---
title: Potential Data Staging via High-Compression Archiving
id: 9f8e7d6c-5b4a-3210-9876-543210fedcba
status: experimental
description: Detects the creation of high-compression archives often used to stage large amounts of sensitive data for exfiltration, relevant to "harvest now" scenarios.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2024/05/21
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\winrar.exe'
      - '\7z.exe'
      - '\winzip.exe'
    CommandLine|contains:
      - '-m5'   # Ultra compression
      - '-mx9'  # Maximum compression
      - '-hp'   # Encrypt file names
falsepositives:
  - Legitimate system backups by administrators
level: medium
---
title: Suspicious Python Script Execution with AI/ML Libraries
id: a1b2c3d4-e5f6-7890-1234-56789abcdef0
status: experimental
description: Detects execution of Python scripts importing common AI/ML libraries (pandas, tensorflow) from non-standard user directories. This may indicate unauthorized use of AI agents or data processing scripts.
references:
  - https://attack.mitre.org/techniques/T1059/006/
author: Security Arsenal
date: 2024/05/21
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\python.exe'
    ParentImage|contains: '\Users\'
    CommandLine|contains:
      - 'import pandas'
      - 'import tensorflow'
      - 'import boto3'
  condition: selection
falsepositives:
  - Data scientists running legitimate Jupyter notebooks or scripts
level: low
---
title: AWS CLI S3 Sync Command Execution
id: b2c3d4e5-f6a7-8901-2345-6789abcdef12
status: experimental
description: Detects the usage of AWS CLI `s3 sync` commands which are often used to bulk exfiltrate data from cloud environments. AI agents often utilize the AWS SDK/CLI for data retrieval.
references:
  - https://attack.mitre.org/techniques/T1530/
author: Security Arsenal
date: 2024/05/21
tags:
  - attack.exfiltration
  - attack.t1530
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\aws.exe'
      - '\aws.cmd'
    CommandLine|contains: 's3 sync'
falsepositives:
  - Legitimate backup routines or administrative sync tasks
level: medium

// Hunt for large data transfers out of S3 buckets (Potential Harvesting)
AWSCloudTrail
| where EventName in ("GetObject", "DownloadDBLogFilePortion")
| extend Bytes = parse_(tostring(AdditionalData)).bytesTransferred
| where isnotempty(Bytes)
| summarize TotalBytes = sum(Bytes) by SourceIpAddress, UserIdentityPrincipalid, UserIdentityType
| where TotalBytes > 100000000 // Greater than 100MB
| order by TotalBytes desc


// Detect unusual AssumeRole usage (Potential AI Agent Compromise)
AWSCloudTrail
| where EventName == "AssumeRole"
| extend RoleName = tostring(parse_(RequestParameters).roleArn)
| summarize Count = count() by RoleName, SourceIpAddress, UserIdentityUserName
| where Count > 100 // High frequency role assumption

-- Hunt for Python scripts containing AWS/AI keywords in user directories
SELECT FullPath, Size, Mtime
FROM glob(globs="C:/Users/*/AppData/Local/**/*.py")
WHERE read_file(filename=FullPath, length=10000) =~ "(boto3|tensorflow|pandas|sklearn)"
   AND Mtime > now() - 7d


-- Scan for AWS credentials in clear text (Harvesting Risk)
SELECT FullPath
FROM glob(globs="C:/Users/**/*")
WHERE FileName =~ "credentials"
  AND read_file(filename=FullPath, length=500) =~ "(aws_access_key_id|aws_secret_access_key)"

# Audit for AI/ML Python Libraries in User Directories
$Paths = @("C:\Users\*\AppData\Local\Programs\Python\*")

if (Test-Path $Paths) {
    Get-ChildItem -Path $Paths -Recurse -Filter "*.py" -ErrorAction SilentlyContinue |
    Select-String -Pattern "import (pandas|tensorflow|torch|sklearn|boto3)" |
    Select-Object Path, LineNumber, Line |
    Export-Csv -Path "C:\Temp\AIAudit.csv" -NoTypeInformation
    Write-Host "Audit complete. Results saved to C:\Temp\AIAudit.csv"
} else {
    Write-Host "No Python installations found in standard user locations."
}