-
GenAI Process Connection to Suspicious Top Level Domain
Oct 1, 2026 · Domain: Endpoint OS: macOS OS: Windows Use Case: Threat Detection Tactic: Command and Control Data Source: Elastic Defend Data Source: Sysmon Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: Suspicious TLD Threat: Unauthorized AI Usage Rule Type: Event Correlation (EQL) Platform: Windows Platform: macOS Domain: GenAI Mitre Atlas: AML.T0072 ·Detects when GenAI tools connect to domains using suspicious TLDs commonly abused for malware C2 infrastructure. TLDs like .top, .xyz, .ml, .cf, .onion are frequently used in phishing and malware campaigns. Legitimate GenAI services use well-established domains (.com, .ai, .io), so connections to suspicious TLDs may indicate compromised tools, malicious plugins, or AI-generated code connecting to attacker infrastructure.
Read More -
GenAI Process Connection to Unusual Domain
Oct 1, 2026 · Domain: Endpoint OS: macOS Use Case: Threat Detection Tactic: Command and Control Data Source: Elastic Defend Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: Unauthorized AI Usage Rule Type: New Terms Platform: macOS Domain: GenAI Mitre Atlas: AML.T0072 ·Detects GenAI tools connecting to unusual domains on macOS. Adversaries may compromise GenAI tools through prompt injection, malicious MCP servers, or poisoned plugins to establish C2 channels or exfiltrate sensitive data to attacker-controlled infrastructure. AI agents with network access can be manipulated to beacon to external servers, download malicious payloads, or transmit harvested credentials and documents.
Read More