Skip to content
Threat Feed

Tag

Command_and_control

3 briefs RSS
medium advisory

Suspicious Processes Connecting to Large Language Model Endpoints

This rule detects DNS queries to known Large Language Model (LLM) domains by unsigned binaries or common Windows scripting utilities, indicating potential command and control activity leveraging LLMs for dynamic actions on compromised systems.

command_and_control malware llm
3r 1t
low advisory

Kubectl Network Configuration Modification

This rule detects potential kubectl network configuration modification activity by monitoring for process events where the kubectl command is executed with arguments that suggest an attempt to modify network configurations in Kubernetes, potentially leading to unauthorized access or data exfiltration.

kubectl kubernetes command_and_control network_configuration linux macos
3r 2t
high advisory

Kubernetes Pod Exec Potential Reverse Shell Activity Detected

This rule flags potential reverse shell activity via kubectl exec commands in Kubernetes pods by detecting specific shell and socket idioms within URL-decoded command payloads in Kubernetes audit logs, indicating post-exploitation interactive access and command-and-control.

Kubernetes reverse_shell execution command_and_control
3r 2t