Indirect Prompt Injection: Defending AI Agents Against Hidden Malicious Instructions — Detection and Hardening Guide

---
title: AI Agent Runtime Spawning Interactive Shell or LOLBin
id: 3f8a2c71-9b4e-4d5a-b6c7-8e1f2a3b4c5d
status: experimental
description: Detects AI agent runtimes (Python/Node-based agent frameworks, MCP clients) spawning command shells, script engines, or data-transfer LOLBins. Indirect prompt injection in processed content commonly manifests as the agent attempting command execution or data staging.
references:
  - https://www.securityweek.com/the-hidden-instructions-that-can-hijack-ai-agents/
  - https://atlas.mitre.org/techniques/AML.T0051
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
      - '\uv.exe'
      - '\claude.exe'
      - '\cursor.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  filter_known_automation:
    CommandLine|contains:
      - 'npm install'
      - 'pip install'
      - 'node_modules'
  condition: selection_parent and selection_child and not filter_known_automation
falsepositives:
  - Coding agents legitimately running build/test commands - tune by approved working directories and approved command lines
level: high
---
title: AI Agent Process Connecting to Uncommon External Destination
id: 8c1d4e92-5a6b-4f7c-9d0e-1a2b3c4d5e6f
status: experimental
description: Detects AI agent runtimes and MCP client processes establishing outbound network connections, a potential indicator of prompt-injection-driven data exfiltration or tool invocation to attacker infrastructure. Baseline approved LLM API endpoints and alert on deviations.
references:
  - https://www.securityweek.com/the-hidden-instructions-that-can-hijack-ai-agents/
  - https://atlas.mitre.org/techniques/AML.T0051
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
      - '\claude.exe'
  filter_approved_endpoints:
    DestinationHostname|endswith:
      - '.openai.com'
      - '.anthropic.com'
      - '.googleapis.com'
      - '.azure.com'
      - '.github.com'
      - '.githubusercontent.com'
      - '.pypi.org'
      - '.npmjs.org'
  condition: selection and not filter_approved_endpoints
falsepositives:
  - Agents browsing the web as an approved capability - restrict to processes not designated for web retrieval, or pair with destination rarity scoring
level: medium

// Hunt 1: Agent runtimes spawning shells, script engines, or transfer tools
let agentRuntimes = dynamic(["python.exe", "python3.exe", "node.exe", "claude.exe", "uv.exe"]);
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "curl.exe", "certutil.exe", "bitsadmin.exe", "mshta.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (agentRuntimes)
| where FileName in~ (suspiciousChildren)
| where ProcessCommandLine !has_any ("npm install", "pip install", "node_modules", "pytest")
| project TimeGenerated, DeviceName, AccountName,
    AgentCmd = InitiatingProcessCommandLine,
    ChildProcess = FileName,
    ChildCmd = ProcessCommandLine,
    FolderPath, SHA256
| sort by TimeGenerated desc;

// Hunt 2: Document/email ingestion followed by agent-initiated rare outbound connections
let agentRuntimes = dynamic(["python.exe", "node.exe", "claude.exe"]);
let contentEvents = DeviceFileEvents
| where TimeGenerated > ago(24h)
| where FileName endswith_any (".pdf", ".docx", ".eml", ".msg", ".html", ".md")
| where InitiatingProcessFileName in~ (agentRuntimes)
| project DeviceName, IngestTime = TimeGenerated, IngestedFile = FileName, FilePath;
let netEvents = DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ (agentRuntimes)
| where RemoteUrl !has_any ("openai.com", "anthropic.com", "googleapis.com", "azure.com", "github.com", "pypi.org")
| project DeviceName, ConnTime = TimeGenerated, RemoteUrl, RemoteIP, RemotePort, AgentProc = InitiatingProcessCommandLine;
contentEvents
| join kind=inner netEvents on DeviceName
| where ConnTime between (IngestTime .. IngestTime + 15m)
| project DeviceName, IngestedFile, IngestTime, RemoteUrl, RemoteIP, ConnTime, AgentProc
| sort by ConnTime desc;

// Hunt 3: MCP server / agent tool-call anomalies via Sysmon ingest (EventID 1)
SecurityEvent
| where TimeGenerated > ago(7d)
| where ParentProcessName has_any ("python.exe", "node.exe")
| where NewProcessName has_any ("cmd.exe", "powershell.exe", "curl.exe", "rundll32.exe")
| summarize EventCount = count(), DistinctHosts = dcount(Computer) by ParentCommandLine, NewProcessName, Account
| where EventCount < 5  // rarity filter: prompt injection actions are typically low-frequency
| sort by DistinctHosts desc;

-- Hunt: AI agent runtimes with suspicious children or unusual network connections
LET agent_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(python3?|node|claude|uv)\\.exe$'

LET suspicious_children = SELECT Pid, Ppid, Name, CommandLine, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(cmd|powershell|pwsh|curl|certutil|rundll32|mshta)\\.exe$'
  AND Ppid IN (SELECT Pid FROM agent_procs)

LET agent_connections = SELECT Pid, Name, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Name =~ '(?i)(python3?|node|claude)\\.exe$'
  AND RemoteAddr !~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)'

SELECT 'SUSPICIOUS_CHILD' AS Finding, Pid, Ppid, Name, CommandLine, CreateTime AS Timestamp, NULL AS RemoteAddr
FROM suspicious_children
UNION ALL
SELECT 'EXTERNAL_CONNECTION' AS Finding, Pid, NULL AS Ppid, Name, NULL AS CommandLine, NULL AS Timestamp, RemoteAddr
FROM agent_connections

#requires -RunAsAdministrator
# Security Arsenal - AI Agent Exposure & MCP Configuration Audit
# Run on agent-hosting workstations/servers. Outputs JSON for SIEM ingestion.

$report = [ordered]@{
    Hostname        = $env:COMPUTERNAME
    Timestamp       = (Get-Date).ToString("o")
    AgentProcesses  = @()
    McpConfigs      = @()
    FirewallGaps    = @()
    Findings        = @()
}

# 1. Inventory running AI agent runtimes and their command lines
$agentProcs = Get-CimInstance Win32_Process | Where-Object {
    $_.Name -match '^(python3?|node|claude|uv|ollama)\.exe$'
} | Select-Object ProcessId, Name, CommandLine, ExecutablePath
$report.AgentProcesses = $agentProcs

# 2. Locate and inspect MCP / agent configuration files for unapproved servers
$configPaths = @(
    "$env:APPDATA\Claude\claude_desktop_config.json",
    "$env:USERPROFILE\.cursor\mcp.json",
    "$env:USERPROFILE\.config\*\mcp*.json",
    "$env:APPDATA\Code\User\mcp.json"
)
foreach ($path in $configPaths) {
    foreach ($file in (Get-Item $path -ErrorAction SilentlyContinue)) {
        $cfg = Get-Content $file.FullName -Raw | ConvertFrom-Json -ErrorAction SilentlyContinue
        $servers = $cfg.mcpServers.PSObject.Properties.Name
        $report.McpConfigs += [pscustomobject]@{
            ConfigFile = $file.FullName
            Servers    = ($servers -join '; ')
        }
        # Flag configs referencing remote URLs or npx/uvx-pulled servers (supply-chain risk)
        if ((Get-Content $file.FullName -Raw) -match 'https?://|"npx"|"uvx"') {
            $report.Findings += "HIGH: MCP config $($file.FullName) references remote or package-pulled servers - verify each server is org-approved"
        }
    }
}

# 3. Verify outbound restrictions exist for agent runtimes (agents should be egress-allowlisted)
$agentExes = $agentProcs.ExecutablePath | Select-Object -Unique
foreach ($exe in $agentExes) {
    $rule = Get-NetFirewallApplicationFilter -ErrorAction SilentlyContinue |
        Where-Object { $_.Program -eq $exe } |
        Get-NetFirewallRule -ErrorAction SilentlyContinue |
        Where-Object { $_.Direction -eq 'Outbound' -and $_.Action -eq 'Block' }
    if (-not $rule) {
        $report.FirewallGaps += $exe
        $report.Findings += "MEDIUM: No outbound block/default-deny rule for $exe - agent has unrestricted egress"
    }
}

# 4. Flag agents running as privileged identities
foreach ($p in $agentProcs) {
    $owner = (Invoke-CimMethod -InputObject $p -MethodName GetOwner -ErrorAction SilentlyContinue).User
    if ($owner -match '^(SYSTEM|Administrator)$') {
        $report.Findings += "HIGH: Agent process $($p.Name) (PID $($p.ProcessId)) running as $owner - apply least privilege immediately"
    }
}

$report | ConvertTo-Json -Depth 5 | Out-File "$env:ProgramData\agent-audit-$(Get-Date -Format yyyyMMdd-HHmmss).json"
Write-Output "Audit complete. Findings: $($report.Findings.Count)"