---
title: AI Agent Runtime Spawning Shell or Scripting Engine
description: Detects Python, Node.js, or common agent framework processes spawning command shells or scripting engines — consistent with a computer-use/coding agent executing attacker-influenced instructions via indirect prompt injection.
references:
  - https://atlas.mitre.org/techniques/AML.T0051
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
id: 3f8c1a2e-7b4d-4e9a-b2c1-9d6e5f4a3b2c
status: experimental
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
      - '\pythonw.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  filter_known_automation:
    CommandLine|contains:
      - 'pytest'
      - 'ansible'
      - 'terraform'
  condition: selection_parent and selection_child and not filter_known_automation
falsepositives:
  - Legitimate developer tooling, build pipelines, and sanctioned AI coding assistants — baseline per host and suppress known agent service accounts
level: high
---
title: Non-Browser Process Connecting to OpenAI API Endpoints
description: Detects network connections to OpenAI API infrastructure from processes other than approved browsers or sanctioned agent services — surfaces shadow AI deployments and potential agent-driven exfiltration channels.
references:
  - https://atlas.mitre.org/techniques/AML.T0051
  - https://attack.mitre.org/techniques/T1071.001/
author: Security Arsenal
date: 2026/04/06
id: 8a2e4c6d-1f3b-4a5c-9d8e-7c6b5a4f3e2d
status: experimental
tags:
  - attack.exfiltration
  - attack.t1071.001
  - attack.command_and_control
logsource:
  category: network_connection
  product: windows
detection:
  selection_domain:
    DestinationHostname|endswith:
      - 'api.openai.com'
      - 'api.openai.azure.com'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  condition: selection_domain and not filter_browsers
falsepositives:
  - Sanctioned agent services and approved AI integrations — maintain an allowlist of approved agent host/service pairs
level: medium
---
title: OpenAI API Key Artifacts Accessed Outside Agent Runtime
description: Detects processes reading files commonly used to store AI API keys (environment exports, .env files, agent configs) where the reader is not the sanctioned agent runtime — potential credential harvesting for agent takeover.
references:
  - https://attack.mitre.org/techniques/T1552.001/
author: Security Arsenal
date: 2026/04/06
id: c5d6e7f8-2a3b-4c5d-8e9f-1a2b3c4d5e6f
status: experimental
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '\.env'
      - '\.env.local'
      - '\openai.key'
      - '\credentials.json'
    TargetFilename|contains:
      - 'openai'
  filter_agent_runtimes:
    Image|endswith:
      - '\python.exe'
      - '\node.exe'
      - '\Code.exe'
  condition: selection and not filter_agent_runtimes
falsepositives:
  - Backup agents, DLP scanners, and EDR itself — tune by Image hash on sanctioned scanners
level: medium

// Hunt 1: Non-browser processes with outbound connections to OpenAI API infrastructure
// Tune ApprovedAgentDevices to your sanctioned agent hosts/service accounts.
let ApprovedAgentDevices = dynamic(["agent-srv-01", "dev-workstation-42"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any ("api.openai.com", "openai.azure.com")
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "safari")
| where DeviceName !in~ (ApprovedAgentDevices)
| summarize ConnectionCount = count(),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated),
            RemoteIPs = make_set(RemoteIP)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by ConnectionCount desc;
// Hunt 2: Agent runtime (python/node) spawning shells or exfil-capable tooling
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("python.exe", "python3.exe", "node.exe", "pythonw.exe", "python", "node")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "curl.exe", "certutil.exe",
                      "bitsadmin.exe", "rundll32.exe", "bash", "sh")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc;
// Hunt 3: Linux — syslog-visible processes resolving/connecting to OpenAI endpoints
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has "api.openai.com"
| summarize Hits = count() by Computer, ProcessName, HostIP
| order by Hits desc;

-- Hunt for AI agent runtime processes, their command lines, OpenAI API key
-- exposure in environment/config files, and live connections to AI endpoints.
-- Deploy as a multi-artifact notebook or split per section.

-- Section 1: Running agent runtimes with network-aware command lines
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(python|node)'
  AND (CommandLine =~ '(?i)openai|agent|computer.?use|playwright|selenium|anthropic'
       OR CommandLine =~ '(?i)sk-[a-zA-Z0-9]')

-- Section 2: Live connections to OpenAI API infrastructure
SELECT Pid, Name, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE RemoteAddr =~ '.' AND RemotePort = 443
  AND Name =~ '(?i)(python|node)'

-- Section 3: Candidate API key material on disk (dotfiles/env files in user profiles)
SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/Users/*/.env', 'C:/Users/*/**/.env',
                 'C:/Users/*/.config/*openai*', 'C:/Users/*/.openai*',
                 '/home/*/.env', '/home/*/.config/*openai*', '/root/.env'])
WHERE Size < 1048576

# GPT-6.1 Terra / agentic AI discovery and hardening audit
# Run elevated. Review output before enabling the firewall block section.

$report = @()

# 1) Inventory non-browser processes that recently resolved OpenAI API hosts
$dnsHits = Get-DnsClientCache -ErrorAction SilentlyContinue |

```powershell
    Where-Object { $_.Entry -match 'openai\.com' }

    Where-Object { $_.Length -lt 1MB }