Detection of Malicious Use of LLM Endpoints for Command and Control

Adversaries are increasingly leveraging the capabilities of Large Language Models (LLMs) to dynamically perform malicious actions on compromised systems. This threat involves malware or post-exploitation scripts that utilize legitimate LLM APIs as a proxy for command and control (C2) or to execute logic within the affected system. This behavior is characterized by network connections to a broad range of AI and ML infrastructure providers, including OpenAI, Anthropic, Mistral, and various specialized inference services, initiated by unsigned binaries or common Windows/macOS scripting utilities such as PowerShell, curl, or WScript. Because these connections mimic legitimate traffic to AI services, detection must focus on the process context, specifically identifying unauthorized or unsigned code initiating the requests.

Attack Chain

1. Initial access is established through standard means, such as spearphishing or exploiting a public-facing service.
2. The attacker drops an unsigned or obfuscated payload (e.g., PowerShell script or malicious executable) into a non-standard directory like /tmp/ or \Users\Public.
3. The malicious process executes and gathers system information or target data.
4. The process initiates an HTTPS connection to an LLM provider's API endpoint (e.g., api.openai.com).
5. The attacker sends instructions or prompts to the LLM API to generate code or malicious commands tailored to the system state.
6. The response from the LLM is parsed and executed locally by the malicious process.
7. The process performs further actions, such as exfiltrating data or establishing persistent access, based on the AI-generated logic.

Impact

Successful exploitation allows attackers to bypass traditional static signature-based defenses by using dynamically generated, AI-assisted malicious logic. This increases the complexity of incident response and attribution, as the malicious commands originate from a legitimate, trusted API service. Affected organizations risk unauthorized data exfiltration, automated system exploitation, and stealthy persistence, as the C2 channel is obscured by traffic destined for reputable AI infrastructure.

Recommendation

1. Deploy the provided EQL-based detection rules across all endpoints to monitor for suspicious processes communicating with known LLM API domains.
2. Implement strict network segmentation and egress filtering to prevent unauthorized processes from accessing cloud-based AI service APIs.
3. Perform a historical search on network proxy and DNS logs for connections to the listed LLM endpoints originating from high-risk or non-standard process paths.
4. Review and harden systems to prevent the execution of unsigned binaries or unauthorized scripting tools in sensitive environments.
5. If an alert triggers, investigate the process tree and parent process to confirm whether the connection originates from a legitimate user-installed application or a malicious actor.