https://feed.craftedsignal.io/tags/network-connection/Trending threats, MITRE ATT&CK coverage, and detection metadata — refreshed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 02 May 2024 14:22:30 +0000https://feed.craftedsignal.io/briefs/2024-05-genai-unusual-domain/Thu, 02 May 2024 14:22:30 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-05-genai-unusual-domain/This rule detects GenAI tools on macOS connecting to unusual domains, potentially indicating command and control activity, data exfiltration, or malicious payload retrieval following compromise via prompt injection, malicious MCP servers, or poisoned plugins.This threat brief addresses the risk of GenAI tools on macOS connecting to unusual domains, which may indicate a compromised state. Attackers can exploit GenAI tools through prompt injection, malicious MCP (Model Context Protocol) servers, or poisoned plugins to establish command-and-control (C2) channels or exfiltrate sensitive data. Given the network access capabilities of AI agents, adversaries may manipulate them to beacon to external servers, download malicious payloads, or transmit harvested credentials and documents. The Elastic detection rule 9050506c-df6d-4bdf-bc82-fcad0ef1e8c1 focuses on identifying such anomalous network connections originating from a predefined list of GenAI processes, excluding known legitimate domains. The rule has been actively maintained since its creation on December 4, 2025, with its latest update on April 29, 2026.

Attack Chain

1. Adversary compromises a GenAI tool on a macOS system through prompt injection, malicious MCP servers, or poisoned plugins.
2. The compromised GenAI tool is configured to connect to an attacker-controlled domain for C2.
3. The GenAI process initiates a network connection attempt to the unusual domain using standard web protocols (HTTP/HTTPS).
4. The macOS system’s network stack resolves the attacker’s domain to its corresponding IP address.
5. The GenAI process sends data to the attacker-controlled domain, potentially including sensitive information.
6. The attacker uses the C2 channel to send commands to the compromised GenAI tool.
7. The GenAI tool executes the commands, potentially leading to further compromise or data exfiltration.

Impact

Compromised GenAI tools can lead to data exfiltration, unauthorized access to sensitive information, and the establishment of persistent C2 channels within an organization’s network. The impact ranges from the loss of intellectual property and customer data to the potential disruption of business operations. The risk is amplified if the GenAI tool has access to internal systems or sensitive data stores, allowing attackers to pivot and escalate their attacks.

Recommendation

• Deploy the Sigma rule “GenAI Process Connecting to Unusual Domain” to your SIEM and tune for your environment (see rule below).
• Enable process creation and network connection logging on macOS endpoints to collect the data required for the Sigma rule.
• Investigate any alerts generated by the Sigma rule to determine the legitimacy of the domain and the GenAI process’s behavior.
• Block any identified malicious domains at the network level (see query in the provided source).
• Review the GenAI tool’s configuration for unauthorized MCP servers, plugins, or extensions that initiated the connection.
• Regularly update the list of allowed domains in the Sigma rule’s filter to account for legitimate updates to GenAI tool infrastructure.

]]>mediumadvisorygenaicommand and controlmacosnetwork connectionhttps://feed.craftedsignal.io/briefs/2024-01-suspicious-cmd-network/Tue, 02 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-suspicious-cmd-network/This alert identifies suspicious network connections initiated by the command prompt (cmd.exe) when executed with arguments indicative of script execution, remote resource access, or originating from Microsoft Office applications, which is a common tactic for downloading payloads or establishing command and control.This detection identifies suspicious network connections initiated by the command prompt (cmd.exe) on Windows systems. The rule focuses on cmd.exe processes executed with specific arguments, such as those indicating script execution (e.g., *.bat, *.cmd), access to remote resources (e.g., URLs), or those spawned by Microsoft Office applications (Excel, Word, etc.). Attackers frequently abuse cmd.exe to download malicious payloads, execute commands, or establish command and control channels. This detection aims to identify such potentially malicious activity by correlating process creation events with subsequent network connections. The rule excludes common private and reserved IP address ranges to reduce false positives. The targeted systems are Windows endpoints where adversaries attempt to leverage cmd.exe for malicious purposes.

Attack Chain

1. A user opens a malicious document (e.g., Word, Excel) or executes a seemingly benign application.
2. The document or application contains a macro or script that initiates a cmd.exe process.
3. The cmd.exe process is launched with arguments indicating script execution (/c, /k) and referencing a remote resource (e.g., a URL) or a local batch file.
4. The cmd.exe process attempts to download a payload from a remote server using protocols like HTTP, HTTPS, or FTP.
5. The downloaded payload is saved to disk, often with a disguised filename.
6. The cmd.exe process executes the downloaded payload, initiating further malicious actions.
7. The malicious payload establishes a command and control (C2) channel with a remote server.
8. The attacker uses the C2 channel to send commands to the compromised system, potentially leading to data exfiltration or other malicious activities.

Impact

Successful exploitation can lead to the compromise of Windows endpoints, potentially enabling attackers to download and execute malicious payloads, establish command and control channels, and perform further malicious activities such as data theft, lateral movement, or ransomware deployment. While this detection has a low severity, it serves as an early warning sign of potential compromise and should be investigated promptly.

Recommendation

• Enable process creation logging with command line arguments to capture the full context of cmd.exe executions.
• Monitor network connections from cmd.exe processes, focusing on connections to external IP addresses, using a network monitoring solution.
• Deploy the Sigma rules provided in this brief to your SIEM to detect suspicious cmd.exe network connections.
• Investigate any alerts generated by the Sigma rules, focusing on cmd.exe processes spawned by Office applications or those executing scripts from remote URLs.

]]>lowadvisorycommand-promptnetwork-connectionwindowsexecutioncommand-and-control