Tag

Llm

2 briefs RSS

Suspicious Processes Connecting to Large Language Model Endpoints

This rule detects DNS queries to known Large Language Model (LLM) domains by unsigned binaries or common Windows scripting utilities, indicating potential command and control activity leveraging LLMs for dynamic actions on compromised systems.

command_and_control malware llm

3r 1t 1w ago

critical advisory

LiteLLM Package Compromised with Credential-Stealing Code via Trivy

2 rules 1 TTP

The LiteLLM package was compromised and infected with credential-stealing code through a supply chain attack leveraging the Trivy vulnerability scanner.

supply-chain credential-theft llm trivy

2r 1t Mar 25, 2026