Defending Against AI-Themed Social Engineering: Detection and Response Strategies for 2026

---
title: Suspicious Executable with AI-Themed Naming Pattern
id: 9a1b2c3d-4e5f-6789-0123-456789abcdef
status: experimental
description: Detects the creation or execution of executables containing AI-related keywords commonly used in social engineering lures (e.g., gpt, claude, midjourney) located in user download paths.
references:
 - https://www.microsoft.com/en-us/security/blog/2026/06/08/ai-brands-as-bait-how-threat-actors-are-using-the-ai-hype-in-social-engineering/
author: Security Arsenal
date: 2026/06/09
tags:
 - attack.initial_access
 - attack.t1566.001
logsource:
 category: file_event
 product: windows
detection:
 selection:
 TargetFilename|contains:
   - '\\Downloads\'
   - '\\AppData\\Local\\Temp\'
   - '\\Desktop\'
 selection_keywords:
 TargetFilename|contains:
   - 'gpt'
   - 'chatgpt'
   - 'midjourney'
   - 'claude'
   - 'gemini'
   - 'copilot'
   - 'stable-diffusion'
   - 'ai-assistant'
 selection_ext:
 TargetFilename|endswith:
   - '.exe'
   - '.msi'
   - '.bat'
   - '.ps1'
   - '.js'
 condition: selection and selection_keywords and selection_ext
falsepositives:
  - Legitimate installation of legitimate AI tools (rare in Downloads/Temp)
level: high
---
title: PowerShell Execution with AI-Themed Parameters
id: b2c3d4e5-6789-0123-4567-89abcdef01
status: experimental
description: Detects PowerShell processes executing scripts or commands referencing AI brands, often used by downloaders masquerading as AI installers.
references:
 - https://www.microsoft.com/en-us/security/blog/2026/06/08/ai-brands-as-bait-how-threat-actors-are-using-the-ai-hype-in-social-engineering/
author: Security Arsenal
date: 2026/06/09
tags:
 - attack.execution
 - attack.t1059.001
logsource:
 category: process_creation
 product: windows
detection:
 selection:\   Image|endswith:
     - '\\powershell.exe'
     - '\\pwsh.exe'
   CommandLine|contains:
     - 'gpt'
     - 'openai'
     - 'midjourney'
     - 'huggingface'
   CommandLine|contains:
     - 'downloadstring'
     - 'iex'
     - 'invoke-expression'
 condition: selection
falsepositives:
  - Developer or administrative tasks using legitimate AI APIs (verify user)
level: high

// Hunt for connections to suspicious AI-themed domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| extend Domain = tostring(parse_url(RemoteUrl).Host)
| where Domain has_any(\"gpt\", \"chatgpt\", \"openai\", \"midjourney\", \"claude\", \"anthropic\", \"huggingface\", \"stability\")
// Filter out known legitimate vendors (update list as needed)
| where Domain !in (\"openai.com\", \"anthropic.com\", \"microsoft.com\", \"github.com\")
| where ActionType != \"ConnectionAllowed\" or RiskScore > 0
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, ActionType, RiskScore
| summarize count() by RemoteUrl, DeviceName
| order by count_ desc

-- Hunt for AI-themed executables in user profiles
SELECT FullPath, Size, Mtime, Sys.btime AS CreateTime
FROM glob(globs=\"C:/Users/*/Downloads/*.exe\")
WHERE 
  FullPath =~ \"(?i)(gpt|chatgpt|claude|midjourney|copilot|gemini|stable-diffusion)\"
UNION ALL
SELECT FullPath, Size, Mtime, Sys.btime AS CreateTime
FROM glob(globs=\"C:/Users/*/Desktop/*.exe\")
WHERE 
  FullPath =~ \"(?i)(gpt|chatgpt|claude|midjourney|copilot|gemini|stable-diffusion)\"

# Security Arsenal - AI-Themed Threat Quarantine Helper
# Scans User Downloads and Desktop for suspicious executables

$Keywords = @(\"gpt\", \"chatgpt\", \"claude\", \"midjourney\", \"copilot\", \"gemini\", \"stable\", \"diffusion\", \"openai\")
$SuspiciousPaths = @(\"Downloads\", \"Desktop\", \"AppData\\Local\\Temp\")
$Report = @()

Write-Host \"[+] Initiating scan for AI-themed suspicious binaries...\"

# Get all user profiles
$Users = Get-ChildItem -Path \"C:\\Users\" -Directory

foreach ($User in $Users) {
    foreach ($PathType in $SuspiciousPaths) {
        $FullPath = Join-Path -Path $User.FullName -ChildPath $PathType
        
        if (Test-Path $FullPath) {
            # Find executables matching keywords
            $Files = Get-ChildItem -Path $FullPath -File -Recurse -ErrorAction SilentlyContinue | 
                     Where-Object { $_.Extension -match '\\.(exe|bat|ps1|js|msi)' -and 
                                    ($Keywords | Where-Object { $_.Name -like \"*$($_)*\" }) }
            
            foreach ($File in $Files) {
                $Details = @{
                    Timestamp = Get-Date
                    User      = $User.Name
                    Path      = $File.FullName
                    Size      = $File.Length
                    Created   = $File.CreationTime
                    Modified  = $File.LastWriteTime
                }
                $Report += [PSCustomObject]$Details
                
                # Optional: Attempt to block the file (requires Admin)
                try {
                    $Acl = Get-Acl $File.FullName
                    $Ar = New-Object System.Security.AccessControl.FileSystemAccessRule(\"BUILTIN\\Users\",\"ReadAndExecute\",\"Deny\")
                    $Acl.SetAccessRule($Ar)
                    Set-Acl $File.FullName $Acl
                    Write-Host \"[!] QUARANTINED: $($File.FullName)\" -ForegroundColor Yellow
                } catch {
                    Write-Host \"[-] Found (No Block): $($File.FullName)\" -ForegroundColor Cyan
                }
            }
        }
    }
}

# Output Report
if ($Report.Count -gt 0) {
    $Report | Export-Csv -Path \"C:\\Windows\\Temp\\AI_Threat_Scan.csv\" -NoTypeInformation
    Write-Host \"[+] Scan complete. Report saved to C:\\Windows\\Temp\\AI_Threat_Scan.csv\"
} else {
    Write-Host \"[+] No suspicious AI-themed binaries found.\"
}