{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Autonomous AI agents can move from initial reconnaissance to cloud pivot in less than 24 hours. A negative result confirms that automated campaigns using these agentic timing signatures are not currently active against the organization's perimeter and identity surfaces." }, "name": "Autonomous AI Agent Probing and Exploitation", "type": "investigation", "labels": [ "hunt", "attack.t1110", "attack.t1133", "attack.t1190", "credential access", "discovery", "initial access" ], "related": [ { "hunt": "cloud-credential-leak-audit", "reason": "This hunt focuses on the behavioral hallmark of agentic tools; a separate audit is needed to identify the static credentials these tools target.", "relation": "out-of-scope-alternative" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A single detection rule would struggle to link perimeter HTTP probing to cloud API testing. This hunt uses an agent to weigh the timing cadence across three separate surfaces to find the signature of an automated planner rather than a person.", "coverage": [ { "stage": "recon-and-attack-surface-mapping", "steps": [ "exposed-perimeter-assets", "api-spec-probing" ], "status": "covered" }, { "stage": "identity-workflow-probing", "steps": [ "identity-canary-usage" ], "status": "covered" }, { "stage": "credential-validation-and-pivot", "steps": [ "cloud-pivot-behavior" ], "status": "covered" }, { "stage": "automated-cloud-discovery-and-testing", "steps": [ "cloud-pivot-behavior" ], "status": "covered" } ], "scenario": { "stages": [ { "name": "Reconnaissance and Attack Surface Mapping", "slug": "recon-and-attack-surface-mapping", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "Scans for OpenAPI specifications, source maps, and configuration files", "High-frequency probing of internet-facing NAS devices and Application Delivery Controllers", "Tool infrastructure associated with ARL, Nemo, XingRin, and Scope Sentry", "Host fingerprints for ARTEX and CyberStrikeAI consoles" ] }, { "name": "Identity Workflow and API Probing", "slug": "identity-workflow-probing", "tactic": "initial-access", "techniques": [ "T1110", "T1190" ], "observables": [ "Cadence of 1-14 requests followed by 25-31 second pauses", "Abuse of public password reset pages and verification code endpoints", "Canary usernames: test@example.com, deadbeefdeadbeefdeadbeef12", "Canary domains: evil.com, example.com", "Unauthenticated account-existence checks" ] }, { "name": "Credential Validation and Cloud Pivot", "slug": "credential-validation-and-pivot", "tactic": "credential-access", "techniques": [ "T1110" ], "observables": [ "Validation of 200+ client secrets within a 3-minute window", "Transition from scripted user agents to desktop browser user agents for token requests", "Pivoting to cloud identity providers within one minute of credential acquisition" ] }, { "name": "Automated Cloud Discovery and Testing", "slug": "automated-cloud-discovery-and-testing", "tactic": "discovery", "observables": [ "Write-then-delete tests on cloud storage buckets", "Polling every 48 seconds for resource status", "Rapid trial-and-error adjustment of HTTP 422 failed requests", "Recheck loops replaying attack sequences every 30 seconds" ] } ], "summary": "Threat actors are employing autonomous AI-powered red teaming frameworks like ARTEX and CyberStrikeAI to execute rapid, multi-stage intrusions. These tools automate the discovery of exposed APIs and identity workflows, using machine-speed reasoning to validate credentials and pivot into cloud environments without traditional software exploits." }, "severity": "high", "rationale": "Start the hunt by examining logs from internet-facing gateways (VPNs, ADCs). The cloud portion should prioritize roles with permission to modify identity or access high-value storage buckets.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An autonomous AI agent like ARTEX is probing internet-facing assets for machine-readable maps and using canary credentials to pivot into cloud environments for automated resource testing.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Specific perimeter hosts (ADCs, VPNs, NAS) to focus the hunt on; leave empty to scan the entire estate." }, "canary_users": { "from": { "ref": "unit42-artex", "kind": "article", "observed": "2026-11-11" }, "type": "list[string]", "default": [ "test@example.com", "deadbeefdeadbeefdeadbeef12", "admin@evil.com", "guest" ], "description": "Known canary or placeholder usernames used by autonomous frameworks." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of historical telemetry to examine." }, "canary_domains": { "from": { "ref": "unit42-artex", "kind": "article", "observed": "2026-11-11" }, "type": "list[domain]", "default": [ "evil.com", "example.com" ], "description": "Placeholder domains often found in agent-led identity probing." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/artex-and-ai-powered-red-teaming-tools/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/artex-and-ai-powered-red-teaming-tools/", "name": "Unit 42 \u2014 ARTEX and AI-Powered Red Teaming Tools" } ], "blind_spots": [ { "id": "limited-http-logging", "risk": "The initial mapping phase remains invisible, preventing us from seeing the intent before the cloud pivot occurs.", "owner": "Network Engineering", "stage": "recon-and-attack-surface-mapping", "question": "What paths were the agent probing if our gateway only logs the domain?", "requires": "hb_http_activity with full url_path and status_code", "remediation": "Enable full request path logging on perimeter application delivery controllers." }, { "id": "no-cloud-data-plane-events", "risk": "If only management-plane events are logged, the 'write-then-delete' discovery Hallmark will be missed, leaving us blind to the agent's verification step.", "owner": "Cloud Security Architecture", "stage": "automated-cloud-discovery-and-testing", "question": "Did the agent successfully write then delete a test file to a private bucket?", "requires": "CloudTrail Data Events or equivalent for S3/Blob storage", "remediation": "Enable data-plane auditing for sensitive storage buckets." } ] }, "name": "Autonomous AI Agent Probing and Exploitation", "description": "AI-powered red teaming tools such as ARTEX and CyberStrikeAI exhibit predictable behavioral hallmarks, specifically a think-then-act timing cadence and machine-speed iteration. This hunt identifies the public attack surface and then hunts for reconnaissance patterns across HTTP and identity telemetry. It correlates these early signals with automated write-then-delete patterns in the cloud control plane to confirm an active agentic intrusion. The hunt is designed to distinguish automated planners from human actors by weighing the cadence and consistency of these interactions across multiple surfaces." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "coverage": [ { "stage": "recon-and-attack-surface-mapping", "steps": [ "exposed-perimeter-assets", "api-spec-probing" ], "status": "covered" }, { "stage": "identity-workflow-probing", "steps": [ "identity-canary-usage" ], "status": "covered" }, { "stage": "credential-validation-and-pivot", "steps": [ "cloud-pivot-behavior" ], "status": "covered" }, { "stage": "automated-cloud-discovery-and-testing", "steps": [ "cloud-pivot-behavior" ], "status": "covered" } ], "rationale": "An autonomous AI agent like ARTEX is probing internet-facing assets for machine-readable maps and using canary credentials to pivot into cloud environments for automated resource testing.", "blind_spots": [ { "id": "limited-http-logging", "risk": "The initial mapping phase remains invisible, preventing us from seeing the intent before the cloud pivot occurs.", "owner": "Network Engineering", "stage": "recon-and-attack-surface-mapping", "question": "What paths were the agent probing if our gateway only logs the domain?", "requires": "hb_http_activity with full url_path and status_code", "remediation": "Enable full request path logging on perimeter application delivery controllers." }, { "id": "no-cloud-data-plane-events", "risk": "If only management-plane events are logged, the 'write-then-delete' discovery Hallmark will be missed, leaving us blind to the agent's verification step.", "owner": "Cloud Security Architecture", "stage": "automated-cloud-discovery-and-testing", "question": "Did the agent successfully write then delete a test file to a private bucket?", "requires": "CloudTrail Data Events or equivalent for S3/Blob storage", "remediation": "Enable data-plane auditing for sensitive storage buckets." } ], "scoping_notes": "Start the hunt by examining logs from internet-facing gateways (VPNs, ADCs). The cloud portion should prioritize roles with permission to modify identity or access high-value storage buckets.", "beyond_detection": "A single detection rule would struggle to link perimeter HTTP probing to cloud API testing. This hunt uses an agent to weigh the timing cadence across three separate surfaces to find the signature of an automated planner rather than a person." } }, { "id": "exposed-perimeter-assets", "type": "query", "label": "Identify Exposed Perimeter Assets", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT domain_or_ip, ip_address, product, version, port FROM hb_exposed_assets WHERE (LOWER(product) LIKE '%vpn%' OR LOWER(product) LIKE '%nas%' OR LOWER(product) LIKE '%adc%' OR LOWER(product) LIKE '%citrix%' OR LOWER(product) LIKE '%f5%') ORDER BY discovered_at DESC", "surface": "hb_exposed_assets", "description": "Identify the organization's public attack surface, specifically VPNs, NAS, and Application Delivery Controllers identified as primary ARTEX targets.", "expected_signal": "A list of hosts forming the organization's exposed edge. These provide the initial scope for the analyst to narrow later behavioral queries." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify Exposed Perimeter Assets", "reads": [ "domain_or_ip", "ip_address", "product", "version", "port" ], "source": "hb_exposed_assets", "target": "endpoint", "content": "SELECT domain_or_ip, ip_address, product, version, port FROM hb_exposed_assets WHERE (LOWER(product) LIKE '%vpn%' OR LOWER(product) LIKE '%nas%' OR LOWER(product) LIKE '%adc%' OR LOWER(product) LIKE '%citrix%' OR LOWER(product) LIKE '%f5%') ORDER BY discovered_at DESC", "silence": "not_evidence_of_absence", "expected": "A list of hosts forming the organization's exposed edge. These provide the initial scope for the analyst to narrow later behavioral queries.", "verified": "dry-run", "verified_at": "2026-11-12" } }, { "id": "api-spec-probing", "type": "query", "label": "API Specification Probing", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "web", "content": "SELECT device_hostname, src_endpoint_ip, url_path, status_code, COUNT(*) as hit_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_http_activity WHERE (LOWER(url_path) LIKE '%.map' OR LOWER(url_path) LIKE '%openapi%' OR LOWER(url_path) LIKE '%swagger%' OR LOWER(url_path) LIKE '%.yaml' OR LOWER(url_path) LIKE '%.json') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3, 4 HAVING hit_count > 3 ORDER BY hit_count DESC", "surface": "hb_http_activity", "description": "Identify high-frequency scans for machine-readable attack maps such as OpenAPI, Swagger, or source maps.", "expected_signal": "Bursts of requests for configuration or map files from a single IP, suggesting the agent is mapping the application structure." }, "parents": [ { "id": "exposed-perimeter-assets" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "API Specification Probing", "reads": [ "device_hostname", "src_endpoint_ip", "url_path", "status_code", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, src_endpoint_ip, url_path, status_code, COUNT(*) as hit_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_http_activity WHERE (LOWER(url_path) LIKE '%.map' OR LOWER(url_path) LIKE '%openapi%' OR LOWER(url_path) LIKE '%swagger%' OR LOWER(url_path) LIKE '%.yaml' OR LOWER(url_path) LIKE '%.json') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3, 4 HAVING hit_count > 3 ORDER BY hit_count DESC", "silence": "not_evidence_of_absence", "expected": "Bursts of requests for configuration or map files from a single IP, suggesting the agent is mapping the application structure.", "verified": "dry-run", "prevalence": { "by": "src_endpoint_ip", "key": [ "url_path" ], "rare_below": 5 }, "verified_at": "2026-11-12" } }, { "id": "identity-canary-usage", "type": "query", "label": "Identity Canary and Placeholder Usage", "config": { "dsl": "sqlite", "role": "triage", "source": "identity", "content": "SELECT src_endpoint_ip, actor_user_name, status_id, COUNT(*) as attempt_count, MIN(time) as start_time, MAX(time) as end_time FROM hb_auth_signin WHERE (instr(',' || '{{canary_users}}' || ',', ',' || LOWER(actor_user_name) || ',') > 0 OR instr(',' || '{{canary_domains}}' || ',', ',' || SUBSTR(LOWER(actor_user_name), INSTR(actor_user_name, '@') + 1) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3 ORDER BY attempt_count DESC", "surface": "hb_auth_signin", "description": "Identify brute-force or probing attempts using known ARTEX canary values or placeholder domains in authentication logs.", "expected_signal": "Multiple failed authentication attempts for 'test' accounts or placeholders like 'evil.com' from a single IP address." }, "parents": [ { "id": "exposed-perimeter-assets" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Identity Canary and Placeholder Usage", "reads": [ "src_endpoint_ip", "actor_user_name", "status_id", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT src_endpoint_ip, actor_user_name, status_id, COUNT(*) as attempt_count, MIN(time) as start_time, MAX(time) as end_time FROM hb_auth_signin WHERE (instr(',' || '{{canary_users}}' || ',', ',' || LOWER(actor_user_name) || ',') > 0 OR instr(',' || '{{canary_domains}}' || ',', ',' || SUBSTR(LOWER(actor_user_name), INSTR(actor_user_name, '@') + 1) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3 ORDER BY attempt_count DESC", "silence": "not_evidence_of_absence", "expected": "Multiple failed authentication attempts for 'test' accounts or placeholders like 'evil.com' from a single IP address.", "verified": "dry-run", "verified_at": "2026-11-12" } }, { "id": "perimeter-agent", "type": "analytic", "label": "Analyze Perimeter Probing Patterns", "config": { "cite": "required", "tools": [ "endpoint", "identity", "web" ], "context": [ "api-spec-probing", "identity-canary-usage" ], "objective": "Identify source IPs that demonstrate the machine-speed iteration and the specific 'think-then-act' cadence (1-14 requests followed by 25-31 second pauses). Determine if these IPs are targeting both API maps and identity endpoints.", "description": "Evaluate the early-stage HTTP and Auth results to determine if the activity matches the timing cadence of an AI inference loop.", "max_iterations": 4, "expected_signal": "A verdict on whether a source IP is exhibiting the burst-then-pause behavior characteristic of an LLM-led agent.", "success_criteria": "A per-IP verdict of agent | suspect | benign, citing the specific timing gaps in the results." }, "parents": [ { "id": "api-spec-probing", "kind": "merge" }, { "id": "identity-canary-usage", "kind": "merge" } ] }, { "id": "cloud-pivot-behavior", "type": "query", "label": "Automated Cloud Discovery and Testing", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT cloud_account_uid, actor_user_name, resource_name, GROUP_CONCAT(api_operation) as operations, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_cloud_api_activity WHERE (api_operation LIKE '%Put%' OR api_operation LIKE '%Delete%' OR api_operation LIKE '%Create%' OR api_operation LIKE '%GetCallerIdentity%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY cloud_account_uid, actor_user_name, resource_name HAVING (instr(operations, 'Put') > 0 AND instr(operations, 'Delete') > 0) OR (instr(operations, 'Create') > 0 AND instr(operations, 'Delete') > 0) ORDER BY first_seen DESC", "surface": "hb_cloud_api_activity", "description": "Search for the 'write-then-delete' discovery pattern in cloud logs that follows a successful credential acquisition.", "expected_signal": "Evidence of automated 'write-then-delete' loops on the same resource within seconds, indicating an agent is testing its permissions." }, "parents": [ { "id": "perimeter-agent" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Automated Cloud Discovery and Testing", "reads": [ "cloud_account_uid", "actor_user_name", "api_operation", "resource_name", "time" ], "source": "hb_cloud_api_activity", "target": "endpoint", "content": "SELECT cloud_account_uid, actor_user_name, resource_name, GROUP_CONCAT(api_operation) as operations, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_cloud_api_activity WHERE (api_operation LIKE '%Put%' OR api_operation LIKE '%Delete%' OR api_operation LIKE '%Create%' OR api_operation LIKE '%GetCallerIdentity%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY cloud_account_uid, actor_user_name, resource_name HAVING (instr(operations, 'Put') > 0 AND instr(operations, 'Delete') > 0) OR (instr(operations, 'Create') > 0 AND instr(operations, 'Delete') > 0) ORDER BY first_seen DESC", "silence": "not_evidence_of_absence", "expected": "Evidence of automated 'write-then-delete' loops on the same resource within seconds, indicating an agent is testing its permissions.", "verified": "dry-run", "verified_at": "2026-11-12" } }, { "id": "pivot-agent", "type": "analytic", "label": "Correlate Perimeter Recon with Cloud Pivot", "config": { "cite": "required", "tools": [ "endpoint", "identity", "web" ], "context": [ "perimeter-agent", "cloud-pivot-behavior" ], "objective": "Determine if the identities performing automated cloud tests were compromised during or immediately after the perimeter probing identified in the first phase. Look for the transition from scripted agents to desktop browsers mentioned in the research.", "description": "Link the automated perimeter probing to the subsequent cloud discovery behavior to confirm a multi-stage intrusion.", "max_iterations": 4, "expected_signal": "A confirmed attack chain timeline linking the IP-based recon to the identity-based cloud pivot.", "success_criteria": "A detailed timeline of the intrusion citing specific IPs and compromised identities." }, "parents": [ { "id": "cloud-pivot-behavior" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on Verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the pivot-agent verdict is malicious for at least one identity or source IP", "condition": "the pivot-agent verdict is malicious for at least one identity or source IP", "blind_spot": "limited-http-logging", "confidence": "high", "description": "Direct the workflow based on the correlation between perimeter and cloud activity.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "pivot-agent" } ] }, { "id": "isolate-identities", "type": "action", "label": "Isolate Compromised Identities", "config": { "target": "identity", "description": "Immediately revoke access for the identities identified as being used by the autonomous agent.", "instructions": "Disable the accounts identified in the correlation agent's timeline and revoke all active OAuth/session tokens. Block the source IPs at the perimeter.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst Review and Verification", "config": { "assignee": "analyst", "description": "Perform a manual review of the automated correlation to confirm the attack chain and check for human-in-the-loop escalation.", "instructions": "Review the timing bursts and canary usage cited by the agent. Specifically, check if any identities transitioned to human-like browsing patterns before containment, which may indicate a secondary beachhead." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-identities" } ] }, { "id": "close-out", "type": "task", "label": "Hunt Close-out", "config": { "assignee": "analyst", "description": "Record the results of the hunt and identify areas for hardening based on the discovered exposure.", "instructions": "Document the findings. If speculative probing for .map or openapi files was identified without a pivot, consider promoting the HTTP query to a standing detection rule." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" } ] } ] }