GenAI Process Connection to Suspicious Top Level Domain

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

GenAI Process Connection to Suspicious Top Level Domain

Detects when GenAI tools connect to domains using suspicious TLDs commonly abused for malware C2 infrastructure. TLDs like .top, .xyz, .ml, .cf, .onion are frequently used in phishing and malware campaigns. Legitimate GenAI services use well-established domains (.com, .ai, .io), so connections to suspicious TLDs may indicate compromised tools, malicious plugins, or AI-generated code connecting to attacker infrastructure.

Rule type: eql

Rule indices:

logs-endpoint.events.network*
winlogbeat-*
logs-windows.sysmon_operational-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Endpoint
OS: macOS
OS: Windows
Use Case: Threat Detection
Tactic: Command and Control
Data Source: Elastic Defend
Data Source: Sysmon
Resources: Investigation Guide
Domain: LLM
Mitre Atlas: T0086

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating GenAI Process Connection to Suspicious Top Level Domain

This rule detects GenAI tools connecting to domains with TLDs commonly abused by malware. The suspicious TLD filter makes this a high-signal rule with low expected volume.

Possible investigation steps

Review the GenAI process command line to identify which tool is running and verify if it’s an expected/authorized tool.
Examine the network connection details (destination IP, port, protocol) to understand the nature of the communication.
Check the process execution chain to identify the full attack path and initial entry point.
Investigate the user account associated with the GenAI process to determine if this activity is expected for that user.
Review network traffic patterns to identify data exfiltration or command and control communications.
Check for other alerts or suspicious activity on the same host around the same time.
Verify if the GenAI tool is from a trusted source and if it’s authorized for use in your environment.
Confirm whether the suspicious domain is used by package registries, CDN mirrors, or AI plugin repos.
Check if the GenAI tool attempted follow-up actions such as downloading scripts, connecting to IPs directly, or loading remote models.
Inspect whether the domain matches prompt-redirections, malicious AI plugins, or compromised package dependencies.

False positive analysis

Legitimate GenAI tools may occasionally connect to domains using suspicious TLDs if they’re legitimate services.
Package managers (npx, pnpm, yarn, bunx) may connect to package registries or CDNs that use suspicious TLDs. Review and exclude known legitimate package registries if needed.
Some third-party AI plugin ecosystems (VSCode AI plugins, Cursor extensions) may download assets from unusual TLDs; verify allowlists.

Response and remediation

Terminate the GenAI process and any spawned child processes to stop the malicious activity.
Review and revoke any API keys, tokens, or credentials that may have been exposed or used by the GenAI tool.
Block the identified suspicious domains at the network level.
Investigate the GenAI tool configuration to identify how it was configured and what it was authorized to access.
Update security policies to restrict or monitor GenAI tool usage in the environment, especially for network communications.
Add detection for secondary indicators (reverse shells, encoded C2 traffic, odd user-agent strings).

Rule query

edit

network where host.os.type in ("macos", "windows") and

  // GenAI processes
  process.name in (
    "ollama.exe", "ollama", "Ollama",
    "textgen.exe", "textgen", "text-generation-webui.exe", "oobabooga.exe",
    "lmstudio.exe", "lmstudio", "LM Studio",
    "claude.exe", "claude", "Claude",
    "cursor.exe", "cursor", "Cursor",
    "copilot.exe", "copilot", "Copilot",
    "codex.exe", "codex",
    "Jan", "jan.exe", "jan",
    "gpt4all.exe", "gpt4all", "GPT4All",
    "gemini-cli.exe", "gemini-cli",
    "genaiscript.exe", "genaiscript",
    "grok.exe", "grok",
    "qwen.exe", "qwen",
    "koboldcpp.exe", "koboldcpp", "KoboldCpp",
    "llama-server", "llama-cli",
    "deno.exe", "deno",
    "npx", "pnpm", "yarn", "bunx"
  ) and

  // Suspicious TLDs
  (
    // Windows DNS events
    (host.os.type == "windows" and dns.question.name != null and
     dns.question.name regex """.*\.(top|buzz|xyz|rest|ml|cf|gq|ga|onion|monster|cyou|quest|cc|bar|cfd|click|cam|surf|tk|shop|club|icu|pw|ws|online|fun|life|boats|store|hair|skin|motorcycles|christmas|lol|makeup|mom|bond|beauty|biz|live|work|zip|country|accountant|date|party|science|loan|win|men|faith|review|racing|download|host)""") or

    // macOS network events
    (host.os.type == "macos" and destination.domain != null and
     destination.domain regex """.*\.(top|buzz|xyz|rest|ml|cf|gq|ga|onion|monster|cyou|quest|cc|bar|cfd|click|cam|surf|tk|shop|club|icu|pw|ws|online|fun|life|boats|store|hair|skin|motorcycles|christmas|lol|makeup|mom|bond|beauty|biz|live|work|zip|country|accountant|date|party|science|loan|win|men|faith|review|racing|download|host)""")

    // Linux DNS events
    // Revist when available
  )

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Command and Control
- ID: TA0011
- Reference URL: https://attack.mitre.org/tactics/TA0011/
Technique:
- Name: Application Layer Protocol
- ID: T1071
- Reference URL: https://attack.mitre.org/techniques/T1071/
Sub-technique:
- Name: DNS
- ID: T1071.004
- Reference URL: https://attack.mitre.org/techniques/T1071/004/

« GenAI Process Compiling or Generating Executables GenAI Process Connection to Unusual Domain »