Elastic medium stable kql

Unusual Process Modifying GenAI Configuration File

Detects unusual modification of GenAI tool configuration files. Adversaries may inject malicious MCP server configurations to hijack AI agents for persistence, C2, or data exfiltration. Attack vectors include malware or scripts directly poisoning config files, supply chain attacks via compromised dependencies, and prompt injection attacks that abuse the GenAI tool itself to modify its own configuration. Unauthorized MCP servers added to these configs execute arbitrary commands when the AI tool is next invoked.

View Source

Detection Logic

event.category : "file" and event.action : ("modification" or "overwrite") and
file.path : (
    */.cursor/mcp.json or */.cursor/settings.json or */AppData/Roaming/Cursor/*mcp* or
    */.claude/* or */claude_desktop_config.json or */AppData/Roaming/Claude/* or
    */.config/github-copilot/* or */AppData/Local/GitHub?Copilot/* or
    */.ollama/config* or */AppData/Local/Ollama/* or
    */.codex/* or */AppData/Roaming/Codex/* or
    */.gemini/* or */AppData/Roaming/gemini-cli/* or
    */.grok/* or */AppData/Roaming/Grok/* or
    */.windsurf/* or */AppData/Roaming/Windsurf/* or
    */.vscode/extensions/*mcp* or
    */.openclaw/* or */AppData/Roaming/OpenClaw/* or
    */.moltbot/* or */AppData/Roaming/Moltbot/* or
    */.config/openclaw/*
) and not (
  file.extension : (lck or lock or log or png or marker or shm or wal or sqlite or sqlite-shm or sqlite-wal or jsonl or journal or xcuserstate) or
  file.name : (
    .DS_Store or .last-cleanup or mcp-needs-auth-cache.json or policy-limits.json or
    .claude.json.backup* or
    *.tmp*
  ) or
  file.path : (
    */.claude/cache/* or
    */.claude/statsig/* or
    */.claude/sessions/* or
    */.claude/shell-snapshots/* or
    */.claude/plugins/* or
    */.claude/worktrees/* or
    */.gemini/antigravity-browser-profile/* or
    */.gemini/tmp/* or
    */.codex/.tmp/* or
    */.codex/tmp/* or
    */.codex/log/* or
    */.codex/sessions/* or
    */.cursor/extensions/* or
    */.vscode/extensions/* or
    */.vscode-oss/extensions/* or
    */opt/homebrew/.claude/* or
    */opt/homebrew/.cursor/* or
    */opt/homebrew/.codex/* or
    */node_modules/* or
    */cargo/registry/* or
    */go/pkg/mod/*
  ) or
  (
    file.path : (*/.codex/* or */.claude/* or */.gemini/*) and
    file.extension : sqlite
  ) or
  (
    file.path : */.config/github-copilot/* and
    file.name : (apps.json or versions.json or copilot*nitrite.db)
  ) or
  process.name : build-script-build or
  (
    file.path : (*/.codex/.tmp/* or */.claude/plugins/* or */.claude/worktrees/* or */node_modules/* or */cargo/registry/* or */go/pkg/mod/*) and
    file.extension : (h or out or part or rs or toml)
  )
)

Field Validations

Loading…

Comments (0)

Loading comments...