Persistence via GenAI Tool

[rule]
description = """
Detects when a GenAI process or descendant attempts to modify commonly abused file persistence entries. This activity
could be the result of exploiting a prompt injection vulnerability or compromised external dependency.
"""
id = "1a2e350a-4f4b-411b-af91-b1555eebe17f"
license = "Elastic License v2"
name = "Persistence via GenAI Tool"
os_list = ["macos", "windows"]
reference = [
    "https://cymulate.com/blog/cve-2025-547954-54795-claude-inverseprompt/",
    "https://specterops.io/blog/2025/11/21/an-evening-with-claude-code/",
    "https://www.straiker.ai/blog/nomshub-cursor-remote-tunneling-sandbox-breakout",
]
version = "1.0.7"

query = '''
sequence by process.entity_id with maxspan=1m
[process where event.type == "start" and event.action in ("exec", "start") and
 (
  process.parent.name in ("claude", "claude.exe", "cursor.exe", "cursor", "Cursor", "codex", "codex.exe", "sandbox-exec",
  "openai", "openai.exe", "ollama.exe", "ollama", "textgen.exe", "textgen", "lmstudio.exe", "lmstudio",
  "copilot.exe", "copilot", "gemini-cli.exe", "llm", "windsurf", "windsurf.exe", "Windsurf.exe", "Windsurf Helper", "Windsurf Helper (Plugin)", "Windsurf Helper (Renderer)", "Windsurf Helper (GPU)") or

  descendant of [process where event.action in ("exec", "start") and
                 process.parent.name in ("claude", "claude.exe", "cursor.exe", "cursor", "codex", "codex.exe", "sandbox-exec",
                 "openai", "openai.exe", "ollama.exe", "ollama", "textgen.exe", "textgen", "lmstudio.exe", "lmstudio", "copilot.exe",
                 "copilot", "gemini-cli.exe", "llm", "windsurf", "windsurf.exe", "Windsurf.exe", "Windsurf Helper", "Windsurf Helper (Plugin)", "Windsurf Helper (Renderer)", "Windsurf Helper (GPU)")]
 ) and
 not process.Ext.effective_parent.executable == "/opt/jc/bin/jumpcloud-agent" and
 not (process.executable like ("/opt/homebrew/Library/Homebrew/vendor/portable-ruby/*/bin/ruby",
                               "/usr/local/Homebrew/Library/Homebrew/vendor/portable-ruby/*/bin/ruby") and
      process.args in ("/opt/homebrew/Library/Homebrew/brew.rb",
                       "/usr/local/Homebrew/Library/Homebrew/brew.rb") and
      process.args == "services")]
[file where not event.action in ("deletion", "open", "rename") and
  file.path : ("/private/etc/rc.local",
               "/etc/rc.local",
               "/etc/sudoers",
               "/System/Library/LaunchAgents/*.plist",
               "/Library/LaunchAgents/*.plist",
               "/Users/*/Library/LaunchAgents/*.plist",
               "/System/Library/LaunchDaemons/*.plist",
               "/Library/LaunchDaemons/*.plist",
               "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
               "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*") and
  not file.name : "com.github.facebook.watchman.plist" and
  not process.code_signature.subject_name == "Ollama Inc."]
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1037"
name = "Boot or Logon Initialization Scripts"
reference = "https://attack.mitre.org/techniques/T1037/"
[[threat.technique.subtechnique]]
id = "T1037.004"
name = "RC Scripts"
reference = "https://attack.mitre.org/techniques/T1037/004/"


[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.001"
name = "Launch Agent"
reference = "https://attack.mitre.org/techniques/T1543/001/"

[[threat.technique.subtechnique]]
id = "T1543.004"
name = "Launch Daemon"
reference = "https://attack.mitre.org/techniques/T1543/004/"


[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"
[[threat.technique.subtechnique]]
id = "T1547.001"
name = "Registry Run Keys / Startup Folder"
reference = "https://attack.mitre.org/techniques/T1547/001/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.10.0"