AI LLM API HTTPS Connections from Suspicious Non-Browser Processes (PROMPTFLUX/PROMPTSTEAL)
Detects outbound network connections to common Large Language Model (LLM) APIs (OpenAI, Anthropic, Google) or local LLM instances (Ollama) from processes that are not standard web browsers, common IDEs, or typical development/scripting tools. This behavior may indicate an attempt to exfiltrate sensitive data or interact with LLM services using unauthorized or hidden processes.
Splunk (SPL)
