Falcon AIDR: Detecting Prompt Injection Threats in Kubernetes AI Applications

---
title: Potential Kubernetes AI Model Exfiltration via kubectl cp
id: a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential exfiltration of model artifacts from AI pods using kubectl cp. Adversaries may attempt to steal weights or data.
references:
  - https://attack.mitre.org/techniques/T1040/
author: Security Arsenal
date: 2025/05/01
tags:
  - attack.exfiltration
  - attack.t1040
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: '/kubectl'
    CommandLine|contains: 'cp'
    CommandLine|contains:
      - '/var/lib/kubelet/pods'
      - 'model-'
      - '/tmp/ray'
  condition: selection
falsepositives:
  - Legitimate backup operations by data scientists
level: high
---
title: Suspicious Interactive Shell Access to AI Workloads
id: b2c3d4e5-f6a7-5b6c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects interactive shell access (kubectl exec) to pods typically associated with AI/ML workloads (e.g., Ray, Jupyter, Triton).
references:
  - https://attack.mitre.org/techniques/T1211/
author: Security Arsenal
date: 2025/05/01
tags:
  - attack.execution
  - attack.t1211
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    verb: 'create'
    objectRef:
      resource: 'pods'
    subresource: 'exec'
    requestObject:
      command:
        - '/bin/sh'
        - '/bin/bash'
  filter_allowed_ns:
    namespace|endswith:
      - '-monitoring'
      - '-logging'
  filter_ai_labels:
    objectRef:
      name|contains:
        - 'jupyter'
        - 'ray'
        - 'triton'
        - 'llm'
  condition: selection and not filter_allowed_ns and filter_ai_labels
falsepositives:
  - Administrators debugging production models
level: medium
---
title: Linux Process Accessing GPU Device Files from Non-Standard Parent
id: c3d4e5f6-a7b8-6c7d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects processes attempting to access GPU device files (/dev/nvidia*) outside of known AI runtimes. May indicate malicious crypto-mining or model hijacking.
references:
  - https://attack.mitre.org/techniques/T1496/
author: Security Arsenal
date: 2025/05/01
tags:
  - attack.resource-hijacking
  - attack.t1496
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains: '/dev/nvidia'
  filter_legit:
    ParentImage|endswith:
      - '/python'
      - '/python3'
      - '/containerd'
      - 'nvidia-smi'
  condition: selection and not filter_legit
falsepositives:
  - Custom CUDA drivers or debugging tools
level: high

// Hunt for suspicious HTTP patterns indicative of Prompt Injection targeting known AI endpoints
// Note: Requires ContainerLog or Syslog ingestion from Ingress Controllers (e.g., Nginx, Istio)
let AIEndpoints = dynamic(["/v1/completions", "/v1/chat", "/predict", "/inference"]);
let InjectionKeywords = dynamic(["ignore instructions", "system prompt", "override previous", "jailbreak", "print database"]);
Syslog
| where ProcessName contains "nginx" or ProcessName contains "envoy"
| where SyslogMessage has_any (AIEndpoints)
| extend RequestBody = extract(@'POST.*\n\n(.*)', 1, SyslogMessage)
| where RequestBody has_any (InjectionKeywords)
| project TimeGenerated, Computer, ProcessName, RequestBody, SourceIP
| order by TimeGenerated desc

-- Hunt for processes accessing model directories or GPU devices in K8s nodes
SELECT Pid, Name, CommandLine, Exe, Username, Cwd
FROM pslist()
WHERE (Name IN ('curl', 'wget', 'python', 'python3') AND CommandLine =~ '/models/')
   OR Exe =~ '/dev/nvidia'
   OR (CommandLine =~ 'kubectl' AND CommandLine =~ 'cp')

#!/bin/bash
# Remediation: Harden Kubernetes AI Workloads
# This script checks for common misconfigurations in AI/ML namespaces and applies restrictive NetworkPolicies

set -e

echo "[*] Checking for pods with GPU access in default namespaces..."
kubectl get pods --all-namespaces -o  | jq -r '.items[] | select(.spec.containers[].resources.limits."nvidia.com/gpu") | "\(.metadata.namespace) \(.metadata.name)"' | while read namespace pod; do
  if [[ "$namespace" == "default" ]]; then
    echo "[!] ALERT: GPU Pod found in default namespace: $pod"
  fi
done

echo "[*] Auditing KubeRay or Jupyter services for LoadBalancer type (Public Exposure)..."
kubectl get svc --all-namespaces -o  | jq -r '.items[] | select(.metadata.name | test("jupyter|ray-head"; "i")) | select(.spec.type == "LoadBalancer") | "\(.metadata.namespace) \(.metadata.name)"' | while read namespace svc; do
  echo "[!] WARNING: Exposed AI Service found: $svc in $namespace"
done

echo "[*] Applying default-deny NetworkPolicy to AI-labeled namespaces..."
# This is a safety measure; AI pods should only talk to specific upstreams
cat <<EOF | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
  namespace: kube-ai  # Replace with your AI namespace
spec:
  podSelector: {}
  policyTypes:
  - Ingress
EOF

echo "[+] Hardening complete. Please review specific alerts above."