NGR Softlab has updated its Alertix SIEM system with a new correlation rule designed to detect cyberattacks that leverage commercial large language models (LLMs). The rule addresses a specific compromise scenario where malware interacts with LLM APIs to determine subsequent actions within a target infrastructure.
The development was inspired by research from Cisco Talos on the Closedquorum malware. Unlike traditional use cases where AI generates malicious code, this method involves malware sending infrastructure data to LLMs to guide its attack path. Because these interactions occur via legitimate APIs, they often blend in with standard corporate traffic.
The new rule, titled 'Process access to LLM API before accessing LSASS,' is now part of the Alertix out-of-the-box expertise set. It monitors for a specific sequence: a process calling an LLM API followed by an attempt to access the Windows LSASS process memory, which typically stores user credentials.
By focusing on the sequence of events rather than specific file signatures, the rule can identify various attack scenarios involving external LLMs and unauthorized access to sensitive OS data. To function, the system requires Sysmon telemetry data collected from Windows hosts.
