---
title: Potential Data Exfiltration to Public Generative AI Services
id: 1a2b3c4d-5e6f-7g8h-9i0j-1k2l3m4n5o6p
status: experimental
description: Detects network connections to known public generative AI service domains which may indicate sensitive data is being uploaded to external models.
references:
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2024/05/22
tags:
  - attack.exfiltration
  - attack.t1567.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'openai.com'
      - 'api.openai.com'
      - 'anthropic.com'
      - 'bard.google.com'
      - 'claude.ai'
  condition: selection
falsepositives:
  - Authorized use of AI tools by research or development teams
level: medium
---
title: Suspicious PowerShell Clipboard Interaction for Potential Prompt Injection
id: 2b3c4d5e-6f7g-8h9i-0j1k-2l3m4n5o6p7q
status: experimental
description: Detects PowerShell scripts accessing clipboard content immediately followed by a web request, a pattern often used in data scraping or prompt injection setups.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2024/05/22
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Get-Clipboard'
  condition: selection
falsepositives:
  - Legitimate administrative scripts involving clipboard data
level: low
---
title: Python AI Library Execution with Network Connectivity
id: 3c4d5e6f-7g8h-9i0j-1k2l-3m4n5o6p7q8r
status: experimental
description: Detects the execution of Python scripts importing common AI libraries (OpenAI, LangChain) which may indicate the use of unsanctioned AI tools.
references:
  - https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2024/05/22
tags:
  - attack.command_and_control
  - attack.t1102.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\python.exe'
    CommandLine|contains:
      - 'import openai'
      - 'from langchain'
      - 'import anthropic'
  condition: selection
falsepositives:
  - Approved data science or ML development workflows
level: medium

// Hunt for network connections to known Generative AI domains
DeviceNetworkEvents
| where RemoteUrl has_any ("openai.com", "anthropic.com", "bard.google.com", "api.openai.com")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemotePort, BytesSent, BytesReceived
| summarize Count=count(), TotalBytesSent=sum(BytesSent), TotalBytesReceived=sum(BytesReceived) by DeviceName, InitiatingProcessAccountName, RemoteUrl
| order by TotalBytesSent desc


// Detect PowerShell reading clipboard and making web requests (Potential data scraping)
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has "Get-Clipboard"
| join kind=inner (
    DeviceNetworkEvents
    | where InitiatingProcessFileName =~ "powershell.exe"
    | where Timestamp > ago(1d)
) on DeviceId, InitiatingProcessCommandLine
| project Timestamp, DeviceName, InitiatingProcessCommandLine, RemoteUrl

-- Hunt for Python scripts containing AI library imports
SELECT FullPath, Mtime, Size
FROM glob(globs="C:/Users/**/*.py")
WHERE read_file(filename=FullPath) =~ '(?i)import (openai|anthropic|langchain|tiktoken)'

-- Check for environment variables containing AI API keys (leakage risk)
SELECT Name, Value
FROM envars()
WHERE Name =~ 'API_KEY' OR Name =~ 'OPENAI' OR Name =~ 'ANTHROPIC'

<#
.SYNOPSIS
    Audit for unauthorized AI installations and API Keys.
.DESCRIPTION
    Checks user profiles for Python AI packages and environment variables.
#>

# Check for AI-related Python packages in common pip directories
$PipPaths = @(
    "$env:APPDATA\Python*\site-packages",
    "$env:LOCALAPPDATA\Programs\Python*\Lib\site-packages"
)

foreach ($Path in $PipPaths) {
    if (Test-Path $Path) {
        Write-Host "Checking path: $Path"
        Get-ChildItem -Path $Path -Directory -ErrorAction SilentlyContinue | 
            Where-Object { $_.Name -match "openai|anthropic|langchain|transformers" } | 
            Select-Object FullName, LastWriteTime
    }
}

# Check Environment Variables for API Keys
Get-ChildItem Env: | Where-Object { 
    $_.Name -match "KEY|TOKEN|SECRET" -and 
    $_.Value -match "sk-|org-" 
} | Select-Object Name, Value