ARTEX and AntiFox AWS Agentic Pentest Hunt
Detects AWS API activity linked to the ARTEX and AntiFox agentic pentest frameworks: published source IPs, the tool name in the user agent, CloudWatch log searches for keys and passwords, placeholder S3 object probes and fast enumeration across many services with many denied calls. Needs CloudTrail in Sentinel, and S3 probes need data events. The enumeration branch skips IAM Identity Center sessions, browser user agents and Lambda automation. Logic tested with synthetic events and run against live CloudTrail data.
Microsoft Sentinel (KQL)
