ARTEX campaign IOC sweep: C2 host, proxy IPs, xcai.pro, CLAUDE.md URL
IOC sweep for ARTEX campaign indicators: C2 host, nine proxy IPs, xcai.pro and its subdomains, and the CLAUDE.md URL across Defender, CEF/firewall, DNS and Entra sign-in telemetry. Domains match on exact host or subdomain only, connection types are limited to real connection events, and sign-ins are limited to successes and credential failures.
Microsoft Sentinel (KQL)
