Skip to content

Commit b563af8

Browse files
MikaayensonMikaayenson
committed
toml-lint
1 parent 35c5e50 commit b563af8

7 files changed

+243
-266
lines changed

‎rules/cross-platform/collection_genai_process_sensitive_file_access.toml‎

Lines changed: 32 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@ updated_date = "2025/12/04"
88
author = ["Elastic"]
99
description = """
1010
Detects when GenAI tools access sensitive files such as cloud credentials, SSH keys, browser password databases, or
11-
shell configurations. Attackers leverage GenAI agents to systematically locate and exfiltrate credentials, API keys,
12-
and tokens. Access to credential stores (.aws/credentials, .ssh/id_*) suggests harvesting, while writes to shell
13-
configs (.bashrc, .zshrc) indicate persistence attempts.
11+
shell configurations. Attackers leverage GenAI agents to systematically locate and exfiltrate credentials, API keys, and
12+
tokens. Access to credential stores (.aws/credentials, .ssh/id_*) suggests harvesting, while writes to shell configs
13+
(.bashrc, .zshrc) indicate persistence attempts.
1414
"""
1515
from = "now-9m"
1616
index = ["logs-endpoint.events.file*"]
@@ -47,12 +47,12 @@ This rule detects GenAI tools accessing credential files, SSH keys, browser data
4747
- Update security policies to restrict or monitor GenAI tool usage in the environment, especially for access to sensitive files.
4848
"""
4949
references = [
50-
"https://atlas.mitre.org/techniques/AML.T0085",
51-
"https://atlas.mitre.org/techniques/AML.T0085.001",
52-
"https://atlas.mitre.org/techniques/AML.T0055",
53-
"https://glama.ai/blog/2025-11-11-the-lethal-trifecta-securing-model-context-protocol-against-data-flow-attacks",
54-
"https://www.elastic.co/security-labs/elastic-advances-llm-security",
55-
"https://specterops.io/blog/2025/11/21/an-evening-with-claude-code"
50+
"https://atlas.mitre.org/techniques/AML.T0085",
51+
"https://atlas.mitre.org/techniques/AML.T0085.001",
52+
"https://atlas.mitre.org/techniques/AML.T0055",
53+
"https://glama.ai/blog/2025-11-11-the-lethal-trifecta-securing-model-context-protocol-against-data-flow-attacks",
54+
"https://www.elastic.co/security-labs/elastic-advances-llm-security",
55+
"https://specterops.io/blog/2025/11/21/an-evening-with-claude-code",
5656
]
5757
risk_score = 73
5858
rule_id = "c0136397-f82a-45e5-9b9f-a3651d77e21a"
@@ -74,6 +74,7 @@ tags = [
7474
]
7575
timestamp_override = "event.ingested"
7676
type = "eql"
77+
7778
query = '''
7879
file where event.action in ("open", "creation", "modification") and event.outcome == "success" and
7980
@@ -123,36 +124,36 @@ file where event.action in ("open", "creation", "modification") and event.outcom
123124
"KeePass.config.xml",
124125
"Unattended.xml")
125126
)
126-
127127
'''
128128

129+
129130
[[rule.threat]]
130131
framework = "MITRE ATLAS"
132+
[[rule.threat.technique]]
133+
id = "AML.T0085"
134+
name = "Data from AI Services"
135+
reference = "https://atlas.mitre.org/techniques/AML.T0085/"
136+
[[rule.threat.technique.subtechnique]]
137+
id = "AML.T0085.001"
138+
name = "AI Agent Tools"
139+
reference = "https://atlas.mitre.org/techniques/AML.T0085.001/"
131140

132-
[rule.threat.tactic]
133-
name = "Collection"
134-
id = "AML.TA0009"
135-
reference = "https://atlas.mitre.org/tactics/AML.TA0009/"
136141

137-
[[rule.threat.technique]]
138-
name = "Data from AI Services"
139-
id = "AML.T0085"
140-
reference = "https://atlas.mitre.org/techniques/AML.T0085/"
141-
142-
[[rule.threat.technique.subtechnique]]
143-
name = "AI Agent Tools"
144-
id = "AML.T0085.001"
145-
reference = "https://atlas.mitre.org/techniques/AML.T0085.001"
146142

143+
[rule.threat.tactic]
144+
id = "AML.TA0009"
145+
name = "Collection"
146+
reference = "https://atlas.mitre.org/tactics/AML.TA0009/"
147147
[[rule.threat]]
148148
framework = "MITRE ATLAS"
149+
[[rule.threat.technique]]
150+
id = "AML.T0055"
151+
name = "Unsecured Credentials"
152+
reference = "https://atlas.mitre.org/techniques/AML.T0055/"
153+
149154

150-
[rule.threat.tactic]
151-
name = "Credential Access"
152-
id = "AML.TA0013"
153-
reference = "https://atlas.mitre.org/tactics/AML.TA0013/"
155+
[rule.threat.tactic]
156+
id = "AML.TA0013"
157+
name = "Credential Access"
158+
reference = "https://atlas.mitre.org/tactics/AML.TA0013/"
154159

155-
[[rule.threat.technique]]
156-
name = "Unsecured Credentials"
157-
id = "AML.T0055"
158-
reference = "https://atlas.mitre.org/techniques/AML.T0055/"

‎rules/cross-platform/command_and_control_genai_process_suspicious_tld_connection.toml‎

Lines changed: 29 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@ updated_date = "2025/12/04"
77
[rule]
88
author = ["Elastic"]
99
description = """
10-
Detects when GenAI tools connect to domains using suspicious TLDs commonly abused for malware C2 infrastructure.
11-
TLDs like .top, .xyz, .ml, .cf, .onion are frequently used in phishing and malware campaigns. Legitimate GenAI
12-
services use well-established domains (.com, .ai, .io), so connections to suspicious TLDs may indicate compromised
13-
tools, malicious plugins, or AI-generated code connecting to attacker infrastructure.
10+
Detects when GenAI tools connect to domains using suspicious TLDs commonly abused for malware C2 infrastructure. TLDs
11+
like .top, .xyz, .ml, .cf, .onion are frequently used in phishing and malware campaigns. Legitimate GenAI services use
12+
well-established domains (.com, .ai, .io), so connections to suspicious TLDs may indicate compromised tools, malicious
13+
plugins, or AI-generated code connecting to attacker infrastructure.
1414
"""
1515
from = "now-9m"
1616
index = ["logs-endpoint.events.network*", "winlogbeat-*", "logs-windows.sysmon_operational-*"]
@@ -52,9 +52,9 @@ This rule detects GenAI tools connecting to domains with TLDs commonly abused by
5252
- Add detection for secondary indicators (reverse shells, encoded C2 traffic, odd user-agent strings).
5353
"""
5454
references = [
55-
"https://www.cybercrimeinfocenter.org/top-20-tlds-by-malicious-phishing-domains",
56-
"https://atlas.mitre.org/techniques/AML.T0086",
57-
"https://www.elastic.co/security-labs/elastic-advances-llm-security"
55+
"https://www.cybercrimeinfocenter.org/top-20-tlds-by-malicious-phishing-domains",
56+
"https://atlas.mitre.org/techniques/AML.T0086",
57+
"https://www.elastic.co/security-labs/elastic-advances-llm-security",
5858
]
5959
risk_score = 73
6060
rule_id = "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
@@ -73,6 +73,7 @@ tags = [
7373
]
7474
timestamp_override = "event.ingested"
7575
type = "eql"
76+
7677
query = '''
7778
network where host.os.type in ("macos", "windows") and
7879
@@ -109,34 +110,34 @@ network where host.os.type in ("macos", "windows") and
109110
)
110111
'''
111112

113+
112114
[[rule.threat]]
113115
framework = "MITRE ATT&CK"
116+
[[rule.threat.technique]]
117+
id = "T1071"
118+
name = "Application Layer Protocol"
119+
reference = "https://attack.mitre.org/techniques/T1071/"
120+
[[rule.threat.technique.subtechnique]]
121+
id = "T1071.004"
122+
name = "DNS"
123+
reference = "https://attack.mitre.org/techniques/T1071/004/"
114124

115-
[rule.threat.tactic]
116-
name = "Command and Control"
117-
id = "TA0011"
118-
reference = "https://attack.mitre.org/tactics/TA0011/"
119-
120-
[[rule.threat.technique]]
121-
name = "Application Layer Protocol"
122-
id = "T1071"
123-
reference = "https://attack.mitre.org/techniques/T1071/"
124125

125-
[[rule.threat.technique.subtechnique]]
126-
name = "DNS"
127-
id = "T1071.004"
128-
reference = "https://attack.mitre.org/techniques/T1071/004/"
129126

127+
[rule.threat.tactic]
128+
id = "TA0011"
129+
name = "Command and Control"
130+
reference = "https://attack.mitre.org/tactics/TA0011/"
130131
[[rule.threat]]
131132
framework = "MITRE ATLAS"
133+
[[rule.threat.technique]]
134+
id = "AML.T0086"
135+
name = "Exfiltration via AI Agent Tool Invocation"
136+
reference = "https://atlas.mitre.org/techniques/AML.T0086/"
132137

133-
[rule.threat.tactic]
134-
name = "Exfiltration"
135-
id = "AML.TA0010"
136-
reference = "https://atlas.mitre.org/tactics/AML.TA0010/"
137138

138-
[[rule.threat.technique]]
139-
name = "Exfiltration via AI Agent Tool Invocation"
140-
id = "AML.T0086"
141-
reference = "https://atlas.mitre.org/techniques/AML.T0086/"
139+
[rule.threat.tactic]
140+
id = "AML.TA0010"
141+
name = "Exfiltration"
142+
reference = "https://atlas.mitre.org/tactics/AML.TA0010/"
142143

‎rules/cross-platform/command_and_control_genai_process_unusual_domain.toml‎

Lines changed: 72 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -50,10 +50,10 @@ GenAI tools with network access can be weaponized to contact attacker infrastruc
5050
- Update detection rules to monitor the identified domain across all hosts in the environment.
5151
"""
5252
references = [
53-
"https://atlas.mitre.org/techniques/AML.T0086",
54-
"https://glama.ai/blog/2025-11-11-the-lethal-trifecta-securing-model-context-protocol-against-data-flow-attacks",
55-
"https://www.elastic.co/security-labs/elastic-advances-llm-security",
56-
"https://specterops.io/blog/2025/11/21/an-evening-with-claude-code"
53+
"https://atlas.mitre.org/techniques/AML.T0086",
54+
"https://glama.ai/blog/2025-11-11-the-lethal-trifecta-securing-model-context-protocol-against-data-flow-attacks",
55+
"https://www.elastic.co/security-labs/elastic-advances-llm-security",
56+
"https://specterops.io/blog/2025/11/21/an-evening-with-claude-code",
5757
]
5858
risk_score = 47
5959
rule_id = "9050506c-df6d-4bdf-bc82-fcad0ef1e8c1"
@@ -74,109 +74,86 @@ timestamp_override = "event.ingested"
7474
type = "new_terms"
7575

7676
query = '''
77-
event.category : ("network" or "dns") and
78-
process.name : (
79-
"ollama" or "ollama.exe" or "Ollama" or
80-
"textgen" or "textgen.exe" or "text-generation-webui.exe" or "oobabooga.exe" or
81-
"lmstudio" or "lmstudio.exe" or "LM Studio" or
82-
"claude" or "claude.exe" or "Claude" or
83-
"cursor" or "cursor.exe" or "Cursor" or
84-
"Cursor Helper" or "Cursor Helper (Plugin)" or
85-
"Claude Helper" or "Claude Helper (Plugin)" or
86-
"copilot" or "copilot.exe" or "Copilot" or
87-
"codex" or "codex.exe" or
88-
"Jan" or "jan" or "jan.exe" or "Jan Helper" or
89-
"gpt4all" or "gpt4all.exe" or "GPT4All" or
90-
"gemini-cli" or "gemini-cli.exe" or
91-
"genaiscript" or "genaiscript.exe" or
92-
"grok" or "grok.exe" or
93-
"qwen" or "qwen.exe" or
94-
"koboldcpp" or "koboldcpp.exe" or "KoboldCpp" or
95-
"llama-server" or "llama-cli" or
96-
"Windsurf" or "windsurf" or "windsurf.exe" or
97-
"Windsurf Helper" or "Windsurf Helper (Plugin)" or
98-
"deno" or "deno.exe" or
99-
"npx" or "pnpm" or "yarn" or "bunx"
100-
) and
101-
(
102-
(host.os.type : "macos" and destination.domain : * and not destination.domain : (
103-
*.openai.com or "openai.com" or *.anthropic.com or "anthropic.com" or
104-
*.cursor.sh or "cursor.sh" or *.cursor.com or "cursor.com" or
105-
*.ollama.com or "ollama.com" or *.ollama.ai or "ollama.ai" or
106-
*.github.com or "github.com" or *.githubusercontent.com or
107-
*.lmstudio.ai or "lmstudio.ai" or *.gpt4all.io or "gpt4all.io" or
108-
*.huggingface.co or "huggingface.co" or *.hf.co or "hf.co" or
109-
*.cloudflare.com or *.cloudflare-dns.com or *.cdn.cloudflare.net or
110-
*.cloudflarestorage.com or *.r2.cloudflarestorage.com or *.akamaized.net or
111-
*.googleapis.com or *.google.com or *.microsoft.com or *.azure.com or
112-
*.msedge.net or "aka.ms" or *.aka.ms or
113-
*.npmjs.org or *.npmjs.com or *.yarnpkg.com or *.pypi.org or
114-
*.elastic.co or *.elastic-cloud.com or "localhost" or
115-
*.sentry.io or *.segment.io or *.amplitude.com or *.mixpanel.com or
116-
*.codeium.com or *.windsurf.ai or *.x.ai or *.grok.x.ai or
117-
*.gemini.google.com or *.generativelanguage.googleapis.com or
118-
*.jan.ai or *.aws.amazon.com or *.amazonaws.com or
119-
*.exp-tas.com or *.gitkraken.com or *.gitkraken.dev or *.datadoghq.com or
120-
*.visualstudio.com or *.launchdarkly.com or *.githubcopilot.com or
121-
*.vsassets.io or *.vscode-cdn.net or
122-
*.intercom.io or *.honeycomb.io or *.atlassian.com or "atlassian.com"
123-
))
124-
or
125-
(host.os.type : "windows" and dns.question.name : * and not dns.question.name : (
126-
*.openai.com or "openai.com" or *.anthropic.com or "anthropic.com" or
127-
*.cursor.sh or "cursor.sh" or *.cursor.com or "cursor.com" or
128-
*.ollama.com or "ollama.com" or *.ollama.ai or "ollama.ai" or
129-
*.github.com or "github.com" or *.githubusercontent.com or
130-
*.lmstudio.ai or "lmstudio.ai" or *.gpt4all.io or "gpt4all.io" or
131-
*.huggingface.co or "huggingface.co" or *.hf.co or "hf.co" or
132-
*.cloudflare.com or *.cloudflare-dns.com or *.cdn.cloudflare.net or
133-
*.cloudflarestorage.com or *.r2.cloudflarestorage.com or *.akamaized.net or
134-
*.googleapis.com or *.google.com or *.microsoft.com or *.azure.com or
135-
*.msedge.net or "aka.ms" or *.aka.ms or
136-
*.npmjs.org or *.npmjs.com or *.yarnpkg.com or *.pypi.org or
137-
*.elastic.co or *.elastic-cloud.com or "localhost" or
138-
*.sentry.io or *.segment.io or *.amplitude.com or *.mixpanel.com or
139-
*.codeium.com or *.windsurf.ai or *.x.ai or *.grok.x.ai or
140-
*.gemini.google.com or *.generativelanguage.googleapis.com or
141-
*.jan.ai or *.aws.amazon.com or *.amazonaws.com or
142-
*.exp-tas.com or *.gitkraken.com or *.gitkraken.dev or *.datadoghq.com or
143-
*.visualstudio.com or *.launchdarkly.com or *.githubcopilot.com or
144-
*.vsassets.io or *.vscode-cdn.net or
145-
*.intercom.io or *.honeycomb.io or *.atlassian.com or "atlassian.com"
77+
event.category:(dns or network) and
78+
process.name:(
79+
Claude or "Claude Helper" or "Claude Helper (Plugin)" or Copilot or Cursor or
80+
"Cursor Helper" or "Cursor Helper (Plugin)" or GPT4All or Jan or "Jan Helper" or
81+
KoboldCpp or "LM Studio" or Ollama or Windsurf or "Windsurf Helper" or
82+
"Windsurf Helper (Plugin)" or bunx or claude or claude.exe or codex or codex.exe or
83+
copilot or copilot.exe or cursor or cursor.exe or deno or deno.exe or gemini-cli or
84+
gemini-cli.exe or genaiscript or genaiscript.exe or gpt4all or gpt4all.exe or grok or
85+
grok.exe or jan or jan.exe or koboldcpp or koboldcpp.exe or llama-cli or llama-server or
86+
lmstudio or lmstudio.exe or npx or ollama or ollama.exe or oobabooga.exe or pnpm or
87+
qwen or qwen.exe or text-generation-webui.exe or textgen or textgen.exe or windsurf or
88+
windsurf.exe or yarn
89+
) and (
90+
host.os.type:macos and destination.domain:(* and not (
91+
aka.ms or anthropic.com or atlassian.com or cursor.com or cursor.sh or github.com or
92+
gpt4all.io or hf.co or huggingface.co or lmstudio.ai or localhost or ollama.ai or
93+
ollama.com or openai.com or *.aka.ms or *.akamaized.net or *.amazonaws.com or
94+
*.amplitude.com or *.anthropic.com or *.atlassian.com or *.aws.amazon.com or
95+
*.azure.com or *.cdn.cloudflare.net or *.cloudflare-dns.com or *.cloudflare.com or
96+
*.cloudflarestorage.com or *.codeium.com or *.cursor.com or *.cursor.sh or
97+
*.datadoghq.com or *.elastic-cloud.com or *.elastic.co or *.exp-tas.com or
98+
*.gemini.google.com or *.generativelanguage.googleapis.com or *.github.com or
99+
*.githubcopilot.com or *.githubusercontent.com or *.gitkraken.com or *.gitkraken.dev or
100+
*.google.com or *.googleapis.com or *.gpt4all.io or *.grok.x.ai or *.hf.co or
101+
*.honeycomb.io or *.huggingface.co or *.intercom.io or *.jan.ai or *.launchdarkly.com or
102+
*.lmstudio.ai or *.microsoft.com or *.mixpanel.com or *.msedge.net or *.npmjs.com or
103+
*.npmjs.org or *.ollama.ai or *.ollama.com or *.openai.com or *.pypi.org or
104+
*.r2.cloudflarestorage.com or *.segment.io or *.sentry.io or *.visualstudio.com or
105+
*.vsassets.io or *.vscode-cdn.net or *.windsurf.ai or *.x.ai or *.yarnpkg.com
106+
)) or
107+
host.os.type:windows and dns.question.name:(* and not (
108+
aka.ms or anthropic.com or atlassian.com or cursor.com or cursor.sh or github.com or
109+
gpt4all.io or hf.co or huggingface.co or lmstudio.ai or localhost or ollama.ai or
110+
ollama.com or openai.com or *.aka.ms or *.akamaized.net or *.amazonaws.com or
111+
*.amplitude.com or *.anthropic.com or *.atlassian.com or *.aws.amazon.com or
112+
*.azure.com or *.cdn.cloudflare.net or *.cloudflare-dns.com or *.cloudflare.com or
113+
*.cloudflarestorage.com or *.codeium.com or *.cursor.com or *.cursor.sh or
114+
*.datadoghq.com or *.elastic-cloud.com or *.elastic.co or *.exp-tas.com or
115+
*.gemini.google.com or *.generativelanguage.googleapis.com or *.github.com or
116+
*.githubcopilot.com or *.githubusercontent.com or *.gitkraken.com or *.gitkraken.dev or
117+
*.google.com or *.googleapis.com or *.gpt4all.io or *.grok.x.ai or *.hf.co or
118+
*.honeycomb.io or *.huggingface.co or *.intercom.io or *.jan.ai or *.launchdarkly.com or
119+
*.lmstudio.ai or *.microsoft.com or *.mixpanel.com or *.msedge.net or *.npmjs.com or
120+
*.npmjs.org or *.ollama.ai or *.ollama.com or *.openai.com or *.pypi.org or
121+
*.r2.cloudflarestorage.com or *.segment.io or *.sentry.io or *.visualstudio.com or
122+
*.vsassets.io or *.vscode-cdn.net or *.windsurf.ai or *.x.ai or *.yarnpkg.com
146123
))
147124
)
148125
'''
149126

127+
150128
[[rule.threat]]
151129
framework = "MITRE ATT&CK"
130+
[[rule.threat.technique]]
131+
id = "T1071"
132+
name = "Application Layer Protocol"
133+
reference = "https://attack.mitre.org/techniques/T1071/"
134+
[[rule.threat.technique.subtechnique]]
135+
id = "T1071.001"
136+
name = "Web Protocols"
137+
reference = "https://attack.mitre.org/techniques/T1071/001/"
152138

153-
[rule.threat.tactic]
154-
name = "Command and Control"
155-
id = "TA0011"
156-
reference = "https://attack.mitre.org/tactics/TA0011/"
157139

158-
[[rule.threat.technique]]
159-
name = "Application Layer Protocol"
160-
id = "T1071"
161-
reference = "https://attack.mitre.org/techniques/T1071/"
162-
163-
[[rule.threat.technique.subtechnique]]
164-
name = "Web Protocols"
165-
id = "T1071.001"
166-
reference = "https://attack.mitre.org/techniques/T1071/001/"
167140

141+
[rule.threat.tactic]
142+
id = "TA0011"
143+
name = "Command and Control"
144+
reference = "https://attack.mitre.org/tactics/TA0011/"
168145
[[rule.threat]]
169146
framework = "MITRE ATLAS"
147+
[[rule.threat.technique]]
148+
id = "AML.T0086"
149+
name = "Exfiltration via AI Agent Tool Invocation"
150+
reference = "https://atlas.mitre.org/techniques/AML.T0086/"
170151

171-
[rule.threat.tactic]
172-
name = "Exfiltration"
173-
id = "AML.TA0010"
174-
reference = "https://atlas.mitre.org/tactics/AML.TA0010/"
175152

176-
[[rule.threat.technique]]
177-
name = "Exfiltration via AI Agent Tool Invocation"
178-
id = "AML.T0086"
179-
reference = "https://atlas.mitre.org/techniques/AML.T0086/"
153+
[rule.threat.tactic]
154+
id = "AML.TA0010"
155+
name = "Exfiltration"
156+
reference = "https://atlas.mitre.org/tactics/AML.TA0010/"
180157

181158
[rule.new_terms]
182159
field = "new_terms_fields"
@@ -185,3 +162,4 @@ value = ["process.name", "destination.domain", "dns.question.name"]
185162
field = "history_window_start"
186163
value = "now-7d"
187164

165+

0 commit comments

Comments
 (0)