AI Webchat as Covert C2 Proxy via WebView2
This rule detects two related activities that could indicate the use of AI webchat services as a covert C2 proxy via WebView2. The first part identifies network connections to specific AI webchat domains (grok.com, copilot.microsoft.com) via proxy or web logs. The second part identifies the creation of the 'msedgewebview2.exe' process by unusual parent processes, excluding common browsers and Microsoft Office applications. This combination aims to catch scenarios where WebView2, often used by AI webchat applications, is leveraged for malicious command and control.
Splunk (SPL)
