ARTEX and AI-Powered Red Teaming Tools: How Attackers Are Weaponizing Offensive AI and What Defenders Must Do Now

---
title: Rapid Sequential Execution of Reconnaissance Commands
description: Detects abnormally fast sequential execution of multiple distinct reconnaissance commands within a short window, characteristic of AI-driven automated enumeration rather than human operator behavior.
references:
  - https://unit42.paloaltonetworks.com/artex-and-ai-powered-red-teaming-tools/
  - https://attack.mitre.org/techniques/T1082/
  - https://attack.mitre.org/techniques/T1033/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.discovery
  - attack.t1082
  - attack.t1033
  - attack.t1087
logsource:
  category: process_creation
  product: windows
detection:
  selection_recon:
    CommandLine|contains:
      - 'whoami'
      - 'ipconfig'
      - 'net user'
      - 'net group'
      - 'net localgroup'
      - 'systeminfo'
      - 'nltest'
      - 'arp -a'
      - 'route print'
      - 'tasklist'
      - 'netstat -an'
      - 'quser'
      - 'wmic computersystem'
      - 'wmic qfe'
  condition: selection_recon
  timeframe: 60s
falsepositives:
  - Legitimate IT administration scripts
  - Vulnerability scanning tools
level: high
---
title: Automated Tool Execution from Temporary or User-Writable Directories
description: Detects execution of binaries from temp, AppData, or user-writable paths commonly used by AI-driven attack frameworks to stage and execute dynamically generated payloads.
references:
  - https://unit42.paloaltonetworks.com/artex-and-ai-powered-red-teaming-tools/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.execution
  - attack.t1059
  - attack.defense_evasion
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\'
  selection_suspicious_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  condition: selection_path and selection_suspicious_parent
falsepositives:
  - Legitimate software installations using temp directories
  - Auto-updaters running from AppData
level: medium
---
title: High-Velocity Lateral Movement via Multiple Protocols
description: Detects a single source system initiating connections via multiple lateral movement protocols (SMB, WinRM, RDP, SSH) to multiple distinct destinations within a short window — a pattern consistent with AI-driven autonomous lateral movement.
references:
  - https://unit42.paloaltonetworks.com/artex-and-ai-powered-red-teaming-tools/
  - https://attack.mitre.org/techniques/T1021/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.lateral_movement
  - attack.t1021
logsource:
  category: network_connection
  product: windows
detection:
  selection_ports:
    DestinationPort:
      - 445
      - 5985
      - 5986
      - 3389
      - 22
  condition: selection_ports
  timeframe: 300s
falsepositives:
  - Legitimate administrative jump boxes
  - Vulnerability scanners
  - SCCM or other management platforms
level: high

// Hunt for AI-driven attack patterns: rapid multi-technique execution from a single host
// Detects when a single device executes an abnormally high number of distinct reconnaissance
// or lateral movement commands within a compressed timeframe — characteristic of automated tooling
let reconCommands = dynamic(["whoami", "ipconfig", "net user", "net group", "net localgroup",
    "systeminfo", "nltest", "arp -a", "route print", "tasklist", "netstat", "quser",
    "wmic computersystem", "wmic qfe", "dsquery", "csvde", "ldifde"]);
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where ProcessCommandLine has_any (reconCommands)
| summarize
    DistinctCommands = dcount(ProcessCommandLine),
    CommandList = make_set(ProcessCommandLine, 50),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    ExecutionSpanMinutes = datetime_diff('minute', max(TimeGenerated), min(TimeGenerated))
    by DeviceName, InitiatingProcessAccountName, bin(TimeGenerated, 5m)
| where DistinctCommands >= 5 and ExecutionSpanMinutes <= 5
| project TimeGenerated, DeviceName, InitiatingProcessAccountName,
    DistinctCommands, ExecutionSpanMinutes, CommandList
| order by DistinctCommands desc;

// Hunt for network connections consistent with AI-driven lateral movement:
// single source hitting multiple destinations across multiple lateral movement protocols
let lateralPorts = dynamic([445, 5985, 5986, 3389, 22, 135]);
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemotePort in (lateralPorts)
| where ActionType == "ConnectionSuccess"
| summarize
    DistinctDestinations = dcount(RemoteIP),
    DistinctPorts = dcount(RemotePort),
    DestinationList = make_set(RemoteIP, 50),
    PortList = make_set(RemotePort, 10)
    by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 10m)
| where DistinctDestinations >= 5 and DistinctPorts >= 2
| project TimeGenerated, DeviceName, InitiatingProcessFileName,
    DistinctDestinations, DistinctPorts, DestinationList, PortList
| order by DistinctDestinations desc;

// Hunt for process execution from user-writable directories with scripting parent processes
// Targets the payload staging and execution pattern of AI-driven attack frameworks
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where FileName has_any ("python", "powershell", "pwsh", "cmd", "wscript", "cscript", "mshta")
    or InitiatingProcessFileName has_any ("python", "powershell", "pwsh", "cmd", "wscript", "cscript", "mshta")
| where FolderPath has_any ("\\AppData\\Local\\Temp\\", "\\Users\\Public\\", "\\ProgramData\\")
    or ProcessCommandLine has_any ("\\AppData\\Local\\Temp\\", "\\Users\\Public\\", "\\ProgramData\\")
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine,
    InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated desc;

-- Hunt for rapid sequential process execution indicative of AI-driven automated tooling
-- Identifies hosts where multiple distinct reconnaissance commands executed within 60-second windows
SELECT 
    Pid,
    Ppid,
    Name,
    Exe,
    CommandLine,
    Username,
    CreateTime,
    count() AS ExecutionCount
FROM pslist()
WHERE CommandLine =~ '(?i)(whoami|ipconfig|net user|net group|net localgroup|systeminfo|nltest|arp -a|route print|tasklist|netstat|quser|wmic)'
GROUP BY Name, Username
HAVING ExecutionCount > 3
ORDER BY ExecutionCount DESC

-- Hunt for suspicious binaries executing from temp and user-writable directories
SELECT
    Pid,
    Ppid,
    Name,
    Exe,
    CommandLine,
    Username,
    CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(AppData\\Local\\Temp|Users\\Public|ProgramData)'
   AND Name =~ '(?i)\.(exe|dll|bat|ps1|py)$'
ORDER BY CreateTime DESC

-- Enumerate active network connections on lateral movement ports
SELECT
    Pid,
    Name,
    LocalAddr,
    LocalPort,
    RemoteAddr,
    RemotePort,
    Status
FROM netstat()
WHERE RemotePort IN (445, 5985, 5986, 3389, 22, 135)
   AND Status =~ 'ESTABLISHED'
ORDER BY RemoteAddr

# AI-Powered Attack Tool Detection and Hardening Script
# Run as Administrator on Windows endpoints and servers
# Purpose: Audit for indicators of AI-driven attack tooling and apply defensive hardening

Write-Host "=== AI-Powered Attack Tool Detection & Hardening ===" -ForegroundColor Cyan
Write-Host "Timestamp: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Cyan

# SECTION 1: Detect suspicious processes running from temp/user-writable directories
Write-Host "`n[1] Scanning for suspicious process execution paths..." -ForegroundColor Yellow
$suspiciousPaths = @("AppData\Local\Temp", "Users\Public", "ProgramData")
$runningProcesses = Get-CimInstance Win32_Process | Where-Object {
    $procPath = $_.ExecutablePath
    $found = $false
    foreach ($path in $suspiciousPaths) {
        if ($procPath -like "*$path*") { $found = $true; break }
    }
    $found
} | Select-Object ProcessId, Name, ExecutablePath, CommandLine, CreationDate

if ($runningProcesses) {
    Write-Host "  ALERT: Suspicious processes found running from user-writable directories:" -ForegroundColor Red
    $runningProcesses | Format-Table -AutoSize
} else {
    Write-Host "  OK: No suspicious processes detected in user-writable paths." -ForegroundColor Green
}

# SECTION 2: Check for rapid reconnaissance command execution in recent event logs
Write-Host "`n[2] Checking for rapid reconnaissance activity (last 24 hours)..." -ForegroundColor Yellow
$reconPatterns = @("whoami", "ipconfig", "net user", "net group", "systeminfo", "nltest", "arp -a", "tasklist", "netstat")
$reconEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue |
    Where-Object {
        $cmdLine = $_.Properties[8].Value
        $matchCount = 0
        foreach ($pattern in $reconPatterns) {
            if ($cmdLine -like "*$pattern*") { $matchCount++ }
        }
        $matchCount -gt 0
    } | Group-Object { $_.Properties[5].Value } | Where-Object { $_.Count -ge 5 }

if ($reconEvents) {
    Write-Host "  ALERT: Accounts with 5+ recon commands in 24h:" -ForegroundColor Red
    $reconEvents | ForEach-Object { Write-Host "    Account: $($_.Name) | Count: $($_.Count)" }
} else {
    Write-Host "  OK: No rapid reconnaissance patterns detected." -ForegroundColor Green
}

# SECTION 3: Audit for unauthorized Python/scripting runtime installations
Write-Host "`n[3] Checking for Python and scripting runtime installations..." -ForegroundColor Yellow
$pythonPaths = @(
    "$env:LOCALAPPDATA\Programs\Python",
    "C:\Python*",
    "C:\Program Files\Python*",
    "$env:USERPROFILE\AppData\Local\Programs\Python"
)
foreach ($pyPath in $pythonPaths) {
    $found = Get-Item $pyPath -ErrorAction SilentlyContinue
    if ($found) {
        Write-Host "  FOUND: Python installation at $($found.FullName)" -ForegroundColor Yellow
        Write-Host "    Verify this is an authorized installation. AI attack frameworks commonly leverage Python." -ForegroundColor Yellow
    }
}

# SECTION 4: Harden PowerShell logging for AI-tool detection
Write-Host "`n[4] Verifying PowerShell logging configuration..." -ForegroundColor Yellow
$scriptBlockLogging = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -ErrorAction SilentlyContinue
$moduleLogging = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" -Name "EnableModuleLogging" -ErrorAction SilentlyContinue
$transcription = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" -Name "EnableTranscripting" -ErrorAction SilentlyContinue

if (-not $scriptBlockLogging -or $scriptBlockLogging.EnableScriptBlockLogging -ne 1) {
    Write-Host "  ENABLING: Script Block Logging" -ForegroundColor Yellow
    New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Force | Out-Null
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1
}
if (-not $moduleLogging -or $moduleLogging.EnableModuleLogging -ne 1) {
    Write-Host "  ENABLING: Module Logging" -ForegroundColor Yellow
    New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" -Force | Out-Null
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" -Name "EnableModuleLogging" -Value 1
}
if (-not $transcription -or $transcription.EnableTranscripting -ne 1) {
    Write-Host "  ENABLING: PowerShell Transcription" -ForegroundColor Yellow
    New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" -Force | Out-Null
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" -Name "EnableTranscripting" -Value 1
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" -Name "OutputDirectory" -Value "C:\PSTranscripts"
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" -Name "EnableInvocationHeader" -Value 1
}
Write-Host "  OK: PowerShell logging hardened." -ForegroundColor Green

# SECTION 5: Restrict execution from user-writable directories via WDAC/AppLocker recommendation
Write-Host "`n[5] Checking AppLocker policy status..." -ForegroundColor Yellow
$appLockerService = Get-Service -Name AppIDSvc -ErrorAction SilentlyContinue
if ($appLockerService -and $appLockerService.Status -ne 'Running') {
    Write-Host "  WARNING: AppLocker service (AppIDSvc) is not running." -ForegroundColor Red
    Write-Host "    Recommendation: Enable AppLocker or WDAC to restrict execution from user-writable paths." -ForegroundColor Yellow
    Write-Host "    Minimum policy: Block executables in %TEMP%, %APPDATA%, %PUBLIC%, %PROGRAMDATA% for standard users." -ForegroundColor Yellow
} elseif (-not $appLockerService) {
    Write-Host "  WARNING: AppLocker service not found. Consider WDAC policies for execution restriction." -ForegroundColor Red
} else {
    Write-Host "  OK: AppLocker service is running." -ForegroundColor Green
}

# SECTION 6: Check for suspicious network listeners on common lateral movement ports
Write-Host "`n[6] Checking for unexpected network listeners on lateral movement ports..." -ForegroundColor Yellow
$lateralPorts = @(445, 5985, 5986, 3389)
$listeners = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object { $_.LocalPort -in $lateralPorts }
foreach ($listener in $listeners) {
    $owningProcess = Get-Process -Id $listener.OwningProcess -ErrorAction SilentlyContinue
    Write-Host "  Listener: Port $($listener.LocalPort) | Process: $($owningProcess.ProcessName) (PID: $($listener.OwningProcess))" -ForegroundColor Yellow
    Write-Host "    Verify this service is expected on this system." -ForegroundColor Yellow
}

Write-Host "`n=== Scan Complete ===" -ForegroundColor Cyan
Write-Host "Review all ALERT and WARNING items above. Correlate findings with your SIEM." -ForegroundColor Cyan