ARTEX Agentic Pentest Framework Abused Against South Korean Financial Institutions

// HUNT: Web server process spawning a shell or interpreter
// MITRE: T1190, T1505.003, T1059
// CONF: high  FP: medium  COST: low | REQUIRES: ProcessRollup2 (process creation with parent, command line)
// FALSE POSITIVES: build agents, deployment hooks, and some Java or Node apps legitimately shell out; java as parent is the noisiest
// TUNING: exclude documented application launchers by CommandLine, and scope java and node parents to hosts that front an internet-facing application
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(w3wp|httpd|nginx|apache2|php-fpm|tomcat[0-9]*|java|node|dotnet|iisexpress)(\.exe)?$/i
| FileName=/^(cmd|powershell|pwsh|sh|bash|dash|zsh|python[0-9.]*|perl|mshta|wscript|cscript|certutil|bitsadmin)(\.exe)?$/i
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

event.type = 'Process Creation'
| limit 5
| columns event.type, src.process.name, tgt.process.name

// HUNT: Web server process spawning a shell or interpreter
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1505.003, T1059
// CONF: high | FP: medium
// FALSE POSITIVES: build agents, deployment hooks, and some Java or Node apps legitimately shell out; java as parent is the noisiest
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a web server or application runtime process as the creator and a shell or interpreter as the created process. On a Process Creation event the creator is src.process.* and the new process is tgt.process.*. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry with creator and new-process names
// TUNING: Exclude documented application launchers by command line, and scope java and node creators to hosts that front an internet-facing application.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A shell started by a process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name matches '^(w3wp|httpd|nginx|apache2|php-fpm|tomcat[0-9]*|java|node|dotnet|iisexpress)([.]exe)?$' tgt.process.name matches '^(cmd|powershell|pwsh|sh|bash|dash|zsh|python[0-9.]*|perl|mshta|wscript|cscript|certutil|bitsadmin)([.]exe)?$'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName
| take 5

// HUNT: Web server process spawning a shell or interpreter
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1190, T1505.003, T1059
// CONF: high | FP: medium
// FALSE POSITIVES: build agents, deployment hooks, and some Java or Node apps legitimately shell out; java as parent is the noisiest
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate. The created process is FileName and its creator is InitiatingProcessFileName. matches regex with a (?i) prefix reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude documented application launchers by command line, and scope java and node creators to hosts that front an internet-facing application.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A shell started by a process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName matches regex @'(?i)^(w3wp|httpd|nginx|apache2|php-fpm|tomcat[0-9]*|java|node|dotnet|iisexpress)([.]exe)?$'
| where FileName matches regex @'(?i)^(cmd|powershell|pwsh|sh|bash|dash|zsh|python[0-9.]*|perl|mshta|wscript|cscript|certutil|bitsadmin)([.]exe)?$'
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Web server process spawning discovery utilities
// MITRE: T1082, T1087, T1016, T1033
// CONF: medium  FP: medium  COST: low | REQUIRES: ProcessRollup2 (process creation with parent, command line)
// FALSE POSITIVES: monitoring agents and health checks run whoami, hostname or ipconfig from service accounts
// TUNING: baseline per host first; exclude known health-check CommandLine values and alert on two or more distinct utilities from one parent within ten minutes
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(w3wp|httpd|nginx|apache2|php-fpm|tomcat[0-9]*|java|node|dotnet|iisexpress)(\.exe)?$/i
| FileName=/^(whoami|hostname|ipconfig|ifconfig|systeminfo|nltest|net1?|quser|arp|netstat|id|uname|nslookup|dsquery|tasklist)(\.exe)?$/i
| groupBy([aid, ComputerName, ParentBaseFileName, FileName], function=[count(as=runs), collect([CommandLine], limit=5)])
| sort(runs, order=desc, limit=100)

event.type = 'Process Creation'
| limit 5
| columns event.type, agent.uuid, endpoint.name, src.process.name, tgt.process.name

// HUNT: Web server process spawning discovery utilities
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1082, T1087, T1016, T1033
// CONF: medium | FP: medium
// FALSE POSITIVES: monitoring agents and health checks run whoami, hostname or ipconfig from service accounts
// EQUIVALENCE: approximate-analytic - Same creator and discovery-utility predicates and the same grouping. The CQL collects up to five command lines per group; PowerQuery here keeps one sample command line per group with any().
// REQUIRES: SentinelOne process-creation telemetry with creator and new-process names
// TUNING: Baseline per host first, exclude known health-check command lines, and alert on two or more distinct utilities from one creator within ten minutes.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Only one sample command line per group is shown, where the CQL tab collects up to five.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name matches '^(w3wp|httpd|nginx|apache2|php-fpm|tomcat[0-9]*|java|node|dotnet|iisexpress)([.]exe)?$' tgt.process.name matches '^(whoami|hostname|ipconfig|ifconfig|systeminfo|nltest|net1?|quser|arp|netstat|id|uname|nslookup|dsquery|tasklist)([.]exe)?$'
| group runs=count(), sample_cmdline=any(tgt.process.cmdline) by agent.uuid, endpoint.name, src.process.name, tgt.process.name
| sort -runs
| limit 100

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceId, DeviceName, InitiatingProcessFileName, FileName
| take 5

// HUNT: Web server process spawning discovery utilities
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1082, T1087, T1016, T1033
// CONF: medium | FP: medium
// FALSE POSITIVES: monitoring agents and health checks run whoami, hostname or ipconfig from service accounts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same creator and discovery-utility predicates and the same grouping. make_set keeps up to five command lines per group, as the CQL does.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Baseline per host first, exclude known health-check command lines, and alert on two or more distinct utilities from one creator within ten minutes.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A utility started by a process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName matches regex @'(?i)^(w3wp|httpd|nginx|apache2|php-fpm|tomcat[0-9]*|java|node|dotnet|iisexpress)([.]exe)?$'
| where FileName matches regex @'(?i)^(whoami|hostname|ipconfig|ifconfig|systeminfo|nltest|net1?|quser|arp|netstat|id|uname|nslookup|dsquery|tasklist)([.]exe)?$'
| summarize runs = count(), LastSeen = max(Timestamp), CommandLines = make_set(ProcessCommandLine, 5) by DeviceId, DeviceName, InitiatingProcessFileName, FileName
| sort by runs desc
| take 100

// HUNT: Credential-access tooling launched from a web server process
// MITRE: T1003, T1555
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 (process creation with parent, command line)
// FALSE POSITIVES: authorized red-team and pentest activity against the web tier
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(w3wp|httpd|nginx|apache2|php-fpm|tomcat[0-9]*|java|node|dotnet|iisexpress)(\.exe)?$/i
| CommandLine=/(lsass|comsvcs|minidump|procdump|ntdsutil|sekurlsa|mimikatz|reg(\.exe)?\s+save\s+hklm)/i
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

event.type = 'Process Creation'
| limit 5
| columns event.type, src.process.name, tgt.process.cmdline

// HUNT: Credential-access tooling launched from a web server process
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1003, T1555
// CONF: high | FP: low
// FALSE POSITIVES: authorized red-team and pentest activity against the web tier
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a web server or application runtime process as the creator and a credential-access keyword in the new process command line. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry with creator name and new-process command line
// TUNING: Authorized red-team and pentest activity against the web tier will match; exclude approved test hosts and accounts after review.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Credential access that does not put one of these keywords on a command line is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name matches '^(w3wp|httpd|nginx|apache2|php-fpm|tomcat[0-9]*|java|node|dotnet|iisexpress)([.]exe)?$' tgt.process.cmdline matches '(lsass|comsvcs|minidump|procdump|ntdsutil|sekurlsa|mimikatz|reg([.]exe)?\\s+save\\s+hklm)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, ProcessCommandLine
| take 5

// HUNT: Credential-access tooling launched from a web server process
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1003, T1555
// CONF: high | FP: low
// FALSE POSITIVES: authorized red-team and pentest activity against the web tier
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the creator is InitiatingProcessFileName and the credential-access keywords are searched in ProcessCommandLine. A (?i) prefix reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Authorized red-team and pentest activity against the web tier will match; exclude approved test hosts and accounts after review.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Credential access that does not put one of these keywords on a command line is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName matches regex @'(?i)^(w3wp|httpd|nginx|apache2|php-fpm|tomcat[0-9]*|java|node|dotnet|iisexpress)([.]exe)?$'
| where ProcessCommandLine matches regex @'(?i)(lsass|comsvcs|minidump|procdump|ntdsutil|sekurlsa|mimikatz|reg([.]exe)?\s+save\s+hklm)'
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Executable or library written into a web application path by a web server process
// MITRE: T1505.003, T1105
// CONF: medium  FP: medium  COST: low | REQUIRES: PeFileWritten, NewExecutableWritten (PE-centric file-write events)
// FALSE POSITIVES: application deployments, hot-fix drops and framework compilation write DLLs under bin or App_Code
// TUNING: exclude deployment windows and the deployment service account; alert on first-seen DLL names per host
#event_simpleName=/PeFileWritten|NewExecutableWritten/
| ContextBaseFileName=/^(w3wp|httpd|nginx|apache2|php-fpm|tomcat[0-9]*|java|node|dotnet|iisexpress)(\.exe)?$/i
| TargetFileName=/(inetpub|wwwroot|webapps|App_Code)/i
| table([@timestamp, ComputerName, aid, ContextBaseFileName, TargetFileName, SHA256HashData], limit=200)

event.type = 'File Creation'
| limit 5
| columns event.type, src.process.name, tgt.file.path

// HUNT: Executable or library written into a web application path by a web server process
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1505.003, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: application deployments, hot-fix drops and framework compilation write DLLs under bin or App_Code
// EQUIVALENCE: approximate-analytic - SentinelOne has no PE-only file-write event. The hunt uses File Creation by a web server or runtime process under a web application path, restricted to executable and library extensions as a proxy for the CQL's PE-centric events.
// REQUIRES: SentinelOne file-creation telemetry with the writing process and target path
// TUNING: Exclude deployment windows and the deployment service account; alert on first-seen library names per host.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Executables written with an unusual extension, and files modified in place rather than created, are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'File Creation' src.process.name matches '^(w3wp|httpd|nginx|apache2|php-fpm|tomcat[0-9]*|java|node|dotnet|iisexpress)([.]exe)?$' tgt.file.path matches '(inetpub|wwwroot|webapps|App_Code)' tgt.file.path matches '[.](exe|dll|sys|ocx|scr)$'
| columns event.time, endpoint.name, src.process.name, tgt.file.path, tgt.file.sha256
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, InitiatingProcessFileName, FolderPath, FileName
| take 5

// HUNT: Executable or library written into a web application path by a web server process
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1505.003, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: application deployments, hot-fix drops and framework compilation write DLLs under bin or App_Code
// EQUIVALENCE: approximate-analytic - Defender has no PE-only file-write event. The hunt uses FileCreated by a web server or runtime process under a web application path, restricted to executable and library extensions as a proxy for the CQL's PE-centric events.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: Exclude deployment windows and the deployment service account; alert on first-seen library names per host.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Executables written with an unusual extension, and files modified in place rather than created, are not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(7d)
| where ActionType == 'FileCreated'
| where InitiatingProcessFileName matches regex @'(?i)^(w3wp|httpd|nginx|apache2|php-fpm|tomcat[0-9]*|java|node|dotnet|iisexpress)([.]exe)?$'
| where FolderPath matches regex @'(?i)(inetpub|wwwroot|webapps|App_Code)'
| where FileName matches regex @'(?i)[.](exe|dll|sys|ocx|scr)$'
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, FolderPath, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Outbound connection to the published ARTEX host and proxy addresses
// MITRE: T1090, T1583.003, T1071
// CONF: high  FP: low  COST: low | REQUIRES: NetworkConnectIP4 (outbound IPv4 connections)
// FALSE POSITIVES: shared hosting and proxy ranges can be reassigned to unrelated tenants over time
#event_simpleName=NetworkConnectIP4
| in(RemoteAddressIP4, values=["38.244.50.120", "101.53.80.20", "205.214.59.31", "124.155.252.63", "154.201.79.246", "23.248.249.90", "23.158.220.98", "103.248.148.84", "203.160.133.172", "209.209.85.38"])
| groupBy([aid, ComputerName, RemoteAddressIP4, RemotePort], function=[count(as=conns), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)])
| sort(conns, order=desc, limit=100)

event.type = 'IP Connect'
| limit 5
| columns event.type, event.time, agent.uuid, endpoint.name, dst.ip.address, dst.port.number

// HUNT: Outbound connection to the published ARTEX host and proxy addresses
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1090, T1583.003, T1071
// CONF: high | FP: low
// FALSE POSITIVES: shared hosting and proxy ranges can be reassigned to unrelated tenants over time
// EQUIVALENCE: equivalent-with-schema-assumptions - Same destination-address list, grouped by endpoint, address and port with a count and first and last seen times.
// REQUIRES: SentinelOne IP Connect telemetry
// TUNING: Shared hosting and proxy ranges can be reassigned over time; confirm the process behind a hit before escalating.
// LOOKBACK: 30d; connections to these addresses are rare enough to search wide
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connections made through an intermediate proxy show the proxy address, not these addresses.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' dst.ip.address in ('38.244.50.120', '101.53.80.20', '205.214.59.31', '124.155.252.63', '154.201.79.246', '23.248.249.90', '23.158.220.98', '103.248.148.84', '203.160.133.172', '209.209.85.38')
| group conns=count(), first_seen=min(event.time), last_seen=max(event.time) by agent.uuid, endpoint.name, dst.ip.address, dst.port.number
| sort -conns
| limit 100

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceId, DeviceName, RemoteIP, RemotePort
| take 5

// HUNT: Outbound connection to the published ARTEX host and proxy addresses
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1090, T1583.003, T1071
// CONF: high | FP: low
// FALSE POSITIVES: shared hosting and proxy ranges can be reassigned to unrelated tenants over time
// EQUIVALENCE: equivalent-with-schema-assumptions - Same destination-address list, grouped by device, address and port with a count and first and last seen times.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Shared hosting and proxy ranges can be reassigned over time; confirm the process behind a hit before escalating.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connections made through an intermediate proxy show the proxy address, not these addresses.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemoteIP in ('38.244.50.120', '101.53.80.20', '205.214.59.31', '124.155.252.63', '154.201.79.246', '23.248.249.90', '23.158.220.98', '103.248.148.84', '203.160.133.172', '209.209.85.38')
| summarize conns = count(), first_seen = min(Timestamp), last_seen = max(Timestamp) by DeviceId, DeviceName, RemoteIP, RemotePort
| sort by conns desc
| take 100

// HUNT: DNS lookup of the likely LLM API proxy domain
// MITRE: T1090, T1588.007
// CONF: medium  FP: low  COST: low | REQUIRES: DnsRequest (DNS lookup with requesting process)
// FALSE POSITIVES: none known; the domain is described by the source as a likely proxy or reseller
#event_simpleName=DnsRequest
| DomainName=/(^|\.)xcai\.pro$/i
| table([@timestamp, ComputerName, aid, ContextBaseFileName, DomainName], limit=200)

event.type = 'DNS Resolved'
| limit 5
| columns event.type, event.dns.request, src.process.name

// HUNT: DNS lookup of the likely LLM API proxy domain
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1090, T1588.007
// CONF: medium | FP: low
// FALSE POSITIVES: none known; the domain is described by the source as a likely proxy or reseller
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a DNS lookup of the domain itself or any subdomain of it. On a DNS Resolved event the acting process is src.process.*.
// REQUIRES: SentinelOne DNS Resolved telemetry with the requesting process
// TUNING: None expected; the domain is described by the source as a likely proxy or reseller.
// LOOKBACK: 30d; a lookup of this domain is rare enough to search wide
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Lookups answered from a cache the agent does not see, and encrypted DNS that bypasses the host resolver, are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' (event.dns.request in:anycase ('xcai.pro') or event.dns.request matches '[.]xcai[.]pro$')
| columns event.time, endpoint.name, src.process.name, event.dns.request
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == 'DnsQueryResponse'
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: DNS lookup of the likely LLM API proxy domain
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1090, T1588.007
// CONF: medium | FP: low
// FALSE POSITIVES: none known; the domain is described by the source as a likely proxy or reseller
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a DNS lookup of the domain itself or any subdomain of it. Defender has no endpoint DNS table, so the name is read from AdditionalFields on the DnsQueryResponse action.
// REQUIRES: Defender for Endpoint DNS action telemetry (DeviceEvents, DnsQueryResponse)
// TUNING: None expected; the domain is described by the source as a likely proxy or reseller.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Lookups answered from a cache the sensor does not see, and encrypted DNS that bypasses the host resolver, are not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == 'DnsQueryResponse'
| extend QueryName = tostring(coalesce(parse_json(AdditionalFields)['DnsQueryString'], parse_json(AdditionalFields)['QueryName']))
| where QueryName =~ 'xcai.pro' or QueryName endswith '.xcai.pro'
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, QueryName
| sort by Timestamp desc
| take 200

// HUNT: Unexpected resolution of LLM service endpoints (hunt context only)
// MITRE: T1588.007, T1071.001
// CONF: low  FP: high  COST: medium | REQUIRES: DnsRequest (DNS lookup with requesting process)
// FALSE POSITIVES: these are legitimate LLM service endpoints used by ordinary business traffic: developer workstations, approved AI gateways, IDE plugins and browsers all call them
// TUNING: exclude approved developer and AI-gateway host groups and browser or IDE processes; focus on server-class hosts and on processes that are not a browser, IDE or approved agent
#event_simpleName=DnsRequest
| DomainName=/^(api\.anthropic\.com|api\.deepseek\.com|open\.bigmodel\.cn|api\.x\.ai)$/i
| ContextBaseFileName!=/^(chrome|msedge|firefox|safari|code|cursor|claude)(\.exe)?$/i
| groupBy([aid, ComputerName, ContextBaseFileName, DomainName], function=[count(as=lookups)])
| sort(lookups, order=desc, limit=100)

event.type = 'DNS Resolved'
| limit 5
| columns event.type, agent.uuid, endpoint.name, event.dns.request, src.process.name

// HUNT: Unexpected resolution of LLM service endpoints (hunt context only)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1588.007, T1071.001
// CONF: low | FP: high
// FALSE POSITIVES: these are legitimate LLM service endpoints used by ordinary business traffic: developer workstations, approved AI gateways, IDE plugins and browsers all call them
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a lookup of one of four LLM service endpoints by a process that is not a browser or IDE, grouped by endpoint, process and domain. in:anycase matches the whole name case-insensitively.
// REQUIRES: SentinelOne DNS Resolved telemetry with the requesting process
// TUNING: Exclude approved developer and AI-gateway host groups and browser or IDE processes; focus on server-class hosts and on processes that are not a browser, IDE or approved agent.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: These are legitimate services, so hits are context only. Lookups made through a browser or IDE are excluded by design.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request in:anycase ('api.anthropic.com', 'api.deepseek.com', 'open.bigmodel.cn', 'api.x.ai') !(src.process.name matches '^(chrome|msedge|firefox|safari|code|cursor|claude)([.]exe)?$')
| group lookups=count() by agent.uuid, endpoint.name, src.process.name, event.dns.request
| sort -lookups
| limit 100

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == 'DnsQueryResponse'
| project Timestamp, ActionType, AdditionalFields, InitiatingProcessFileName, DeviceId, DeviceName
| take 5

// HUNT: Unexpected resolution of LLM service endpoints (hunt context only)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1588.007, T1071.001
// CONF: low | FP: high
// FALSE POSITIVES: these are legitimate LLM service endpoints used by ordinary business traffic: developer workstations, approved AI gateways, IDE plugins and browsers all call them
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a lookup of one of four LLM service endpoints by a process that is not a browser or IDE, grouped by device, process and domain. Defender has no endpoint DNS table, so the name is read from AdditionalFields on the DnsQueryResponse action.
// REQUIRES: Defender for Endpoint DNS action telemetry (DeviceEvents, DnsQueryResponse)
// TUNING: Exclude approved developer and AI-gateway host groups and browser or IDE processes; focus on server-class hosts and on processes that are not a browser, IDE or approved agent.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: These are legitimate services, so hits are context only. Lookups made through a browser or IDE are excluded by design.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == 'DnsQueryResponse'
| extend QueryName = tostring(coalesce(parse_json(AdditionalFields)['DnsQueryString'], parse_json(AdditionalFields)['QueryName']))
| where QueryName in~ ('api.anthropic.com', 'api.deepseek.com', 'open.bigmodel.cn', 'api.x.ai')
| where not(InitiatingProcessFileName matches regex @'(?i)^(chrome|msedge|firefox|safari|code|cursor|claude)([.]exe)?$')
| summarize lookups = count(), LastSeen = max(Timestamp) by DeviceId, DeviceName, InitiatingProcessFileName, QueryName
| sort by lookups desc
| take 100

// HUNT: ARTEX named in a process image or command line
// MITRE: T1588.007
// CONF: low  FP: medium  COST: medium | REQUIRES: ProcessRollup2 (process creation with command line)
// FALSE POSITIVES: authorized internal pentest hosts, and unrelated software whose name contains the string
// TUNING: scope to hosts that are not on the approved pentest asset list and exclude your own red-team accounts
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/artex/i or CommandLine=/artex/i
| table([@timestamp, ComputerName, aid, UserName, FileName, CommandLine, ParentBaseFileName], limit=200)

event.type = 'Process Creation'
| limit 5
| columns event.type, tgt.process.name, tgt.process.cmdline

// HUNT: ARTEX named in a process image or command line
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1588.007
// CONF: low | FP: medium
// FALSE POSITIVES: authorized internal pentest hosts, and unrelated software whose name contains the string
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the string is present in the new process name or command line. contains is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry with new-process name and command line
// TUNING: Scope to hosts that are not on the approved pentest asset list and exclude your own red-team accounts.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A tool renamed and run without the string on its command line is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' (tgt.process.name contains 'artex' or tgt.process.cmdline contains 'artex')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: ARTEX named in a process image or command line
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1588.007
// CONF: low | FP: medium
// FALSE POSITIVES: authorized internal pentest hosts, and unrelated software whose name contains the string
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the string is present in the created process name or command line. contains is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Scope to hosts that are not on the approved pentest asset list and exclude your own red-team accounts.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A tool renamed and run without the string on its command line is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName contains 'artex' or ProcessCommandLine contains 'artex'
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: Web server process connecting to public addresses on non-web ports
// MITRE: T1090, T1071, T1041
// CONF: medium  FP: medium  COST: high | REQUIRES: NetworkConnectIP4 joined to ProcessRollup2
// FALSE POSITIVES: database replication, SMTP relays, license servers and monitoring agents legitimately connect outbound from application hosts
// TUNING: baseline each application host's egress set first and alert only on destinations outside it; exclude known partner API ranges
#event_simpleName=NetworkConnectIP4
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","127.0.0.0/8","169.254.0.0/16"])
| !in(RemotePort, values=[80,443,53])
| rename(field=ContextProcessId_decimal, as=TargetProcessId_decimal)
| join(query={#event_simpleName=ProcessRollup2 | FileName=/^(w3wp|httpd|nginx|apache2|php-fpm|tomcat[0-9]*|java|node|dotnet|iisexpress)(\.exe)?$/i}, field=[aid, TargetProcessId_decimal], include=[FileName, CommandLine], mode=inner)
| table([@timestamp, ComputerName, aid, FileName, RemoteAddressIP4, RemotePort], limit=200)

event.type = 'IP Connect'
| limit 5
| columns event.type, src.process.name, dst.ip.address, dst.port.number

// HUNT: Web server process connecting to public addresses on non-web ports
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1090, T1071, T1041
// CONF: medium | FP: medium
// FALSE POSITIVES: database replication, SMTP relays, license servers and monitoring agents legitimately connect outbound from application hosts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an outbound IPv4 connection from a web server or runtime process to a non-private address on a port other than 80, 443 and 53. The CQL joins the connection to the process record; SentinelOne carries the acting process on the IP Connect event itself, so no join is needed.
// REQUIRES: SentinelOne IP Connect telemetry with the acting process
// TUNING: Baseline each application host's egress set first and alert only on destinations outside it; exclude known partner API ranges.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connections to the excluded ports 80, 443 and 53 are not shown, so tunnelling over those ports is out of scope.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' src.process.name matches '^(w3wp|httpd|nginx|apache2|php-fpm|tomcat[0-9]*|java|node|dotnet|iisexpress)([.]exe)?$' !(dst.ip.address contains ':') !(net_ipsubnet(dst.ip.address, '10.0.0.0/8') or net_ipsubnet(dst.ip.address, '172.16.0.0/12') or net_ipsubnet(dst.ip.address, '192.168.0.0/16') or net_ipsubnet(dst.ip.address, '127.0.0.0/8') or net_ipsubnet(dst.ip.address, '169.254.0.0/16')) !(dst.port.number in (80, 443, 53))
| columns event.time, endpoint.name, src.process.name, dst.ip.address, dst.port.number
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, RemoteIP, RemotePort
| take 5

// HUNT: Web server process connecting to public addresses on non-web ports
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1090, T1071, T1041
// CONF: medium | FP: medium
// FALSE POSITIVES: database replication, SMTP relays, license servers and monitoring agents legitimately connect outbound from application hosts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an outbound IPv4 connection from a web server or runtime process to a non-private address on a port other than 80, 443 and 53. DeviceNetworkEvents carries the initiating process on the row, so the CQL's join is not needed.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Baseline each application host's egress set first and alert only on destinations outside it; exclude known partner API ranges.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connections to the excluded ports 80, 443 and 53 are not shown, so tunnelling over those ports is out of scope.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName matches regex @'(?i)^(w3wp|httpd|nginx|apache2|php-fpm|tomcat[0-9]*|java|node|dotnet|iisexpress)([.]exe)?$'
| where RemotePort !in (80, 443, 53)
| where not(ipv4_is_in_range(RemoteIP, '10.0.0.0/8') or ipv4_is_in_range(RemoteIP, '172.16.0.0/12') or ipv4_is_in_range(RemoteIP, '192.168.0.0/16') or ipv4_is_in_range(RemoteIP, '127.0.0.0/8') or ipv4_is_in_range(RemoteIP, '169.254.0.0/16'))
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| sort by Timestamp desc
| take 200