Agentic tool-call syntax combined with offensive capability terms

Ankit Mehta@Secvyn

•updated Sep 22, 2026•0•0•2

Detects process command lines containing LLM tool-calling syntax (e.g., 'tool_call', 'function_call') in conjunction with keywords associated with offensive security capabilities (e.g., 'exploit', 'mimikatz', 'exfiltrate'). This pattern is consistent with the behavior of malicious LLM-based agents attempting to autonomously invoke and execute offensive tasks.