--- analysis: A standard rule might detect large uploads, but this hunt pivots between high-frequency HTTP traffic, fileless process state (on_disk = 0), and network baseline deviations to distinguish an intrusion from legitimate AI usage. blind_spots: - id: no-http-telemetry question: Whether the host initiated the connection via a non-HTTP protocol or encrypted tunnel. requires: hb_http_activity or proxy logs risk: A host connecting to a malicious AI skill repository via an SSH tunnel would be missed in the initial gate. stage: initial-access-ai-enhanced-phishing-and-exploitation - id: no-endpoint-telemetry question: Whether the malicious runtime hijack was fileless or executed from memory. requires: hb_process_activity with on_disk state risk: Without endpoint-level 'on_disk' data, fileless persistence within an AI interpreter is indistinguishable from legitimate process execution. stage: persistence-ai-runtime-abuse coverage: - stage: initial-access-ai-enhanced-phishing-and-exploitation status: covered steps: - ai-service-leads - assess-traffic-volume - stage: persistence-ai-runtime-abuse status: covered steps: - ai-runtime-anomalies - stage: exfiltration-automated-data-theft status: covered steps: - exfiltration-volume - reason: Not examined by this hunt; belongs to a separate hunt. stage: execution-malicious-ai-skills status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: AI adoption is outpacing governance; this hunt identifies the misuse of AI runtimes and exfiltration channels that bypass traditional signature-based detection. methodology: model-assisted trigger: intel-report hypothesis: An adversary is using compromised AI runtimes to maintain persistence and automate the exfiltration of sensitive data to AI skill repositories. labels: - hunt - attack.t1041 - attack.t1190 - attack.t1566 - attack.t1543 - execution - exfiltration - initial access - persistence name: AI-Driven Persistence and Automated Data Theft parameters: ai_parent_processes: default: - chrome.exe - firefox.exe - msedge.exe - gemini.exe - python.exe - python3.exe description: Common parent processes for AI runtimes and browsers. from: kind: manual observed: '2026-06-15' ref: promptspy-persistence-research type: list[string] ai_service_domains: default: - openai.com - anthropic.com - gemini.google.com - huggingface.co - mistral.ai description: Known AI provider and skill repository domains. from: kind: article observed: '2026-05-01' ref: eset-research-2026 type: list[domain] lookback_days: default: '14' description: Days of history to examine. type: number scope_hosts: default: [] description: Hosts identified in the scoping lead; leave empty to scan the full estate. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.welivesecurity.com/en/business-security/cyberthreats-moving-faster-smbs-readiness-must-accelerate/ gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: Begin by scanning all endpoints for high-frequency AI domain traffic. Focus on departments likely to use AI, such as Engineering (coding assistants) and Marketing (content generation), as they are primary targets for AI-based persistence and data theft. references: - name: 'Cyberthreats are moving faster than SMBs: Readiness must accelerate' url: https://www.welivesecurity.com/en/business-security/cyberthreats-moving-faster-smbs-readiness-must-accelerate/ related: - hunt: malicious-ai-skill-execution reason: This hunt focuses on runtime hijacks (PromptSpy), while execution of malicious plugins belongs in a hunt targeting container and dependency scanning. relation: out-of-scope-alternative scenario: stages: - name: AI-Enhanced Phishing and Exploitation observables: - automated social media reconnaissance - personalized phishing messages in local languages - rapid exploitation of N-day vulnerabilities in public applications - prompt injection via chatbots slug: initial-access-ai-enhanced-phishing-and-exploitation tactic: initial-access techniques: - T1190 - T1566 - name: Execution via Malicious AI Skills observables: - malicious AI skills/plugins - download of secondary malware payloads - suspicious agent instructions causing unintended actions slug: execution-malicious-ai-skills tactic: execution techniques: - T1204.002 - name: AI Engine Runtime Persistence observables: - abuse of Google Gemini runtime for persistent execution - AI-powered spyware (PromptSpy) persistence mechanisms slug: persistence-ai-runtime-abuse tactic: persistence techniques: - T1543 - name: Automated Data Exfiltration observables: - data exfiltration over existing C2 channels - AI-driven classification and extraction of stolen data - high-volume traffic to AI skills repositories slug: exfiltration-automated-data-theft tactic: exfiltration techniques: - T1041 summary: Threat actors are leveraging AI to automate victim reconnaissance, accelerate exploit development for public-facing applications, and conduct high-volume personalized phishing. The intrusion lifecycle involves the deployment of malicious AI skills or plugins that execute malware and exfiltrate data via automated classification agents. severity: medium targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent network: category: network name: Network telemetry telemetry: - network web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # AI-Driven Persistence and Automated Data Theft This hunt identifies the misuse of AI ecosystem components, such as hijacked Google Gemini runtimes and malicious AI skill repositories. It uses a gated flow to first identify hosts with high-frequency AI service interactions before performing deeper process-level and network-volume forensics. The hunt focuses on detecting 'PromptSpy' style persistence where malicious code runs within an AI interpreter and exfiltrates data at scale. ## ai-service-leads Identify hosts with unusual volumes of HTTP traffic to AI providers as a lead for automated agent abuse. ```sqlite target=web role=scoping params=(lookback_days=lookback_days, ai_service_domains=ai_service_domains) ~~~yaml expected: Hosts with high request counts suggest automated activity rather than manual chat. Silence indicates no large-scale AI service usage observed in HTTP logs. reads: - device_hostname - url_hostname - user_agent - time silence: evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-09-29' ~~~ SELECT device_hostname, url_hostname, COUNT(*) AS request_count, user_agent, MIN(time) AS first_request, MAX(time) AS last_request FROM hb_http_activity WHERE instr(',' || '{{ai_service_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_hostname, user_agent HAVING request_count > 100 ORDER BY request_count DESC ``` ## assess-traffic-volume ```agent target=hunter cite: required context: - ai-service-leads max_iterations: 3 objective: Review the request counts and user agents from ai-service-leads. Mark hosts as suspicious if they show persistent, high-frequency requests or use non-standard browser user agents. success_criteria: A per-host verdict of suspicious or benign. tools: - endpoint - network - web ``` ## gate-decision if~: "The assessment identifies at least one host where AI interaction is likely automated or malicious." (confidence: medium, judge=hunter) then: → forensic-fan-out indeterminate: → analyst-confirmation unavailable: → analyst-confirmation (blind_spot: no-http-telemetry) else: → close-out-report ## forensic-fan-out parallel: - → ai-runtime-anomalies - → exfiltration-volume join: → final-triage ## ai-runtime-anomalies Identify processes with no binary on disk running under AI-related parents, characteristic of PromptSpy. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, ai_parent_processes=ai_parent_processes, scope_hosts=scope_hosts) ~~~yaml expected: A process launched from a browser or AI runtime that has since been deleted from disk. This is a high-confidence signal for fileless execution. reads: - device_hostname - process_name - parent_process_name - on_disk - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-09-29' ~~~ SELECT device_hostname, process_name, process_cmd_line, parent_process_name, on_disk, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{ai_parent_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{ai_parent_processes}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0) AND (on_disk = 0 OR on_disk = 'false') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## exfiltration-volume Establish a baseline and identify hosts sending unusually large volumes of data to AI domains. ```sqlite target=network role=baseline params=(lookback_days=lookback_days, ai_service_domains=ai_service_domains, scope_hosts=scope_hosts) ~~~yaml baseline: compare: prior_equal_window window: '{{lookback_days}}d' expected: Hosts sending more than 50MB to AI domains. Silence suggests no bulk exfiltration occurred via these endpoints during the window. prevalence: by: device_hostname key: - dst_endpoint_hostname rare_below: 3 reads: - device_hostname - dst_endpoint_hostname - traffic_bytes - direction - state_kind - time silence: evidence_of_absence source: hb_network_connection verified: dry-run verified_at: '2026-09-29' ~~~ SELECT device_hostname, dst_endpoint_hostname, SUM(traffic_bytes) AS total_out_bytes, COUNT(*) AS session_count FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{ai_service_domains}}' || ',', ',' || LOWER(dst_endpoint_hostname) || ',') > 0 AND direction = 'outbound' AND state_kind = 'log' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_hostname HAVING total_out_bytes > 50000000 ``` ## final-triage ```agent target=hunter cite: required context: - assess-traffic-volume - ai-runtime-anomalies - exfiltration-volume max_iterations: 6 objective: Review the correlated evidence. Confirm a malicious verdict if a host shows suspicious traffic automation (from assess-traffic-volume), a fileless process anomaly (from ai-runtime-anomalies), and a matching exfiltration spike to an AI domain (from exfiltration-volume). success_criteria: A verdict of malicious, suspicious, or benign citing specific event rows. tools: - endpoint - network - web ``` ## final-route if~: "The final triage verdict is malicious for at least one host." (confidence: high, judge=hunter) then: → isolate-compromised-host indeterminate: → analyst-confirmation unavailable: → analyst-confirmation (blind_spot: no-endpoint-telemetry) else: → close-out-report ## isolate-compromised-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host immediately. Revoke all active session tokens for AI services (OpenAI, Gemini) used on this device. ``` → analyst-confirmation ## analyst-confirmation ```manual target=analyst Review the cited process and network volume rows. Verify if the 'on_disk = 0' process correlates with the network spike to the AI provider. Determine if this represents a rogue AI agent or a legitimate developer activity. ``` → close-out-report ## close-out-report ```manual target=analyst Summarize the findings. Note any legitimate automated AI tasks that should be excluded from future runs. Update the corporate AI policy if shadow AI usage was discovered. ``` → end