Elastic high stable eql

GenAI Process Accessing Sensitive Files

Detects when GenAI tools access sensitive files such as cloud credentials, SSH keys, browser password databases, or shell configurations. Attackers leverage GenAI agents to systematically locate and exfiltrate credentials, API keys, and tokens. Access to credential stores (.aws/credentials, .ssh/id_*) suggests harvesting, while writes to shell configs (.bashrc, .zshrc) indicate persistence attempts. Note: On linux only creation events are available. Access events are not yet implemented.

View Source

Detection Logic

file where event.action in ("open", "creation", "modification") and event.outcome == "success" and

  // GenAI process 
    (
      process.name in~ (
        "ollama.exe", "ollama",
        "textgen.exe", "textgen", "text-generation-webui.exe", "oobabooga.exe",
        "lmstudio.exe", "lmstudio", "LM Studio",
        "claude.exe", "claude",
        "cursor.exe", "cursor",
        "copilot.exe", "copilot",
        "codex.exe", "codex",
        "jan.exe", "jan",
        "gpt4all.exe", "gpt4all",
        "gemini-cli.exe", "gemini-cli", "gemini.exe",
        "genaiscript.exe", "genaiscript",
        "grok.exe", "grok",
        "qwen.exe", "qwen",
        "koboldcpp.exe", "koboldcpp",
        "llama-server", "llama-cli",
        "windsurf.exe", "windsurf",
        "zed.exe", "zed",
        "opencode.exe", "opencode",
        "goose.exe", "goose"
      )
    ) and

  // Sensitive file paths
  (
    // Persistence via Shell configs
    file.name in (".bashrc", ".bash_profile", ".zshrc", ".zshenv", ".zprofile", ".profile", ".bash_logout") or

    // Credentials In Files 
    file.name like~ 
                 ("key?.db", 
                  "logins.json", 
                  "Login Data", 
                  "Local State",
                  "signons.sqlite",
                  "Cookies", 
                  "cookies.sqlite",
                  "Cookies.binarycookies", 
                  "login.keychain-db", 
                  "System.keychain", 
                  "credentials.db", 
                  "credentials", 
                  "access_tokens.db", 
                  "accessTokens.json", 
                  "azureProfile.json",
                  "RDCMan.settings", 
                  "known_hosts", 
                  "KeePass.config.xml", 
                  "Unattended.xml")
  ) and not (
    host.os.type == "windows" and
    file.name like~ "Local State" and
    file.path : (
      "?:\\Users\\*\\AppData\\Roaming\\*\\Local State",
      "?:\\Users\\*\\AppData\\Local\\Packages\\*\\LocalCache\\Roaming\\*\\Local State"
    )
  )

Field Validations

Loading…

Comments (0)

Loading comments...