-
Connection to Common Large Language Model Endpoints
Oct 1, 2026 · Domain: Endpoint OS: Windows OS: macOS Use Case: Threat Detection Tactic: Command and Control Resources: Investigation Guide Data Source: Elastic Endgame Data Source: Elastic Defend Data Source: SentinelOne Data Source: Sysmon Noise: High Performance: Normal Profile: Aggressive Threat: Unauthorized AI Usage Rule Type: Event Correlation (EQL) Platform: Windows Platform: macOS Domain: GenAI Mitre Atlas: AML.T0096 ·Identifies DNS queries to known Large Language Model domains by unsigned binaries or common Windows scripting utilities. Malwares may leverage the capabilities of LLM to perform actions in the affected system in a dynamic way.
Read More