Skip to content
Threat Feed
Subscribe

Tag

Genai

10 briefs RSS
medium advisory

Detecting Data Exfiltration Preparation via GenAI Processes

Detection of unauthorized GenAI workflows utilizing local compression or encoding utilities followed by outbound network communication, indicating potential staging and exfiltration of sensitive data.

exfiltration defense-evasion genai endpoint-security
1r 3t
medium advisory

Detection of GenAI-Driven Autonomous Malware Compilation

Adversaries are leveraging Generative AI tools and agent frameworks to autonomously generate and compile malicious executables or droppers directly on compromised endpoints.

defense-evasion execution genai malware-development
1r 2t
medium advisory

Detection of Suspicious TLD Connections by GenAI and CLI Tools

Detection rule monitors GenAI tools and CLI package managers for network connections to high-risk Top-Level Domains frequently utilized by threat actors for C2 infrastructure.

command-and-control genai network-security
1r 1t
medium threat

Detection of Generative AI Processes Connecting to Unusual Domains

Adversaries may compromise macOS-based Generative AI (GenAI) tools through prompt injection, malicious Model Context Protocol (MCP) servers, or poisoned plugins to establish Command and Control (C2) channels or exfiltrate sensitive data by causing them to connect to unusual domains.

exploited Claude +8 command-and-control genai macos data-exfiltration
1r 1t
high advisory

GenAI Tools Accessing Sensitive Files for Credential Access and Persistence

This threat brief details the detection of GenAI tools accessing sensitive files containing credentials, SSH keys, browser data, and shell configurations, indicating potential credential harvesting and persistence attempts by attackers leveraging GenAI agents.

Elastic Endpoint Security genai credential-access persistence collection
2r 4t
high advisory

GenAI Tool Access to Sensitive Files for Credential Harvesting and Persistence

This brief outlines the threat of attackers leveraging GenAI tools to access sensitive files containing credentials, SSH keys, browser data, and shell configurations for credential access and persistence.

credential-access genai file-access persistence
2r 4t
critical advisory

Elastic Defend Alert from GenAI Utility or Descendant

This rule detects Elastic Defend alerts originating from or directly related to GenAI coding utilities, indicating potential prompt injection, malicious skills, or supply-chain compromise.

Cursor +11 genai supply-chain elastic-defend
2r 1t
medium advisory

GenAI Process Connection to Unusual Domain on macOS

This rule detects GenAI tools on macOS connecting to unusual domains, potentially indicating command and control activity, data exfiltration, or malicious payload retrieval following compromise via prompt injection, malicious MCP servers, or poisoned plugins.

Copilot +22 genai command and control macos network connection
2r 1t
medium advisory

GenAI Process Performing Encoding/Chunking Prior to Network Activity

This rule detects GenAI processes performing encoding or chunking (base64, gzip, tar, zip) followed by outbound network activity, indicating data preparation for exfiltration.

Ollama +2 genai exfiltration defense-evasion
2r 4t
medium advisory

Unusual Modification of GenAI Tool Configuration File

This rule detects unusual modifications to GenAI tool configuration files, potentially indicating an attacker injecting malicious MCP server configurations to hijack AI agents for persistence, command and control, or data exfiltration.

Claude +3 genai configuration-modification defense-evasion
3r 4t