GenAI Identity Hijacking: Containing Encryption-Based Risks in Enterprise Agents

---
title: GenAI Agent Spawning Encryption Utility
id: 8f4a2b1c-9e3d-4f5a-8b1c-2d3e4f5a6b7c
status: experimental
description: Detects known GenAI application processes spawning encryption or system utilities like cipher, vssadmin, or powershell.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
  - attack.impact
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
      - '\Teams.exe'
      - '\Copilot.exe'
      - '\python.exe' # Common for custom agents
    Image|endswith:
      - '\cipher.exe'
      - '\vssadmin.exe'
      - '\powershell.exe'
      - '\cmd.exe'
  condition: selection
falsepositives:
  - Legitimate administrative troubleshooting by IT staff using AI assistance
level: high
---
title: Excessive Role Assignment to AI Service Principal
id: 3d2e1f0a-9b8c-7d6e-5f4a-3b2c1d0e9f8a
status: experimental
description: Detects the assignment of high-privilege roles (e.g., Global Admin, Contributor) to identities tagged as AI or Service Principals.
references:
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1078.004
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    LoggedByService: 'Core Directory'
    Category: 'RoleManagement'
    OperationName:
      - 'Add member to role'
      - 'Assign role'
    TargetProperties|contains:
      - 'ServicePrincipal'
      - 'ManagedIdentity'
    ModifiedProperties|contains:
      - 'Global Administrator'
      - 'Security Administrator'
      - 'User Administrator'
  condition: selection
falsepositives:
  - Legitimate deployment of a new AI agent requiring elevated access (rare and should be scoped)
level: high

// Hunt for mass file operations by AI Service Accounts
DeviceFileEvents
| where Timestamp > ago(24h)
// Filter for non-interactive session types or specific AI account naming conventions
| where InitiatingProcessAccountName contains "svc" 
   or InitiatingProcessAccountName contains "ai" 
   or InitiatingProcessAccountName contains "bot"
// Look for encryption-related actions or massive write volumes
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| summarize Count = count(), FileSet = makeset(FileName) by InitiatingProcessAccountName, DeviceName, bin(Timestamp, 5m)
| where Count > 50 // Threshold for "mass" activity
| order by Count desc

-- Hunt for suspicious service account activity related to AI agents
SELECT Pid, Name, CommandLine, Username, Exe, ParentInfo.Name AS ParentName
FROM pslist()
WHERE Username =~ 'svc_' 
   OR Username =~ 'AI_'
   OR Username =~ '.*$' // Non-interactive patterns
AND (
   Name =~ 'cipher.exe' 
   OR Name =~ 'vssadmin.exe' 
   OR Name =~ 'wbadmin.exe'
   OR CommandLine =~ '-encrypt' 
   OR CommandLine =~ '-delete'
)

<#
.SYNOPSIS
    Audit AI/Service Principal Permissions for Encryption Risk.
.DESCRIPTION
    Identifies accounts with patterns matching AI/Bot/Service accounts 
    that are members of high-privilege groups or have direct write access.
#>

Import-Module ActiveDirectory

$RiskGroups = @("Domain Admins", "Enterprise Admins", "Organization Management", "Backup Operators")
$SuspiciousPatterns = @("*svc*", "*ai*", "*bot*", "*agent*")

Write-Host "[+] Initiating AI Identity Privilege Audit..." -ForegroundColor Cyan

foreach ($Pattern in $SuspiciousPatterns) {
    $Accounts = Get-ADUser -Filter {Name -like $Pattern} -Properties MemberOf
    
    foreach ($Account in $Accounts) {
        $Privileges = $Account.MemberOf | Get-ADGroup | Select-Object -ExpandProperty Name
        $HighRisk = $Privileges | Where-Object { $_ -in $RiskGroups }
        
        if ($HighRisk) {
            Write-Host "[!] CRITICAL: Account '$($Account.Name)' matches pattern '$Pattern' and is in: $($HighRisk -join ', ')" -ForegroundColor Red
        }
    }
}

# Check for Service Principals (Azure AD module required for full cloud scope)
try {
    Connect-MgGraph -Scopes "Directory.Read.All" -NoWelcome
    $ServicePrincipals = Get-MgServicePrincipal -All
    
    foreach ($SP in $ServicePrincipals) {
        if ($SP.DisplayName -match "(svc|ai|bot|agent)") {
            $AppRoles = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $SP.Id
            if ($AppRoles) {
                Write-Host "[*] AI/Service Principal found: $($SP.DisplayName) with Role Assignments." -ForegroundColor Yellow
                $AppRoles | Select-Object ResourceDisplayName, AppRoleId
            }
        }
    }
} catch {
    Write-Host "[-] Azure AD audit skipped. Ensure Microsoft.Graph module is installed." -ForegroundColor Gray
}