x47.c Windows Botnet Weaponizes xAI Grok API for AI-Driven Persistence — Detection and Response Guide

---
title: Suspicious Process Network Connection to xAI Grok API
id: 3f8a1c94-7b2e-4d5a-9c61-8e4f2a0b7d33
status: experimental
description: Detects non-browser, non-approved processes establishing network connections to the xAI Grok API endpoint (api.x.ai), consistent with x47.c botnet LLM-driven C2 tasking. Baseline legitimate AI SDK processes in your environment before enabling at high level.
references:
  - https://www.securityweek.com/new-x47-c-windows-botnet-weaponizes-xai-grok-ai-api-draining/
  - https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_destination:
    DestinationHostname|contains:
      - 'api.x.ai'
      - 'api.grok.x.ai'
  filter_approved:
    Image|endswith:
      - '\Code.exe'
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: selection_destination and not filter_approved
falsepositives:
  - Legitimate Grok SDK integrations running from custom paths
  - Electron-based AI clients
level: high
---
title: API Key Environment Variable Access via Command Line
id: 8c2d4e61-3a9f-4b7c-b512-6d8e0f1a9c44
status: experimental
description: Detects command-line access to AI provider API key environment variables, consistent with x47.c credential harvesting and API draining behavior. Administrators legitimately echo these keys rarely; treat hits as suspicious by default.
references:
  - https://www.securityweek.com/new-x47-c-windows-botnet-weaponizes-xai-grok-ai-api-draining/
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_keys:
    CommandLine|contains:
      - 'XAI_API_KEY'
      - 'GROK_API_KEY'
      - 'OPENAI_API_KEY'
      - 'ANTHROPIC_API_KEY'
  selection_method:
    CommandLine|contains:
      - 'echo'
      - 'set '
      - 'Get-ChildItem Env:'
      - 'gci env:'
      - '$env:'
      - '[Environment]::GetEnvironmentVariable'
      - 'printenv'
  filter_setup:
    CommandLine|contains:
      - 'setx'
  condition: selection_keys and selection_method and not filter_setup
falsepositives:
  - Developers validating local configuration
  - CI/CD pipeline diagnostics
level: medium
---
title: Bulk Read of AI Credential and Environment Configuration Files
id: b71e9f02-4c5d-4a8e-9237-1f6c8d3e5a21
status: experimental
description: Detects suspicious processes reading .env files and AI SDK configuration files where LLM API keys are commonly stored, consistent with x47.c API key harvesting prior to API draining.
references:
  - https://www.securityweek.com/new-x47-c-windows-botnet-weaponizes-xai-grok-ai-api-draining/
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '\.env'
      - '\.env.local'
      - '\.env.production'
      - '\openai\config.json'
      - '\anthropic\config.json'
      - '\xai\config.json'
  filter_dev:
    Image|endswith:
      - '\Code.exe'
      - '\devenv.exe'
      - '\idea64.exe'
      - '\node.exe'
      - '\python.exe'
      - '\git.exe'
  condition: selection and not filter_dev
falsepositives:
  - Backup agents and indexing services
  - DLP scanners
level: medium

// Hunt: Non-standard processes communicating with xAI Grok API (x47.c LLM-C2 indicator)
let ApprovedAIClients = dynamic([
    "code.exe", "python.exe", "python3.exe", "node.exe",
    "chrome.exe", "msedge.exe", "firefox.exe"
]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any ("api.x.ai", "api.grok.x.ai")
   or RemoteIP in ("104.18.0.0/16") // replace with resolved api.x.ai ranges from your DNS telemetry
| extend ProcessName = tolower(split(InitiatingProcessFileName, "\"")[-1])
| where ProcessName !in~ (ApprovedAIClients)
| summarize
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    ConnectionCount = count(),
    RemoteIPs = make_set(RemoteIP, 10),
    CommandLines = make_set(InitiatingProcessCommandLine, 5)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessAccountName
| project FirstSeen, LastSeen, DeviceName, InitiatingProcessFileName,
          InitiatingProcessFolderPath, InitiatingProcessAccountName,
          ConnectionCount, RemoteIPs, CommandLines
| order by ConnectionCount desc;
// Companion hunt: processes reading AI API key material from environment or config files
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any (
    "XAI_API_KEY", "GROK_API_KEY", "OPENAI_API_KEY", "ANTHROPIC_API_KEY")
   and ProcessCommandLine has_any (
    "echo", "$env:", "Get-ChildItem Env:", "GetEnvironmentVariable", "printenv")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine,
          AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc;

-- Hunt: x47.c LLM-C2 indicator — active connections to api.x.ai from suspicious processes
SELECT Pid, Name, Exe, CommandLine, Username,
       netstat.RemoteAddr AS RemoteAddr,
       netstat.RemotePort AS RemotePort,
       netstat.Status AS ConnStatus,
       CreateTime
FROM pslist()
JOIN (
    SELECT Pid AS NetPid, RemoteAddr, RemotePort, Status
    FROM netstat()
    WHERE RemotePort = 443
      AND Status = 'ESTABLISHED'
) AS netstat
ON pslist.Pid = netstat.NetPid
WHERE Name =~ '(?i)(powershell|pwsh|cmd|rundll32|regsvr32|mshta|wscript|cscript)'
   OR Exe =~ '(?i)(\\temp\\|\\appdata\\local\\temp\\|\\programdata\\|\\users\\public\\)'
-- Second artifact: enumerate processes holding AI API keys in their environment block
SELECT Pid, Name, Exe, Username,
       environ() AS EnvVars
FROM pslist()
WHERE EnvVars =~ '(?i)(XAI_API_KEY|GROK_API_KEY|OPENAI_API_KEY|ANTHROPIC_API_KEY)'

# x47.c Botnet Triage & Hardening Script — run elevated on suspect endpoints
# 1. Identify live connections to xAI API infrastructure from non-approved processes
$approved = @('code.exe','python.exe','python3.exe','node.exe','chrome.exe','msedge.exe')
$xaiIPs = (Resolve-DnsName api.x.ai -Type A -ErrorAction SilentlyContinue).IPAddress
Get-NetTCPConnection -State Established -RemotePort 443 -ErrorAction SilentlyContinue |
  Where-Object { $xaiIPs -contains $_.RemoteAddress } |
  ForEach-Object {
    $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($p -and $approved -notcontains $p.ProcessName.ToLower()) {
      [PSCustomObject]@{
        Alert      = 'SUSPICIOUS_XAI_CONNECTION'
        PID        = $p.Id
        Process    = $p.ProcessName
        Path       = $p.Path
        RemoteIP   = $_.RemoteAddress
        StartTime  = $p.StartTime
      }
    }
  }

# 2. Sweep common credential locations for AI API keys (exposure check, rotate if found)
$keyPaths = @(
  "$env:USERPROFILE\.env",
  "$env:APPDATA\xai",
  "$env:APPDATA\openai",
  "$env:USERPROFILE\.config"
)
foreach ($path in $keyPaths) {
  if (Test-Path $path) {
    Get-ChildItem $path -Recurse -ErrorAction SilentlyContinue |
      Select-String -Pattern 'XAI_API_KEY|GROK_API_KEY|OPENAI_API_KEY|ANTHROPIC_API_KEY' -List |
      ForEach-Object { Write-Warning "API key material found: $($_.Path) — ROTATE IMMEDIATELY" }
  }
}

# 3. Check persistence locations for recently created entries (x47.c persistence footholds)
Get-CimInstance Win32_StartupCommand |
  Where-Object { $_.Command -match 'temp|appdata|programdata|powershell' } |
  Select-Object Name, Command, Location, User
Get-ScheduledTask | Where-Object {
  $_.Actions.Execute -match 'powershell|wscript|mshta' -and
  $_.Date -gt (Get-Date).AddDays(-30)
} | Select-Object TaskName, TaskPath, @{n='Action';e={$_.Actions.Execute}}

# 4. Optional containment: block api.x.ai at the endpoint firewall on hosts with NO legitimate Grok use
# Comment out until you have inventoried legitimate usage — this WILL break sanctioned AI tooling
# New-NetFirewallRule -DisplayName 'Block xAI API (x47.c containment)' -Direction Outbound `
#   -RemoteAddress $xaiIPs -Protocol TCP -RemotePort 443 -Action Block