with the report's IP addresses and Tor exit nodes, filtered by the scoped devices.", "expected_signal": "Service principal or user logons from 199.19.77.84 or Tor nodes. Silence indicates no direct hits on the reported IPs." }, "parents": [ { "id": "scope-reporting-devices" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Sign-ins from campaign IPs and Tor", "reads": [ "time", "actor_user_name", "app_id", "src_endpoint_ip", "device_hostname", "status" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT time, actor_user_name, app_id, src_endpoint_ip, device_hostname, status FROM hb_auth_signin WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{suspicious_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Service principal or user logons from 199.19.77.84 or Tor nodes. Silence indicates no direct hits on the reported IPs.", "verified": "dry-run", "verified_at": "2026-11-06" } }, { "id": "automated-discovery-patterns", "type": "query", "label": "Automated cloud discovery patterns", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT actor_user_name, api_operation, api_service_name, src_endpoint_ip, COUNT(*) AS op_count, MIN(time) AS first_op FROM hb_cloud_api_activity WHERE (api_operation LIKE '%List%' OR api_operation LIKE '%Get%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, api_operation, api_service_name, src_endpoint_ip HAVING op_count > 10 ORDER BY op_count DESC", "surface": "hb_cloud_api_activity", "description": "Identify identities performing high-frequency cloud resource enumeration.", "expected_signal": "Identities querying multiple subscriptions or resources in quick succession. Silence means no high-volume enumeration was captured." }, "parents": [ { "id": "scope-reporting-devices" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Automated cloud discovery patterns", "reads": [ "actor_user_name", "api_operation", "api_service_name", "src_endpoint_ip", "time" ], "source": "hb_cloud_api_activity", "target": "endpoint", "content": "SELECT actor_user_name, api_operation, api_service_name, src_endpoint_ip, COUNT(*) AS op_count, MIN(time) AS first_op FROM hb_cloud_api_activity WHERE (api_operation LIKE '%List%' OR api_operation LIKE '%Get%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, api_operation, api_service_name, src_endpoint_ip HAVING op_count > 10 ORDER BY op_count DESC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "new_this_window" }, "expected": "Identities querying multiple subscriptions or resources in quick succession. Silence means no high-volume enumeration was captured.", "verified": "dry-run", "prevalence": { "by": "actor_user_name", "key": [ "api_operation" ], "rare_below": 5 }, "verified_at": "2026-11-06" } }, { "id": "triage-initial-compromise", "type": "analytic", "label": "Triage initial cloud compromise", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "scope-reporting-devices", "signins-from-malicious-ips", "automated-discovery-patterns" ], "objective": "Identify service principals that have successfully authenticated from suspicious IPs and immediately transitioned to broad cloud discovery.", "description": "Identify service principals showing early signs of takeover by correlating malicious sign-ins with discovery behaviors.", "max_iterations": 3, "expected_signal": "A list of service principals confirmed as potentially compromised.", "success_criteria": "A per-identity verdict citing sign-in source and discovery volume." }, "parents": [ { "id": "signins-from-malicious-ips", "kind": "merge" }, { "id": "automated-discovery-patterns", "kind": "merge" } ] }, { "id": "adaptive-api-troubleshooting", "type": "query", "label": "Adaptive API troubleshooting signature", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT * FROM (SELECT time, actor_user_name, api_operation, status, request_uri, src_endpoint_ip, LAG(status) OVER (PARTITION BY actor_user_name, api_operation ORDER BY time) as prev_status, LAG(time) OVER (PARTITION BY actor_user_name, api_operation ORDER BY time) as prev_time FROM hb_cloud_api_activity WHERE time >= datetime('now', '-{{lookback_days}} days')) WHERE status = '200' AND prev_status = '400' AND (strftime('%s', time) - strftime('%s', prev_time)) <= 65", "surface": "hb_cloud_api_activity", "description": "Detect the core behavioral signature of an AI agent: immediate self-correction after API failures.", "expected_signal": "An API request that fails (400) and is retried successfully (200) within 65 seconds by the same actor. This is the hallmark of agentic automation." }, "parents": [ { "id": "triage-initial-compromise" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Adaptive API troubleshooting signature", "reads": [ "time", "actor_user_name", "api_operation", "status", "request_uri", "src_endpoint_ip" ], "source": "hb_cloud_api_activity", "target": "endpoint", "content": "SELECT * FROM (SELECT time, actor_user_name, api_operation, status, request_uri, src_endpoint_ip, LAG(status) OVER (PARTITION BY actor_user_name, api_operation ORDER BY time) as prev_status, LAG(time) OVER (PARTITION BY actor_user_name, api_operation ORDER BY time) as prev_time FROM hb_cloud_api_activity WHERE time >= datetime('now', '-{{lookback_days}} days')) WHERE status = '200' AND prev_status = '400' AND (strftime('%s', time) - strftime('%s', prev_time)) <= 65", "silence": "not_evidence_of_absence", "expected": "An API request that fails (400) and is retried successfully (200) within 65 seconds by the same actor. This is the hallmark of agentic automation.", "verified": "dry-run", "verified_at": "2026-11-06" } }, { "id": "evaluate-agentic-lifecycle", "type": "analytic", "label": "Evaluate full agentic lifecycle", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "triage-initial-compromise", "adaptive-api-troubleshooting" ], "objective": "Determine if any service principals are being operated by an AI agent demonstrating adaptive troubleshooting and sensitive resource discovery.", "description": "Combine the evidence of compromise, discovery, and adaptive behavior into a final verdict.", "max_iterations": 5, "expected_signal": "A high-confidence verdict on the presence of an AI agent.", "success_criteria": "A final verdict per identity citing the sequence of adaptive success after failure." }, "parents": [ { "id": "adaptive-api-troubleshooting" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the evaluate-agentic-lifecycle verdict is malicious for at least one identity demonstrating adaptive troubleshooting", "condition": "the evaluate-agentic-lifecycle verdict is malicious for at least one identity demonstrating adaptive troubleshooting", "blind_spot": "cloud-audit-latency", "confidence": "high", "description": "Decide whether to isolate the compromised identity based on the agent's findings.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "evaluate-agentic-lifecycle" } ] }, { "id": "revoke-service-principal", "type": "action", "label": "Revoke service principal", "config": { "target": "identity", "description": "Immediately disable the compromised identity to halt further AI-driven exfiltration.", "instructions": "Disable the service principal and revoke all active OAuth refresh tokens for the compromised application.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "secret-rotation-audit", "type": "task", "label": "Secret rotation and impact audit", "config": { "assignee": "analyst", "description": "Assess which secrets were accessed by the agent and ensure they are rotated.", "instructions": "Audit Key Vault and Storage Account logs for any 'Get' or 'List' operations performed by the compromised identity. Rotate every secret, key, or connection string in those containers." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "revoke-service-principal" } ] }, { "id": "close-out", "type": "task", "label": "Hunt closure", "config": { "assignee": "analyst", "description": "Document findings and determine if the behavioral signature is ready for production detection.", "instructions": "Finalize the investigation. If the adaptive troubleshooting pattern (400 -> 200) was verified as malicious, recommend it for promotion to a permanent detection rule." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "secret-rotation-audit" } ] } ] }