{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Adversaries are using AI agents to shrink the window between secret exposure and cloud compromise to minutes; identifying reconnaissance against vulnerable assets is the only way to prevent full tenant takeovers." }, "name": "Suspicious Perimeter Reconnaissance and Web Exploitation", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1071", "attack.t1090.003", "attack.t1566", "defense evasion", "discovery", "exfiltration", "initial access" ], "series": { "slug": "threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets", "index": 2, "title": "Threat actors use agentic AI tooling to find and abuse exposed secrets", "total": 2 }, "related": [ { "hunt": "cloud-api-abuse-from-malicious-ips", "reason": "Once initial access is confirmed via this hunt, a second hunt should track the subsequent ARM and Graph API abuse.", "relation": "follows" }, { "hunt": "agentic-ai-cloud-resource-abuse", "relation": "follows" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple rule might catch the IPs, but this hunt pivots between static vulnerability findings and behavioral HTTP traffic. The use of prevalence stack-counting for User-Agents ensures that even if IPs rotate, the tool-based injection patterns remain visible against a baseline of legitimate browser traffic.", "coverage": [ { "stage": "initial-secret-exposure", "steps": [ "vulnerable-secret-exposure", "triage-recon-activity" ], "status": "covered" }, { "stage": "web-vulnerability-exploitation", "steps": [ "suspicious-user-agent-prevalence", "malicious-ip-recon", "triage-recon-activity" ], "status": "covered" }, { "stage": "service-principal-compromise", "reason": "Belongs to another part of the 'Threat actors use agentic AI tooling to find and abuse exposed secrets' series.", "status": "out_of_scope" }, { "stage": "cloud-resource-discovery", "reason": "Belongs to another part of the 'Threat actors use agentic AI tooling to find and abuse exposed secrets' series.", "status": "out_of_scope" }, { "stage": "adaptive-api-probing", "reason": "Belongs to another part of the 'Threat actors use agentic AI tooling to find and abuse exposed secrets' series.", "status": "out_of_scope" }, { "stage": "credential-and-data-exfiltration", "reason": "Belongs to another part of the 'Threat actors use agentic AI tooling to find and abuse exposed secrets' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Secret Exposure in Public Repositories", "slug": "initial-secret-exposure", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "GitHub repositories containing OAuth client secrets", "Azure API keys", "AI inference-related API keys", "ARTEX offensive framework scanning patterns" ] }, { "name": "Credential Abuse via Entra ID", "slug": "service-principal-compromise", "tactic": "initial-access", "techniques": [ "T1078" ], "observables": [ "IP address 199.19.77.84", "IP address 199.19.77.18", "Service principal sign-ins for multitenant applications", "Logins from Tor exit nodes" ] }, { "name": "Automated Cloud Reconnaissance", "slug": "cloud-resource-discovery", "tactic": "discovery", "techniques": [ "T1071" ], "observables": [ "Enumeration of Azure subscriptions", "Enumeration of resource groups", "Mapping of AI model deployments", "Graph API search requests for sensitive content" ] }, { "name": "Adaptive API Troubleshooting", "slug": "adaptive-api-probing", "tactic": "defense-evasion", "techniques": [ "T1071" ], "observables": [ "ARM requests returning HTTP 400 followed by HTTP 200 within 30-60 seconds", "Rapid changes to api-version parameters (e.g., switching to 2023-07-01)", "Switching between HTTP methods (GET/POST) after failure", "Mixing Key Vault data-plane and control-plane API versions" ] }, { "name": "Cloud Data Exfiltration", "slug": "credential-and-data-exfiltration", "tactic": "exfiltration", "techniques": [ "T1041" ], "observables": [ "Retrieval of Storage Account keys", "Accessing Azure Key Vault secrets and metadata", "SharePoint and OneDrive file downloads", "Mailbox item access", "Downloading App Service publishing credentials" ] }, { "name": "Embedded Shell Command Injection", "slug": "web-vulnerability-exploitation", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "IP address 65.87.223.26", "Shell commands embedded in HTTP User-Agent headers", "Attempts to obtain App Service authentication tokens" ] } ], "summary": "Threat actors use the ARTEX agentic AI framework to harvest exposed secrets from GitHub and automate the compromise of Entra ID service principals. Once authenticated, the AI agents perform cloud resource discovery and adaptive API troubleshooting to exfiltrate sensitive data from Azure Key Vault, Storage Accounts, and Microsoft 365 environments." }, "severity": "high", "rationale": "Scope the hunt to hosts with vulnerability findings mentioning 'secret', 'credential', or 'api key'. Analysts should populate scope_hosts with the hostnames mapped from those vulnerable resources.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder is using automated agentic tools to identify exposed secrets on public-facing assets and is exploiting web vulnerabilities via command injection in user-agent headers to gain initial access.", "parameters": { "scope_hosts": { "from": { "ref": "hunt-standard", "kind": "manual", "observed": "2026-11-05" }, "type": "list[host]", "default": [], "description": "Hostnames identified in the scoping step as having exposed secret vulnerabilities." }, "lookback_days": { "from": { "ref": "hunt-standard", "kind": "manual", "observed": "2026-11-05" }, "type": "number", "default": "14", "description": "Days of historical telemetry to examine." }, "malicious_ips": { "from": { "ref": "msrc-blog", "kind": "article", "observed": "2026-10-28" }, "type": "list[ip]", "default": [ "65.87.223.26", "199.19.77.84", "199.19.77.18", "157.22.126.128" ], "description": "IP addresses associated with ARTEX reconnaissance and exploitation." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/", "name": "MSRC \u2014 Threat actors use agentic AI tooling to find and abuse exposed secrets" } ], "blind_spots": [ { "id": "no-http-body-telemetry", "risk": "While user-agent injection is visible, injection payloads in the HTTP POST body are not captured by standard surface logging.", "owner": "Network Security Team", "stage": "web-vulnerability-exploitation", "question": "What were the full payloads sent in POST requests?", "requires": "hb_http_activity with request_body column", "remediation": "Enable WAF logging for POST request bodies on high-value web applications." }, { "id": "no-github-platform-audit", "risk": "Adversary search activity on the GitHub platform itself is only visible to GitHub; we can only see the exposure (vulnerability scan) or the abuse (sign-in logs).", "owner": "AppSec Team", "stage": "initial-secret-exposure", "question": "Which external IPs searched for our organization's code in public repositories?", "requires": "GitHub Enterprise Audit Log", "remediation": "Configure GitHub Secret Scanning and Push Protection to alert on leaks before commits." } ] }, "name": "Suspicious Perimeter Reconnaissance and Web Exploitation", "description": "This hunt targets the early stages of an AI-driven attack chain, specifically focusing on the discovery of exposed secrets and the exploitation of web applications. It first scopes the estate for resources with known secret-related vulnerabilities. It then fanned out to identify rare, high-risk User-Agent strings containing shell commands (a technique linked to the ARTEX framework) and monitors for inbound traffic from known malicious reconnaissance IPs. An agent triages the combined evidence to identify targeted exploitation attempts against vulnerable infrastructure." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets", "index": 2, "title": "Threat actors use agentic AI tooling to find and abuse exposed secrets", "total": 2 }, "coverage": [ { "stage": "initial-secret-exposure", "steps": [ "vulnerable-secret-exposure", "triage-recon-activity" ], "status": "covered" }, { "stage": "web-vulnerability-exploitation", "steps": [ "suspicious-user-agent-prevalence", "malicious-ip-recon", "triage-recon-activity" ], "status": "covered" }, { "stage": "service-principal-compromise", "reason": "Belongs to another part of the 'Threat actors use agentic AI tooling to find and abuse exposed secrets' series.", "status": "out_of_scope" }, { "stage": "cloud-resource-discovery", "reason": "Belongs to another part of the 'Threat actors use agentic AI tooling to find and abuse exposed secrets' series.", "status": "out_of_scope" }, { "stage": "adaptive-api-probing", "reason": "Belongs to another part of the 'Threat actors use agentic AI tooling to find and abuse exposed secrets' series.", "status": "out_of_scope" }, { "stage": "credential-and-data-exfiltration", "reason": "Belongs to another part of the 'Threat actors use agentic AI tooling to find and abuse exposed secrets' series.", "status": "out_of_scope" } ], "rationale": "An intruder is using automated agentic tools to identify exposed secrets on public-facing assets and is exploiting web vulnerabilities via command injection in user-agent headers to gain initial access.", "blind_spots": [ { "id": "no-http-body-telemetry", "risk": "While user-agent injection is visible, injection payloads in the HTTP POST body are not captured by standard surface logging.", "owner": "Network Security Team", "stage": "web-vulnerability-exploitation", "question": "What were the full payloads sent in POST requests?", "requires": "hb_http_activity with request_body column", "remediation": "Enable WAF logging for POST request bodies on high-value web applications." }, { "id": "no-github-platform-audit", "risk": "Adversary search activity on the GitHub platform itself is only visible to GitHub; we can only see the exposure (vulnerability scan) or the abuse (sign-in logs).", "owner": "AppSec Team", "stage": "initial-secret-exposure", "question": "Which external IPs searched for our organization's code in public repositories?", "requires": "GitHub Enterprise Audit Log", "remediation": "Configure GitHub Secret Scanning and Push Protection to alert on leaks before commits." } ], "scoping_notes": "Scope the hunt to hosts with vulnerability findings mentioning 'secret', 'credential', or 'api key'. Analysts should populate scope_hosts with the hostnames mapped from those vulnerable resources.", "beyond_detection": "A simple rule might catch the IPs, but this hunt pivots between static vulnerability findings and behavioral HTTP traffic. The use of prevalence stack-counting for User-Agents ensures that even if IPs rotate, the tool-based injection patterns remain visible against a baseline of legitimate browser traffic." } }, { "id": "vulnerable-secret-exposure", "type": "query", "label": "Resources with exposed secret findings", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT resource_uid, title, severity, status, first_seen FROM hb_vulnerability_finding WHERE (LOWER(title) LIKE '%secret%' OR LOWER(title) LIKE '%credential%' OR LOWER(title) LIKE '%api key%') AND status != 'suppressed'", "surface": "hb_vulnerability_finding", "description": "Identify hosts or resources already flagged by scanners for having exposed secrets or credentials to narrow the search area.", "expected_signal": "A list of cloud resources (ARNs, instance IDs, or hostnames) where secrets were found in source code or configuration. Silence means no known exposures exist." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Resources with exposed secret findings", "reads": [ "resource_uid", "title", "severity", "status", "first_seen" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT resource_uid, title, severity, status, first_seen FROM hb_vulnerability_finding WHERE (LOWER(title) LIKE '%secret%' OR LOWER(title) LIKE '%credential%' OR LOWER(title) LIKE '%api key%') AND status != 'suppressed'", "silence": "not_evidence_of_absence", "expected": "A list of cloud resources (ARNs, instance IDs, or hostnames) where secrets were found in source code or configuration. Silence means no known exposures exist.", "verified": "dry-run", "verified_at": "2026-11-06" } }, { "id": "suspicious-user-agent-prevalence", "type": "query", "label": "Prevalence of suspicious User-Agents", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "web", "content": "SELECT user_agent, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(user_agent) LIKE '%bash%' OR LOWER(user_agent) LIKE '%/bin/%' OR LOWER(user_agent) LIKE '%curl%' OR LOWER(user_agent) LIKE '%wget%' OR LOWER(user_agent) LIKE '%python%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY user_agent HAVING hosts <= 3 ORDER BY hosts ASC", "surface": "hb_http_activity", "description": "Stack-count User-Agent strings containing shell commands across the fleet to identify rare exploitation attempts.", "expected_signal": "Rare User-Agents (seen on < 3 hosts) that contain shell commands. Common browsers are ignored by the stack-count." }, "parents": [ { "id": "vulnerable-secret-exposure" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Prevalence of suspicious User-Agents", "reads": [ "user_agent", "device_hostname", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT user_agent, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(user_agent) LIKE '%bash%' OR LOWER(user_agent) LIKE '%/bin/%' OR LOWER(user_agent) LIKE '%curl%' OR LOWER(user_agent) LIKE '%wget%' OR LOWER(user_agent) LIKE '%python%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY user_agent HAVING hosts <= 3 ORDER BY hosts ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Rare User-Agents (seen on < 3 hosts) that contain shell commands. Common browsers are ignored by the stack-count.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "user_agent" ], "rare_below": 3 }, "verified_at": "2026-11-06" } }, { "id": "malicious-ip-recon", "type": "query", "label": "HTTP activity from malicious origin IPs", "config": { "dsl": "sqlite", "role": "enrichment", "source": "web", "content": "SELECT device_hostname, src_endpoint_ip, url_full, user_agent, status_code, time FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{malicious_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_http_activity", "description": "Identify inbound requests to scoped hosts originating from IP addresses named in the ARTEX report.", "expected_signal": "Specific requests from the reported IPs, showing which assets are being probed or exploited. Silence means the adversary is using different infrastructure." }, "parents": [ { "id": "vulnerable-secret-exposure" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "HTTP activity from malicious origin IPs", "reads": [ "device_hostname", "src_endpoint_ip", "url_full", "user_agent", "status_code", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, src_endpoint_ip, url_full, user_agent, status_code, time FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{malicious_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Specific requests from the reported IPs, showing which assets are being probed or exploited. Silence means the adversary is using different infrastructure.", "verified": "dry-run", "verified_at": "2026-11-06" } }, { "id": "triage-recon-activity", "type": "analytic", "label": "Triage reconnaissance and exploitation evidence", "config": { "cite": "required", "tools": [ "endpoint", "web" ], "context": [ "vulnerable-secret-exposure", "suspicious-user-agent-prevalence", "malicious-ip-recon" ], "objective": "Review the parallel query results and verify if the suspicious User-Agents or malicious IP requests were directed at hosts previously identified as having secret-related vulnerabilities. Assess if the user-agents contain valid shell commands targeting App Service tokens or environment variables.", "description": "Determine if the rare User-Agents and malicious IP activity constitute a confirmed exploitation attempt against vulnerable assets.", "max_iterations": 4, "expected_signal": "A host-by-host verdict classifying the activity as malicious, suspicious, or benign.", "success_criteria": "A detailed verdict per host, citing the User-Agent string, source IP, and the target vulnerability identifier." }, "parents": [ { "id": "suspicious-user-agent-prevalence", "kind": "merge" }, { "id": "malicious-ip-recon", "kind": "merge" } ] }, { "id": "recon-decision", "type": "checkpoint", "label": "Decide on containment", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-recon-activity verdict is malicious for at least one host, indicating confirmed command injection or targeted probing from the malicious_ips.", "condition": "the triage-recon-activity verdict is malicious for at least one host, indicating confirmed command injection or targeted probing from the malicious_ips.", "blind_spot": "no-http-body-telemetry", "confidence": "high", "description": "Route the hunt to immediate host isolation if the triage confirms active exploitation from malicious infrastructure.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-recon-activity" } ] }, { "id": "isolate-affected-host", "type": "action", "label": "Isolate affected web server", "config": { "target": "endpoint", "description": "Halt active exploitation by isolating the compromised web application host.", "instructions": "Isolate the hosts identified by the triage verdict to prevent further command execution or credential scraping.", "action_approval": "required" }, "parents": [ { "id": "recon-decision", "branch": "on_supports" } ] }, { "id": "credential-rotation-audit", "type": "task", "label": "Credential rotation and audit", "config": { "assignee": "analyst", "description": "Ensure any secrets known to be exposed on the targeted host are rotated and invalidated.", "instructions": "Verify if the secrets listed in the scoping step have been rotated. Check for sign-in activity (hb_auth_signin) using the compromised application IDs from the malicious_ips." }, "parents": [ { "id": "recon-decision", "branch": "default" }, { "id": "recon-decision", "branch": "on_unavailable" }, { "id": "isolate-affected-host" } ] }, { "id": "final-hunt-closure", "type": "task", "label": "Final hunt closure", "config": { "assignee": "analyst", "description": "Document findings and update perimeter scanning policies.", "instructions": "Document whether the reconnaissance was generic or targeted based on the scoping results. Provide a list of identified rare user-agents to the detection engineering team." }, "parents": [ { "id": "recon-decision", "branch": "on_refutes" }, { "id": "credential-rotation-audit" } ] } ] }