NIST, CISA and NSA Publish Incident Response Practices for Rogue AI Agents — A Defender's Implementation Guide

---
title: AI Agent Runtime Spawning Shell or Script Interpreter
id: 3f8a1c24-7b6e-4d91-a5f2-9c3e7d1b8a04
status: experimental
description: Detects Python, Node, or agent framework runtimes spawning command shells or script interpreters, consistent with a rogue or prompt-injected AI agent executing arbitrary commands via a code execution or shell tool.
references:
  - https://www.securityweek.com/us-agencies-detail-incident-response-practices-for-rogue-ai-agents/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
      - '\deno.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\curl.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate LangChain/CrewAI shell-tool usage by approved automation agents - baseline known agent hosts and alert only on deviation
  - Data science workstations running interactive notebooks
level: high
---
title: Agent Process Making Unexpected Outbound Connection to LLM API
id: 8b2d5e17-4a9c-4f83-b6d1-2e7a9c5f3d08
status: experimental
description: Detects non-browser, non-agent processes establishing connections to public LLM API endpoints, which may indicate an unauthorized or shadow AI agent exfiltrating data through an LLM API.
references:
  - https://www.securityweek.com/us-agencies-detail-incident-response-practices-for-rogue-ai-agents/
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567
logsource:
  category: network_connection
  product: windows
detection:
  selection_dest:
    DestinationHostname|contains:
      - 'api.openai.com'
      - 'api.anthropic.com'
      - 'generativelanguage.googleapis.com'
      - 'api.cohere.ai'
      - 'api.mistral.ai'
  filter_known_agents:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: selection_dest and not filter_known_agents
falsepositives:
  - Approved internal AI applications and developer tooling - maintain an allowlist of authorized agent processes per host
level: medium
---
title: Mass Tool Invocation or File Access by Agent-Hosting Process
id: c47e9a62-1d5b-4e28-93f6-5a8d2c7b4e19
status: experimental
description: Detects an agent runtime accessing sensitive files (credentials, SSH keys, cloud config, browser stores) inconsistent with its intended function - a hallmark of a rogue or hijacked agent performing collection.
references:
  - https://www.securityweek.com/us-agencies-detail-incident-response-practices-for-rogue-ai-agents/
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552
logsource:
  category: file_event
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
  selection_files:
    TargetFilename|contains:
      - '\.ssh\'
      - '\.aws\credentials'
      - '\.azure\'
      - '\.config\gcloud\'
      - 'Login Data'
      - '\.kube\config'
      - '\.env'
      - 'mcp.json'
      - 'claude_desktop_config.json'
  condition: selection_process and selection_files
falsepositives:
  - Agents legitimately configured with MCP tooling that reads cloud credentials - scope tightly to hosts where agents should never touch credential stores
level: high

// Hunt: Anomalous agent process behavior - agent runtimes spawning shells or touching credential material
// Tables: DeviceProcessEvents / DeviceFileEvents (Defender), CommonSecurityLog for egress
let agentRuntimes = dynamic(["python.exe", "python3.exe", "python", "node.exe", "node", "deno"]);
let shellChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "sh", "bash", "curl", "wget", "certutil.exe", "mshta.exe"]);
let procHits =
    DeviceProcessEvents
    | where TimeGenerated > ago(24h)
    | where InitiatingProcessFileName in~ (agentRuntimes)
    | where FileName in~ (shellChildren)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName;
let fileHits =
    DeviceFileEvents
    | where TimeGenerated > ago(24h)
    | where InitiatingProcessFileName in~ (agentRuntimes)
    | where FileName has_any ("credentials", "id_rsa", "Login Data", ".env", "mcp.json", "claude_desktop_config")
       or FolderPath has_any ("\\.ssh\\", "\\.aws\\", "\\.azure\\", "\\.kube\\")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FolderPath, FileName, AccountName;
union procHits, fileHits
| sort by TimeGenerated desc
// Companion egress hunt: unexpected hosts talking to public LLM APIs (via CEF/syslog firewall ingestion)
// CommonSecurityLog
// | where TimeGenerated > ago(24h)
// | where DestinationHostName has_any ("api.openai.com", "api.anthropic.com", "generativelanguage.googleapis.com")
// | summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DeviceName
// | where ConnectionCount > 500   // burst threshold - tune to baseline; rogue loops generate extreme volume
// | sort by ConnectionCount desc

-- Hunt: Enumerate agent framework artifacts and anomalous agent-spawned processes across the fleet
-- Deploys as a Velociraptor hunt artifact to inventory MCP configs, agent installs, and shell children of agent runtimes

-- 1. Find MCP / agent configuration files that reveal deployed agents and their tool permissions
SELECT FullPath, Size, Mtime
FROM glob(globs=[
  'C:/Users/*/AppData/Roaming/Claude/claude_desktop_config.json',
  'C:/Users/*/.cursor/mcp.json',
  'C:/Users/*/.vscode/mcp.json',
  'C:/ProgramData/*/mcp.json',
  '/home/*/.config/Claude/claude_desktop_config.json',
  '/home/*/.cursor/mcp.json',
  '/etc/**/mcp.json'
])

-- 2. Identify agent runtimes that have spawned shells or download utilities
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)python|node|deno'
  AND CommandLine =~ '(?i)(subprocess|os\.system|child_process|spawn|exec\()'

-- 3. Correlate: find shell processes whose parent is an agent runtime
SELECT p.Pid, p.Name, p.CommandLine, p.Username, parent.Name AS ParentName, parent.CommandLine AS ParentCommandLine
FROM pslist() AS p
JOIN pslist() AS parent ON p.Ppid = parent.Pid
WHERE parent.Name =~ '(?i)python|node|deno'
  AND p.Name =~ '(?i)cmd|powershell|pwsh|sh$|bash|curl|wget'

# Audit and harden: inventory AI agents, MCP tool permissions, and credential scope on a Windows host
# Run elevated. Produces a JSON report for IR scoping per the NIST/CISA/NSA preparation practices.

$report = [ordered]@{ Hostname = $env:COMPUTERNAME; Timestamp = (Get-Date -Format o) }

# 1. Locate MCP/agent configuration files and enumerate granted tools
$mcpPaths = @(
    "$env:APPDATA\Claude\claude_desktop_config.json",
    "$env:USERPROFILE\.cursor\mcp.json",
    "$env:USERPROFILE\.vscode\mcp.json"
)
$report.McpConfigs = foreach ($p in $mcpPaths) {
    if (Test-Path $p) {
        $cfg = Get-Content $p -Raw | ConvertFrom-Json
        [pscustomobject]@{ Path = $p; Servers = ($cfg.mcpServers.PSObject.Properties.Name -join ',') }
    }
}

# 2. Inventory installed agent frameworks (pip + npm)
$report.PythonAgentPackages = (pip list 2>$null | Select-String -Pattern 'langchain|langgraph|autogen|crewai|openai|anthropic|mcp|semantic-kernel|llamaindex')
$report.NpmAgentPackages    = (npm ls -g --depth=0 2>$null | Select-String -Pattern 'langchain|mcp|openai|anthropic')

# 3. Find hardcoded API keys / tokens in common agent env files
$report.EnvFiles = Get-ChildItem -Path "$env:USERPROFILE" -Recurse -Filter '.env' -ErrorAction SilentlyContinue |
    Select-String -Pattern 'OPENAI_API_KEY|ANTHROPIC_API_KEY|AZURE_OPENAI|GOOGLE_API_KEY' -List |
    Select-Object Path, LineNumber

# 4. Check for agent processes currently holding network connections to LLM endpoints
$report.LlmConnections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|127\.)' } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        if ($proc.ProcessName -match 'python|node|deno') {
            [pscustomobject]@{ Process = $proc.ProcessName; PID = $_.OwningProcess; RemoteIP = $_.RemoteAddress; RemoteHost = (Resolve-DnsName $_.RemoteAddress -ErrorAction SilentlyContinue).NameHost }
        }
    }

$report | ConvertTo-Json -Depth 5 | Out-File "$env:TEMP\agent_ir_audit_$($env:COMPUTERNAME).json"
Write-Output "Audit written to $env:TEMP\agent_ir_audit_$($env:COMPUTERNAME).json - review MCP server permissions and key exposure first."

# 5. Emergency containment snippet: revoke network access for a rogue agent process by name
# Get-Process python | Stop-Process -Force
# New-NetFirewallRule -DisplayName "IR-CONTAIN-AgentEgress" -Direction Outbound -Program "C:\Python312\python.exe" -Action Block