CLOSEDQUORUM: Multi-LLM Provider Voting C2 with Discord Webhook Exfil
Detects instances where a non-browser process initiates network connections to multiple AI service providers and Discord within a 15-minute correlation window, potentially indicating automated data exfiltration or unauthorized interaction with AI platforms using tools other than standard web browsers.
Microsoft Sentinel (KQL)
