--- analysis: A single detection rule would struggle to link perimeter HTTP probing to cloud API testing. This hunt uses an agent to weigh the timing cadence across three separate surfaces to find the signature of an automated planner rather than a person. blind_spots: - id: limited-http-logging owner: Network Engineering question: What paths were the agent probing if our gateway only logs the domain? remediation: Enable full request path logging on perimeter application delivery controllers. requires: hb_http_activity with full url_path and status_code risk: The initial mapping phase remains invisible, preventing us from seeing the intent before the cloud pivot occurs. stage: recon-and-attack-surface-mapping - id: no-cloud-data-plane-events owner: Cloud Security Architecture question: Did the agent successfully write then delete a test file to a private bucket? remediation: Enable data-plane auditing for sensitive storage buckets. requires: CloudTrail Data Events or equivalent for S3/Blob storage risk: If only management-plane events are logged, the 'write-then-delete' discovery Hallmark will be missed, leaving us blind to the agent's verification step. stage: automated-cloud-discovery-and-testing coverage: - stage: recon-and-attack-surface-mapping status: covered steps: - exposed-perimeter-assets - api-spec-probing - stage: identity-workflow-probing status: covered steps: - identity-canary-usage - stage: credential-validation-and-pivot status: covered steps: - cloud-pivot-behavior - stage: automated-cloud-discovery-and-testing status: covered steps: - cloud-pivot-behavior guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: Autonomous AI agents can move from initial reconnaissance to cloud pivot in less than 24 hours. A negative result confirms that automated campaigns using these agentic timing signatures are not currently active against the organization's perimeter and identity surfaces. methodology: model-assisted trigger: intel-report hypothesis: An autonomous AI agent like ARTEX is probing internet-facing assets for machine-readable maps and using canary credentials to pivot into cloud environments for automated resource testing. labels: - hunt - attack.t1110 - attack.t1133 - attack.t1190 - credential access - discovery - initial access name: Autonomous AI Agent Probing and Exploitation parameters: canary_domains: default: - evil.com - example.com description: Placeholder domains often found in agent-led identity probing. from: kind: article observed: '2026-11-11' ref: unit42-artex type: list[domain] canary_users: default: - test@example.com - deadbeefdeadbeefdeadbeef12 - admin@evil.com - guest description: Known canary or placeholder usernames used by autonomous frameworks. from: kind: article observed: '2026-11-11' ref: unit42-artex type: list[string] lookback_days: default: '14' description: Days of historical telemetry to examine. type: number scope_hosts: default: [] description: Specific perimeter hosts (ADCs, VPNs, NAS) to focus the hunt on; leave empty to scan the entire estate. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://unit42.paloaltonetworks.com/artex-and-ai-powered-red-teaming-tools/ gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: Start the hunt by examining logs from internet-facing gateways (VPNs, ADCs). The cloud portion should prioritize roles with permission to modify identity or access high-value storage buckets. references: - name: "Unit 42 \u2014 ARTEX and AI-Powered Red Teaming Tools" url: https://unit42.paloaltonetworks.com/artex-and-ai-powered-red-teaming-tools/ related: - hunt: cloud-credential-leak-audit reason: This hunt focuses on the behavioral hallmark of agentic tools; a separate audit is needed to identify the static credentials these tools target. relation: out-of-scope-alternative scenario: stages: - name: Reconnaissance and Attack Surface Mapping observables: - Scans for OpenAPI specifications, source maps, and configuration files - High-frequency probing of internet-facing NAS devices and Application Delivery Controllers - Tool infrastructure associated with ARL, Nemo, XingRin, and Scope Sentry - Host fingerprints for ARTEX and CyberStrikeAI consoles slug: recon-and-attack-surface-mapping tactic: initial-access techniques: - T1190 - name: Identity Workflow and API Probing observables: - Cadence of 1-14 requests followed by 25-31 second pauses - Abuse of public password reset pages and verification code endpoints - 'Canary usernames: test@example.com, deadbeefdeadbeefdeadbeef12' - 'Canary domains: evil.com, example.com' - Unauthenticated account-existence checks slug: identity-workflow-probing tactic: initial-access techniques: - T1110 - T1190 - name: Credential Validation and Cloud Pivot observables: - Validation of 200+ client secrets within a 3-minute window - Transition from scripted user agents to desktop browser user agents for token requests - Pivoting to cloud identity providers within one minute of credential acquisition slug: credential-validation-and-pivot tactic: credential-access techniques: - T1110 - name: Automated Cloud Discovery and Testing observables: - Write-then-delete tests on cloud storage buckets - Polling every 48 seconds for resource status - Rapid trial-and-error adjustment of HTTP 422 failed requests - Recheck loops replaying attack sequences every 30 seconds slug: automated-cloud-discovery-and-testing tactic: discovery summary: Threat actors are employing autonomous AI-powered red teaming frameworks like ARTEX and CyberStrikeAI to execute rapid, multi-stage intrusions. These tools automate the discovery of exposed APIs and identity workflows, using machine-speed reasoning to validate credentials and pivot into cloud environments without traditional software exploits. severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent identity: category: identity name: Identity / sign-in telemetry telemetry: - identity web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # Autonomous AI Agent Probing and Exploitation AI-powered red teaming tools such as ARTEX and CyberStrikeAI exhibit predictable behavioral hallmarks, specifically a think-then-act timing cadence and machine-speed iteration. This hunt identifies the public attack surface and then hunts for reconnaissance patterns across HTTP and identity telemetry. It correlates these early signals with automated write-then-delete patterns in the cloud control plane to confirm an active agentic intrusion. The hunt is designed to distinguish automated planners from human actors by weighing the cadence and consistency of these interactions across multiple surfaces. ## exposed-perimeter-assets Identify the organization's public attack surface, specifically VPNs, NAS, and Application Delivery Controllers identified as primary ARTEX targets. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of hosts forming the organization's exposed edge. These provide the initial scope for the analyst to narrow later behavioral queries. reads: - domain_or_ip - ip_address - product - version - port silence: not_evidence_of_absence source: hb_exposed_assets verified: dry-run verified_at: '2026-11-12' ~~~ SELECT domain_or_ip, ip_address, product, version, port FROM hb_exposed_assets WHERE (LOWER(product) LIKE '%vpn%' OR LOWER(product) LIKE '%nas%' OR LOWER(product) LIKE '%adc%' OR LOWER(product) LIKE '%citrix%' OR LOWER(product) LIKE '%f5%') ORDER BY discovered_at DESC ``` ## early-recon-parallel parallel: - → api-spec-probing - → identity-canary-usage join: → perimeter-agent ## api-spec-probing Identify high-frequency scans for machine-readable attack maps such as OpenAPI, Swagger, or source maps. ```sqlite target=web role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Bursts of requests for configuration or map files from a single IP, suggesting the agent is mapping the application structure. prevalence: by: src_endpoint_ip key: - url_path rare_below: 5 reads: - device_hostname - src_endpoint_ip - url_path - status_code - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-11-12' ~~~ SELECT device_hostname, src_endpoint_ip, url_path, status_code, COUNT(*) as hit_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_http_activity WHERE (LOWER(url_path) LIKE '%.map' OR LOWER(url_path) LIKE '%openapi%' OR LOWER(url_path) LIKE '%swagger%' OR LOWER(url_path) LIKE '%.yaml' OR LOWER(url_path) LIKE '%.json') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3, 4 HAVING hit_count > 3 ORDER BY hit_count DESC ``` ## identity-canary-usage Identify brute-force or probing attempts using known ARTEX canary values or placeholder domains in authentication logs. ```sqlite target=identity role=triage params=(lookback_days=lookback_days, canary_users=canary_users, canary_domains=canary_domains) ~~~yaml expected: Multiple failed authentication attempts for 'test' accounts or placeholders like 'evil.com' from a single IP address. reads: - src_endpoint_ip - actor_user_name - status_id - time silence: not_evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-11-12' ~~~ SELECT src_endpoint_ip, actor_user_name, status_id, COUNT(*) as attempt_count, MIN(time) as start_time, MAX(time) as end_time FROM hb_auth_signin WHERE (instr(',' || '{{canary_users}}' || ',', ',' || LOWER(actor_user_name) || ',') > 0 OR instr(',' || '{{canary_domains}}' || ',', ',' || SUBSTR(LOWER(actor_user_name), INSTR(actor_user_name, '@') + 1) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3 ORDER BY attempt_count DESC ``` ## perimeter-agent ```agent target=hunter cite: required context: - api-spec-probing - identity-canary-usage max_iterations: 4 objective: Identify source IPs that demonstrate the machine-speed iteration and the specific 'think-then-act' cadence (1-14 requests followed by 25-31 second pauses). Determine if these IPs are targeting both API maps and identity endpoints. success_criteria: A per-IP verdict of agent | suspect | benign, citing the specific timing gaps in the results. tools: - endpoint - identity - web ``` ## cloud-pivot-behavior Search for the 'write-then-delete' discovery pattern in cloud logs that follows a successful credential acquisition. ```sqlite target=endpoint role=triage params=(lookback_days=lookback_days) ~~~yaml expected: Evidence of automated 'write-then-delete' loops on the same resource within seconds, indicating an agent is testing its permissions. reads: - cloud_account_uid - actor_user_name - api_operation - resource_name - time silence: not_evidence_of_absence source: hb_cloud_api_activity verified: dry-run verified_at: '2026-11-12' ~~~ SELECT cloud_account_uid, actor_user_name, resource_name, GROUP_CONCAT(api_operation) as operations, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_cloud_api_activity WHERE (api_operation LIKE '%Put%' OR api_operation LIKE '%Delete%' OR api_operation LIKE '%Create%' OR api_operation LIKE '%GetCallerIdentity%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY cloud_account_uid, actor_user_name, resource_name HAVING (instr(operations, 'Put') > 0 AND instr(operations, 'Delete') > 0) OR (instr(operations, 'Create') > 0 AND instr(operations, 'Delete') > 0) ORDER BY first_seen DESC ``` ## pivot-agent ```agent target=hunter cite: required context: - perimeter-agent - cloud-pivot-behavior max_iterations: 4 objective: Determine if the identities performing automated cloud tests were compromised during or immediately after the perimeter probing identified in the first phase. Look for the transition from scripted agents to desktop browsers mentioned in the research. success_criteria: A detailed timeline of the intrusion citing specific IPs and compromised identities. tools: - endpoint - identity - web ``` ## route-on-verdict if~: "the pivot-agent verdict is malicious for at least one identity or source IP" (confidence: high, judge=hunter) then: → isolate-identities indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: limited-http-logging) else: → close-out ## isolate-identities ```action target=identity ~~~yaml approval: required ~~~ Disable the accounts identified in the correlation agent's timeline and revoke all active OAuth/session tokens. Block the source IPs at the perimeter. ``` → analyst-review ## analyst-review ```manual target=analyst Review the timing bursts and canary usage cited by the agent. Specifically, check if any identities transitioned to human-like browsing patterns before containment, which may indicate a secondary beachhead. ``` → end ## close-out ```manual target=analyst Document the findings. If speculative probing for .map or openapi files was identified without a pivot, consider promoting the HTTP query to a standing detection rule. ``` → end