Anomalous Outbound Traffic to External LLM APIs from Non-Interactive/Service Hosts (AI-Powered-Malware C2 or Data Staging)
Detects network connections to known Generative AI API endpoints (OpenAI, Anthropic, Google, Mistral) from devices that have not exhibited such activity in the past 30 days. This rule excludes common browser processes and email/messaging clients to identify potentially anomalous or unapproved use of AI services.
Microsoft Sentinel (KQL)
