Kontext Security Raises $4M for AI Agent Runtime Controls: A Defender's Guide to Visibility and Enforcement

---
title: Process Connection to LLM API Endpoint
id: 8f2a1b3c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects processes establishing network connections to known LLM API endpoints. May indicate unauthorized AI agent activity, shadow AI usage, or legitimate approved integrations. Baseline expected traffic before deployment.
references:
  - https://attack.mitre.org/techniques/T1071.001/
  - https://www.securityweek.com/kontext-security-emerges-with-4-million-for-ai-agent-runtime-controls/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'api.openai.com'
      - 'api.anthropic.com'
      - 'generativelanguage.googleapis.com'
      - 'api.cohere.ai'
      - 'api.mistral.ai'
      - 'openai.azure.com'
  filter_known_processes:
    Image|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
  condition: selection and not filter_known_processes
falsepositives:
  - Approved AI integrations in business applications
  - Developer tools with LLM assistance features
level: medium
---
title: AI Agent Framework Execution via Python or Node
id: 3c4d5e6f-7a8b-9c0d-1e2f-3a4b5c6d7e8f
status: experimental
description: Detects execution of Python or Node.js processes with command-line references to common AI agent frameworks and orchestration libraries. May indicate shadow AI agent deployment or developer experimentation with agentic frameworks.
references:
  - https://attack.mitre.org/techniques/T1059.006/
  - https://www.securityweek.com/kontext-security-emerges-with-4-million-for-ai-agent-runtime-controls/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
    CommandLine|contains:
      - 'langchain'
      - 'autogen'
      - 'crewai'
      - 'openai-agents'
      - 'llamaindex'
      - 'semantic_kernel'
      - 'mcp_server'
      - 'modelcontextprotocol'
  condition: selection
falsepositives:
  - Approved AI development and research activity
  - Legitimate AI-powered internal tools
level: medium
---
title: MCP Server Process Execution
id: 5e6f7a8b-9c0d-1e2f-3a4b-5c6d7e8f9a0b
status: experimental
description: Detects execution of Model Context Protocol (MCP) server processes, which are used to extend AI agent capabilities with external tools and data sources. Unauthorized MCP servers may expose internal systems to agent-driven access.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://www.securityweek.com/kontext-security-emerges-with-4-million-for-ai-agent-runtime-controls/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'mcp-server'
      - 'mcp_server'
      - 'modelcontextprotocol'
      - '@modelcontextprotocol'
      - 'mcp-server-'
  condition: selection
falsepositives:
  - Approved MCP server deployments for AI development workflows
level: medium

// Hunt: Processes communicating with LLM API endpoints (potential shadow AI agents)
// Scope: Last 7 days. Tune the process exclusion list to match approved applications.
let LLMEndpoints = dynamic([
    "api.openai.com",
    "api.anthropic.com",
    "generativelanguage.googleapis.com",
    "api.cohere.ai",
    "api.mistral.ai",
    "api.together.xyz",
    "openai.azure.com"
]);
let ApprovedProcesses = dynamic([
    "msedge.exe", "chrome.exe", "firefox.exe", "brave.exe"
]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl in~ (LLMEndpoints)
| where InitiatingProcessFileName !in~ (ApprovedProcesses)
| summarize
    ConnectionCount = count(),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    RemoteIPs = make_set(RemoteIP, 10),
    DeviceNames = make_set(DeviceName, 10)
    by InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessFolderPath
| order by ConnectionCount desc

// Hunt: Python/Node processes invoking AI agent frameworks or MCP tooling
// Scope: Last 7 days. Review for unauthorized agent deployments.
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("python.exe", "python3.exe", "node.exe")
| where ProcessCommandLine has_any (
    "langchain", "autogen", "crewai",
    "openai-agents", "llamaindex", "semantic_kernel",
    "mcp_server", "modelcontextprotocol", "mcp-server"
)
| summarize
    ExecutionCount = count(),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    Devices = make_set(DeviceName, 10),
    Users = make_set(AccountName, 10)
    by ProcessCommandLine, FolderPath
| order by ExecutionCount desc

-- Hunt for processes with established connections to LLM API endpoints
-- Execute across the fleet to identify unauthorized AI agent activity
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(langchain|autogen|crewai|openai|anthropic|mcp_server|modelcontextprotocol)'
   OR Exe =~ '(?i)(langchain|autogen|crewai|mcp)'

-- Correlate with active network connections to known LLM endpoints
SELECT Pid, Name, CommandLine, Exe, Username
FROM netstat()
WHERE RemoteIP =~ '(?i)(openai|anthropic|googleapis|cohere|mistral)'
   OR Name =~ '(?i)(python|node)'

#Requires -RunAsAdministrator
# AI Agent Exposure Audit and Egress Control Script
# Security Arsenal — Defensive Controls for Agentic AI

param(
    [switch]$AuditOnly,
    [switch]$BlockEgress
)

Write-Host "[+] AI Agent Exposure Audit — $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Cyan

# --- 1. Inventory Python packages related to AI agent frameworks ---
Write-Host "`n[*] Checking for AI agent framework packages..." -ForegroundColor Yellow
$AgentPackages = @("langchain", "autogen", "crewai", "openai", "anthropic", "llamaindex", "semantic-kernel", "modelcontextprotocol", "mcp")
try {
    $PipList = pip list 2>$null | Out-String
    foreach ($pkg in $AgentPackages) {
        if ($PipList -match $pkg) {
            Write-Host "  [!] FOUND: $pkg" -ForegroundColor Red
        }
    }
    if ($PipList -notmatch ($AgentPackages -join "|")) {
        Write-Host "  [+] No known agent framework packages detected via pip." -ForegroundColor Green
    }
} catch {
    Write-Host "  [-] pip not available. Manual package inventory required." -ForegroundColor DarkYellow
}

# --- 2. Check for MCP server configuration files ---
Write-Host "`n[*] Checking for MCP server configurations..." -ForegroundColor Yellow
$MCPPaths = @(
    "$env:USERPROFILE\.cursor\mcp.json",
    "$env:USERPROFILE\.claude\claude_desktop_config.json",
    "$env:APPDATA\Claude\claude_desktop_config.json",
    "$env:USERPROFILE\.vscode\mcp.json",
    "$env:USERPROFILE\.continue\config.json"
)
foreach ($path in $MCPPaths) {
    if (Test-Path $path) {
        Write-Host "  [!] MCP config found: $path" -ForegroundColor Red
        Write-Host "      Review this file for unauthorized tool configurations." -ForegroundColor DarkYellow
    }
}

# --- 3. Audit running processes with LLM-related command lines ---
Write-Host "`n[*] Checking for running processes with AI agent indicators..." -ForegroundColor Yellow
$SuspiciousProcesses = Get-Process | Where-Object {
    $_.ProcessName -match "python|node"
} | ForEach-Object {
    $cmdline = (Get-CimInstance Win32_Process -Filter "ProcessId=$($_.Id)").CommandLine
    if ($cmdline -match "(?i)(langchain|autogen|crewai|openai|anthropic|mcp_server|modelcontextprotocol)") {
        [PSCustomObject]@{
            PID = $_.Id
            Name = $_.ProcessName
            CommandLine = $cmdline
        }
    }
}
if ($SuspiciousProcesses) {
    $SuspiciousProcesses | Format-Table -AutoSize
    Write-Host "  [!] Active agent processes detected. Review above." -ForegroundColor Red
} else {
    Write-Host "  [+] No active agent processes detected." -ForegroundColor Green
}

# --- 4. Optional: Block egress to LLM API endpoints ---
if ($BlockEgress) {
    Write-Host "`n[*] Applying egress firewall rules for LLM endpoints..." -ForegroundColor Yellow
    $LLMDomains = @(
        "api.openai.com",
        "api.anthropic.com",
        "generativelanguage.googleapis.com",
        "api.cohere.ai",
        "api.mistral.ai"
    )
    foreach ($domain in $LLMDomains) {
        $ruleName = "Block-LLM-Egress-$domain"
        $existing = Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue
        if (-not $existing) {
            # Resolve IPs and block — note: LLM providers use CDN ranges; consider proxy-level controls for production
            Write-Host "  [*] Creating rule: $ruleName" -ForegroundColor Yellow
            New-NetFirewallRule -DisplayName $ruleName `
                -Direction Outbound `
                -Action Block `
                -RemoteAddress (Resolve-DnsName $domain -Type A -ErrorAction SilentlyContinue | Select-Object -ExpandProperty IPAddress) `
                -Protocol TCP `
                -Profile Any `
                -Enabled True | Out-Null
            Write-Host "  [+] Rule created: $ruleName" -ForegroundColor Green
        } else {
            Write-Host "  [=] Rule already exists: $ruleName" -ForegroundColor DarkYellow
        }
    }
    Write-Host "`n  [!] NOTE: LLM providers use dynamic CDN IPs. For production egress control," -ForegroundColor Red
    Write-Host "      use a forward proxy (e.g., Zscaler, Palo Alto, Squid) with domain-based" -ForegroundColor Red
    Write-Host "      URL filtering instead of host firewall rules." -ForegroundColor Red
}

Write-Host "`n[+] Audit complete. Review findings and escalate unauthorized agent deployments." -ForegroundColor Cyan