Russian Hackers Weaponized Claude AI for Malware Evasion: Defending Against AI-Assisted Threats and AI Infrastructure Attacks

---
title: Heavily Obfuscated Command Line Execution — AI-Generated Evasion Pattern
id: 3f9c2a71-8b4d-4e6a-b1c9-5d7e2f8a3b41
status: experimental
description: Detects command lines with high-entropy obfuscation patterns typical of AI-assisted malware evasion — long base64 blobs, chained string concatenation, and nested encoded script invocation via PowerShell, cmd, wscript, or mshta.
references:
  - https://www.securityweek.com/anthropic-says-russian-hackers-used-claude-ai-to-automate-malware-evasion/
  - https://attack.mitre.org/techniques/T1027/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1027
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_interpreter:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  selection_obfuscation:
    CommandLine|contains:
      - ' -enc '
      - ' -ec '
      - 'FromBase64String'
      - '[Convert]::ToBase64String'
      - 'IEX('
      - 'Invoke-Expression'
      - 'bypass -nop'
      - ' -w hidden'
      - 'DownloadString'
  condition: selection_interpreter and selection_obfuscation
falsepositives:
  - Legitimate administrative scripts using encoded commands — tune with a known-good script inventory
level: high
---
title: Non-Browser Process Connecting to AI API Endpoints
id: 8e1d4b62-3c7a-4f95-a2d8-6b9e1c4a7d52
status: experimental
description: Detects network connections to major AI API endpoints (Anthropic, OpenAI) from non-browser processes. Legitimate developer tooling exists, but script interpreters, Office applications, or unsigned binaries calling AI APIs may indicate AI-assisted attack tooling, API key abuse, or exfiltration via AI services.
references:
  - https://www.securityweek.com/anthropic-says-russian-hackers-used-claude-ai-to-automate-malware-evasion/
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567
  - attack.command_and_control
logsource:
  category: network_connection
  product: windows
detection:
  selection_dest:
    DestinationHostname|contains:
      - 'api.anthropic.com'
      - 'api.openai.com'
      - 'claude.ai'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\Code.exe'
      - '\cursor.exe'
  condition: selection_dest and not filter_browsers
falsepositives:
  - Legitimate AI-integrated developer tools, CLI clients, and sanctioned internal AI gateways — baseline approved integrations first
level: medium
---
title: Suspicious Dropper Writing Executables to User-Writable Directories
id: 5c2f8a94-1e6b-4d38-b7c1-9a3e5f2d8b63
status: experimental
description: Detects script interpreters and Office processes writing executable content to user-writable locations (AppData, Temp, Public) — a consistent artifact of AI-generated droppers regardless of how heavily the payload itself is obfuscated.
references:
  - https://www.securityweek.com/anthropic-says-russian-hackers-used-claude-ai-to-automate-malware-evasion/
  - https://attack.mitre.org/techniques/T1027/
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1027
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.scr'
      - '.ps1'
  selection_writer:
    Image|endswith:
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\winword.exe'
      - '\excel.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
  condition: selection_path and selection_ext and selection_writer
falsepositives:
  - Software updaters and installers — correlate with parent process and signer before escalating
level: high

// Hunt 1: Obfuscated/encoded script execution consistent with AI-generated evasion payloads
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("powershell.exe","pwsh.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe")
| where ProcessCommandLine has_any (" -enc "," -ec ","FromBase64String","IEX(","Invoke-Expression","DownloadString","bypass -nop")
| extend EncodedLength = strlen(ProcessCommandLine)
| where EncodedLength > 400
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, SHA256
| order by TimeGenerated desc;

// Hunt 2: Non-browser processes communicating with AI API endpoints (potential tooling abuse or exfil channel)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any ("api.anthropic.com","api.openai.com","claude.ai")
| where InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe","Code.exe","cursor.exe","ms-teams.exe","slack.exe")
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP
| order by ConnectionCount desc;

// Hunt 3: Script interpreters dropping executables to user-writable paths
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("\\AppData\\Local\\Temp\\","\\AppData\\Roaming\\","\\Users\\Public\\")
| where FileName endswith_any (".exe",".dll",".scr",".ps1")
| where InitiatingProcessFileName in~ ("powershell.exe","wscript.exe","cscript.exe","mshta.exe","winword.exe","excel.exe","rundll32.exe","certutil.exe")
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

-- Hunt for obfuscated script execution and non-browser AI API connections
-- Combines pslist() for live encoded command lines with netstat() for AI endpoint connections

SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
       CommandLine =~ '(?i)(-enc|FromBase64String|IEX\(|Invoke-Expression|DownloadString|bypass -nop)' AS IsObfuscated
FROM pslist()
WHERE CommandLine =~ '(?i)(-enc|FromBase64String|IEX\(|Invoke-Expression|DownloadString|bypass -nop)'
  AND length(string=CommandLine) > 400

-- Separately: identify processes holding connections to AI API infrastructure
SELECT Pid, Name, Status, Family, Type, LocalIP, LocalPort, RemoteIP, RemotePort
FROM netstat()
WHERE RemoteIP =~ '.'
  AND Name !~ '(?i)(chrome|msedge|firefox|brave)'

# AI-assisted threat hardening: audit encoded script usage, AI endpoint egress, and enforce controls
# Run elevated. Review output before applying blocks in production.

$report = @()

# 1. Enable PowerShell Script Block Logging (critical for de-obfuscating AI-generated payloads)
$sblPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
if (-not (Test-Path $sblPath)) { New-Item -Path $sblPath -Force | Out-Null }
Set-ItemProperty -Path $sblPath -Name 'EnableScriptBlockLogging' -Value 1
Set-ItemProperty -Path $sblPath -Name 'EnableScriptBlockInvocationLogging' -Value 1
$report += 'Script Block Logging: ENABLED'

# 2. Audit recent encoded/obfuscated PowerShell execution (Event ID 4104)
$events = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} -MaxEvents 500 -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'FromBase64String|Invoke-Expression|-enc|DownloadString' }
$report += "Suspicious script-block events found: $($events.Count)"
$events | Select-Object TimeCreated, @{n='Snippet';e={$_.Message.Substring(0,[Math]::Min(200,$_.Message.Length))}} |
  Export-Csv -Path ".\ObfuscatedScriptAudit_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation

# 3. Identify processes with active/established connections to AI API endpoints
$aiConnections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemotePort -eq 443 } |
  ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{ Process=$proc.ProcessName; PID=$_.OwningProcess; RemoteIP=$_.RemoteAddress; Path=$proc.Path }
  } | Where-Object { $_.Process -notmatch 'chrome|msedge|firefox|brave|svchost|MsMpEng' }
$aiConnections | Export-Csv -Path ".\AIEgressAudit_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
$report += "Non-browser 443 connections to review (resolve RemoteIP against AI provider ranges): $($aiConnections.Count)"

# 4. Hunt for exposed AI API keys in common user config locations
$keyPatterns = 'sk-ant-|sk-proj-|sk-[A-Za-z0-9]{20,}'
$searchPaths = @("$env:USERPROFILE\.anthropic","$env:USERPROFILE\.openai","$env:USERPROFILE\.config","$env:APPDATA")
foreach ($p in $searchPaths) {
  if (Test-Path $p) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue |
      Select-String -Pattern $keyPatterns -ErrorAction SilentlyContinue |
      ForEach-Object { $report += "POTENTIAL EXPOSED API KEY: $($_.Path) (line $($_.LineNumber))" }
  }
}

$report | ForEach-Object { Write-Output $_ }
Write-Output "`nAudit complete. Review CSV outputs and rotate any exposed keys immediately."