Browse Rules

LLM-Based Compromised User Triage by User

This rule correlates multiple security alerts involving the same user across hosts and data sources, then uses an LLM to analyze whether they indicate account compromise. The LLM evaluates alert patterns, MITRE tactics progression, geographic anomalies, and multi-host activity to provide a verdict and confidence score, helping analysts prioritize users exhibiting indicators of credential theft or unauthorized access.

LLM-Based Attack Chain Triage by Host

This rule correlates multiple endpoint security alerts from the same host and uses an LLM to analyze command lines, parent processes, file operations, DNS queries, registry modifications, module loads and MITRE ATT&CK tactics progression to determine if they form a coherent attack chain. The LLM provides a verdict (TP/FP/SUSPICIOUS) with confidence score and summary explanation, helping analysts to prioritize hosts exhibiting corroborated malicious behavior while filtering out benign activity.

Correlated Alerts on Similar User Identities

This rule correlates alerts from multiple integrations and event categories that involve different user.name values which may represent the same real-world identity. It uses an LLM-based similarity analysis to evaluate whether multiple user identifiers (e.g. naming variations, formats, aliases, or domain differences) likely belong to the same person.

Local LLM Framework DNS Query

Detects DNS queries related to local LLM models on endpoints by monitoring Sysmon DNS query events (Event ID 22) for known LLM model domains and services. Local LLM frameworks like Ollama, LM Studio, and GPT4All make DNS calls to repositories such as huggingface.co and ollama.ai for model downloads, updates, and telemetry. These queries can reveal unauthorized AI tool usage or data exfiltration risks on corporate networks.

LLM-Based Curl Activity Triage via Auditd

Detects non-allowlisted curl activity on Linux hosts via Auditd Manager or Auditbeat and uses an LLM to assess whether the activity is malicious, benign, or requires investigation. The rule parses and normalizes the destination, redacts sensitive command-line values, and aggregates activity by host and destination before invoking the ES|QL COMPLETION command. Only true positive or suspicious verdicts with confidence above 0.7 generate alerts.

LLM-Based Curl Activity Triage

Detects non-allowlisted curl activity on Linux, macOS, and Windows hosts and uses an LLM to assess whether the activity is malicious, benign, or requires investigation. The rule parses and normalizes the destination, redacts sensitive command-line values, and aggregates activity by host and destination before invoking the ES|QL COMPLETION command. Only true positive or suspicious verdicts with confidence above 0.7 generate alerts.

LLM-Based Wget Activity Triage via Auditd

Detects non-allowlisted wget activity on Linux hosts via Auditd Manager or Auditbeat and uses an LLM to assess whether the activity is malicious, benign, or requires investigation. The rule parses and normalizes the destination, redacts sensitive command-line values, and aggregates activity by host and destination before invoking the ES|QL COMPLETION command. Only true positive or suspicious verdicts with confidence above 0.7 generate alerts.

LLM-Based Wget Activity Triage

Detects non-allowlisted wget activity on Linux, macOS, and Windows hosts and uses an LLM to assess whether the activity is malicious, benign, or requires investigation. The rule parses and normalizes the destination, redacts sensitive command-line values, and aggregates activity by host and destination before invoking the ES|QL COMPLETION command. Only true positive or suspicious verdicts with confidence above 0.7 generate alerts.

Ollama API Accessed from External Network

Detects when the Ollama LLM server accepts connections from external IP addresses. Ollama lacks built-in authentication, so exposed instances allow unauthenticated model theft, prompt injection, and resource hijacking.

Ollama DNS Query to Untrusted Domain

Detects Ollama DNS queries to domains outside official infrastructure. Adversaries can redirect Ollama to pull models from attacker-controlled servers via OLLAMA_HOST or custom manifests. Malicious models may contain backdoors, exploit parsing vulnerabilities like CVE-2025-1975, or poison inference outputs.

GenAI or MCP Server Child Process Execution

Detects child process execution from GenAI tools or MCP (Model Context Protocol) servers. Adversaries exploit AI agents to execute system commands, exfiltrate data, or establish persistence. MCP servers provide LLMs direct access to execute shell commands, read files, and interact with external services. This building block provides visibility into AI-initiated process execution for correlation with other suspicious activity.

GenAI Process Connection to Unusual Domain

Detects GenAI tools connecting to unusual domains on macOS. Adversaries may compromise GenAI tools through prompt injection, malicious MCP servers, or poisoned plugins to establish C2 channels or exfiltrate sensitive data to attacker-controlled infrastructure. AI agents with network access can be manipulated to beacon to external servers, download malicious payloads, or transmit harvested credentials and documents.

GenAI Process Connection to Suspicious Top Level Domain

Detects when GenAI tools connect to domains using suspicious TLDs commonly abused for malware C2 infrastructure. TLDs like .top, .xyz, .ml, .cf, .onion are frequently used in phishing and malware campaigns. Legitimate GenAI services use well-established domains (.com, .ai, .io), so connections to suspicious TLDs may indicate compromised tools, malicious plugins, or AI-generated code connecting to attacker infrastructure.

GenAI Process Compiling or Generating Executables

Detects when GenAI tools spawn compilers or packaging tools to generate executables. Attackers leverage local LLMs to autonomously generate and compile malware, droppers, or implants. Python packaging tools (pyinstaller, nuitka, pyarmor) are particularly high-risk as they create standalone executables that can be deployed without dependencies. This rule focuses on compilation activity that produces output binaries, filtering out inspection-only operations.

AWS Bedrock Foundation Model Access Enabled or Entitlement Granted

Identifies when access to an Amazon Bedrock foundation model is enabled at the account level, either by granting a foundation-model entitlement, submitting a use case for model access, or creating a foundation-model agreement (accepting the EULA). These account-level "model access" actions unlock a foundation model so that it can subsequently be invoked. Adversaries or a compromised principal may enable model access to abuse expensive models (LLMjacking), to establish a durable ability to invoke

Claude Cowork VM Boot Image Tamper

Detects unexpected modification of Claude Desktop Cowork VM boot images (kernel, initrd, root filesystem). Adversaries with user-context access can rewrite these stored images so later Cowork sessions boot attacker-controlled code inside a virtual instance that host EDR cannot inspect by default.

Potential Abuse of Resources by High Token Count and Large Response Sizes

Detects potential resource exhaustion or data breach attempts by monitoring for users who consistently generate high input token counts, submit numerous requests, and receive large responses. This behavior could indicate an attempt to overload the system or extract an unusually large amount of data, possibly revealing sensitive information or causing service disruptions.

Connection to Common Large Language Model Endpoints

Identifies DNS queries to known Large Language Model domains by unsigned binaries or common Windows scripting utilities. Malwares may leverage the capabilities of LLM to perform actions in the affected system in a dynamic way.

Unusual High Denied Topic Blocks Detected

Detects repeated compliance violation 'BLOCKED' actions coupled with specific policy name such as 'topic_policy', indicating persistent misuse or attempts to probe the model's denied topics.

Unusual High Word Policy Blocks Detected

Detects repeated compliance violation 'BLOCKED' actions coupled with specific policy name such as 'word_policy', indicating persistent misuse or attempts to probe the model's denied topics.

Unusual High Denied Sensitive Information Policy Blocks Detected

Detects repeated compliance violation 'BLOCKED' actions coupled with specific policy name such as 'sensitive_information_policy', indicating persistent misuse or attempts to probe the model's denied topics.

Potential Azure OpenAI Model Theft

Monitors for suspicious activities that may indicate theft or unauthorized duplication of machine learning (ML) models, such as unauthorized API calls, atypical access patterns, or large data transfers that are unusual during model interactions.

GenAI CLI Started with Unsafe Permission Bypass

Identifies GenAI agent CLIs started with permission-bypass or auto-approval flags that disable human-in-the-loop guardrails. These modes are intended for isolated sandboxes but are frequently misused on internet-connected developer workstations, allowing prompt injection, compromised dependencies, or malicious skills to execute commands, modify files, or reach sensitive paths without confirmation.

AWS Bedrock High Risk Filesystem or Execution Tool Invocation

Detects when a Bedrock model is prompted to invoke high-risk tools associated with shell execution, filesystem operations, or process spawning. Adversaries may use compromised AI agent pipelines or manipulated prompts to instruct the model to execute arbitrary system commands, read or write sensitive files, or spawn subprocesses — extending the blast radius of a credential compromise or prompt injection attack.

First Time Python Spawned a Shell on Host

Detects the first time a Python process spawns a shell on a given host. Malicious Python scripts, compromised dependencies, or model file deserialization can result in shell spawns that would not occur during normal workflows. Since legitimate Python processes rarely shell out to interactive shells, a first occurrence of this behavior on a host is a strong signal of potential compromise.