Analytics BIOC Informational
✕

Untrusted process contacted LLM API

An untrusted process contacted an LLM API.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Resource Development (TA0042)
ATT&CK techniques: Obtain Capabilities: Artificial Intelligence (T1588.007)
Attacker's goals:

Adversaries may use LLM APIs to create malicious payload dynamically. Each payload will be slightly different making detection more complex.

Investigative actions:

Investigate the process that contacted the LLM API. Check if this LLM API access is legitimate and expected. Analyze the data potentially sent to the LLM service.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Untrusted process contacted a rare LLM API Low (parent: Informational)