Unusual Process Modifying GenAI Configuration File

  1[metadata]
  2creation_date = "2025/12/04"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/10/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects unusual modification of GenAI tool configuration files. Adversaries may inject malicious MCP server
 11configurations to hijack AI agents for persistence, C2, or data exfiltration. Attack vectors include malware or scripts
 12directly poisoning config files, supply chain attacks via compromised dependencies, and prompt injection attacks that
 13abuse the GenAI tool itself to modify its own configuration. Unauthorized MCP servers added to these configs execute
 14arbitrary commands when the AI tool is next invoked.
 15"""
 16from = "now-9m"
 17index = ["logs-endpoint.events.file*"]
 18language = "kuery"
 19license = "Elastic License v2"
 20name = "Unusual Process Modifying GenAI Configuration File"
 21note = """## Triage and analysis
 22
 23### Investigating Unusual Process Modifying GenAI Configuration File
 24
 25Configuration files for GenAI tools like Cursor, Claude, Copilot, and Ollama control which MCP servers, plugins, and extensions are loaded. Attackers target these files to inject malicious MCP servers that execute arbitrary commands, exfiltrate data, or establish persistence. Threats include external processes (malware, compromised scripts, supply chain attacks) directly modifying configs, as well as prompt injection attacks that abuse the AI tool's own file access capabilities.
 26
 27### Possible investigation steps
 28
 29- Identify the process that modified the configuration file and determine if it's expected (GenAI tool, installer, user action) or suspicious (unknown script, malware).
 30- If the modifying process is NOT a GenAI tool, investigate its origin, parent process tree, and whether it was downloaded or executed from a suspicious location.
 31- If a GenAI tool made the modification, check recent user prompts or agent activity that may have triggered the config change via prompt injection.
 32- Review the contents of the modified configuration file for suspicious MCP server URLs, unauthorized plugins, or unusual agent permissions.
 33- Examine the process command line and parent process tree to identify how the modifying process was invoked.
 34- Check for other file modifications by the same process around the same time, particularly to other GenAI configs or startup scripts.
 35- Investigate whether the GenAI tool subsequently connected to unknown domains or spawned unusual child processes after the config change.
 36
 37### False positive analysis
 38
 39- Novel but legitimate configuration changes will trigger this rule when the process hasn't been seen modifying these files within the configured history window. Review the modified file content to determine legitimacy.
 40- GenAI tool updates may modify config files in new ways; correlate with recent software updates.
 41- IDE extensions integrating with GenAI tools may modify configs as part of initial setup.
 42- Developer tools (git, go, npm) checking out or downloading projects containing `.gemini/` or `.claude/` directories may trigger alerts. These are project-level configs, not user configs - verify by checking if the path is within a project directory.
 43
 44### Response and remediation
 45
 46- Review the modified configuration file and revert any unauthorized changes to MCP servers, plugins, or agent settings.
 47- If malicious MCP servers were added, block the associated domains at the network level.
 48- Review and rotate any API keys or credentials that may have been exposed through the compromised GenAI configuration.
 49"""
 50references = [
 51    "https://modelcontextprotocol.io/",
 52    "https://glama.ai/blog/2025-11-11-the-lethal-trifecta-securing-model-context-protocol-against-data-flow-attacks",
 53    "https://www.elastic.co/security-labs/elastic-advances-llm-security",
 54]
 55risk_score = 47
 56rule_id = "590fc62d-7386-4c75-92b0-af4517018da1"
 57severity = "medium"
 58tags = [
 59    "Domain: Endpoint",
 60    "OS: macOS",
 61    "OS: Windows",
 62    "Use Case: Threat Detection",
 63    "Tactic: Defense Evasion",
 64    "Tactic: Persistence",
 65    "Data Source: Elastic Defend",
 66    "Resources: Investigation Guide",
 67    "Noise: Medium",
 68    "Performance: Normal",
 69    "Profile: Recommended",
 70    "Threat: Unauthorized AI Usage",
 71    "Rule Type: New Terms",
 72    "Platform: Windows",
 73    "Platform: macOS",
 74    "Domain: GenAI",
 75    "Mitre Atlas: AML.T0081",
 76]
 77timestamp_override = "event.ingested"
 78type = "new_terms"
 79
 80query = '''
 81event.category : "file" and event.action : ("modification" or "overwrite") and
 82file.path : (
 83    */.cursor/mcp.json or */.cursor/settings.json or */AppData/Roaming/Cursor/*mcp* or
 84    */.claude/* or */claude_desktop_config.json or */AppData/Roaming/Claude/* or
 85    */.config/github-copilot/* or */AppData/Local/GitHub?Copilot/* or
 86    */.ollama/config* or */AppData/Local/Ollama/* or
 87    */.codex/* or */AppData/Roaming/Codex/* or
 88    */.gemini/* or */AppData/Roaming/gemini-cli/* or
 89    */.grok/* or */AppData/Roaming/Grok/* or
 90    */.windsurf/* or */AppData/Roaming/Windsurf/* or
 91    */.vscode/extensions/*mcp* or
 92    */.openclaw/* or */AppData/Roaming/OpenClaw/* or
 93    */.moltbot/* or */AppData/Roaming/Moltbot/* or
 94    */.config/openclaw/*
 95) and not (
 96  file.extension : (lck or lock or log or png or marker or shm or wal or sqlite or sqlite-shm or sqlite-wal or jsonl or journal or xcuserstate) or
 97  file.name : (
 98    .DS_Store or .last-cleanup or mcp-needs-auth-cache.json or policy-limits.json or
 99    .claude.json.backup* or
100    *.tmp*
101  ) or
102  file.path : (
103    */.claude/cache/* or
104    */.claude/statsig/* or
105    */.claude/sessions/* or
106    */.claude/shell-snapshots/* or
107    */.claude/plugins/* or
108    */.claude/worktrees/* or
109    */.gemini/antigravity-browser-profile/* or
110    */.gemini/tmp/* or
111    */.codex/.tmp/* or
112    */.codex/tmp/* or
113    */.codex/log/* or
114    */.codex/sessions/* or
115    */.cursor/extensions/* or
116    */.vscode/extensions/* or
117    */.vscode-oss/extensions/* or
118    */opt/homebrew/.claude/* or
119    */opt/homebrew/.cursor/* or
120    */opt/homebrew/.codex/* or
121    */node_modules/* or
122    */cargo/registry/* or
123    */go/pkg/mod/*
124  ) or
125  (
126    file.path : (*/.codex/* or */.claude/* or */.gemini/*) and
127    file.extension : sqlite
128  ) or
129  (
130    file.path : */.config/github-copilot/* and
131    file.name : (apps.json or versions.json or copilot*nitrite.db)
132  ) or
133  process.name : build-script-build or
134  (
135    file.path : (*/.codex/.tmp/* or */.claude/plugins/* or */.claude/worktrees/* or */node_modules/* or */cargo/registry/* or */go/pkg/mod/*) and
136    file.extension : (h or out or part or rs or toml)
137  )
138)
139'''
140
141
142[[rule.threat]]
143framework = "MITRE ATT&CK"
144[[rule.threat.technique]]
145id = "T1556"
146name = "Modify Authentication Process"
147reference = "https://attack.mitre.org/techniques/T1556/"
148
149[[rule.threat.technique]]
150id = "T1574"
151name = "Hijack Execution Flow"
152reference = "https://attack.mitre.org/techniques/T1574/"
153
154
155[rule.threat.tactic]
156id = "TA0005"
157name = "Defense Evasion"
158reference = "https://attack.mitre.org/tactics/TA0005/"
159[[rule.threat]]
160framework = "MITRE ATT&CK"
161[[rule.threat.technique]]
162id = "T1546"
163name = "Event Triggered Execution"
164reference = "https://attack.mitre.org/techniques/T1546/"
165
166[[rule.threat.technique]]
167id = "T1554"
168name = "Compromise Host Software Binary"
169reference = "https://attack.mitre.org/techniques/T1554/"
170
171
172[rule.threat.tactic]
173id = "TA0003"
174name = "Persistence"
175reference = "https://attack.mitre.org/tactics/TA0003/"
176[[rule.threat_mappings]]
177framework = "MITRE ATLAS"
178version = "2026.08"
179[[rule.threat_mappings.threat]]
180framework = "MITRE ATLAS"
181[[rule.threat_mappings.threat.technique]]
182id = "AML.T0081"
183name = "Modify AI Agent Configuration"
184reference = "https://atlas.mitre.org/techniques/AML.T0081/"
185
186
187[rule.threat_mappings.threat.tactic]
188id = "AML.TA0006"
189name = "Persistence"
190reference = "https://atlas.mitre.org/tactics/AML.TA0006/"
191[[rule.threat_mappings.threat]]
192framework = "MITRE ATLAS"
193[[rule.threat_mappings.threat.technique]]
194id = "AML.T0081"
195name = "Modify AI Agent Configuration"
196reference = "https://atlas.mitre.org/techniques/AML.T0081/"
197
198
199[rule.threat_mappings.threat.tactic]
200id = "AML.TA0007"
201name = "Defense Evasion"
202reference = "https://atlas.mitre.org/tactics/AML.TA0007/"
203
204[rule.new_terms]
205field = "new_terms_fields"
206value = ["process.executable"]
207[[rule.new_terms.history_window_start]]
208field = "history_window_start"
209value = "now-7d"