GenAI Prompt Contains Base64-Encoded Payload

  1[metadata]
  2creation_date = "2026/08/18"
  3integration = ["security_ai", "aws_bedrock", "openai_chatgpt_enterprise"]
  4maturity = "production"
  5min_stack_comments = "Detection rules for the security_ai integration package are supported in v9.6.0 and above"
  6min_stack_version = "9.6.0"
  7updated_date = "2026/11/06"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Detects base64-encoded content within GenAI prompt or completion text. The
 13security_ai ML model has identified one or more candidate strings in
 14the message that score as encoded payloads. Attackers embed base64 in prompts to
 15smuggle instructions past content filters, exfiltrate data, or inject indirect
 16prompt-injection payloads into model context.
 17
 18Strings that match known credential formats (AWS access key IDs, API keys, private
 19key headers, and similar) are excluded — those fire the dedicated
 20"GenAI Prompt Contains Leaked Credential" rule instead at higher severity.
 21"""
 22false_positives = [
 23    """
 24    Developers or administrators sending base64-encoded configuration blobs,
 25    tokens, or binary artifacts to a model for parsing or analysis. Review the
 26    decoded content and the surrounding prompt to determine intent.
 27    """,
 28    """
 29    If a credential-shaped string is present alongside other encoded content, the
 30    credential pattern suppresses this alert. The higher-severity credential rule
 31    fires instead and the investigation guide for that rule covers triage of any
 32    co-occurring obfuscated content.
 33    """,
 34]
 35from = "now-60m"
 36interval = "10m"
 37language = "esql"
 38license = "Elastic License v2"
 39name = "GenAI Prompt Contains Base64-Encoded Payload"
 40note = """
 41## Triage and Analysis
 42
 43### Investigating GenAI Prompt Contains Base64-Encoded Payload
 44
 45The `security_ai` ML integration has flagged one or more base64-encoded
 46strings in a GenAI prompt or completion. Base64 is a common obfuscation technique
 47used in prompt injection, jailbreaking, and data-exfiltration attacks targeting LLMs.
 48
 49Strings that match known credential patterns are suppressed in this rule and routed
 50to the dedicated "GenAI Prompt Contains Leaked Credential" rule instead.
 51
 52### Possible investigation steps
 53
 54- Examine `security_ai.encoding.input_messages.strings` for encoded payloads in
 55  the user input, and `security_ai.encoding.output_messages.strings` for encoded
 56  payloads in the model's response. Decode each string (standard base64) and inspect
 57  the plaintext for:
 58  - Shell commands, PowerShell, JavaScript, or other scripting payloads
 59  - Secondary instructions intended to override system prompts (indirect prompt injection)
 60  - Sensitive data being sent to the model for exfiltration via its output
 61- Review the corresponding `.probabilities` arrays — higher values indicate stronger
 62  confidence that the string is genuinely encoded rather than a benign coincidence.
 63- The `input_messages` scope covers the last user turn in `gen_ai.input.messages`; the
 64  `output_messages` scope covers the last assistant turn in `gen_ai.output.messages`. A hit
 65  in `output_messages` means the encoded string appeared in the model's own response.
 66- Check `gen_ai.input.messages` or `gen_ai.output.messages` for the full conversation context.
 67- Identify the user or application that originated the request (`user.id`, `source.ip`,
 68  `user_agent.original`).
 69- Determine whether this user or application has sent similar encoded payloads before.
 70- Check the model's response (`gen_ai.output.messages`) to assess whether the injected
 71  instructions influenced output.
 72
 73### False positive analysis
 74
 75- Developers sending base64-encoded config, tokens, or binary data for legitimate
 76  model processing is common. Decoded content that is benign and contextually
 77  appropriate (e.g., a JWT being sent for parsing) is likely a false positive.
 78- Consider adding an exception for known automation accounts or specific API consumers
 79  that regularly process encoded data.
 80
 81### Response and remediation
 82
 83- If the decoded payload contains malicious instructions or scripts, treat this as an
 84  active prompt injection attempt. Revoke the API key or session and notify the owner.
 85- Review model output delivered to downstream systems — if the model acted on injected
 86  instructions, assess what data or actions were affected.
 87- Consider rate-limiting or blocking the source IP or user until the root cause is understood.
 88"""
 89references = [
 90    "https://owasp.org/www-project-top-10-for-large-language-model-applications/",
 91    "https://www.elastic.co/guide/en/security/current/prebuilt-rules-management.html",
 92]
 93risk_score = 47
 94rule_id = "781c9c2e-f42c-42b2-8a86-0de4e32b06cf"
 95setup = """This rule requires the security_ai Fleet integration. Install the
 96integration and ensure that the ML model pipeline is enriching invocation events before
 97enabling this rule. For setup instructions, refer to the [Security for AI integration documentation](https://www.elastic.co/docs/reference/integrations/security_ai)."""
 98severity = "medium"
 99tags = [
100    "Domain: GenAI",
101    "Use Case: Security for AI",
102    "Tactic: Defense Evasion",
103    "Mitre Atlas: AML.T0068",
104    "Data Source: AWS Bedrock",
105    "Data Source: OpenAI ChatGPT Enterprise",
106    "Platform: AWS",
107    "Platform: OpenAI",
108    "Service: AWS Bedrock",
109    "Service: OpenAI ChatGPT Enterprise",
110    "Rule Type: ES|QL",
111    "Resources: Investigation Guide",
112]
113timestamp_override = "event.ingested"
114to = "now"
115type = "esql"
116
117query = '''
118FROM logs-aws_bedrock.invocation-*, logs-openai_chatgpt_enterprise.codex_log-*, logs-openai_chatgpt_enterprise.conversation_message-*, logs-openai_chatgpt_enterprise.custom_agents_log-* METADATA _id, _version, _index
119| EVAL Esql_priv.b64_strings = CONCAT(
120    COALESCE(MV_CONCAT(security_ai.encoding.input_messages.strings, "\n"), ""), "\n",
121    COALESCE(MV_CONCAT(security_ai.encoding.output_messages.strings, "\n"), ""))
122| WHERE Esql_priv.b64_strings != "\n"
123// Suppress credential-shaped content — those fire the dedicated credential rule instead.
124// Credential formats are split across two RLIKEs because a single pattern with every format exceeds
125// ES|QL's regex determinization limit. A key must not be glued to a preceding key character (or be
126// preceded by a JSON-escaped \n, \r or \t); that also keeps the automaton small.
127// Not lowercased: credential prefixes (AKIA, sk-, ghp_, etc.) are case-significant.
128| WHERE NOT Esql_priv.b64_strings RLIKE """(.*([^A-Za-z0-9_\-]|\\[nrt]))?((AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}|ABSK[A-Za-z0-9+/=]{20}|AIza[0-9A-Za-z_\-]{35}|gh[pousr]_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_\-]{20,}|sk-ant-api03-[A-Za-z0-9_\-]{80,}|sk-proj-[A-Za-z0-9_\-]{20,}).*"""
129| WHERE NOT Esql_priv.b64_strings RLIKE """(.*([^A-Za-z0-9_\-]|\\[nrt]))?(sk-[A-Za-z0-9]{48}|sk_live_[A-Za-z0-9]{24}|hf_[A-Za-z0-9]{34}|xox[baprs]-[A-Za-z0-9\-]{10,}|eyJ[A-Za-z0-9_\-]{10,}\.eyJ[A-Za-z0-9_\-]{10,}\..*|-----BEGIN [A-Z ]*PRIVATE KEY-----).*"""
130| KEEP _id, _version, _index, @timestamp, security_ai.*, gen_ai.*, aws_bedrock.*, user.*, cloud.*, event.*, openai_chatgpt_enterprise.*
131'''
132
133[[rule.threat]]
134framework = "MITRE ATT&CK"
135
136[[rule.threat.technique]]
137id = "T1027"
138name = "Obfuscated Files or Information"
139reference = "https://attack.mitre.org/techniques/T1027/"
140
141[rule.threat.tactic]
142id = "TA0005"
143name = "Defense Evasion"
144reference = "https://attack.mitre.org/tactics/TA0005/"
145
146[[rule.threat_mappings]]
147framework = "MITRE ATLAS"
148version = "2026.08"
149
150[[rule.threat_mappings.threat]]
151framework = "MITRE ATLAS"
152
153[[rule.threat_mappings.threat.technique]]
154id = "AML.T0068"
155name = "LLM Prompt Obfuscation"
156reference = "https://atlas.mitre.org/techniques/AML.T0068/"
157
158[rule.threat_mappings.threat.tactic]
159id = "AML.TA0007"
160name = "Defense Evasion"
161reference = "https://atlas.mitre.org/tactics/AML.TA0007/"