Policy-Violation

Adversaries are exploiting Amazon Bedrock APIs by submitting malformed inference parameters to trigger repeated validation exceptions, potentially for model evasion, cost harvesting, or testing defensive boundaries.

This analytic identifies instances where network traffic, specifically using prohibited ports and protocols such as FTP or Telnet, is allowed by Cisco Secure Firewall, signaling potential misconfigurations or unauthorized activity.

This brief details the detection of DNS queries originating from local Large Language Model (LLM) frameworks like Ollama, LM Studio, and GPT4All on Windows endpoints, leveraging Sysmon Event ID 22 to identify potential unauthorized AI tool usage or data exfiltration risks associated with model downloads, updates, and telemetry from repositories such as huggingface.co and ollama.ai.

This brief describes how the creation of Large Language Model (LLM) files, including formats like .gguf, .safetensors, .ggml, and Modelfiles, by local AI inference frameworks such as Ollama, llama.cpp, GPT4All, and LM Studio can be detected on Windows endpoints, indicating potential shadow AI deployments, unauthorized model downloads, or rogue LLM infrastructure which poses data exfiltration risks and policy violations.

This analytic detects instances where prohibited network traffic is allowed, highlighting potential misconfigurations or policy violations that could lead to unauthorized access or data exfiltration, ultimately allowing attackers to bypass network defenses.

Detection of unauthorized or suspicious wallpaper modifications on endpoints can indicate malicious activity or policy violations.