AI Search Poisoning, Repo-Leaking Coding Assistants, and One-Click Code Execution: A Defender's Playbook for Poisoned Trusted Paths

---
title: Browser Spawning Script Interpreter or LOLBin
title: Browser Spawning Script Interpreter or LOLBin
id: 3f8a2c71-9b4e-4d12-a756-2c8e9f0a1b34
status: experimental
description: Detects web browsers spawning script interpreters or living-off-the-land binaries, consistent with AI search poisoning, ClickFix fake-prompt, and malvertising payload chains where the lure page initiates execution.
references:
  - https://thehackernews.com/2026/09/threatsday-ai-search-poisoning-ai.html
  - https://attack.mitre.org/techniques/T1204/002/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare enterprise browser extensions performing scripted automation
  - Legitimate software updaters (validate against software inventory)
level: high
---
title: Suspicious Access to Git Credentials and SSH Keys by Non-Developer Tooling
id: 8c1d4e92-6a3f-4b87-c921-5d7a0e3f6b28
status: experimental
description: Detects command-line access to git credential stores, SSH private keys, or environment files by utilities commonly abused for exfiltration, consistent with AI coding tool compromise or prompt-injection driven repository and secret leakage.
references:
  - https://thehackernews.com/2026/09/threatsday-ai-search-poisoning-ai.html
  - https://attack.mitre.org/techniques/T1552/001/
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.exfiltration
  - attack.t1567
logsource:
  category: process_creation
  product: windows
detection:
  selection_paths:
    CommandLine|contains:
      - '\.git\config'
      - 'credentials.git'
      - '.git-credentials'
      - '\.ssh\id_rsa'
      - '\.ssh\id_ed25519'
      - '\.env'
      - 'git credential'
  selection_tools:
    Image|endswith:
      - '\curl.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\certutil.exe'
      - '\cmd.exe'
      - '\findstr.exe'
      - '\type.exe'
  condition: selection_paths and selection_tools
falsepositives:
  - Developer scripts managing dotfiles or CI bootstrap automation
  - Legitimate git credential helper operations (tune by Image and user context)
level: high
---
title: Encoded or Download-Cradle Command Line Indicative of One-Click Execution Chain
id: 5b9e7f34-2d8c-4a15-b634-9f1c4a8e2d07
status: experimental
description: Detects encoded PowerShell, inline download cradles, or paste-into-Run style commands associated with one-click execution lures and ClickFix fake-prompt campaigns delivered via poisoned search results.
references:
  - https://thehackernews.com/2026/09/threatsday-ai-search-poisoning-ai.html
  - https://attack.mitre.org/techniques/T1059/001/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_encoded:
    CommandLine|contains:
      - ' -enc '
      - ' -ec '
      - '-EncodedCommand'
      - 'FromBase64String'
  selection_cradle:
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'iwr '
      - 'irm '
      - 'DownloadString'
      - 'Start-BitsTransfer'
      - 'mshta http'
  selection_suspicious_pipe:
    CommandLine|contains:
      - '| iex'
      - '|iex'
      - 'IEX ('
  condition: selection_encoded or (selection_cradle and selection_suspicious_pipe)
falsepositives:
  - Administrative automation using encoded commands (tune per admin account and host role)
level: high

let ScriptEngines = dynamic(["powershell.exe","pwsh.exe","mshta.exe","wscript.exe","cscript.exe","cmd.exe","rundll32.exe","certutil.exe","bitsadmin.exe"]);
let LureParents = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe","winword.exe","excel.exe","outlook.exe","teams.exe","slack.exe","acrord32.exe"]);
let SecretPaths = dynamic(["\\.git\\config",".git-credentials","\\.ssh\\id_","\\.env","git credential"]);
union
(
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ (ScriptEngines)
    | where InitiatingProcessFileName in~ (LureParents)
    | extend HuntSignal = "BrowserOrOfficeSpawnedScriptEngine"
    | project TimeGenerated, HuntSignal, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256, ReportId
),
(
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where ProcessCommandLine has_any (SecretPaths)
    | where FileName in~ (dynamic(["curl.exe","powershell.exe","pwsh.exe","certutil.exe","cmd.exe","findstr.exe"]))
    | where InitiatingProcessFileName !in~ (dynamic(["git.exe","code.exe","devenv.exe","idea64.exe"]))
    | extend HuntSignal = "NonGitProcessReadingRepoSecrets"
    | project TimeGenerated, HuntSignal, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256, ReportId
)
| order by TimeGenerated desc

-- Hunt: Trusted-Path Execution Chains and Secret File Access
-- Targets browser-spawned script engines and non-dev tooling touching repo secrets

SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       get_field(member='Name', item=pslist(pid=Ppid)) AS ParentName
FROM pslist()
WHERE (
        -- Script engines or LOLBins spawned by browsers/office/chat clients
        Name =~ '(?i)(powershell|pwsh|mshta|wscript|cscript|cmd|rundll32|certutil|bitsadmin)\.exe'
        AND get_field(member='Name', item=pslist(pid=Ppid)) =~ '(?i)(chrome|msedge|firefox|brave|opera|winword|excel|outlook|teams|slack)\.exe'
      )
   OR (
        -- Command lines referencing repo secrets, SSH keys, or env files
        CommandLine =~ '(?i)(\.git[/\\\\]config|\.git-credentials|id_rsa|id_ed25519|\.env|git credential)'
        AND Name !~ '(?i)(git|code|devenv|idea64)\.exe'
      )
ORDER BY CreateTime DESC

# Security Arsenal - Trusted Path Attack Surface Audit
# Run elevated. Read-only audit; no system changes are made.

Write-Host "=== [1/4] VS Code Extension Audit ===" -ForegroundColor Cyan
$extPath = "$env:USERPROFILE\.vscode\extensions"
if (Test-Path $extPath) {
    Get-ChildItem $extPath -Directory | ForEach-Object {
        $pkg = Join-Path $_.FullName "package.json"
        if (Test-Path $pkg) {
            $meta = Get-Content $pkg -Raw | ConvertFrom-Json
            [PSCustomObject]@{
                Extension = $meta.name
                Publisher = $meta.publisher
                Version   = $meta.version
            }
        }
    } | Sort-Object Publisher | Format-Table -AutoSize
    Write-Host "ACTION: Compare publisher list against your approved extension allowlist. Unapproved AI/copilot extensions are a repo-leak vector." -ForegroundColor Yellow
} else { Write-Host "No VS Code extensions directory found." }

Write-Host "`n=== [2/4] Git Config Injection Check (repo-level URL rewrites & credential helpers) ===" -ForegroundColor Cyan
$repoRoots = @("$env:USERPROFILE\source", "$env:USERPROFILE\repos", "$env:USERPROFILE\dev", "$env:USERPROFILE\Documents")
foreach ($root in $repoRoots) {
    if (Test-Path $root) {
        Get-ChildItem $root -Recurse -Force -Depth 3 -Filter "config" -ErrorAction SilentlyContinue |
            Where-Object { $_.DirectoryName -like "*\.git*" } | ForEach-Object {
                $content = Get-Content $_.FullName -Raw
                if ($content -match 'insteadOf|credentialhelper|http\.proxy|core\.sshCommand') {
                    Write-Host "REVIEW: $($_.FullName)" -ForegroundColor Red
                    $content | Select-String -Pattern 'insteadOf|credentialhelper|http\.proxy|core\.sshCommand' -AllMatches |
                        ForEach-Object { Write-Host "   $($_.Line.Trim())" }
                }
            }
    }
}

Write-Host "`n=== [3/4] Custom URI Protocol Handlers (one-click execution surface) ===" -ForegroundColor Cyan
Get-ChildItem "HKLM:\SOFTWARE\Classes" -ErrorAction SilentlyContinue |
    Where-Object { $_.Property -contains "URL Protocol" } |
    ForEach-Object {
        $shellCmd = (Get-ItemProperty "$($_.PSPath)\shell\open\command" -ErrorAction SilentlyContinue).'(default)'
        if ($shellCmd -match 'powershell|mshta|wscript|cmd\.exe|curl|rundll32') {
            Write-Host "SUSPICIOUS HANDLER: $($_.PSChildName) -> $shellCmd" -ForegroundColor Red
        }
    }
Write-Host "ACTION: Investigate any flagged handler. Legitimate handlers point to installed application binaries, not script engines." -ForegroundColor Yellow

Write-Host "`n=== [4/4] ASR Rule Status (blunts browser/office-spawned payloads) ===" -ForegroundColor Cyan
$asrRules = @{
    "d4f940ab-401b-4efc-aadc-ad5f3c50688a" = "Block Office apps from creating child processes"
    "26190899-1602-49e8-8b27-eb1d0a1ce869" = "Block Office communication apps from creating child processes"
    "56a863a9-875e-4185-98a7-b882c64b5ce5" = "Block abuse of exploited vulnerable signed drivers"
    "e6db77e5-3df2-4cf1-b95a-636979351e5b" = "Block persistence through WMI event subscription"
}
$current = (Get-MpPreference).AttackSurfaceReductionRules_Ids
$actions = (Get-MpPreference).AttackSurfaceReductionRules_Actions
for ($i=0; $i -lt $current.Count; $i++) {
    $id = $current[$i]
    if ($asrRules.ContainsKey($id)) {
        $state = switch ($actions[$i]) { 0 {"DISABLED"} 1 {"Block"} 2 {"Audit"} 6 {"Warn"} default {"Unknown"} }
        Write-Host ("{0}: {1}" -f $asrRules[$id], $state) -ForegroundColor ($(if($actions[$i] -eq 1){"Green"}else{"Yellow"}))
    }
}
Write-Host "ACTION: Set child-process ASR rules to Block mode on endpoints where workflow testing confirms low impact." -ForegroundColor Yellow
Write-Host "`nAudit complete. Route findings to your change-control and IR queues." -ForegroundColor Cyan