Product
medium
threat
Detection of Generative AI Processes Connecting to Unusual Domains
1 rule 1 TTPAdversaries may compromise macOS-based Generative AI (GenAI) tools through prompt injection, malicious Model Context Protocol (MCP) servers, or poisoned plugins to establish Command and Control (C2) channels or exfiltrate sensitive data by causing them to connect to unusual domains.
exploited
Claude +8
command-and-control
genai
macos
data-exfiltration
1r
1t
medium
advisory
GenAI Process Connection to Unusual Domain on macOS
2 rules 1 TTPThis rule detects GenAI tools on macOS connecting to unusual domains, potentially indicating command and control activity, data exfiltration, or malicious payload retrieval following compromise via prompt injection, malicious MCP servers, or poisoned plugins.
Copilot +22
genai
command and control
macos
network connection
2r
1t