GenAI Prompt Contains Cryptographic Hash String

  1[metadata]
  2creation_date = "2026/08/18"
  3integration = ["security_ai", "aws_bedrock", "openai_chatgpt_enterprise"]
  4maturity = "production"
  5min_stack_comments = "Detection rules for the security_ai integration package are supported in v9.6.0 and above"
  6min_stack_version = "9.6.0"
  7updated_date = "2026/11/06"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Detects hex-encoded hash strings (MD5, SHA-1, SHA-256, SHA-512) within GenAI
 13prompt or completion text. The security_ai ML model has identified
 14one or more candidate strings whose character distribution matches a cryptographic
 15digest. Attackers may pass hashes in prompts to exfiltrate credentials for
 16offline cracking, to reference stolen data without sending plaintext, or as part
 17of prompt injection payloads that encode malicious instructions as hex data.
 18"""
 19false_positives = [
 20    """
 21    Security or forensics workflows that send file hashes to a model for threat
 22    intelligence lookup or malware triage. Review the surrounding context and
 23    verify the hash does not correspond to a credential or sensitive artifact.
 24    """,
 25    """
 26    Development tooling that includes git commit SHAs, Docker image digests, or
 27    package checksums in prompts for CI/CD automation.
 28    """,
 29]
 30from = "now-6m"
 31index = [
 32    "logs-aws_bedrock.invocation-*",
 33    "logs-openai_chatgpt_enterprise.codex_log-*",
 34    "logs-openai_chatgpt_enterprise.conversation_message-*",
 35    "logs-openai_chatgpt_enterprise.custom_agents_log-*",
 36]
 37language = "kuery"
 38license = "Elastic License v2"
 39name = "GenAI Prompt Contains Cryptographic Hash String"
 40note = """
 41## Triage and Analysis
 42
 43### Investigating GenAI Prompt Contains Cryptographic Hash String
 44
 45The `security_ai` ML integration has flagged one or more hex digest
 46strings in a GenAI prompt or completion. Hash strings in LLM context can indicate
 47credential theft (passing NTLM/password hashes for cracking), data exfiltration
 48via digest fingerprints, or encoded prompt injection payloads.
 49
 50### Possible investigation steps
 51
 52- Examine `security_ai.hash_string.input_messages.strings` for hashes in the user input,
 53  and `security_ai.hash_string.output_messages.strings` for hashes in the model response.
 54  Note the length to infer the algorithm:
 55  - 32 chars → MD5
 56  - 40 chars → SHA-1
 57  - 64 chars → SHA-256
 58  - 128 chars → SHA-512
 59- Check the corresponding `.probabilities` arrays — higher values indicate stronger
 60  model confidence.
 61- The `input_messages` scope covers the last user turn in `gen_ai.input.messages`; the
 62  `output_messages` scope covers the last assistant turn in `gen_ai.output.messages`. A hit
 63  in `output_messages` means the hash appeared in the model's own response.
 64- Review `gen_ai.input.messages` or `gen_ai.output.messages` for the full conversation context:
 65  - Is the hash referenced alongside a username or credential field? May indicate
 66    pass-the-hash or credential exfiltration.
 67  - Is the hash part of a sequence of encoded values? May indicate a structured
 68    exfiltration payload.
 69  - Is the hash a known-bad IOC? Query threat intelligence feeds.
 70- Identify the originating user or application (`user.id`, `source.ip`,
 71  `user_agent.original`) and assess whether this is expected behavior.
 72- Examine the model's response (`gen_ai.output.messages`) — did the model decode,
 73  describe, or act on the hash in a way that reveals additional context?
 74
 75### False positive analysis
 76
 77- Security tooling that passes file hashes or commit SHAs to LLMs for threat
 78  intel enrichment is common. If the hash is a known benign artifact (git SHA,
 79  package checksum), this is likely a false positive.
 80- Tune with an exception for automation accounts or pipelines that regularly
 81  include hashes in prompts.
 82
 83### Response and remediation
 84
 85- If the hash corresponds to a credential or sensitive artifact, treat as a
 86  potential data exfiltration incident. Revoke affected credentials immediately.
 87- If the hash is part of a prompt injection payload, treat as an active attack.
 88  Revoke the API key or session and notify the account owner.
 89- Correlate with authentication logs to determine whether any pass-the-hash or
 90  lateral movement activity followed.
 91"""
 92references = [
 93    "https://owasp.org/www-project-top-10-for-large-language-model-applications/",
 94    "https://attack.mitre.org/techniques/T1110/002/",
 95]
 96risk_score = 47
 97rule_id = "aa3daae8-d479-46ce-a63f-6a695a8e28e5"
 98setup = """This rule requires the security_ai Fleet integration. Install the
 99integration and ensure that the ML model pipeline is enriching invocation events before
100enabling this rule. For setup instructions, refer to the [Security for AI integration documentation](https://www.elastic.co/docs/reference/integrations/security_ai)."""
101severity = "medium"
102tags = [
103    "Domain: GenAI",
104    "Use Case: Security for AI",
105    "Tactic: Credential Access",
106    "Tactic: Exfiltration",
107    "Mitre Atlas: AML.T0057",
108    "Data Source: AWS Bedrock",
109    "Data Source: OpenAI ChatGPT Enterprise",
110    "Platform: AWS",
111    "Platform: OpenAI",
112    "Service: AWS Bedrock",
113    "Service: OpenAI ChatGPT Enterprise",
114    "Rule Type: Custom Query (KQL)",
115    "Resources: Investigation Guide",
116]
117timestamp_override = "event.ingested"
118to = "now"
119type = "query"
120
121query = '''
122data_stream.dataset : (
123    "aws_bedrock.invocation" or
124    "openai_chatgpt_enterprise.codex_log" or
125    "openai_chatgpt_enterprise.conversation_message" or
126    "openai_chatgpt_enterprise.custom_agents_log"
127) and (security_ai.hash_string.input_messages.strings : * or security_ai.hash_string.output_messages.strings : *)
128'''
129
130[[rule.threat]]
131framework = "MITRE ATT&CK"
132
133[[rule.threat.technique]]
134id = "T1110"
135name = "Brute Force"
136reference = "https://attack.mitre.org/techniques/T1110/"
137
138[[rule.threat.technique.subtechnique]]
139id = "T1110.002"
140name = "Password Cracking"
141reference = "https://attack.mitre.org/techniques/T1110/002/"
142
143[rule.threat.tactic]
144id = "TA0006"
145name = "Credential Access"
146reference = "https://attack.mitre.org/tactics/TA0006/"
147
148[[rule.threat_mappings]]
149framework = "MITRE ATLAS"
150version = "2026.08"
151
152[[rule.threat_mappings.threat]]
153framework = "MITRE ATLAS"
154
155[[rule.threat_mappings.threat.technique]]
156id = "AML.T0057"
157name = "LLM Data Leakage"
158reference = "https://atlas.mitre.org/techniques/AML.T0057/"
159
160[rule.threat_mappings.threat.tactic]
161id = "AML.TA0010"
162name = "Exfiltration"
163reference = "https://atlas.mitre.org/tactics/AML.TA0010/"