GenAI Process Connection to Suspicious Top Level Domain

  1[metadata]
  2creation_date = "2025/12/04"
  3integration = ["endpoint", "windows"]
  4maturity = "production"
  5updated_date = "2026/09/25"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects when GenAI tools connect to domains using suspicious TLDs commonly abused for malware C2 infrastructure. TLDs
 11like .top, .xyz, .ml, .cf, .onion are frequently used in phishing and malware campaigns. Legitimate GenAI services use
 12well-established domains (.com, .ai, .io), so connections to suspicious TLDs may indicate compromised tools, malicious
 13plugins, or AI-generated code connecting to attacker infrastructure.
 14"""
 15from = "now-9m"
 16index = ["logs-endpoint.events.network*", "winlogbeat-*", "logs-windows.sysmon_operational-*"]
 17language = "eql"
 18license = "Elastic License v2"
 19name = "GenAI Process Connection to Suspicious Top Level Domain"
 20note = """## Triage and analysis
 21
 22### Investigating GenAI Process Connection to Suspicious Top Level Domain
 23
 24This rule detects GenAI tools connecting to domains with TLDs commonly abused by malware. The suspicious TLD filter makes this a high-signal rule with low expected volume.
 25
 26### Possible investigation steps
 27
 28- Review the GenAI process command line to identify which tool is running and verify if it's an expected/authorized tool.
 29- Examine the network connection details (destination IP, port, protocol) to understand the nature of the communication.
 30- Check the process execution chain to identify the full attack path and initial entry point.
 31- Investigate the user account associated with the GenAI process to determine if this activity is expected for that user.
 32- Review network traffic patterns to identify data exfiltration or command and control communications.
 33- Check for other alerts or suspicious activity on the same host around the same time.
 34- Verify if the GenAI tool is from a trusted source and if it's authorized for use in your environment.
 35- Confirm whether the suspicious domain is used by package registries, CDN mirrors, or AI plugin repos.
 36- Check if the GenAI tool attempted follow-up actions such as downloading scripts, connecting to IPs directly, or loading remote models.
 37- Inspect whether the domain matches prompt-redirections, malicious AI plugins, or compromised package dependencies.
 38
 39### False positive analysis
 40
 41- Legitimate GenAI tools may occasionally connect to domains using suspicious TLDs if they're legitimate services.
 42- Package managers (npx, pnpm, yarn, bunx) may connect to package registries or CDNs that use suspicious TLDs. Review and exclude known legitimate package registries if needed.
 43- Some third-party AI plugin ecosystems (VSCode AI plugins, Cursor extensions) may download assets from unusual TLDs; verify allowlists.
 44
 45### Response and remediation
 46
 47- Terminate the GenAI process and any spawned child processes to stop the malicious activity.
 48- Review and revoke any API keys, tokens, or credentials that may have been exposed or used by the GenAI tool.
 49- Block the identified suspicious domains at the network level.
 50- Investigate the GenAI tool configuration to identify how it was configured and what it was authorized to access.
 51- Update security policies to restrict or monitor GenAI tool usage in the environment, especially for network communications.
 52- Add detection for secondary indicators (reverse shells, encoded C2 traffic, odd user-agent strings).
 53"""
 54references = [
 55    "https://www.cybercrimeinfocenter.org/top-20-tlds-by-malicious-phishing-domains",
 56    "https://atlas.mitre.org/techniques/AML.T0086",
 57    "https://www.elastic.co/security-labs/elastic-advances-llm-security",
 58]
 59risk_score = 47
 60rule_id = "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
 61severity = "medium"
 62tags = [
 63    "Domain: Endpoint",
 64    "OS: macOS",
 65    "OS: Windows",
 66    "Use Case: Threat Detection",
 67    "Tactic: Command and Control",
 68    "Data Source: Elastic Defend",
 69    "Data Source: Sysmon",
 70    "Resources: Investigation Guide",
 71    "Noise: Medium",
 72    "Performance: Normal",
 73    "Profile: Recommended",
 74    "Threat: Suspicious TLD",
 75    "Threat: Unauthorized AI Usage",
 76    "Rule Type: Event Correlation (EQL)",
 77    "Platform: Windows",
 78    "Platform: macOS",
 79    "Domain: GenAI",
 80    "Mitre Atlas: AML.T0072",
 81]
 82timestamp_override = "event.ingested"
 83type = "eql"
 84
 85query = '''
 86network where host.os.type in ("macos", "windows") and
 87
 88  // GenAI processes
 89  process.name in (
 90    "ollama.exe", "ollama", "Ollama",
 91    "textgen.exe", "textgen", "text-generation-webui.exe", "oobabooga.exe",
 92    "lmstudio.exe", "lmstudio", "LM Studio",
 93    "claude.exe", "claude", "Claude",
 94    "cursor.exe", "cursor", "Cursor",
 95    "copilot.exe", "copilot", "Copilot",
 96    "codex.exe", "codex",
 97    "Jan", "jan.exe", "jan",
 98    "gpt4all.exe", "gpt4all", "GPT4All",
 99    "gemini-cli.exe", "gemini-cli",
100    "genaiscript.exe", "genaiscript",
101    "grok.exe", "grok",
102    "qwen.exe", "qwen",
103    "koboldcpp.exe", "koboldcpp", "KoboldCpp",
104    "llama-server", "llama-cli",
105    "deno.exe", "deno",
106    "npx", "pnpm", "yarn", "bunx"
107  ) and
108
109  // Suspicious TLDs 
110  (
111    // Windows DNS events
112    (host.os.type == "windows" and dns.question.name != null and
113     dns.question.name regex """.*\.(top|buzz|xyz|rest|ml|cf|gq|ga|onion|monster|cyou|quest|cc|bar|cfd|click|cam|surf|tk|shop|club|icu|pw|ws|online|fun|life|boats|store|hair|skin|motorcycles|christmas|lol|makeup|mom|bond|beauty|biz|live|work|zip|country|accountant|date|party|science|loan|win|men|faith|review|racing|download|host)""") or
114
115    // macOS network events
116    (host.os.type == "macos" and destination.domain != null and
117     destination.domain regex """.*\.(top|buzz|xyz|rest|ml|cf|gq|ga|onion|monster|cyou|quest|cc|bar|cfd|click|cam|surf|tk|shop|club|icu|pw|ws|online|fun|life|boats|store|hair|skin|motorcycles|christmas|lol|makeup|mom|bond|beauty|biz|live|work|zip|country|accountant|date|party|science|loan|win|men|faith|review|racing|download|host)""")
118
119    // Linux DNS events
120    // Revist when available
121  )
122'''
123
124
125[[rule.threat]]
126framework = "MITRE ATT&CK"
127[[rule.threat.technique]]
128id = "T1071"
129name = "Application Layer Protocol"
130reference = "https://attack.mitre.org/techniques/T1071/"
131[[rule.threat.technique.subtechnique]]
132id = "T1071.004"
133name = "DNS"
134reference = "https://attack.mitre.org/techniques/T1071/004/"
135
136
137
138[rule.threat.tactic]
139id = "TA0011"
140name = "Command and Control"
141reference = "https://attack.mitre.org/tactics/TA0011/"
142[[rule.threat_mappings]]
143framework = "MITRE ATLAS"
144version = "2026.08"
145[[rule.threat_mappings.threat]]
146framework = "MITRE ATLAS"
147[[rule.threat_mappings.threat.technique]]
148id = "AML.T0072"
149name = "Cyber Communication Channel"
150reference = "https://atlas.mitre.org/techniques/AML.T0072/"
151
152
153[rule.threat_mappings.threat.tactic]
154id = "AML.TA0014"
155name = "Command and Control"
156reference = "https://atlas.mitre.org/tactics/AML.TA0014/"