GenAI CLI Started with Unsafe Permission Bypass

  1[metadata]
  2creation_date = "2026/06/24"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/25"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies GenAI agent CLIs started with permission-bypass or auto-approval flags that disable human-in-the-loop
 11guardrails. These modes are intended for isolated sandboxes but are frequently misused on internet-connected developer
 12workstations, allowing prompt injection, compromised dependencies, or malicious skills to execute commands, modify
 13files, or reach sensitive paths without confirmation.
 14"""
 15from = "now-9m"
 16index = ["logs-endpoint.events.process-*"]
 17language = "eql"
 18license = "Elastic License v2"
 19name = "GenAI CLI Started with Unsafe Permission Bypass"
 20note = """## Triage and analysis
 21
 22### Investigating GenAI CLI Started with Unsafe Permission Bypass
 23
 24GenAI coding agents normally prompt before running shell commands or editing files. Vendor-supplied bypass flags remove
 25those controls entirely or auto-approve all tool calls. On a networked host this materially increases blast radius from
 26prompt injection, poisoned MCP servers, malicious project configs, and autonomous agent workflows.
 27
 28### Possible investigation steps
 29
 30- Identify which GenAI tool and bypass flag were used from `process.command_line` and `process.executable`.
 31- Determine whether the session was intentional (CI/CD, isolated lab VM) or an interactive developer workstation.
 32- Review child processes spawned after startup for credential access, network exfiltration, or persistence.
 33- Check for recent GenAI config changes (MCP servers, skills, `.claude/settings.json`, `~/.codex/config.toml`).
 34- Correlate with other GenAI-related alerts on the same host and user.
 35
 36### False positive analysis
 37
 38- Deliberate use in approved sandbox/CI images with no outbound network access.
 39- Internal automation scripts that wrap GenAI CLIs with bypass flags; scope exceptions by host or user group.
 40- Each matching process start produces one alert; habitual bypass use in CI or developer workflows may need host or user exceptions.
 41
 42### Response and remediation
 43
 44- Remove bypass flags from scripts, shell profiles, and CI job definitions; use default or plan-only permission modes.
 45- Rotate API keys and cloud credentials accessible to the user account that ran the agent.
 46- Audit GenAI tool configs and MCP servers loaded during the session.
 47- Restrict GenAI agent usage policies to disallow permission bypass on production endpoints.
 48"""
 49references = [
 50    "https://code.claude.com/docs/en/permission-modes",
 51    "https://developers.openai.com/codex/cli/reference",
 52    "https://developers.openai.com/codex/agent-approvals-security",
 53    "https://google-gemini.github.io/gemini-cli/docs/get-started/configuration.html",
 54    "https://specterops.io/blog/2025/11/21/an-evening-with-claude-code/",
 55]
 56risk_score = 47
 57rule_id = "c1326e45-6d3c-4a2d-9882-606a0c310299"
 58severity = "medium"
 59tags = [
 60    "Domain: Endpoint",
 61    "OS: Linux",
 62    "OS: macOS",
 63    "OS: Windows",
 64    "Use Case: Threat Detection",
 65    "Tactic: Defense Evasion",
 66    "Data Source: Elastic Defend",
 67    "Resources: Investigation Guide",
 68    "Noise: High",
 69    "Performance: Normal",
 70    "Profile: Aggressive",
 71    "Threat: Unauthorized AI Usage",
 72    "Rule Type: Event Correlation (EQL)",
 73    "Platform: Windows",
 74    "Platform: Linux",
 75    "Platform: macOS",
 76    "Domain: GenAI",
 77    "Mitre Atlas: AML.T0081",
 78    "Mitre Atlas: AML.T0053",
 79]
 80timestamp_override = "event.ingested"
 81type = "eql"
 82
 83query = '''
 84process where event.type == "start" and event.action in ("exec", "start") and
 85(
 86  (
 87    process.args in (
 88      "--dangerously-skip-permissions",
 89      "--allow-dangerously-skip-permissions",
 90      "--permission-mode=bypassPermissions"
 91    ) or
 92    (process.args == "--permission-mode" and process.args == "bypassPermissions")
 93  ) and
 94  (
 95    process.name in ("claude", "claude.exe") or
 96    process.executable : (
 97      "*/.local/share/claude/versions/*",
 98      "*/.claude/downloads/*",
 99      "*Caskroom/claude-code/*",
100      "*\\Claude\\versions\\*"
101    ) or
102    (process.name in ("node", "node.exe") and process.args : "*@anthropic-ai/claude-code*")
103  )
104) or
105(
106  (
107    process.args in ("--dangerously-bypass-approvals-and-sandbox", "--full-auto", "--yolo") or
108    process.command_line : (
109      "* -s danger-full-access*",
110      "*--sandbox danger-full-access*",
111      "*--sandbox=danger-full-access*",
112      "*--ask-for-approval never*",
113      "*--ask-for-approval=never*"
114    )
115  ) and
116  (
117    process.name in (
118      "codex", "codex.exe", "codex-exec",
119      "codex-aarch64-apple-darwin", "codex-x86_64-apple-darwin",
120      "codex-linux-arm64", "codex-linux-x64"
121    ) or
122    (process.name in ("node", "node.exe") and process.args : ("*@openai/codex*", "*/codex", "*\\codex*"))
123  )
124) or
125(
126  (
127    process.args in ("--yolo", "-y") or
128    (process.args == "--approval-mode" and process.args == "yolo") or
129    process.args == "--approval-mode=yolo"
130  ) and
131  (
132    process.name in ("gemini", "gemini-cli", "gemini.exe", "gemini-cli.exe") or
133    (process.name in ("node", "node.exe") and process.args : ("*@google/gemini-cli*", "*/gemini", "*\\gemini*"))
134  )
135) or
136(
137  (
138    process.args in (
139      "--yolo",
140      "--autopilot",
141      "--allow-all",
142      "--allow-all-tools",
143      "--allow-all-paths",
144      "--allow-all-urls"
145    )
146  ) and
147  (
148    process.name in ("copilot", "copilot.exe") or
149    (process.name in ("node", "node.exe") and process.args : ("*@github/copilot*", "*/copilot", "*\\copilot*"))
150  )
151) or
152(
153  process.args == "--dangerously-skip-permissions" and
154  (
155    process.name in ("opencode", "opencode.exe", ".opencode") or
156    process.executable : ("*opencode-ai*", "*\\.opencode*") or
157    (process.name in ("node", "node.exe") and process.args : ("*opencode-ai*", "*/opencode", "*\\opencode*"))
158  )
159)
160'''
161
162
163[[rule.threat]]
164framework = "MITRE ATT&CK"
165[[rule.threat.technique]]
166id = "T1562"
167name = "Impair Defenses"
168reference = "https://attack.mitre.org/techniques/T1562/"
169[[rule.threat.technique.subtechnique]]
170id = "T1562.001"
171name = "Disable or Modify Tools"
172reference = "https://attack.mitre.org/techniques/T1562/001/"
173
174
175
176[rule.threat.tactic]
177id = "TA0005"
178name = "Defense Evasion"
179reference = "https://attack.mitre.org/tactics/TA0005/"
180[[rule.threat_mappings]]
181framework = "MITRE ATLAS"
182version = "2026.08"
183[[rule.threat_mappings.threat]]
184framework = "MITRE ATLAS"
185[[rule.threat_mappings.threat.technique]]
186id = "AML.T0081"
187name = "Modify AI Agent Configuration"
188reference = "https://atlas.mitre.org/techniques/AML.T0081/"
189
190
191[rule.threat_mappings.threat.tactic]
192id = "AML.TA0007"
193name = "Defense Evasion"
194reference = "https://atlas.mitre.org/tactics/AML.TA0007/"
195[[rule.threat_mappings.threat]]
196framework = "MITRE ATLAS"
197[[rule.threat_mappings.threat.technique]]
198id = "AML.T0053"
199name = "AI Agent Tool Invocation"
200reference = "https://atlas.mitre.org/techniques/AML.T0053/"
201
202
203[rule.threat_mappings.threat.tactic]
204id = "AML.TA0012"
205name = "Privilege Escalation"
206reference = "https://atlas.mitre.org/tactics/AML.TA0012/"