Skip to content
Threat Feed
Subscribe

Product

Textgen

2 briefs RSS
medium advisory

GenAI Process Connection to Unusual Domain on macOS

This rule detects GenAI tools on macOS connecting to unusual domains, potentially indicating command and control activity, data exfiltration, or malicious payload retrieval following compromise via prompt injection, malicious MCP servers, or poisoned plugins.

Copilot +22 genai command and control macos network connection
2r 1t
medium advisory

GenAI Process Performing Encoding/Chunking Prior to Network Activity

This rule detects GenAI processes performing encoding or chunking (base64, gzip, tar, zip) followed by outbound network activity, indicating data preparation for exfiltration.

Ollama +2 genai exfiltration defense-evasion
2r 4t