Defending Against Shadow AI Supply-Chain Attacks: Lessons from the 2026 Vercel Incident

---
title: Potential Shadow AI Tool Execution
id: a1b2c3d4-5678-90ab-cdef-123456789012
status: experimental
description: Detects execution of known or suspicious AI/copilot tools from unapproved sources. This rule targets processes associated with common AI development tools that may represent Shadow AI adoption.
references:
  - https://attack.mitre.org/techniques/T1195/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1195
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - 'copilot'
      - 'cursor'
      - 'codium'
      - 'tabnine'
      - 'codegpt'
      - 'codeium'
      - 'continue'
      - 'aider'
      - 'gpt-engineer'
    -   Image|contains:
          - 'AppData\\Local'
          - 'AppData\\Roaming'
  filter:
    Signed: 'true'
    Publisher|contains:
      - 'Microsoft Corporation'
      - 'GitHub'
      - 'JetBrains'
  condition: selection and not filter
falsepositives:
  - Approved AI tools from corporate catalog
  - Legitimate development tool installations approved by IT
level: medium
---
title: Suspicious Network Connection to AI Service Domains
id: b2c3d4e5-6789-01ab-cdef-234567890123
status: experimental
description: Detects outbound network connections from developer workstations to known AI service domains or suspicious AI-related endpoints. May indicate Shadow AI usage or data exfiltration.
references:
  - https://attack.mitre.org/techniques/T1041/
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.exfiltration
  - attack.command_and_control
  - attack.t1041
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationHostname|contains:
      - 'api.anthropic.com'
      - 'api.openai.com'
      - 'api.cohere.ai'
      - 'api.ai21.com'
      - 'cursor.sh'
      - 'codeium.com'
      - 'tabnine.com'
      - 'copilot.githubusercontent.com'
  filter_corporate:
    SourceHostname|contains:
      - 'corp-'
      - 'dev-'
      - 'build-'
  condition: selection and filter_corporate
falsepositives:
  - Approved enterprise AI integrations
  - Corporate-sanctioned AI service usage
level: low
---
title: Deceptive Link Execution via AI Tools
id: c3d4e5f6-7890-12ab-cdef-345678901234
status: experimental
description: Detects suspicious process chains where an AI tool spawns browser or network processes with potential deceptive link parameters. This mirrors the Vercel attack vector where attackers weaponized trusted links.
references:
  - https://attack.mitre.org/techniques/T1204/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.execution
  - attack.user_execution
  - attack.t1204
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    Image|contains:
      - 'copilot'
      - 'cursor'
      - 'codium'
      - 'tabnine'
  selection_child:
    Image|endswith:
      - '\\chrome.exe'
      - '\\msedge.exe'
      - '\\firefox.exe'
      - '\\brave.exe'
    CommandLine|contains:
      - 'http://'
      - 'https://'
    CommandLine|contains:
      - 'token='
      - 'auth='
      - 'session='
      - 'key='
      - 'oauth='
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate AI tool link handling
  - User-initiated browser launches from AI tools
level: high

// Hunt for Shadow AI tool executions on endpoints
let KnownAITools = dynamic(['copilot', 'cursor', 'codium', 'tabnine', 'codegpt', 'codeium', 'continue', 'aider', 'gpt-engineer']);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessVersionInfoCompanyName !in ('Microsoft Corporation', 'GitHub', 'JetBrains', 'Amazon Web Services')
| where FolderPath has 'AppData' 
| where ProcessName has_any (KnownAITools) or ProcessCommandLine has_any (KnownAITools)
| extend AI_Tool = coalesce(
    extract(@'(copilot|cursor|codium|tabnine|codegpt|codeium|continue|aider|gpt-engineer)', 1, ProcessName),
    extract(@'(copilot|cursor|codium|tabnine|codegpt|codeium|continue|aider|gpt-engineer)', 1, ProcessCommandLine)
)
| project Timestamp, DeviceName, AccountName, ProcessName, ProcessCommandLine, FolderPath, SHA256, AI_Tool
| summarize count() by DeviceName, AI_Tool, SHA256, ProcessName
| order by count_ desc
| extend Recommendation = iff(count_ > 5, 'FREQUENT_EXECUTION', 'SPORADIC_EXECUTION');


// Hunt for network connections to AI service domains from dev workstations
let AIServiceDomains = dynamic(['api.anthropic.com', 'api.openai.com', 'api.cohere.ai', 'api.ai21.com', 'cursor.sh', 'codeium.com', 'tabnine.com', 'copilot.githubusercontent.com', 'oaistatic.com', 'oaiusercontent.com']);
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (AIServiceDomains)
| where InitiatingProcessVersionInfoCompanyName !in ('Microsoft Corporation', 'GitHub', 'JetBrains')
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessName, InitiatingProcessCommandLine, RemoteUrl, RemotePort, RemoteIP
| summarize count(), unique(RemoteIP) by DeviceName, InitiatingProcessName, RemoteUrl
| order by count_ desc
| where unique_RemoteIP > 1 // Multiple IPs may indicate C2 rotation
| extend RiskIndicator = 'Multiple_IPs_to_AIService';


// Detect suspicious process chains from AI tools spawning browser processes with token parameters
let AIProcesses = DeviceProcessEvents
| where Timestamp > ago(3d)
| where ProcessName has_any (dynamic(['copilot', 'cursor', 'codium', 'tabnine', 'codeium', 'codegpt']))
| project ProcessId = InitiatingProcessId, DeviceId, DeviceName, AIProcessName = ProcessName, AICommandLine = ProcessCommandLine, Timestamp;
let BrowserProcesses = DeviceProcessEvents
| where Timestamp > ago(3d)
| where FileName in ('chrome.exe', 'msedge.exe', 'firefox.exe', 'brave.exe')
| where ProcessCommandLine has_any (dynamic(['token=', 'auth=', 'session=', 'key=', 'oauth=', 'credential=']))
| project ProcessId, DeviceId, DeviceName, BrowserName = ProcessName, BrowserCommandLine = ProcessCommandLine, InitiatingProcessParentId, Timestamp;
AIProcesses
| join kind=inner BrowserProcesses on $left.ProcessId == $right.InitiatingProcessParentId, DeviceId, DeviceName
| project Timestamp, DeviceName, AIProcessName, AICommandLine, BrowserName, BrowserCommandLine
| order by Timestamp desc
| extend MITRE_Tactic = 'Execution', MITRE_Technique = 'T1204.002', ThreatDescription = 'AI tool spawning browser with credential/token parameters - possible deceptive link attack';

-- Hunt for Shadow AI tools installed on endpoints
LET AI_TOOL_PATTERNS = [
  '*copilot*', '*cursor*', '*codium*', '*tabnine*', 
  '*codegpt*', '*codeium*', '*continue*', '*aider*', '*gpt-engineer*'
]

-- Search for AI tool executables in user directories
SELECT FullPath, Size, Mtime, Atime, Btime, 
       Sys.ImagePath, Sys.ImageSubsystem
FROM glob(globs=JOIN(array=['C:/Users/*/AppData/Local/**', 
                            'C:/Users/*/AppData/Roaming/**'], 
                      sep=''),
       accessor='file')
WHERE FullPath =~ AI_TOOL_PATTERNS
  AND NOT FullPath =~ 'Program Files'
  AND NOT FullPath =~ 'Program Files (x86)'

-- Hunt for AI tool processes and network connections
SELECT Pid, Name, Exe, Username, CommandLine, 
       StartTime, CpuTime, MemoryUsed
FROM pslist()
WHERE Name =~ AI_TOOL_PATTERNS
   OR Exe =~ AI_TOOL_PATTERNS

-- Get network connections from AI tools
SELECT Pid, RemoteAddr, RemotePort, State, Family,
       Process.Name, Process.Exe, Process.Username
FROM netstat()
WHERE Process.Name =~ AI_TOOL_PATTERNS
   OR Process.Exe =~ AI_TOOL_PATTERNS
   OR RemoteAddr =~ '(api\.openai\.com|api\.anthropic\.com|cursor\.sh|codeium\.com)'

<#
.SYNOPSIS
    Detect and Report Shadow AI Tools - Vercel Breach Response
.DESCRIPTION
    Scans endpoints for unauthorized AI/copilot tools following the 
    2026 Vercel Shadow AI supply-chain breach. Generates audit report
    and optionally quarantines suspicious installations.
.NOTES
    Author: Security Arsenal
    Date: 2026-04-15
    Version: 1.0
#>

[CmdletBinding()]
param(
    [Parameter(Mandatory=$false)]
    [string]$OutputPath = "$env:TEMP\ShadowAI_Audit_$(Get-Date -Format 'yyyyMMdd').csv",
    
    [Parameter(Mandatory=$false)]
    [switch]$Quarantine,
    
    [Parameter(Mandatory=$false)]
    [string[]]$ApprovedPublishers = @('Microsoft Corporation', 'GitHub', 'JetBrains', 'Amazon Web Services', 'OpenAI, Inc.')
)

# Known AI tool patterns - adjust based on your environment's approved list
$AIToolPatterns = @(
    '*copilot*', '*cursor*', '*codium*', '*tabnine*', 
    '*codegpt*', '*codeium*', '*continue*', '*aider*', '*gpt-engineer*',
    '*claude*', '*perplexity*', '*poe*', '*character*'
)

$Results = @()
$UserProfiles = Get-ChildItem 'C:\Users' -Directory | Where-Object { $_.Name -notin @('Public', 'Default', 'Default User') }

foreach ($Profile in $UserProfiles) {
    $SearchPaths = @(
        "$($Profile.FullName)\AppData\Local",
        "$($Profile.FullName)\AppData\Roaming",
        "$($Profile.FullName)\Downloads"
    )
    
    foreach ($Path in $SearchPaths) {
        if (Test-Path $Path) {
            Write-Verbose "Scanning: $Path"
            
            try {
                $Files = Get-ChildItem -Path $Path -Recurse -File -ErrorAction SilentlyContinue |
                    Where-Object { 
                        $Match = $false
                        foreach ($Pattern in $AIToolPatterns) {
                            if ($_.Name -like $Pattern -or $_.DirectoryName -like $Pattern) {
                                $Match = $true
                                break
                            }
                        }
                        $Match
                    }
                
                foreach ($File in $Files) {
                    $Signature = $null
                    try {
                        $Signature = Get-AuthenticodeSignature -FilePath $File.FullName -ErrorAction SilentlyContinue
                    } catch {
                        $Signature = $null
                    }
                    
                    $IsApproved = $false
                    if ($Signature -and $Signature.Status -eq 'Valid') {
                        $Publisher = if ($Signature.SignerCertificate) {
                            $Signature.SignerCertificate.Subject
                        } else { $null }
                        
                        foreach ($ApprovedPublisher in $ApprovedPublishers) {
                            if ($Publisher -like "*$ApprovedPublisher*") {
                                $IsApproved = $true
                                break
                            }
                        }
                    }
                    
                    $Result = [PSCustomObject]@{
                        Timestamp = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
                        ComputerName = $env:COMPUTERNAME
                        Username = $Profile.Name
                        FilePath = $File.FullName
                        FileName = $File.Name
                        FileSize = $File.Length
                        ModifiedDate = $File.LastWriteTime
                        SignatureStatus = if ($Signature) { $Signature.Status } else { 'Unsigned' }
                        Publisher = if ($Signature.SignerCertificate) { $Signature.SignerCertificate.Subject } else { 'Unknown' }
                        IsApproved = $IsApproved
                        Action = 'None'
                    }
                    
                    if (-not $IsApproved -and $Quarantine) {
                        $QuarantinePath = "$env:TEMP\Quarantine_ShadowAI_$(Get-Date -Format 'yyyyMMdd')"
                        if (-not (Test-Path $QuarantinePath)) {
                            New-Item -Path $QuarantinePath -ItemType Directory -Force | Out-Null
                        }
                        
                        try {
                            Move-Item -Path $File.FullName -Destination "$QuarantinePath\$($File.Name)" -Force
                            $Result.Action = 'Quarantined'
                            Write-Warning "Quarantined: $($File.FullName)"
                        } catch {
                            $Result.Action = 'Quarantine_Failed'
                            Write-Error "Failed to quarantine: $($File.FullName) - $_"
                        }
                    } elseif (-not $IsApproved) {
                        $Result.Action = 'Flagged_Unapproved'
                    }
                    
                    $Results += $Result
                }
            } catch {
                Write-Error "Error scanning $Path : $_"
            }
        }
    }
}

# Export results
$Results | Export-Csv -Path $OutputPath -NoTypeInformation -Force
Write-Host ""
Write-Host "Shadow AI Audit Complete" -ForegroundColor Cyan
Write-Host "Results exported to: $OutputPath" -ForegroundColor Green

# Summary
$Summary = $Results | Group-Object Action | Select-Object Count, Name
Write-Host ""
Write-Host "Summary:" -ForegroundColor Yellow
$Summary | Format-Table -AutoSize

# Network connection check for AI services
$AIEndpoints = @(
    'api.openai.com', 'api.anthropic.com', 'cursor.sh', 
    'codeium.com', 'tabnine.com', 'copilot.githubusercontent.com'
)

$NetConnections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { 
        $RemoteAddress = $_.RemoteAddress
        try {
            $Hostname = [System.Net.Dns]::GetHostEntry($RemoteAddress).HostName
            foreach ($Endpoint in $AIEndpoints) {
                if ($Hostname -like "*$Endpoint*") {
                    return $true
                }
            }
        } catch {
            return $false
        }
        return $false
    }

if ($NetConnections) {
    Write-Host ""
    Write-Host "Active connections to AI services detected:" -ForegroundColor Yellow
    $NetConnections | Format-Table LocalAddress, RemoteAddress, State, OwningProcess -AutoSize
}