ARTEX detection pack v1.1.0 targets LLM-agent attack behavior, not expiring IOCs
evilsocket · x · 2026-11-15
malwaremustdie released ARTEX signature detection pack v1.1.0 and clarified the real deliverable isn't an IOC list—IOCs expire within a year by design. The release is a workflow for turning LLM-driven attacks into detections at attacker speed.
Key insight: ARTEX is an LLM harness. Swap the model, prompts, or infrastructure and every IOC changes, but agent behavior stays largely the same—machine-speed recon chains, 1/s password sprays with rotating UAs, self-correcting API retries, systematic record enumeration. Hence the behavior-first design via Sigma correlations, Sentinel KQL, and Zeek SumStats rather than packet filters.
v1.1.0 updates include:
- Rename-proof webshell rules (upload → execute, any filename)
- Windows coverage: IIS/PHP workers spawning shells, script drops
- AWS rules for AntiFox, an ARTEX fork (secrets/IAM/S3 sweeps)
- OAuth high-privilege consent + Graph recon (Sentinel)
- LLM-API egress policy rules for servers
- IP IOCs with a 90-day alert window, then hunt-only
- New D0/D1/D2 durability labels plus mutation testing
Known gaps are documented rather than hidden.
More from Safety
- D.C. Council kills robotaxi bill 3-3, labor concerns trump Waymo safety data — QuintinPope5 · 2026-11-15
- AI-native companies reportedly churning from Fireworks to Baseten after security incident — AccBalanced · 2026-11-15
- Plenty of AI company talent would take big pay cuts to join public safety bodies — AndyMasley · 2026-11-15
- Permission Delta: Open-Source GitHub Action Reviews MCP Config Changes in PRs — AGENTPROOFINC · 2026-11-15
- New York's RAISE Act takes effect: frontier labs must register by Jan 1, 2027, report incidents in 72h — dl_weekly · 2026-11-15
- DC 'March for an AI Treaty' calls for banning recursive self-improvement — jeremiecharris · 2026-11-15