Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
Platforms
1
Products / Services
10,844
9,798
6,760
4,421
3,776
MITRE Techniques
1
1
1
1
1
Detects AWS API activity linked to the ARTEX and AntiFox agentic pentest frameworks: published source IPs, the tool name in the user agent, CloudWatch log searches for keys and passwords, placeholder S3 object probes and fast enumeration across many services with many denied calls. Needs CloudTrail in Sentinel, and S3 probes need data events. The enumeration branch skips IAM Identity Center sessions, browser user agents and Lambda automation. Logic tested with synthetic events and run against live CloudTrail data.
