Elastic medium stable eql

GenAI Process Connection to Suspicious Top Level Domain

Detects when GenAI tools connect to domains using suspicious TLDs commonly abused for malware C2 infrastructure. TLDs like .top, .xyz, .ml, .cf, .onion are frequently used in phishing and malware campaigns. Legitimate GenAI services use well-established domains (.com, .ai, .io), so connections to suspicious TLDs may indicate compromised tools, malicious plugins, or AI-generated code connecting to attacker infrastructure.

View Source

Detection Logic

network where host.os.type in ("macos", "windows") and

  // GenAI processes
  process.name in (
    "ollama.exe", "ollama", "Ollama",
    "textgen.exe", "textgen", "text-generation-webui.exe", "oobabooga.exe",
    "lmstudio.exe", "lmstudio", "LM Studio",
    "claude.exe", "claude", "Claude",
    "cursor.exe", "cursor", "Cursor",
    "copilot.exe", "copilot", "Copilot",
    "codex.exe", "codex",
    "Jan", "jan.exe", "jan",
    "gpt4all.exe", "gpt4all", "GPT4All",
    "gemini-cli.exe", "gemini-cli",
    "genaiscript.exe", "genaiscript",
    "grok.exe", "grok",
    "qwen.exe", "qwen",
    "koboldcpp.exe", "koboldcpp", "KoboldCpp",
    "llama-server", "llama-cli",
    "deno.exe", "deno",
    "npx", "pnpm", "yarn", "bunx"
  ) and

  // Suspicious TLDs 
  (
    // Windows DNS events
    (host.os.type == "windows" and dns.question.name != null and
     dns.question.name regex """.*\.(top
| buzz
| xyz
| rest
| ml
| cf
| gq
| ga
| onion
| monster
| cyou
| quest
| cc
| bar
| cfd
| click
| cam
| surf
| tk
| shop
| club
| icu
| pw
| ws
| online
| fun
| life
| boats
| store
| hair
| skin
| motorcycles
| christmas
| lol
| makeup
| mom
| bond
| beauty
| biz
| live
| work
| zip
| country
| accountant
| date
| party
| science
| loan
| win
| men
| faith
| review
| racing
| download
| host)""") or

    // macOS network events
    (host.os.type == "macos" and destination.domain != null and
     destination.domain regex """.*\.(top
| buzz
| xyz
| rest
| ml
| cf
| gq
| ga
| onion
| monster
| cyou
| quest
| cc
| bar
| cfd
| click
| cam
| surf
| tk
| shop
| club
| icu
| pw
| ws
| online
| fun
| life
| boats
| store
| hair
| skin
| motorcycles
| christmas
| lol
| makeup
| mom
| bond
| beauty
| biz
| live
| work
| zip
| country
| accountant
| date
| party
| science
| loan
| win
| men
| faith
| review
| racing
| download
| host)""")

    // Linux DNS events
    // Revist when available
  )

Field Validations

Loading…

Comments (0)

Loading comments...