JADEPUFFER-style Autonomous AI Extortion Chain (Access to Impact <4h)

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•3

This rule detects a sequence of suspicious events related to the 'ENCFORGE' threat actor or toolset. It monitors for evidence of initial access (via validation/code API calls), command and control communication (to specific IP/port), and destructive impact, correlating these activities within a 4-hour window on the same host.