Linux Espionage - C2/Exfil via AI LLM API
Detects script-driven (curl, wget, python) outbound connections to AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert command, control, and exfiltration channels, blending malicious traffic with approved web services to evade network-based detection.
YARA-L
