lamehug

Author: t-contreras

detections/endpoint/windows_ai_platform_dns_query.yml

@@ -8,13 +8,13 @@ type: Anomaly
 description: The following analytic detects DNS queries initiated by the Windows AI Platform to domains associated with Hugging Face, a popular provider of machine learning models and services. Monitoring for such DNS requests is important because it can reveal when systems are reaching out to external AI platforms, which may indicate the use of third-party AI resources or the transfer of sensitive data outside the organization’s environment. Detecting these queries helps organizations enforce data governance policies, prevent unapproved use of external AI services, and maintain visibility into potential data exfiltration risks. Proactive monitoring ensures better control over AI model usage and organizational data flows.
 data_source:
 - Sysmon EventID 22
-search: '`sysmon` EventCode=22 process_name="python.exe" QueryName= "router.huggingface.co"
+search: '`sysmon` EventCode=22 process_name IN ("python.exe", "cmd.exe", "rundll32.exe","powershell.exe", "pwsh.exe") QueryName= "router.huggingface.co"
   | rename dvc as dest
-  | stats count min(_time) as firstTime max(_time) as lastTime
-  by answer answer_count dest process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id
+  | stats count min(_time) as firstTime max(_time) as lastTime 
+  by answer answer_count dvc process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id
   vendor_product QueryName QueryResults QueryStatus 
   | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+  | `security_content_ctime(lastTime)`
   | `windows_ai_platform_dns_query_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name and eventcode = 22 dnsquery executions from your endpoints.