# ARTEX-style attack self-test kit For business owners and their authorized IT providers. Prepared November 3, 2026. AUTHORIZATION FIRST: Use this kit only on systems you own or have written permission to review. Start with the [AI security audit authorization kit](https://jwatte.com/downloads/ai-security-audit-authorization-kit.md). Probing someone else's systems without permission creates Computer Fraud and Abuse Act risk. Public scanning is passive only; anything active is a separately scoped engagement with written authorization. Ownership of an account does not grant permission to test a supplier's infrastructure or other customers. This is a configuration and records review. It does not run ARTEX, reproduce an exploit, forge identity assertions or test stolen credentials. It cannot certify that a system is secure. Keep resulting inventories and findings private. Never paste keys, passwords, customer data or raw session histories into an AI service. ## Review record - Business and approving owner: - Authorized reviewer and provider: - Written authorization reference: - Systems, accounts, domains and Regions included: - Systems and third parties excluded: - Review start and end, with time zone: - Emergency contact and stop conditions: - Approved evidence storage and retention period: - Change approval owner: - Next review date: For each check record PASS, NEEDS FIX, UNKNOWN or NOT APPLICABLE, plus evidence date, reviewer, responsible owner and due date. Explain every exclusion. Missing access or missing records means UNKNOWN, not PASS. If evidence suggests a current intrusion, preserve records and contact the incident-response owner rather than continuing routine testing. ## Inventory of internet-facing services Use your own DNS inventory, hosting accounts, firewall rules, cloud consoles and provider contracts. Include administration portals and vendor integrations. Do not discover assets by probing unrelated address ranges. | Service or application | Business purpose and owner | Public hostname or approved asset ID | Hosting provider and account | Software and supported version | Patch owner and last verified update | Login and MFA control | Logs and EDR coverage | Keep, restrict or retire | |---|---|---|---|---|---|---|---|---| | Fill in | | | | | | | | | | Fill in | | | | | | | | | Add separate rows for VPN gateways, remote monitoring and management (RMM) tools, mail systems, firewalls, container administration, backup services and retired systems still connected. Record the complete expected device inventory separately so it can be reconciled against security reporting. ## Checks mapped to the reported weaknesses Commands below read configuration or status and change nothing on the reviewed systems. Run them only with existing authorized access. Do not add administrator rights merely to complete a worksheet. | Weakness | How to check your own setup | Read-only command or console path | What good looks like | Who fixes it | |---|---|---|---|---| | Internet-facing applications and old appliances | Reconcile inventory with configured public routes and vendor support records | Hosting and firewall consoles; installed version/status page | Every exposure has a purpose and owner; supported patches installed; unnecessary exposure removed through change control | Network and application owners | | Exposed dot folders, agent instructions and histories | Review deployed filenames and server rules without opening potential secret files | Check A; web-server document-root, alias and directory-listing configuration | Sensitive files outside published roots; unintended dot paths denied; directory listing disabled where unnecessary | Website operator | | Cloud instance metadata and excessive roles | Review actual instance settings across every owned AWS account and Region, then role permissions | Check B; EC2 instance details and IAM role permission review | Metadata disabled if unused; otherwise HttpTokens required and State applied; narrowly scoped role permissions | Cloud administrator | | Unsigned SAML assertions | Ask identity and application vendors for documented validation behavior and supported configuration | Identity provider application settings; application SSO configuration; vendor support confirmation | Unsigned/invalid assertions rejected; issuer, audience, recipient and expiry checked; signed response/assertion handling matches the integration | Identity lead and application vendor | | XXE in XML document handling | Ask application owner to review supported parser settings and patch records | Application configuration and dependency/version inventory | External entity processing disabled where unnecessary; safe supported parser configuration documented | Developer or application vendor | | Unauthenticated administration or container orchestration | List local listeners, then review authentication and network restrictions | Check C; orchestration service configuration and firewall/cloud rules | Every admin interface has deliberate exposure, authenticated access and minimal rights | Platform or network administrator | | LAPS absent, stale or excessively readable | Verify policy assignment and backup/update status; review who may retrieve passwords | Check D; Group Policy or Intune policy/device status; directory permissions review | Unique managed local admin credentials, current backups, restricted retrieval rights and monitored failures | Windows and identity administrator | | Unnecessary Active Directory delegation | Review computer and service account grants, their owners and who can change them | Check E; Active Directory administrative tools | Every grant has a documented need; unexpected/broad grants investigated; change rights restricted | Directory administrator | | Keys in old exports, backups or mail | Inventory historical exports and backup access; review secret-exposure findings without opening values | Backup console, approved data-classification reports, key/certificate inventory | Known owner, restricted retention/access, and rotation or revocation after suspected exposure | Application, backup and identity owners | | VPN/RMM credentials and unpatched remote tools | Reconcile installed tools with approved inventory; review versions, access and MFA | VPN/RMM vendor consoles, account and version reports | Supported patches, named accounts, MFA, least privilege, stale accounts removed through approved changes | IT provider and network owner | | Trusted supplier application abuse | Review approved app permissions and unusual app-only access or changes | Microsoft Entra enterprise applications, service-principal sign-ins and audit logs | Documented grants and owners; unauthorized credentials/privileges investigated; affected integrations follow current vendor guidance | Cloud identity lead and provider | | Missing endpoint coverage | Compare expected hosts with current sensor reports | EDR console device inventory and last-seen report | Every in-scope supported host reporting; exclusions, stale hosts and unsupported systems explicitly resolved | Security monitoring provider | | Published indicators and behavior | Search retained records using the dated markers below | EDR process/file telemetry, DNS, firewall, identity and cloud audit consoles | Adequate retained data, investigated matches, alerts routed to an accountable responder | Monitoring provider and incident-response lead | SAML is the identity statement an application trusts after sign-in. MFA is a separate identity check and does not repair faulty SAML signature validation. Do not send forged assertions to test production. Ask for an authorized specialist test in an isolated environment if documentation cannot establish behavior. XXE means XML external entity processing that can expose information or trigger unintended requests. This kit asks for configuration evidence rather than a test document. LAPS manages local Windows administrator passwords. Active Directory delegation lets services act for users; it needs a business justification and restricted change rights. ## A. Filename-only review of a published web root Reads names in one document root on your own server. Changes nothing and makes no network request. Replace the placeholder with an approved document root. The variable assignment affects this shell only. ```bash WEBROOT='REPLACE_WITH_OWN_WEB_ROOT' find "$WEBROOT" -xdev \ \( -type d -name '.*' -print -prune \) -o \ \( -type f \( -name '.env*' -o -name 'CLAUDE.md' -o -name 'AGENTS.md' -o -name 'MEMORY.md' \) -print \) ``` Matches are review candidates, not proof that a browser can retrieve them. Dot directories are listed without descending into their contents. Inspect deployment rules, directory listing settings and access rules with the site owner. An intentional public `.well-known` directory may be needed and must not be blindly removed. This command does not follow symbolic links or cross filesystem boundaries; review aliases, mounts and linked deployment locations separately. Files under other names can still contain secrets. Validation: Bash syntax checked and executed against a synthetic fixture. It found candidate dot directories, `.env` variants and agent filenames, and excluded an ordinary page. No file contents were read. This does not verify your own web server's exposure. ## B. AWS instance metadata settings Reads instance configuration in the account/profile and Region you specify. Changes nothing. Uses an existing authorized role with `ec2:DescribeInstances`. The API query reads configuration without retrieving credentials from the instances being reviewed; the CLI authenticates through your existing profile. Replace both placeholders and repeat for each approved account and Region. ```bash aws ec2 describe-instances \ --profile YOUR_READ_ONLY_PROFILE \ --region YOUR_REGION \ --query 'Reservations[].Instances[].{Instance:InstanceId,Endpoint:MetadataOptions.HttpEndpoint,Tokens:MetadataOptions.HttpTokens,State:MetadataOptions.State}' \ --output table \ --no-cli-pager ``` Good: Endpoint is disabled where metadata is unused. Where enabled, Tokens is `required` and State is `applied`. `optional` permits the older metadata method. A pending change is not yet a confirmed result. Have the cloud owner separately review the attached role and its administration permissions. IMDSv2 is a session-token requirement, not a substitute for limited permissions or application security. Check application compatibility before changing settings. Validation: Bash syntax checked and fields reviewed against AWS documentation. AWS CLI was unavailable, so this command and its query were not executed against AWS or a CLI fixture. No cloud account was queried. ## C. Local listening services Reads the local operating system's socket table. Changes nothing and opens no connection. ```bash ss -lntu ``` This lists local TCP and UDP listeners. It covers only this machine and network namespace. Bind addresses alone cannot establish public reachability or whether an application requires authentication. Compare each service with firewall rules, published container ports, reverse-routing configuration and the service's identity settings. Review configuration; do not try unauthenticated administrative actions. Validation: Executed locally with a successful exit. No remote system was contacted. ## D. Windows LAPS deployment status Reads event headers on the authorized Windows endpoint. Changes nothing. Does not retrieve passwords or print event message contents. ```powershell Get-WinEvent -LogName 'Microsoft-Windows-LAPS/Operational' -MaxEvents 30 | Select-Object TimeCreated,Id,LevelDisplayName ``` Console alternative: Event Viewer > Applications and Services Logs > Microsoft > Windows > LAPS > Operational. Check the assigned policy in Group Policy Management > relevant policy > Computer Configuration > Administrative Templates > System > LAPS, or the organization's Intune LAPS policy and device status. The event sample size is an illustration, not a standard. Review a period covering the configured rotation interval. Microsoft documents event 10004 as successful policy processing; that alone does not prove a password backup. Event 10018 records a successful Active Directory backup, 10029 an Entra ID backup, and 10020 a successful managed local account update. Review failures such as 10005 and compare status with effective policy and the complete device inventory. A missing channel or no events means UNKNOWN. Review password retrieval permissions separately without retrieving the password itself. Validation: Not run or parsed locally because PowerShell and a Windows fixture were unavailable. Syntax and event meanings were checked against Microsoft documentation. An administrator must validate behavior on a representative authorized endpoint. ## E. Active Directory delegation review For an authorized directory administrator with the ActiveDirectory PowerShell module. Reads named computer properties in the current domain, changes nothing and retrieves no passwords. ```powershell Get-ADComputer -Filter * -Properties TrustedForDelegation,TrustedToAuthForDelegation,'msDS-AllowedToDelegateTo',PrincipalsAllowedToDelegateToAccount | Select-Object Name,TrustedForDelegation,TrustedToAuthForDelegation,'msDS-AllowedToDelegateTo',PrincipalsAllowedToDelegateToAccount ``` This separate inventory lists all user accounts, including service identities. It reads settings only and changes nothing: ```powershell Get-ADUser -Filter * -Properties TrustedForDelegation,TrustedToAuthForDelegation,'msDS-AllowedToDelegateTo' | Select-Object Name,TrustedForDelegation,TrustedToAuthForDelegation,'msDS-AllowedToDelegateTo' ``` Treat unexpected grants as review findings, not automatic proof of intrusion. Domain controllers need specialist interpretation. Review permitted destination services, resource-based delegation represented by `PrincipalsAllowedToDelegateToAccount`, and who has permission to change these settings. Also review managed service accounts and every relevant domain; these commands are not a complete directory audit. Use restricted evidence storage because account names and relationships are sensitive. Validation: Neither command was parsed or run locally. PowerShell, the AD module and a domain fixture were unavailable. Properties and syntax were reviewed against Microsoft references. No live directory was queried. ## Dated log-search markers and indicators Sources: [CrowdStrike's October 29 VAPOR PANDA report](https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/), read November 3, 2026 at 22:31:23 UTC, and [October 7 South Korean finance report](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/), read at 22:31:22 UTC. An IOC is an indicator of compromise: a lead associated with reported malicious activity. Values below retain the vendor's defanging. They are for searching records you already hold, never for browsing, name resolution, downloading or contacting infrastructure. Use the approved search syntax in your monitoring console. If that console needs ordinary dots, normalize only within its stored-data search field, never a browser or network tool. No match does not establish absence of compromise; telemetry may be missing or names may change. | ARTEX marker reported by CrowdStrike | Search in your existing records | Review context | |---|---|---| | `artx` or `artex` in command-line parameters | EDR process telemetry | Compare executable, parent process, host, identity and approved activity | | Cloud role names beginning `artx` | Cloud identity inventory and audit history | Investigate role creator, grants and use | | Administration-command comments beginning `art18-` | Retained cloud administration records | Investigate issuing identity and affected instances | | Directory named `artx5v` under Windows ProgramData | Retained EDR file/directory telemetry | Vendor report supplies the full location; correlate creation and process events | The directory location is described by its components here to keep the worksheet portable. These strings can appear in legitimate work or be changed by an attacker; do not automatically delete files, disable accounts or declare a breach based on one match. VAPOR PANDA report, domains labeled BLOODALCHEMY command-and-control infrastructure: ```text nginxmysql[.]com sqlserver-sqlite[.]com www[.]ddduuuppp[.]com ``` The same report lists these corresponding IP addresses: ```text 45.153.126[.]223 89.46.234[.]50 192.121.47[.]20 ``` South Korean finance report, address labeled threat actor-controlled: ```text 38.244.50[.]120 ``` The same report lists these intermediary addresses. Shared or reassigned infrastructure needs especially careful date and activity correlation: ```text 101.53.80[.]20 205.214.59[.]31 124.155.252[.]63 154.201.79[.]246 23.248.249[.]90 23.158.220[.]98 103.248.148[.]84 203.160.133[.]172 209.209.85[.]38 ``` MITRE ATT&CK is a shared catalog of adversary behavior. CrowdStrike's published mappings include T1190 (public-facing application exploitation), T1552.005 (cloud metadata credentials), T1555 (credentials from password stores), T1606.002 (SAML tokens), T1078 (valid accounts) and T1133 (external remote services). Ask the monitoring provider which collected events support investigation of these behaviors. A mapping is not proof your product detected them. For Microsoft 365 supplier concerns, use [Microsoft's October 21 investigation and defensive queries](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/). Review service-principal sign-ins and subsequent credential, consent, owner and privilege changes. This kit does not reproduce those tenant-specific queries. Preserve evidence and follow current vendor containment guidance with an authorized responder. Record each search's time range, log sources, retention gaps, filters, matches, reviewer and disposition. A security incident requires correlation and a response owner; a list of matching strings is not an investigation. ## Monthly retest calendar This is a proposed operating schedule, not a legal or vendor-mandated interval. Suspected compromise, urgent advisories and material changes require prompt review instead of waiting for the next monthly slot. | When | Work | Evidence and owner | |---|---|---| | First business week | Reconcile exposed service, vendor integration and device inventories | Dated inventory; business and IT owners | | Second business week | Review appliance support/patches, VPN/RMM MFA, SAML configuration changes, metadata and delegation exceptions | Configuration evidence; relevant administrators | | Third business week | Compare EDR reporting, review alerts and available indicator searches, examine application permission changes | Coverage denominator, stale devices, search period and disposition; monitoring provider | | Final business week | Review old exports/key exposure, overdue fixes and completed retests | Key owner decisions, closure evidence and next due dates; business owner | | After relevant changes or exposure | Repeat affected checks and reassess keys, identities and log preservation immediately | Change or incident reference; response lead | Finding record: ID | affected asset | observed weakness | evidence date | business effect | owner | proposed change | approval | due date | retest evidence | remaining uncertainty. ## Scope for a hired penetration test Use these items in a request for proposals. Ask for an anonymized sample report and references for similar environments. The provider should be able to explain its insurance, evidence handling and the qualifications of the people doing the work. No service prices are assumed here. - Exact assets and legal owner, cloud accounts and tenants, environments, permitted dates and test identities. - Written permission from each party entitled to authorize the work; applicable hosting and supplier conditions. - Included review areas: public applications, SAML validation, XML handling, cloud roles and metadata settings, orchestration authentication, LAPS permissions, delegation, historical credential exposure, remote tools and supplier app grants. - Explicitly permitted techniques, request limits, prohibited actions and whether active validation is confined to a test environment. No destructive testing, real-data extraction or cross-customer access unless separately and lawfully agreed. - Stop conditions, emergency contacts, service availability limits, immediate disclosure of critical findings and incident escalation. - Rules for AI use, model providers, data leaving the environment, retention, deletion and human verification. No customer credentials or raw production data in unapproved services. - Deliverables: executive explanation, technical evidence, affected assets, prerequisites, confidence, business impact, actionable remediation, untested areas, limitations and a prioritized owner list. - Retest arrangements, closure criteria, treatment of unresolved findings and secure delivery of evidence. Configuration review can establish settings; controlled testing can validate behavior. Neither proves every possible attack path has been examined. Keep that limitation in the contract and the final report. ## Sources and read dates All reads below occurred November 3, 2026, UTC. Commands were checked as stated in their individual sections. The review did not run a penetration test. - [CrowdStrike VAPOR PANDA](https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/), 22:31:23: weakness mapping, recommendations, markers, defanged indicators and ATT&CK entries. - [CrowdStrike South Korean finance](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/), 22:31:22: exposed agent records and defanged addresses. - [Microsoft Storm-0940](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/), 22:31:22: trusted application abuse and records review. - [AWS describe-instances](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html), 22:31:28; [instance metadata options](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html), 22:31:30. - [Windows LAPS event logs](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-event-log), 22:31:28; [LAPS policy settings](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-management-policy-settings), 22:31:30. - [Get-ADComputer](https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer?view=windowsserver2025-ps), 22:31:31; [Get-ADUser](https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2025-ps), 22:31:32; [delegation property reference](https://learn.microsoft.com/en-us/powershell/module/activedirectory/set-adcomputer?view=windowsserver2025-ps), 22:32:08. The last source explains a property; no configuration-changing command is included. - [GNU find manual](https://www.gnu.org/software/findutils/manual/find.html), 22:32:44; [ss manual](https://man7.org/linux/man-pages/man8/ss.8.html), 22:31:28. - [18 U.S.C. 1030](https://www.law.cornell.edu/uscode/text/18/1030), 22:31:25: federal unauthorized-access law. Read the authorization kit before work. Informational only, not legal or security advice for a particular environment. No affiliation or endorsement is implied.