Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
20,632
11,971
5,918
5,199
4,875
Platforms
1
1
Products / Services
1
1
MITRE Techniques
2
1
1
1
1
Detects AWS API activity linked to the ARTEX and AntiFox agentic pentest frameworks: published source IPs, the tool name in the user agent, CloudWatch log searches for keys and passwords, placeholder S3 object probes and fast enumeration across many services with many denied calls. Needs CloudTrail in Sentinel, and S3 probes need data events. The enumeration branch skips IAM Identity Center sessions, browser user agents and Lambda automation. Logic tested with synthetic events and run against live CloudTrail data.
Detects IIS worker processes (w3wp.exe) that start shells, run whoami or icacls, search for web.config files, read connection strings through PowerShell or write .aspx and config copy files, which matches the web shell and configuration discovery steps reported in AntiFox intrusions. Needs Defender for Endpoint on the IIS servers, and file events can be sparse. Logic tested with synthetic events and run against live Defender data.