Chinese Threat Actor Weaponized ARTEX Agentic Pentesting Tool and Claude AI Against South Korean Banks — Detection and Defense Guide

---
title: Rapid Internal Enumeration Burst - Potential Agentic AI Recon
id: 3f9c2a71-4b6d-4e58-a91c-7d2e5f8a0b11
status: experimental
description: Detects bursts of internal reconnaissance commands executed in short succession from a single host, consistent with agentic AI frameworks (e.g., ARTEX) performing automated enumeration at machine speed.
references:
  - https://www.infosecurity-magazine.com/news/chinese-hacker-ai-korean-banks/
  - https://attack.mitre.org/techniques/T1087/
  - https://attack.mitre.org/techniques/T1018/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1087
  - attack.t1018
  - attack.t1482
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\nltest.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\dsquery.exe'
      - '\adfind.exe'
      - '\sharpHound.exe'
      - '\bloodhound.exe'
  selection_cli:
    CommandLine|contains:
      - ' /domain_trusts'
      - 'domain admins'
      - 'enterprise admins'
      - 'dsquery computer'
      - 'dsquery user'
      - '-CollectionMethod'
  condition: selection_img or selection_cli
falsepositives:
  - Legitimate IT administration and inventory scripts - baseline admin workstations and exclude known service accounts
level: high
---
title: Outbound Connection to LLM API Endpoint from Server or Endpoint
id: 8b1e4d92-5c7f-4a39-b62d-9e3a1f5c7d22
status: experimental
description: Detects network connections to commercial LLM API endpoints (Anthropic, OpenAI) initiated by non-browser processes. Threat actors have abused Claude and other LLMs during intrusions for payload generation and data processing; unexpected API egress may indicate attacker tooling or use of a compromised host as an AI proxy.
references:
  - https://www.infosecurity-magazine.com/news/chinese-hacker-ai-korean-banks/
  - https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.exfiltration
logsource:
  category: network_connection
  product: windows
detection:
  selection_dst:
    DestinationHostname|contains:
      - 'api.anthropic.com'
      - 'api.openai.com'
  filter_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  condition: selection_dst and not filter_browser
falsepositives:
  - Approved internal AI integrations and developer tooling - maintain an allowlist of sanctioned AI application paths
level: medium
---
title: Short-Lived Script or Binary Execution from User-Writable Directory
id: c5d7f0a3-2e8b-4c46-9d71-4a2b6e8f0c33
status: experimental
description: Detects execution of scripts and binaries from temp and user-profile directories with randomized-looking filenames, a pattern consistent with agentic frameworks rapidly generating and discarding payloads during iterative exploitation.
references:
  - https://www.infosecurity-magazine.com/news/chinese-hacker-ai-korean-banks/
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.defense_evasion
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
  selection_random:
    Image|re: '\\[a-z0-9]{8,12}\.(exe|bat|ps1|py|js)$'
  condition: selection_path and selection_random
falsepositives:
  - Software installers and auto-updaters - correlate with known installer parent processes and signer metadata
level: medium

// Hunt 1: Recon burst - many distinct discovery commands from one device in 15 min
let reconCmds = dynamic(["nltest", "net group", "net localgroup", "dsquery", "adfind", "whoami /all", "ipconfig /all", "arp -a", "route print", "netstat -an"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where reconCmds has (ProcessCommandLine)
| summarize DistinctCmds = dcount(ProcessCommandLine), CmdList = make_set(ProcessCommandLine, 20) by DeviceName, InitiatingProcessAccountName, bin(TimeGenerated, 15m)
| where DistinctCmds >= 5
| order by DistinctCmds desc;

// Hunt 2: Non-browser process egress to LLM API endpoints
let llmDomains = dynamic(["api.anthropic.com", "api.openai.com", "claude.ai"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (llmDomains)
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "Teams.exe", "slack.exe")
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl
| order by FirstSeen asc;

// Hunt 3: Short-lived executables in user-writable paths (Sysmon Event 1 via SecurityEvent not applicable; use Defender)
DeviceProcessEvents
| where TimeGenerated > ago(3d)
| where FolderPath has_any ("\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\", "\\Users\\Public\\")
| where FileName matches regex @"^[a-z0-9]{8,12}\.(exe|bat|ps1|py|js)$"
| summarize ExecCount = count(), Parents = make_set(InitiatingProcessFileName) by DeviceName, FileName, FolderPath, SHA256
| order by ExecCount desc;

-- Hunt: Disposable payloads in user-writable paths + LLM API connections
-- Payload artifacts in temp/profile directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/Users/*/AppData/Local/Temp/*.exe',
                 'C:/Users/*/AppData/Local/Temp/*.ps1',
                 'C:/Users/*/AppData/Roaming/*.exe',
                 'C:/Users/Public/*.exe'])
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC

-- Live connections to LLM API infrastructure
SELECT Pid, Name, Path, Address.Family as Family,
       Address.IP as RemoteIP, Address.Port as RemotePort, Status
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND Name !~ '(chrome|msedge|firefox|brave|slack|Teams)'

# ============================================================
# AI-Augmented Intrusion Hardening & Audit Script
# Targets: LLM API egress control + disposable payload artifacts
# ============================================================

# --- 1. Test whether LLM API egress is reachable from this host ---
$llmEndpoints = @('api.anthropic.com','api.openai.com')
Write-Host "[*] Testing egress to LLM API endpoints..." -ForegroundColor Cyan
foreach ($ep in $llmEndpoints) {
    $result = Test-NetConnection -ComputerName $ep -Port 443 -WarningAction SilentlyContinue
    if ($result.TcpTestSucceeded) {
        Write-Host "[WARN] $ep is REACHABLE on 443. If no sanctioned AI workload exists on this host, block at the egress firewall/proxy." -ForegroundColor Yellow
    } else {
        Write-Host "[OK]   $ep is blocked/unreachable." -ForegroundColor Green
    }
}

# --- 2. Add Windows Defender Firewall block rules for LLM API egress (optional, review first) ---
# Resolve and block at IP level as a compensating control; prefer DNS sinkholing at the resolver
foreach ($ep in $llmEndpoints) {
    $ips = (Resolve-DnsName $ep -Type A -ErrorAction SilentlyContinue | Where-Object {$_.IPAddress}).IPAddress
    foreach ($ip in $ips) {
        $ruleName = "Block-LLM-Egress-$ep-$ip"
        if (-not (Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue)) {
            New-NetFirewallRule -DisplayName $ruleName -Direction Outbound -Action Block `
                -RemoteAddress $ip -Protocol TCP -RemotePort 443 -Profile Any | Out-Null
            Write-Host "[+] Created firewall rule: $ruleName" -ForegroundColor Green
        }
    }
}

# --- 3. Audit user-writable directories for unsigned executables (last 7 days) ---
$paths = @("$env:SystemDrive\Users\*\AppData\Local\Temp",
           "$env:SystemDrive\Users\*\AppData\Roaming",
           "$env:SystemDrive\Users\Public")
$cutoff = (Get-Date).AddDays(-7)
Write-Host "[*] Scanning for unsigned executables in user-writable paths..." -ForegroundColor Cyan
$findings = foreach ($p in $paths) {
    Get-ChildItem -Path $p -Include *.exe,*.ps1,*.bat,*.js,*.py -Recurse -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt $cutoff } |
        ForEach-Object {
            $sig = Get-AuthenticodeSignature $_.FullName
            [PSCustomObject]@{
                Path      = $_.FullName
                Modified  = $_.LastWriteTime
                Signature = $sig.Status
                Signer    = $sig.SignerCertificate.Subject
            }
        }
}
$unsigned = $findings | Where-Object { $_.Signature -ne 'Valid' }
if ($unsigned) {
    Write-Host "[ALERT] $($unsigned.Count) unsigned/invalid files found:" -ForegroundColor Red
    $unsigned | Format-Table -AutoSize
    $unsigned | Export-Csv -Path ".\unsigned_payload_audit_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
} else {
    Write-Host "[OK] No unsigned executables found in scope." -ForegroundColor Green
}