JadePuffer: Defending Against the First Fully Agentic AI Encryption Campaign

---
title: Potential Agentic AI Script Activity
id: 89b4c123-e5f6-4a2b-9c8d-1e2f3a4b5c6d
status: experimental
description: Detects script interpreters (Python/Node) making connections to known AI API endpoints followed by shell execution, indicative of an agentic loop.
references:
  - https://www.infosecurity-magazine.com/news/researchers-first-agentic/
author: Security Arsenal
date: 2026/04/16
tags:
  - attack.execution
  - attack.t1059.001
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\python.exe'
      - '\node.exe'
      - '\python3.exe'
  selection_dst:
    DestinationHostname|contains:
      - 'api.openai.com'
      - 'openai.azure.com'
      - 'api.anthropic.com'
      - 'generativelanguage.googleapis.com'
  condition: selection_img and selection_dst
falsepositives:
  - Legitimate development or internal tools using AI APIs
level: medium
---
title: Script Interpreter Spawning Encryption Shell
id: a1b2c3d4-e5f6-4789-a012-345678901234
status: experimental
description: Detects a script interpreter spawning a PowerShell or CMD process with arguments indicative of file encryption or mass deletion, common in JadePuffer style attacks.
references:
  - https://www.infosecurity-magazine.com/news/researchers-first-agentic/
author: Security Arsenal
date: 2026/04/16
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\node.exe'
      - '\pwsh.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
  selection_cmd:
    CommandLine|contains:
      - '-encrypt'
      - 'System.Security.Cryptography'
      - 'Compress-Archive'
      - '/c delete'
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
  - Legitimate administrative scripts run by developers
level: high

let AI_Providers = dynamic(['api.openai.com', 'openai.azure.com', 'api.anthropic.com', 'generativelanguage.googleapis.com']);
let ScriptProcesses = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('python.exe', 'node.exe', 'python3.exe')
| summarize StartTime = min(Timestamp), EndTime = max(Timestamp), ProcessCount = count() by DeviceId, ProcessId, AccountName, InitiatingProcessFileName;
let NetworkActivity = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (AI_Providers)
| summarize API_Call_Count = count() by DeviceId, InitiatingProcessId;
let SuspiciousAgents = ScriptProcesses
| join kind=inner (NetworkActivity) on DeviceId, $left.ProcessId == $right.InitiatingProcessId
| project DeviceId, AccountName, InitiatingProcessFileName, ProcessId, StartTime;
SuspiciousAgents
| join kind=inner (DeviceProcessEvents) on $left.ProcessId == $right.InitiatingProcessId
| where Timestamp between(StartTime .. StartTime + 5m)
| project Timestamp, DeviceId, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, RemoteUrl
| order by Timestamp desc

-- Hunt for active script interpreters with network connections
SELECT Pid, Name, CommandLine, Exe, Username, StartTime
FROM pslist()
WHERE Name =~ 'python.exe' OR Name =~ 'node.exe'
AND Pid IN (
    SELECT Pid
    FROM netstat()
    WHERE RemoteAddress NOT IN ('127.0.0.1', '::1', '0.0.0.0')
    AND State =~ 'ESTABLISHED'
)

# JadePuffer Response: Audit and Block AI API Endpoints
# Requires Administrator privileges

Write-Host "[+] Auditing connectivity to common AI API endpoints..."

$BlockedDomains = @(
    "api.openai.com",
    "openai.azure.com",
    "api.anthropic.com",
    "generativelanguage.googleapis.com"
)

$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
$RedirectIP = "127.0.0.1"

foreach ($Domain in $BlockedDomains) {
    $CheckHosts = Select-String -Path $HostsPath -Pattern $Domain -Quiet
    
    if (-not $CheckHosts) {
        Write-Host "[!] Domain $Domain is NOT currently blocked in hosts file." -ForegroundColor Yellow
        # Uncomment the line below to automatically block (Use with caution in production)
        # Add-Content -Path $HostsPath -Value "$RedirectIP $Domain # Blocked by Security Arsenal JadePuffer Response"
    } else {
        Write-Host "[+] Domain $Domain is already blocked." -ForegroundColor Green
    }
}

# Check for running Python/Node processes making network connections
Write-Host "[+] Checking for suspicious script interpreter processes..."
$SuspiciousProcs = Get-WmiObject Win32_Process | Where-Object { 
    ($_.Name -eq 'python.exe' -or $_.Name -eq 'node.exe') -and 
    $_.CommandLine -like '*https*' 
}

if ($SuspiciousProcs) {
    Write-Host "[!] WARNING: Found script interpreters with potential network arguments:" -ForegroundColor Red
    $SuspiciousProcs | Format-List Name, ProcessId, CommandLine
} else {
    Write-Host "[+] No immediate suspicious script processes detected." -ForegroundColor Green
}