GenAI Process Connection to Suspicious Top Level Domain

  1[metadata]
  2creation_date = "2025/12/04"
  3integration = ["endpoint", "windows"]
  4maturity = "production"
  5updated_date = "2025/12/04"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects when GenAI tools connect to domains using suspicious TLDs commonly abused for malware C2 infrastructure. TLDs
 11like .top, .xyz, .ml, .cf, .onion are frequently used in phishing and malware campaigns. Legitimate GenAI services use
 12well-established domains (.com, .ai, .io), so connections to suspicious TLDs may indicate compromised tools, malicious
 13plugins, or AI-generated code connecting to attacker infrastructure.
 14"""
 15from = "now-9m"
 16index = ["logs-endpoint.events.network*", "winlogbeat-*", "logs-windows.sysmon_operational-*"]
 17language = "eql"
 18license = "Elastic License v2"
 19name = "GenAI Process Connection to Suspicious Top Level Domain"
 20note = """## Triage and analysis
 21
 22### Investigating GenAI Process Connection to Suspicious Top Level Domain
 23
 24This rule detects GenAI tools connecting to domains with TLDs commonly abused by malware. The suspicious TLD filter makes this a high-signal rule with low expected volume.
 25
 26### Possible investigation steps
 27
 28- Review the GenAI process command line to identify which tool is running and verify if it's an expected/authorized tool.
 29- Examine the network connection details (destination IP, port, protocol) to understand the nature of the communication.
 30- Check the process execution chain to identify the full attack path and initial entry point.
 31- Investigate the user account associated with the GenAI process to determine if this activity is expected for that user.
 32- Review network traffic patterns to identify data exfiltration or command and control communications.
 33- Check for other alerts or suspicious activity on the same host around the same time.
 34- Verify if the GenAI tool is from a trusted source and if it's authorized for use in your environment.
 35- Confirm whether the suspicious domain is used by package registries, CDN mirrors, or AI plugin repos.
 36- Check if the GenAI tool attempted follow-up actions such as downloading scripts, connecting to IPs directly, or loading remote models.
 37- Inspect whether the domain matches prompt-redirections, malicious AI plugins, or compromised package dependencies.
 38
 39### False positive analysis
 40
 41- Legitimate GenAI tools may occasionally connect to domains using suspicious TLDs if they're legitimate services.
 42- Package managers (npx, pnpm, yarn, bunx) may connect to package registries or CDNs that use suspicious TLDs. Review and exclude known legitimate package registries if needed.
 43- Some third-party AI plugin ecosystems (VSCode AI plugins, Cursor extensions) may download assets from unusual TLDs; verify allowlists.
 44
 45### Response and remediation
 46
 47- Terminate the GenAI process and any spawned child processes to stop the malicious activity.
 48- Review and revoke any API keys, tokens, or credentials that may have been exposed or used by the GenAI tool.
 49- Block the identified suspicious domains at the network level.
 50- Investigate the GenAI tool configuration to identify how it was configured and what it was authorized to access.
 51- Update security policies to restrict or monitor GenAI tool usage in the environment, especially for network communications.
 52- Add detection for secondary indicators (reverse shells, encoded C2 traffic, odd user-agent strings).
 53"""
 54references = [
 55    "https://www.cybercrimeinfocenter.org/top-20-tlds-by-malicious-phishing-domains",
 56    "https://atlas.mitre.org/techniques/AML.T0086",
 57    "https://www.elastic.co/security-labs/elastic-advances-llm-security",
 58]
 59risk_score = 47
 60rule_id = "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
 61severity = "medium"
 62tags = [
 63    "Domain: Endpoint",
 64    "OS: macOS",
 65    "OS: Windows",
 66    "Use Case: Threat Detection",
 67    "Tactic: Command and Control",
 68    "Data Source: Elastic Defend",
 69    "Data Source: Sysmon",
 70    "Resources: Investigation Guide",
 71    "Domain: LLM",
 72    "Mitre Atlas: T0086",
 73]
 74timestamp_override = "event.ingested"
 75type = "eql"
 76
 77query = '''
 78network where host.os.type in ("macos", "windows") and
 79
 80  // GenAI processes
 81  process.name in (
 82    "ollama.exe", "ollama", "Ollama",
 83    "textgen.exe", "textgen", "text-generation-webui.exe", "oobabooga.exe",
 84    "lmstudio.exe", "lmstudio", "LM Studio",
 85    "claude.exe", "claude", "Claude",
 86    "cursor.exe", "cursor", "Cursor",
 87    "copilot.exe", "copilot", "Copilot",
 88    "codex.exe", "codex",
 89    "Jan", "jan.exe", "jan",
 90    "gpt4all.exe", "gpt4all", "GPT4All",
 91    "gemini-cli.exe", "gemini-cli",
 92    "genaiscript.exe", "genaiscript",
 93    "grok.exe", "grok",
 94    "qwen.exe", "qwen",
 95    "koboldcpp.exe", "koboldcpp", "KoboldCpp",
 96    "llama-server", "llama-cli",
 97    "deno.exe", "deno",
 98    "npx", "pnpm", "yarn", "bunx"
 99  ) and
100
101  // Suspicious TLDs 
102  (
103    // Windows DNS events
104    (host.os.type == "windows" and dns.question.name != null and
105     dns.question.name regex """.*\.(top|buzz|xyz|rest|ml|cf|gq|ga|onion|monster|cyou|quest|cc|bar|cfd|click|cam|surf|tk|shop|club|icu|pw|ws|online|fun|life|boats|store|hair|skin|motorcycles|christmas|lol|makeup|mom|bond|beauty|biz|live|work|zip|country|accountant|date|party|science|loan|win|men|faith|review|racing|download|host)""") or
106
107    // macOS network events
108    (host.os.type == "macos" and destination.domain != null and
109     destination.domain regex """.*\.(top|buzz|xyz|rest|ml|cf|gq|ga|onion|monster|cyou|quest|cc|bar|cfd|click|cam|surf|tk|shop|club|icu|pw|ws|online|fun|life|boats|store|hair|skin|motorcycles|christmas|lol|makeup|mom|bond|beauty|biz|live|work|zip|country|accountant|date|party|science|loan|win|men|faith|review|racing|download|host)""")
110
111    // Linux DNS events
112    // Revist when available
113  )
114'''
115
116
117[[rule.threat]]
118framework = "MITRE ATT&CK"
119[[rule.threat.technique]]
120id = "T1071"
121name = "Application Layer Protocol"
122reference = "https://attack.mitre.org/techniques/T1071/"
123[[rule.threat.technique.subtechnique]]
124id = "T1071.004"
125name = "DNS"
126reference = "https://attack.mitre.org/techniques/T1071/004/"
127
128
129
130[rule.threat.tactic]
131id = "TA0011"
132name = "Command and Control"
133reference = "https://attack.mitre.org/tactics/TA0011/"