{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Adversaries using ARTEX can move from initial access to full tenant persistence in under 3 hours; identifying machine-speed directory changes and Graph abuse is essential for timely eviction." }, "name": "ARTEX-Driven Cloud Persistence and Graph Exfiltration", "type": "investigation", "labels": [ "hunt", "attack.t1087", "attack.t1098", "attack.t1041", "attack.t1195", "credential access", "exfiltration", "initial access", "persistence" ], "series": { "slug": "ai-driven-large-scale-nation-state-campaign-using-artex-enables-supply-chain-compromise", "index": 2, "title": "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise", "total": 2 }, "related": [ { "hunt": "ai-automated-password-spraying", "reason": "This hunt focuses on post-authentication tenant activity, while the password spray campaign targets initial access.", "relation": "out-of-scope-alternative" }, { "hunt": "connectwise-supply-chain-initial-access", "reason": "This hunt addresses internal tenant persistence, not the initial exploitation of the ConnectWise platform.", "relation": "out-of-scope-alternative" }, { "hunt": "storm-0940-ai-auth-accelerated", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A single rule on credential addition is often too noisy for dynamic environments. This hunt correlates that action with machine-speed API call volumes and rare source IP reputation to confirm a high-confidence automated intrusion.", "coverage": [ { "stage": "graph-api-recon-and-persistence", "steps": [ "directory-persistence", "api-volume" ], "status": "covered" }, { "stage": "privilege-and-group-modification", "steps": [ "directory-persistence" ], "status": "covered" }, { "stage": "mailbox-and-file-exfiltration", "steps": [ "api-volume" ], "status": "covered" }, { "stage": "ai-automated-password-spraying", "reason": "Belongs to another part of the 'AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise' series.", "status": "out_of_scope" }, { "stage": "connectwise-supply-chain-compromise", "reason": "Belongs to another part of the 'AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise' series.", "status": "out_of_scope" }, { "stage": "compromised-application-abuse", "reason": "Belongs to another part of the 'AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "AI-Automated Password Spraying", "slug": "ai-automated-password-spraying", "tactic": "credential-access", "techniques": [ "T1110.003" ], "observables": [ "IP address 144.172.64.99", "2,900 authentication attempts per minute", "151,000+ failed logon events", "98% lockout responses", "Targeting Microsoft 365 and Exchange Online", "Peak activity on October 11, 2026" ] }, { "name": "ConnectWise Supply Chain Compromise", "slug": "connectwise-supply-chain-compromise", "tactic": "initial-access", "techniques": [ "T1195" ], "observables": [ "ConnectWise Cloud Backup application", "Multi-tenant application compromise", "Stolen application credentials/identities" ] }, { "name": "Compromised Application Authentication", "slug": "compromised-application-abuse", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "Service principal sign-ins from 144.172.64.x IP range", "ARTEX framework (Next.js frontend)", "Use of stolen app credentials to bypass interactive sign-in", "Authentication to 2,250+ tenants" ] }, { "name": "Microsoft Graph Reconnaissance and Persistence", "slug": "graph-api-recon-and-persistence", "tactic": "persistence", "techniques": [ "T1087", "T1098" ], "observables": [ "Microsoft Graph API calls", "Listing directories, permissions, and approvals", "Modification of OAuth application credentials", "Adding new application owners or service principals", "Modifying app-role assignments" ] }, { "name": "Privilege and Group Modification", "slug": "privilege-and-group-modification", "tactic": "persistence", "techniques": [ "T1098" ], "observables": [ "Changes to privileged roles", "Modification of group memberships", "Conditional Access policy changes", "Identity-related directory operations" ] }, { "name": "Mailbox and File Exfiltration", "slug": "mailbox-and-file-exfiltration", "tactic": "exfiltration", "techniques": [ "T1041" ], "observables": [ "Unusual mail or file access and downloads", "Creation of inbox or transport rules", "Delegated mailbox permission changes", "Forwarding rule creation" ] } ], "summary": "Storm-0940 used the ARTEX agentic AI framework to automate large-scale password spraying and a supply chain compromise of the ConnectWise multi-tenant application. The actor abused stolen application credentials to perform high-speed reconnaissance via Microsoft Graph, modify application credentials for persistence, and exfiltrate mailbox data from Microsoft 365 environments." }, "severity": "high", "rationale": "Narrow focus to Microsoft 365 tenants with active ConnectWise integrations. The window of interest begins on October 10, 2026, when Storm-0940 infrastructure was first observed conducting high-volume campaigns.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is using agentic AI to perform high-velocity reconnaissance, credential additions, and data exfiltration within our Microsoft 365 environment after compromising a trusted application.", "parameters": { "actor_ips": { "from": { "ref": "msrc-blog-storm-0940", "kind": "article", "observed": "2026-10-21" }, "type": "list[ip]", "default": [ "144.172.64.99" ], "description": "Known infrastructure used by Storm-0940 agents." }, "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2024-10-21" }, "type": "list[host]", "default": [], "description": "Specific hosts to narrow the directory persistence search." }, "lookback_days": { "from": { "ref": "standard-retention", "kind": "manual", "observed": "2024-10-21" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "connectwise_app_ids": { "from": { "ref": "connectwise-october-2026", "kind": "advisory", "observed": "2026-10-16" }, "type": "list[string]", "default": [ "00000000-0000-0000-0000-000000000000" ], "description": "Application IDs for the affected ConnectWise applications; refresh from advisory." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "name": "Storm-0940 uses ARTEX agentic AI in ConnectWise supply chain compromise" } ], "blind_spots": [ { "id": "no-graph-data-events", "risk": "Standard audit logs do not capture 'MailItemsAccessed' events, which are the primary indicator of data theft via Graph API.", "stage": "mailbox-and-file-exfiltration", "question": "whether specific mail items were accessed", "requires": "Microsoft Purview Audit (Premium)" }, { "id": "limited-ip-reputation", "risk": "Legitimate vendor infrastructure may use many IPs; without a long-term baseline, AI-driven attacks may be misidentified as normal vendor traffic.", "stage": "graph-api-recon-and-persistence", "question": "whether an IP is truly rare for a specific service principal", "requires": "historical src_endpoint_ip baseline" } ] }, "name": "ARTEX-Driven Cloud Persistence and Graph Exfiltration", "description": "This hunt targets the machine-speed post-authentication activity associated with Storm-0940 and the ARTEX framework. It focuses on identifying automated reconnaissance, unauthorized credential additions to OAuth applications, and high-volume data access via Microsoft Graph. The flow correlates known threat actor infrastructure with sensitive directory changes and uses stack-counting to identify anomalous API call volumes that signify automated exfiltration and persistence." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "ai-driven-large-scale-nation-state-campaign-using-artex-enables-supply-chain-compromise", "index": 2, "title": "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise", "total": 2 }, "coverage": [ { "stage": "graph-api-recon-and-persistence", "steps": [ "directory-persistence", "api-volume" ], "status": "covered" }, { "stage": "privilege-and-group-modification", "steps": [ "directory-persistence" ], "status": "covered" }, { "stage": "mailbox-and-file-exfiltration", "steps": [ "api-volume" ], "status": "covered" }, { "stage": "ai-automated-password-spraying", "reason": "Belongs to another part of the 'AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise' series.", "status": "out_of_scope" }, { "stage": "connectwise-supply-chain-compromise", "reason": "Belongs to another part of the 'AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise' series.", "status": "out_of_scope" }, { "stage": "compromised-application-abuse", "reason": "Belongs to another part of the 'AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise' series.", "status": "out_of_scope" } ], "rationale": "An adversary is using agentic AI to perform high-velocity reconnaissance, credential additions, and data exfiltration within our Microsoft 365 environment after compromising a trusted application.", "blind_spots": [ { "id": "no-graph-data-events", "risk": "Standard audit logs do not capture 'MailItemsAccessed' events, which are the primary indicator of data theft via Graph API.", "stage": "mailbox-and-file-exfiltration", "question": "whether specific mail items were accessed", "requires": "Microsoft Purview Audit (Premium)" }, { "id": "limited-ip-reputation", "risk": "Legitimate vendor infrastructure may use many IPs; without a long-term baseline, AI-driven attacks may be misidentified as normal vendor traffic.", "stage": "graph-api-recon-and-persistence", "question": "whether an IP is truly rare for a specific service principal", "requires": "historical src_endpoint_ip baseline" } ], "scoping_notes": "Narrow focus to Microsoft 365 tenants with active ConnectWise integrations. The window of interest begins on October 10, 2026, when Storm-0940 infrastructure was first observed conducting high-volume campaigns.", "beyond_detection": "A single rule on credential addition is often too noisy for dynamic environments. This hunt correlates that action with machine-speed API call volumes and rare source IP reputation to confirm a high-confidence automated intrusion." } }, { "id": "signin-lead", "type": "query", "label": "Initial Sign-ins from Actor Infrastructure", "config": { "dsl": "sqlite", "role": "scoping", "source": "identity", "content": "SELECT device_hostname, actor_user_name, src_endpoint_ip, app_id, time FROM hb_auth_signin WHERE (instr(',' || '{{actor_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 OR instr(',' || '{{connectwise_app_ids}}' || ',', ',' || app_id || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_auth_signin", "description": "Identify successful or failed sign-ins from reported actor IP addresses or using the compromised application IDs.", "expected_signal": "Rows indicate the specific account and IP used to enter the tenant; silence provides evidence of absence for these specific IOCs." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Initial Sign-ins from Actor Infrastructure", "reads": [ "device_hostname", "actor_user_name", "src_endpoint_ip", "app_id", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT device_hostname, actor_user_name, src_endpoint_ip, app_id, time FROM hb_auth_signin WHERE (instr(',' || '{{actor_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 OR instr(',' || '{{connectwise_app_ids}}' || ',', ',' || app_id || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "Rows indicate the specific account and IP used to enter the tenant; silence provides evidence of absence for these specific IOCs.", "verified": "dry-run", "verified_at": "2026-10-22" } }, { "id": "directory-persistence", "type": "query", "label": "Directory Entity and Role Modifications", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT time, actor_user_name, entity_name, operation_type, attribute_name, device_hostname FROM hb_entity_management WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(operation_type) LIKE '%credential%' OR LOWER(operation_type) LIKE '%role%' OR LOWER(operation_type) LIKE '%owner%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_entity_management", "description": "Identify entity modifications that indicate credential additions or role expansion within the tenant.", "expected_signal": "New credentials added to applications or new users added to privileged roles, potentially by automated accounts." }, "parents": [ { "id": "signin-lead" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Directory Entity and Role Modifications", "reads": [ "time", "actor_user_name", "entity_name", "operation_type", "attribute_name", "device_hostname" ], "source": "hb_entity_management", "target": "endpoint", "content": "SELECT time, actor_user_name, entity_name, operation_type, attribute_name, device_hostname FROM hb_entity_management WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(operation_type) LIKE '%credential%' OR LOWER(operation_type) LIKE '%role%' OR LOWER(operation_type) LIKE '%owner%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "New credentials added to applications or new users added to privileged roles, potentially by automated accounts.", "verified": "dry-run", "verified_at": "2026-10-22" } }, { "id": "api-volume", "type": "query", "label": "High-Velocity API Call Patterns", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT src_endpoint_ip, actor_user_name, api_operation, COUNT(*) AS call_count, MIN(time) AS first_seen FROM hb_cloud_api_activity WHERE provider IN ('m365', 'azure_ad') AND (LOWER(api_operation) LIKE '%mail%' OR LOWER(api_operation) LIKE '%get%' OR LOWER(api_operation) LIKE '%list%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip, actor_user_name, api_operation HAVING call_count > 100", "surface": "hb_cloud_api_activity", "description": "Stack-count sensitive API calls by source IP to identify automated data exfiltration or reconnaissance.", "expected_signal": "A single IP address or service principal performing over 100 sensitive operations in the window, suggesting AI-driven automation." }, "parents": [ { "id": "signin-lead" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "High-Velocity API Call Patterns", "reads": [ "src_endpoint_ip", "actor_user_name", "api_operation", "time", "provider", "cloud_account_uid" ], "source": "hb_cloud_api_activity", "target": "endpoint", "content": "SELECT src_endpoint_ip, actor_user_name, api_operation, COUNT(*) AS call_count, MIN(time) AS first_seen FROM hb_cloud_api_activity WHERE provider IN ('m365', 'azure_ad') AND (LOWER(api_operation) LIKE '%mail%' OR LOWER(api_operation) LIKE '%get%' OR LOWER(api_operation) LIKE '%list%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip, actor_user_name, api_operation HAVING call_count > 100", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A single IP address or service principal performing over 100 sensitive operations in the window, suggesting AI-driven automation.", "verified": "dry-run", "prevalence": { "by": "cloud_account_uid", "key": [ "src_endpoint_ip", "api_operation" ], "rare_below": 3 }, "verified_at": "2026-10-22" } }, { "id": "triage-agent", "type": "analytic", "label": "Triage AI-Accelerated Activity", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "signin-lead", "directory-persistence", "api-volume" ], "objective": "Determine whether the high-volume API calls and entity modifications correlate with the compromised application IDs or the reported actor IPs.", "description": "Correlate sign-in leads with directory changes and anomalous API volumes to confirm an automated intrusion.", "max_iterations": 5, "expected_signal": "A per-tenant verdict citing specific IPs and API operations that demonstrate machine-speed activity.", "success_criteria": "A verdict of malicious | suspicious | benign per host or service principal, citing specific rows." }, "parents": [ { "id": "directory-persistence", "kind": "merge" }, { "id": "api-volume", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on Verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-agent verdict is malicious for at least one service principal or account", "condition": "the triage-agent verdict is malicious for at least one service principal or account", "blind_spot": "no-graph-data-events", "confidence": "high", "description": "Direct the workflow based on the triage agent's findings.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-agent" } ] }, { "id": "isolate-identity", "type": "action", "label": "Revoke Identity Access", "config": { "target": "identity", "description": "Immediately halt the automated intrusion by revoking credentials.", "instructions": "Revoke all active sessions for the identified service principals and rotate their client secrets. Revoke any consent grants created during the intrusion window.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "manual-review", "type": "task", "label": "Manual Analyst Review", "config": { "assignee": "analyst", "description": "Analyst validation of findings and forensic review of resource access.", "instructions": "Review M365 Unified Audit Logs for the specific principal. Search for MailItemsAccessed and FileDownloaded events. Check for new inbox rules or transport rules created during the intrusion." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-identity" } ] }, { "id": "close-out", "type": "task", "label": "Hunt Close-out", "config": { "assignee": "analyst", "description": "Document findings and propose permanent monitoring rules.", "instructions": "Log the identified indicators of compromise. Propose the api-volume query as a permanent detection for high-volume Graph API activity from rare IPs." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "manual-review" } ] } ] }