Securing Healthcare AI Implementation: Detection and Defense Strategies for the Post-Hype Era

---
title: Potential Shadow AI Usage via Network Connection
id: 7f8a9b1c-2d3e-4a5b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects processes connecting to known Generative AI domains which may indicate unauthorized usage of Shadow AI tools.
references:
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2025/04/15
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'openai.com'
      - 'chatgpt.com'
      - 'anthropic.com'
      - 'huggingface.co'
      - 'api.openai.com'
  condition: selection
falsepositives:
  - Legitimate approved AI applications
level: medium
---
title: AI Service API Key in Command Line
id: 9b8c7d6e-5f4a-3b2c-1a0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exposure of AI service API keys (e.g., OpenAI sk- prefix) in process command lines, suggesting insecure credential handling.
references:
  - https://attack.mitre.org/techniques/T1052/001/
author: Security Arsenal
date: 2025/04/15
tags:
  - attack.credential_access
  - attack.t1052.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'sk-'
      - 'org-'
      - 'ANTHROPIC_API_KEY'
      - 'HUGGING_FACE_TOKEN'
  condition: selection
falsepositives:
  - Legitimate administrative scripts (rare)
level: high
---
title: Suspicious PowerShell Interaction with AI Endpoints
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects PowerShell processes making network connections to AI endpoints, often indicative of script-based data scraping or automation.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2025/04/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    DestinationHostname|contains:
      - 'openai.com'
      - 'anthropic.com'
  condition: selection
falsepositives:
  - Authorized administrative automation scripts
level: high

// Hunt for connections to known AI Generative domains
DeviceNetworkEvents
| where RemoteUrl has_any ("openai.com", "chatgpt.com", "anthropic.com", "huggingface.co", "api.openai.com")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP
| order by Timestamp desc


// Hunt for API Keys in Process Command Lines (Specific to OpenAI format)
DeviceProcessEvents
| where InitiatingProcessCommandLine has "sk-" and (InitiatingProcessCommandLine has "openai" or InitiatingProcessCommandLine has "api")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath
| order by Timestamp desc

-- Hunt for AI API Keys in Environment or Config Files
SELECT FullPath, Size, Mtime
FROM glob(globs='/Users/*/.env', 'C:\Users\*\.env', 'C:\**\config.')
WHERE read_file(filename=FullPath) =~ 'sk-' 
   OR read_file(filename=FullPath) =~ 'ANTHROPIC_API_KEY'


-- Hunt for processes with AI related command line arguments
SELECT Pid, Ppid, Name, Username, CommandLine, Exe
FROM pslist()
WHERE CommandLine =~ 'openai' 
   OR CommandLine =~ 'anthropic' 
   OR CommandLine =~ 'huggingface'

# Scan for common AI API Key patterns in text files
$SearchPaths = @("C:\Users\", "C:\Scripts\")
$Patterns = @("sk-[a-zA-Z0-9]{32}", "org-[a-zA-Z0-9]{32}", "ANTHROPIC_API_KEY")

foreach ($Path in $SearchPaths) {
    if (Test-Path $Path) {
        Write-Host "Scanning $Path for API Keys..."
        Get-ChildItem -Path $Path -Recurse -Include *.txt, *.ps1, *.py, *.env, *. -ErrorAction SilentlyContinue | 
        Select-String -Pattern $Patterns | 
        Select-Object Path, Line, Pattern | 
        Format-Table -AutoSize
    }
}