Vendor
medium
threat
Detection of Generative AI Processes Connecting to Unusual Domains
1 rule 1 TTPAdversaries may compromise macOS-based Generative AI (GenAI) tools through prompt injection, malicious Model Context Protocol (MCP) servers, or poisoned plugins to establish Command and Control (C2) channels or exfiltrate sensitive data by causing them to connect to unusual domains.
exploited
Claude +8
command-and-control
genai
macos
data-exfiltration
1r
1t
high
advisory
Shai-Hulud Campaign Activity
20 IOCsTracking brief for the Shai-Hulud campaign; individual sightings are folded in as reported.
jscrambler 8.14.0 +102
campaign
shai-hulud
20i
updated
critical
advisory
Elastic Defend Alert from GenAI Utility or Descendant
2 rules 1 TTPThis rule detects Elastic Defend alerts originating from or directly related to GenAI coding utilities, indicating potential prompt injection, malicious skills, or supply-chain compromise.
Cursor +11
genai
supply-chain
elastic-defend
2r
1t