Detections
Sigma rules for AI-agent threats: the agent-to-agent protocol surface
(A2A, Poppy Personal Agent Protocol), MCP supply chain, and AI-assistant
endpoint behavior. All rules are DRL 1.1 (attribution appreciated).
Expand a rule to read it; the table is generated from the rule sources by
build_rules_index.py.
- Every rule is tagged to a pinned MITRE ATLAS release (v2026.09); proposed-but-unadopted techniques are marked
*. - Every rule passes
sigma-clischema checks and backend conversion in CI. - False-positive methodology is published alongside each rule; retractions are published when numbers change.
License: DRL 1.1 (attribution travels with rule matches). Honeypot-derived rules are backed by captured telemetry (see Datasets).
Rules
-
Local LLM Inference Server Started on Windows Endpoint
Detects the start of a local LLM inference server (Ollama, llama.cpp/llama-server, LM Studio, KoboldCPP, LocalAI, TabbyAPI, vLLM, text-generation-webui) on a Windows endpoint. Local inference on workstations is the enabling condition for AI-authored tooling and EDR-evasion tradecraft documented in 2026 (e.g. uncensored open-weight models generating LSASS-dumping tooling on-host — see Project Black), as well as a data-exfiltration and shadow-IT risk. Sigma-native complement to Splunk's "Suspicious Local LLM Frameworks" analytic story (May 2026).
title: Local LLM Inference Server Started on Windows Endpoint id: 42f6f53d-5678-4f23-b5cb-8e4039d5ab38 status: experimental description: Detects the start of a local LLM inference server (Ollama, llama.cpp/llama-server, LM Studio, KoboldCPP, LocalAI, TabbyAPI, vLLM, text-generation-webui) on a Windows endpoint. Local inference on workstations is the enabling condition for AI-authored tooling and EDR-evasion tradecraft documented in 2026 (e.g. uncensored open-weight models generating LSASS-dumping tooling on-host — see Project Black), as well as a data-exfiltration and shadow-IT risk. Sigma-native complement to Splunk's "Suspicious Local LLM Frameworks" analytic story (May 2026). references: - https://projectblack.io/blog/bypassing-edr-with-local-ai/ - https://research.splunk.com/stories/ - https://www.greynoise.io/blog/threat-actors-actively-targeting-llms author: Agentic Threat Lab date: 2026-10-23 tags: - attack.discovery atlas: - AML.T0132 logsource: category: process_creation product: windows detection: selection_image: Image|endswith: - '\ollama.exe' - '\llama-server.exe' - '\lms.exe' - '\lmstudio.exe' - '\koboldcpp.exe' - '\localai.exe' - '\tabbyapi.exe' - '\oobabooga.exe' selection_cli: CommandLine|contains: - 'vllm serve' - 'ollama serve' - 'python -m vllm' - 'text-generation-webui' condition: selection_image or selection_cli falsepositives: - Developers and ML engineers running local models legitimately (baseline expected hosts, alert on the rest) - Software bundling llama.cpp runtimes (some desktop AI apps); tune per environment level: informational -
Local LLM Inference Server Started on Linux Host
Detects the start of a local LLM inference server (Ollama, llama.cpp/llama-server, LM Studio CLI, KoboldCPP, LocalAI, vLLM) on a Linux host. Relevant both for AI-assisted attack tradecraft (tooling generation, EDR evasion — see Project Black writeup) and for exposed-inference abuse — attackers increasingly deploy their own local models inside compromised environments to parse exfiltrated data and orchestrate follow-on actions without touching a provider API.
title: Local LLM Inference Server Started on Linux Host id: a1c75bd9-b78a-41f5-8339-f10e80d79a4b status: experimental description: Detects the start of a local LLM inference server (Ollama, llama.cpp/llama-server, LM Studio CLI, KoboldCPP, LocalAI, vLLM) on a Linux host. Relevant both for AI-assisted attack tradecraft (tooling generation, EDR evasion — see Project Black writeup) and for exposed-inference abuse — attackers increasingly deploy their own local models inside compromised environments to parse exfiltrated data and orchestrate follow-on actions without touching a provider API. references: - https://projectblack.io/blog/bypassing-edr-with-local-ai/ - https://www.greynoise.io/blog/threat-actors-actively-targeting-llms - https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai author: Agentic Threat Lab date: 2026-10-23 tags: - attack.discovery atlas: - AML.T0132 logsource: category: process_creation product: linux detection: selection_image: Image|endswith: - '/ollama' - '/ollama-app' - '/llama-server' - '/lms' - '/koboldcpp' - '/localai' selection_cli: CommandLine|contains: - 'vllm serve' - 'ollama serve' - '-m vllm' - 'python3 -m vllm' - 'text-generation-webui' condition: selection_image or selection_cli falsepositives: - Legitimate development/inference workloads (baseline expected hosts) - Container images bundling inference runtimes; correlate with container parentage where available level: informational -
Poppy Personal Agent Protocol Discovery File Requested
Detects HTTP requests for /.well-known/poppy.json, the discovery document defined by the Poppy Personal Agent Protocol (Sierra/Meta, draft 0.2). A request for this file is the first observable contact of a personal AI agent (or anything impersonating one) with a business endpoint. At the current adoption stage (5 known deployments in an October 2026 scan of ~24,500 domains) almost any such request is research traffic, scanner noise, or early agent activity worth triaging.
title: Poppy Personal Agent Protocol Discovery File Requested id: c35827f4-a907-4b74-995b-be7068715cc7 status: experimental description: Detects HTTP requests for /.well-known/poppy.json, the discovery document defined by the Poppy Personal Agent Protocol (Sierra/Meta, draft 0.2). A request for this file is the first observable contact of a personal AI agent (or anything impersonating one) with a business endpoint. At the current adoption stage (5 known deployments in an October 2026 scan of ~24,500 domains) almost any such request is research traffic, scanner noise, or early agent activity worth triaging. references: - https://personalagentprotocol.org/docs/spec - https://sierra.ai/blog/introducing-personal-agent-protocol author: Agentic Threat Lab date: 2026-10-22 tags: - attack.discovery - attack.t1595 atlas: - AML.T0116 - AML.T0132 logsource: category: web detection: selection: - cs-uri|contains: '/.well-known/poppy.json' - c-uri|contains: '/.well-known/poppy.json' - uri|contains: '/.well-known/poppy.json' - request|contains: '/.well-known/poppy.json' condition: selection falsepositives: - Security researchers and internet scanners (prevalent while the protocol is new) - Search-engine or uptime crawlers that request well-known files indiscriminately level: informational -
MCP STDIO Server Spawned by AI Coding Assistant
Detects an AI coding assistant process spawning a local MCP server over STDIO transport (npx/node/python/uvx with MCP arguments, including mcp-remote). STDIO transport gives the MCP server the full privileges of the assistant process; malicious or trojanized servers (2026 MCP supply-chain incidents, e.g. the Ox Security CVE cluster around STDIO command execution) therefore inherit them silently. Hunting rule — expect noise in developer environments.
title: MCP STDIO Server Spawned by AI Coding Assistant id: 22733efb-4557-41a3-b01f-6e1686e566df status: experimental description: Detects an AI coding assistant process spawning a local MCP server over STDIO transport (npx/node/python/uvx with MCP arguments, including mcp-remote). STDIO transport gives the MCP server the full privileges of the assistant process; malicious or trojanized servers (2026 MCP supply-chain incidents, e.g. the Ox Security CVE cluster around STDIO command execution) therefore inherit them silently. Hunting rule — expect noise in developer environments. references: - https://media.defense.gov/2026/Jun/02/2003943289/-1/-1/0/CSI_MCP_SECURITY.PDF - https://github.com/7WaySecurity/ai_osint/blob/main/detection-rules/SIGMA_RULES.md - https://labs.cloudsecurityalliance.org/agentic/csa-research-note-atlas-agentic-gap-analysis-20260327/ author: Agentic Threat Lab date: 2026-10-22 tags: - attack.execution - attack.t1059 atlas: - AML.T0053 - AML.T0095 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - '\code.exe' - '\cursor.exe' - '\claude.exe' - '\windsurf.exe' - '\aider.exe' selection_child_mcp: CommandLine|contains: - 'mcp' - 'mcp-remote' condition: selection_parent and selection_child_mcp falsepositives: - Legitimate MCP server startup — this is the normal mechanism for local MCP servers; hunt and baseline first - Command lines containing 'mcp' as a substring of unrelated words (consider word-boundary field mappings on your backend) level: low -
LLM Provider API Key Material in Command Line
Detects command lines containing API key material for major LLM providers (OpenAI sk-proj, Anthropic sk-ant, Google AIzaSy, Hugging Face hf_, Groq gsk_, xAI xai-). Keys in process command lines are visible to any same-user process and frequently leak via shell history, CI logs, or agent transcripts; exfiltrated keys power unauthorized agent use. Informational — tune per environment before elevating.
title: LLM Provider API Key Material in Command Line id: 0ce9bd1d-3c07-4797-b312-cd109a3334c7 status: experimental description: Detects command lines containing API key material for major LLM providers (OpenAI sk-proj, Anthropic sk-ant, Google AIzaSy, Hugging Face hf_, Groq gsk_, xAI xai-). Keys in process command lines are visible to any same-user process and frequently leak via shell history, CI logs, or agent transcripts; exfiltrated keys power unauthorized agent use. Informational — tune per environment before elevating. references: - https://github.com/7WaySecurity/ai_osint/blob/main/detection-rules/SIGMA_RULES.md author: Agentic Threat Lab date: 2026-10-22 tags: - attack.t1552 atlas: - AML.T0082 logsource: category: process_creation product: windows detection: selection: CommandLine|re: '(sk-(proj|ant-api03|live)-[A-Za-z0-9_-]{10,}|AIzaSy[A-Za-z0-9_-]{10,}|hf_[A-Za-z0-9]{20,}|gsk_[A-Za-z0-9]{20,}|xai-[A-Za-z0-9]{20,})' condition: selection falsepositives: - Developers legitimately passing keys on the command line (common and bad practice — consider pairing with an alert to the user) - Documentation or example strings level: informational -
AWS Bedrock Model Invocation Logging Disabled
Detects deletion of an AWS Bedrock model invocation logging configuration. Invocation logging captures full model request/response content and metadata to CloudWatch/S3 and is the primary forensic source for AI-abuse investigations; deleting it is AI-specific anti-forensics, analogous to disabling audit policy. Splunk Security Content tracks this detection ("AWS Bedrock Security" analytic story, May 2026); this is the Sigma-native version for pipelines without Splunk.
title: AWS Bedrock Model Invocation Logging Disabled id: 74a6d44b-05b2-4c06-99dc-3269cefc15e6 status: experimental description: Detects deletion of an AWS Bedrock model invocation logging configuration. Invocation logging captures full model request/response content and metadata to CloudWatch/S3 and is the primary forensic source for AI-abuse investigations; deleting it is AI-specific anti-forensics, analogous to disabling audit policy. Splunk Security Content tracks this detection ("AWS Bedrock Security" analytic story, May 2026); this is the Sigma-native version for pipelines without Splunk. references: - https://research.splunk.com/cloud/9c5e3d62-f743-11ee-9f6e-acde48001124/ - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html author: Agentic Threat Lab date: 2026-10-22 atlas: - AML.T0081 logsource: category: cloud product: aws service: cloudtrail detection: selection: EventSource: bedrock.amazonaws.com EventName: DeleteModelInvocationLoggingConfiguration condition: selection falsepositives: - Genuinely decommissioned Bedrock workloads by authorized administrators (rare; verify change ticket) level: high -
AI Coding Agent Configuration Tampering
Detects writes to configuration and instruction files that steer AI coding agents, including .cursor/mcp.json, .claude/settings.json, AGENTS.md, CLAUDE.md, SKILL.md, and .windsurf/mcp.json. Documented 2026 tradecraft (Google GTIG DUSTMAKER/UNC6780; MITRE ATLAS OpenClaw investigation) plants or modifies these files for persistence, MCP server redirection, and tool poisoning. Modify AI Agent Configuration is MITRE ATLAS technique AML.T0081; malicious MCP config is tracked as proposed technique AML.T0095.
title: AI Coding Agent Configuration Tampering id: f6cb7f1a-864d-482a-bf59-ebe831011fc0 status: experimental description: Detects writes to configuration and instruction files that steer AI coding agents, including .cursor/mcp.json, .claude/settings.json, AGENTS.md, CLAUDE.md, SKILL.md, and .windsurf/mcp.json. Documented 2026 tradecraft (Google GTIG DUSTMAKER/UNC6780; MITRE ATLAS OpenClaw investigation) plants or modifies these files for persistence, MCP server redirection, and tool poisoning. Modify AI Agent Configuration is MITRE ATLAS technique AML.T0081; malicious MCP config is tracked as proposed technique AML.T0095. references: - https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai - https://ctid.mitre.org/blog/2026/02/09/mitre-atlas-openclaw-investigation/ - https://labs.cloudsecurityalliance.org/agentic/csa-research-note-atlas-agentic-gap-analysis-20260327/ author: Agentic Threat Lab date: 2026-10-22 tags: - attack.persistence - attack.t1546 atlas: - AML.T0081 - AML.T0095 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - '\.cursor\mcp.json' - '\.claude\settings.json' - '\.windsurf\mcp.json' - '\.vscode\mcp.json' - '\.continue\config.yaml' - '\AGENTS.md' - '\CLAUDE.md' - '\SKILL.md' filter_main_dev_edit: Image|endswith: - '\code.exe' - '\cursor.exe' - '\claude.exe' - '\windsurf.exe' condition: selection and not filter_main_dev_edit falsepositives: - Developers editing their own agent configuration from less common editors (extend the filter for your environment) - Repository template files named AGENTS.md being created during legitimate project setup level: medium -
A2A Agent Card Discovery Request
Detects requests for /.well-known/agent.json, the Agent Card discovery document of the Agent2Agent (A2A) protocol. Agent Cards advertise an agent's identity, skills, and endpoint; fetching one is a precondition for agent-to-agent task delegation and therefore also for agent-card spoofing, skill-survey reconnaissance, and task-replay attacks. Log at hunt level and correlate with subsequent POSTs to the advertised A2A endpoint.
title: A2A Agent Card Discovery Request id: 938e96f4-dc7e-4b0e-9750-e95ccc55c612 status: experimental description: Detects requests for /.well-known/agent.json, the Agent Card discovery document of the Agent2Agent (A2A) protocol. Agent Cards advertise an agent's identity, skills, and endpoint; fetching one is a precondition for agent-to-agent task delegation and therefore also for agent-card spoofing, skill-survey reconnaissance, and task-replay attacks. Log at hunt level and correlate with subsequent POSTs to the advertised A2A endpoint. references: - https://developers.googleblog.com/2025/04/a2a-a-new-era-of-agent-interoperability.html - https://arxiv.org/html/2504.16902v1 author: Agentic Threat Lab date: 2026-10-22 tags: - attack.discovery - attack.t1595 atlas: - AML.T0116 - AML.T0132 logsource: category: web detection: selection: - cs-uri|contains: '/.well-known/agent.json' - c-uri|contains: '/.well-known/agent.json' - uri|contains: '/.well-known/agent.json' - request|contains: '/.well-known/agent.json' condition: selection falsepositives: - Legitimate A2A client agents beginning a delegated task (expected inside agent-enabled environments) - Researchers and scanners enumerating well-known paths level: informational