Skip to content

Commit ddd34e9

Browse files
Mika AyensonMika Ayenson
Mika Ayenson
authored and
Mika Ayenson
committed
cleanup
1 parent 288178b commit ddd34e9

6 files changed

+372
-264
lines changed

‎rules/cross-platform/collection_genai_process_sensitive_file_access.toml‎

Lines changed: 119 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,16 @@
11
[metadata]
2-
creation_date = "2025/11/21"
2+
creation_date = "2025/12/04"
33
integration = ["endpoint"]
44
maturity = "production"
5-
updated_date = "2025/11/21"
5+
updated_date = "2025/12/04"
66

77
[rule]
88
author = ["Elastic"]
99
description = """
10-
Detects when a recognized Generative AI (GenAI) tool or agent framework accesses monitored sensitive files. Legitimate
11-
GenAI development tools typically work within project folders or user-sanctioned workspaces, but access to credential
12-
stores (e.g., .aws/credentials, .ssh/ keys, browser password databases), key libraries, browser profile data,
13-
cloud-access tokens, or private SSH/key directories strongly suggests credential harvesting or data-collection activity.
14-
In MCP/agent-enabled workflows (e.g., via AutoGPT, LangChain, or other GenAI frameworks), this behavior aligns with the
15-
"private data access" threat model for AI agents where an agent with access to private data becomes an exfiltration
16-
risk. Attackers may leverage GenAI tools to systematically search for and access sensitive files, then use the AI to
17-
process and summarize the data before exfiltration to reduce payload size and evade detection. Because these GenAI
18-
processes are not ordinarily expected to touch protected file stores, this behavior is high signal for potential
19-
malicious use and should be investigated immediately.
10+
Detects when GenAI tools access sensitive files such as cloud credentials, SSH keys, browser password databases, or
11+
shell configurations. Attackers leverage GenAI agents to systematically locate and exfiltrate credentials, API keys,
12+
and tokens. Access to credential stores (.aws/credentials, .ssh/id_*) suggests harvesting, while writes to shell
13+
configs (.bashrc, .zshrc) indicate persistence attempts.
2014
"""
2115
from = "now-9m"
2216
index = ["logs-endpoint.events.*"]
@@ -27,7 +21,7 @@ note = """## Triage and analysis
2721
2822
### Investigating GenAI Process Accessing Sensitive Files
2923
30-
Generative AI tools are increasingly used in development environments, but they typically only access files within active project folders. When a GenAI process accesses sensitive files (credentials, keys, browser data, etc.) that are monitored by Elastic Defend, it strongly indicates suspicious credential harvesting or data collection activity. Attackers use GenAI to process and summarize sensitive data before extraction to reduce payload size and evade detection.
24+
This rule detects GenAI tools accessing credential files, SSH keys, browser data, or shell configurations. While GenAI tools legitimately access project files, access to sensitive credential stores is unusual and warrants investigation.
3125
3226
### Possible investigation steps
3327
@@ -57,7 +51,8 @@ references = [
5751
"https://atlas.mitre.org/techniques/AML.T0085.001",
5852
"https://atlas.mitre.org/techniques/AML.T0055",
5953
"https://glama.ai/blog/2025-11-11-the-lethal-trifecta-securing-model-context-protocol-against-data-flow-attacks",
60-
"https://www.elastic.co/security-labs/elastic-advances-llm-security"
54+
"https://www.elastic.co/security-labs/elastic-advances-llm-security",
55+
"https://specterops.io/blog/2025/11/21/an-evening-with-claude-code"
6156
]
6257
risk_score = 73
6358
rule_id = "c0136397-f82a-45e5-9b9f-a3651d77e21a"
@@ -80,9 +75,116 @@ tags = [
8075
timestamp_override = "event.ingested"
8176
type = "eql"
8277
query = '''
83-
file where event.action == "open" and event.outcome == "success" and
84-
process.name in ("ollama.exe", "ollama", "textgen.exe", "textgen", "lmstudio.exe", "lmstudio", "claude.exe", "claude", "cursor.exe", "cursor", "copilot.exe", "copilot") and
85-
not (process.name in ("claude.exe", "claude") and file.path like "?:\\Users\\*\\AppData\\Roaming\\Claude\\Local State")
78+
file where event.action in ("open", "creation", "modification") and event.outcome == "success" and
79+
80+
// GenAI process or child of GenAI process
81+
(
82+
process.name in (
83+
"ollama.exe", "ollama", "Ollama",
84+
"textgen.exe", "textgen", "text-generation-webui.exe", "oobabooga.exe",
85+
"lmstudio.exe", "lmstudio", "LM Studio",
86+
"claude.exe", "claude", "Claude",
87+
"cursor.exe", "cursor", "Cursor",
88+
"copilot.exe", "copilot", "Copilot",
89+
"codex.exe", "codex",
90+
"Jan", "jan.exe", "jan",
91+
"gpt4all.exe", "gpt4all", "GPT4All",
92+
"gemini-cli.exe", "gemini-cli",
93+
"genaiscript.exe", "genaiscript",
94+
"grok.exe", "grok",
95+
"qwen.exe", "qwen",
96+
"koboldcpp.exe", "koboldcpp", "KoboldCpp",
97+
"llama-server", "llama-cli"
98+
) or
99+
process.parent.name in (
100+
"ollama.exe", "ollama", "Ollama",
101+
"textgen.exe", "textgen", "text-generation-webui.exe", "oobabooga.exe",
102+
"lmstudio.exe", "lmstudio", "LM Studio",
103+
"claude.exe", "claude", "Claude",
104+
"cursor.exe", "cursor", "Cursor", "Cursor Helper", "Cursor Helper (Plugin)",
105+
"copilot.exe", "copilot", "Copilot",
106+
"codex.exe", "codex",
107+
"Jan", "jan.exe", "jan", "Jan Helper",
108+
"gpt4all.exe", "gpt4all", "GPT4All",
109+
"gemini-cli.exe", "gemini-cli",
110+
"genaiscript.exe", "genaiscript",
111+
"grok.exe", "grok",
112+
"qwen.exe", "qwen",
113+
"koboldcpp.exe", "koboldcpp", "KoboldCpp",
114+
"llama-server", "llama-cli"
115+
)
116+
) and
117+
118+
// Sensitive file paths
119+
(
120+
// Cloud credentials
121+
file.path like~ ("*/.aws/credentials*", "*/.aws/config*", "*/.azure/*", "*/.config/gcloud/*") or
122+
// SSH keys and config
123+
file.path like~ ("*/.ssh/id_*", "*/.ssh/config*", "*/.ssh/known_hosts*", "*/.ssh/authorized_keys*") or
124+
// Shell configs (persistence)
125+
file.path like~ ("*/.bashrc*", "*/.bash_profile*", "*/.zshrc*", "*/.zshenv*", "*/.zprofile*", "*/.profile*", "*/.bash_logout*") or
126+
// Browser credentials
127+
file.path like~ ("*/Login Data*", "*/Cookies*", "*/Web Data*", "*\\Login Data*", "*\\Cookies*", "*\\Web Data*") or
128+
// macOS Keychain
129+
file.path like~ ("*/Keychain/*.keychain*", "*/keychains/*.keychain-db*") or
130+
// Git credentials
131+
file.path like~ ("*/.git-credentials*", "*/.netrc*") or
132+
// GPG/PGP keys
133+
file.path like~ ("*/.gnupg/*", "*/.pgp/*") or
134+
// Docker credentials
135+
file.path like~ ("*/.docker/config.json*") or
136+
// Kubernetes config
137+
file.path like~ ("*/.kube/config*") or
138+
// Package manager tokens
139+
file.path like~ ("*/.npmrc*", "*/.yarnrc*") or
140+
// Python credentials
141+
file.path like~ ("*/.pypirc*", "*/pip.conf*") or
142+
// GitHub CLI config
143+
file.path like~ ("*/.config/gh/*", "*/.config/hub*") or
144+
// Password managers
145+
file.path like~ ("*1Password*", "*Bitwarden*", "*KeePass*", "*LastPass*") or
146+
// Windows credentials
147+
file.path like~ ("*\\AppData\\*\\Credentials\\*", "*\\AppData\\*\\Vault\\*")
148+
) and
149+
150+
// Exclusions
151+
not (
152+
// Claude accessing own credentials
153+
(process.name == "security" and
154+
process.parent.name in ("claude", "claude.exe", "Claude", "node", "node.exe") and
155+
process.command_line like~ ("*Claude Code*", "*Claude Code-credentials*", "*claude-code*")) or
156+
157+
// GenAI tools accessing own config
158+
(file.path like~ ("*Claude*", "*Cursor*", "*claude-code*", "*/anthropic/*",
159+
"*/.ollama/*", "*Ollama*", "*codex*", "*Jan*", "*/jan/*",
160+
"*Copilot*", "*LM Studio*", "*gpt4all*") and
161+
process.parent.name in ("claude", "claude.exe", "Claude", "cursor", "cursor.exe",
162+
"Cursor", "ollama", "ollama.exe", "Ollama", "codex", "codex.exe",
163+
"Jan", "jan", "Copilot", "LM Studio", "gpt4all")) or
164+
165+
// IDE extensions accessing state files
166+
(file.path like~ ("*/.vscode/*", "*/.cursor/*") and
167+
process.executable like~ ("*/.vscode/extensions/*", "*/.cursor/extensions/*")) or
168+
169+
// Shell config sourcing (read-only)
170+
(event.action == "open" and
171+
process.name in ("zsh", "bash", "sh", "fish") and
172+
process.parent.name in ("claude", "claude.exe", "cursor", "cursor.exe", "codex", "codex.exe",
173+
"Jan", "jan", "Ollama", "ollama", "LM Studio") and
174+
file.path like~ ("*/.zshrc", "*/.bashrc", "*/.bash_profile", "*/.profile")) or
175+
176+
// Code search tools
177+
(process.name in ("rg", "ripgrep") or process.command_line like~ "*--ripgrep*") or
178+
179+
// Git config (not credentials)
180+
(process.name == "git" and
181+
file.path like~ ("*/.gitconfig", "*/.git/config", "*/.git/HEAD") and
182+
not file.path like~ "*/.git-credentials*") or
183+
184+
// System info commands
185+
process.name in ("uname", "sw_vers", "which", "hostname", "id", "whoami",
186+
"ioreg", "scutil", "defaults", "env", "getconf", "locale")
187+
)
86188
'''
87189

88190
[[rule.threat]]

‎rules/cross-platform/command_and_control_genai_process_suspicious_tld_connection.toml‎

Lines changed: 27 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,16 @@
11
[metadata]
2-
creation_date = "2025/11/20"
2+
creation_date = "2025/12/04"
33
integration = ["endpoint"]
44
maturity = "production"
5-
updated_date = "2025/11/20"
5+
updated_date = "2025/12/04"
66

77
[rule]
88
author = ["Elastic"]
99
description = """
10-
Detects when Generative AI (GenAI) tools and frameworks establish network connections to suspicious top-level domains (TLDs)
11-
commonly abused by malware for command and control (C2) operations. GenAI tools connecting to suspicious TLDs (e.g., .top, .xyz,
12-
.ml, .cf, .gq, .onion) may indicate compromised tools, malicious GenAI agents, or adversaries using GenAI tools to establish
13-
C2 communications. Attackers may leverage GenAI tools to generate and execute code that connects to malicious infrastructure,
14-
or compromise legitimate GenAI tools to use them as a conduit for C2 traffic. This rule focuses on native GenAI executables
15-
(e.g., Ollama, LM Studio, Claude Desktop, Cursor) and package managers (npx, pnpm, yarn, bunx) commonly used with GenAI frameworks.
16-
The use of suspicious TLDs is a strong indicator of malicious intent, as legitimate GenAI services typically use well-established
17-
domains.
10+
Detects when GenAI tools connect to domains using suspicious TLDs commonly abused for malware C2 infrastructure.
11+
TLDs like .top, .xyz, .ml, .cf, .onion are frequently used in phishing and malware campaigns. Legitimate GenAI
12+
services use well-established domains (.com, .ai, .io), so connections to suspicious TLDs may indicate compromised
13+
tools, malicious plugins, or AI-generated code connecting to attacker infrastructure.
1814
"""
1915
from = "now-9m"
2016
index = ["logs-endpoint.events.*"]
@@ -25,7 +21,7 @@ note = """## Triage and analysis
2521
2622
### Investigating GenAI Process Connection to Suspicious Top Level Domain
2723
28-
GenAI tools connecting to suspicious TLDs is highly suspicious and may indicate a compromised GenAI tool being used for C2 communications, a malicious GenAI agent establishing command and control, or an adversary using GenAI tools to evade detection by using suspicious domains.
24+
This rule detects GenAI tools connecting to domains with TLDs commonly abused by malware. The suspicious TLD filter makes this a high-signal rule with low expected volume.
2925
3026
### Possible investigation steps
3127
@@ -65,7 +61,6 @@ rule_id = "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
6561
severity = "high"
6662
tags = [
6763
"Domain: Endpoint",
68-
"OS: Linux",
6964
"OS: macOS",
7065
"OS: Windows",
7166
"Use Case: Threat Detection",
@@ -79,32 +74,40 @@ timestamp_override = "event.ingested"
7974
type = "eql"
8075
query = '''
8176
network where host.os.type in ("macos", "windows") and
82-
// Native GenAI related executables
77+
78+
// GenAI processes
8379
process.name in (
84-
"ollama.exe", "ollama",
85-
"textgen.exe", "textgen",
86-
"lmstudio.exe", "lmstudio",
87-
"claude.exe", "claude",
88-
"cursor.exe", "cursor",
89-
"copilot.exe", "copilot",
80+
"ollama.exe", "ollama", "Ollama",
81+
"textgen.exe", "textgen", "text-generation-webui.exe", "oobabooga.exe",
82+
"lmstudio.exe", "lmstudio", "LM Studio",
83+
"claude.exe", "claude", "Claude",
84+
"cursor.exe", "cursor", "Cursor",
85+
"copilot.exe", "copilot", "Copilot",
86+
"codex.exe", "codex",
87+
"Jan", "jan.exe", "jan",
88+
"gpt4all.exe", "gpt4all", "GPT4All",
9089
"gemini-cli.exe", "gemini-cli",
9190
"genaiscript.exe", "genaiscript",
9291
"grok.exe", "grok",
9392
"qwen.exe", "qwen",
93+
"koboldcpp.exe", "koboldcpp", "KoboldCpp",
94+
"llama-server", "llama-cli",
9495
"deno.exe", "deno",
9596
"npx", "pnpm", "yarn", "bunx"
9697
) and
98+
99+
// Suspicious TLDs
97100
(
98-
// Windows DNS events - supported by Elastic Defend, Crowdstrike, and SentinelOne
101+
// Windows DNS events
99102
(host.os.type == "windows" and dns.question.name != null and
100103
dns.question.name like~ ("*.top", "*.buzz", "*.xyz", "*.rest", "*.ml", "*.cf", "*.gq", "*.ga", "*.onion", "*.monster", "*.cyou", "*.quest", "*.cc", "*.bar", "*.cfd", "*.click", "*.cam",
101-
"*.surf", "*.tk", "*.shop", "*.club", "*.icu", "*.pw", "*.ws", "*.online", "*.fun", "*.life", "*.boats", "*.store", "*.hair", "*.skin", "*.motorcycles", "*.christmas", "*.lol", "*.makeup",
102-
"*.mom", "*.rest", "*.monster", "*.bond", "*.beauty", "*.biz", "*.live")) or
103-
// macOS network events - Elastic Defend only
104+
"*.surf", "*.tk", "*.shop", "*.club", "*.icu", "*.pw", "*.ws", "*.online", "*.fun", "*.life", "*.boats", "*.store", "*.hair", "*.skin", "*.motorcycles", "*.christmas", "*.lol", "*.makeup",
105+
"*.mom", "*.bond", "*.beauty", "*.biz", "*.live")) or
106+
// macOS network events
104107
(host.os.type == "macos" and destination.domain != null and
105108
destination.domain like~ ("*.top", "*.buzz", "*.xyz", "*.rest", "*.ml", "*.cf", "*.gq", "*.ga", "*.onion", "*.monster", "*.cyou", "*.quest", "*.cc", "*.bar", "*.cfd", "*.click", "*.cam",
106109
"*.surf", "*.tk", "*.shop", "*.club", "*.icu", "*.pw", "*.ws", "*.online", "*.fun", "*.life", "*.boats", "*.store", "*.hair", "*.skin", "*.motorcycles", "*.christmas", "*.lol", "*.makeup",
107-
"*.mom", "*.rest", "*.monster", "*.bond", "*.beauty", "*.biz", "*.live"))
110+
"*.mom", "*.bond", "*.beauty", "*.biz", "*.live"))
108111
)
109112
'''
110113

0 commit comments

Comments
 (0)