[New Rules] Add MITRE ATLAS framework support and GenAI threat detection rules #5352

Mikaayenson · 2025-11-22T00:32:34Z

Pull Request

Issue link(s): Related https://github.com/elastic/security-team/issues/9809

Summary - What I changed

This PR adds MITRE ATLAS framework support to the detection-rules repository and introduces seven new Generative AI (GenAI) threat detection rules with ATLAS technique references.

Framework Support

Added MITRE ATLAS framework support: New atlas.py module with utilities to load and process ATLAS data from the official MITRE ATLAS YAML file
Schema updates: Extended threat framework validation to support MITRE ATLAS URLs and tags in rule definitions
Test infrastructure: Updated test_all_rules.py with ATLAS validation logic (temporarily skipped pending Security Solution support for ATLAS [[rule.threat]] blocks)
ATLAS integration approach: ATLAS techniques are currently referenced via tags (e.g., Mitre Atlas: T0086) and rule references; validation logic is in place for future [[rule.threat]] block support

New Detection Rules

Seven new detection rules targeting GenAI-related threats:

Credential Access - GenAI Process Accessing Sensitive Files
- Detects when GenAI tools access credential stores, SSH keys, browser data, cloud configs, or API keys
- ATLAS: AML.T0085, AML.T0085.001, AML.T0055
Command and Control - GenAI Process Connection to Suspicious TLD
- Detects GenAI tools connecting to suspicious top-level domains commonly used for C2
- ATLAS: AML.T0086
Defense Evasion - GenAI Process Compiling Executables
- Detects when GenAI processes spawn compilation or packaging tools
- ATLAS: AML.T0053
Defense Evasion - GenAI Process Encoding Prior to Network Activity
- Detects encoding/chunking operations by GenAI processes followed by outbound network connections
- ATLAS: AML.T0086
Defense Evasion - Unusual Process Modifying GenAI Configuration File
- Detects unusual modification of GenAI tool configuration files
- Catches prompt injection attacks that abuse GenAI tools to modify their own configs
Command and Control - GenAI Process Connection to Unusual Domain
- Detects GenAI tools connecting to domains not seen in the past 7 days
- ATLAS: AML.T0086
Execution - GenAI or MCP Server Child Process
- Building block rule detecting child processes spawned by GenAI tools or MCP servers
- ATLAS: AML.T0053

How To Test

🔱 Tests will run in CI

Manual Testing

Validate framework support and all rules:
```
python -m detection_rules test
```

Lint specific rules:

python -m detection_rules toml-lint -f rules/cross-platform/credential_access_genai_process_sensitive_file_access.toml

Check ATLAS data loading:

from detection_rules.atlas import load_atlas_yaml, build_threat_map_entry
atlas_data = load_atlas_yaml()
threat_entry = build_threat_map_entry("Collection", "AML.T0085", "AML.T0085.001")

Expected Test Results

All existing tests should pass
Schema validation should accept ATLAS framework URLs and tags (unit test should still skip for now)

Checklist

Added a label for the type of pr: Rule: New and enhancement (for ATLAS framework support)
Added the meta:rapid-merge label if planning to merge within 24 hours
Secret and sensitive material has been managed correctly
Automated testing was updated or added to match the most common scenarios
Documentation and comments were added for features that require explanation

github-actions · 2025-11-22T00:33:32Z

rules/cross-platform/command_and_control_genai_process_suspicious_tld_connection.toml

rules/cross-platform/collection_genai_process_sensitive_file_access.toml

…ccess.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

cla-checker-service · 2025-12-04T06:14:44Z

💚 CLA has been signed

tradebot-elastic · 2025-12-04T06:17:00Z

⛔️ Test failed

Results

❌ GenAI Process Connection to Suspicious Top Level Domain (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Compiling or Generating Executables (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Accessing Sensitive Files (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Performing Encoding/Chunking Prior to Network Activity (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

rules/cross-platform/collection_genai_process_sensitive_file_access.toml

rules/cross-platform/command_and_control_genai_process_suspicious_tld_connection.toml

rules_building_block/execution_mcp_server_child_process.toml

rules/cross-platform/command_and_control_genai_process_suspicious_tld_connection.toml

tradebot-elastic · 2025-12-04T14:44:06Z

⛔️ Test failed

Results

❌ GenAI Process Connection to Suspicious Top Level Domain (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Compiling or Generating Executables (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Accessing Sensitive Files (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Performing Encoding/Chunking Prior to Network Activity (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

…c/detection-rules into additional_genai_coverage

rules/cross-platform/defense_evasion_genai_config_modification.toml

rules/cross-platform/command_and_control_genai_process_unusual_domain.toml

eric-forte-elastic

🟢 Manual review, local testing (ref), looks good to me! 👍

Mikaayenson · 2025-12-04T20:29:05Z

rules_building_block/execution_mcp_server_child_process.toml

+shell commands, read files, and interact with external services. This building block provides visibility into
+AI-initiated process execution for correlation with other suspicious activity.
+"""
+from = "now-119m"


Wondering if we should bypass_bbr_timing = true

If you don't expect it to be noisy I would just run on regular interval here.

this will be noisy

Aegrah

Looks good! Some comments to improve on.

rules/cross-platform/command_and_control_genai_process_suspicious_tld_connection.toml

Aegrah · 2025-12-05T13:19:57Z

rules/cross-platform/command_and_control_genai_process_suspicious_tld_connection.toml

+type = "eql"
+
+query = '''
+network where host.os.type in ("macos", "windows") and


event.action/event.type could be added here

rules/cross-platform/command_and_control_genai_process_unusual_domain.toml

Aegrah · 2025-12-05T13:28:28Z

rules/cross-platform/defense_evasion_genai_process_encoding_prior_to_network_activity.toml

+
+  // Encoding/compression followed by network activity
+  [process where event.type == "start"
+     and event.type == "start"


Suggested change

and event.type == "start"

Same note on event.action

rules/cross-platform/defense_evasion_genai_process_encoding_prior_to_network_activity.toml

Aegrah · 2025-12-05T13:29:55Z

rules_building_block/execution_mcp_server_child_process.toml

+shell commands, read files, and interact with external services. This building block provides visibility into
+AI-initiated process execution for correlation with other suspicious activity.
+"""
+from = "now-119m"


If you don't expect it to be noisy I would just run on regular interval here.

rules/cross-platform/defense_evasion_genai_process_encoding_prior_to_network_activity.toml

Aegrah · 2025-12-05T13:31:14Z

rules_building_block/execution_mcp_server_child_process.toml

+type = "eql"
+
+query = '''
+process where event.type == "start" 


Would be good to add compatible event.actions

…xecutables.toml Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

tradebot-elastic · 2025-12-05T18:06:56Z

⛔️ Test failed

Results

❌ Unusual Process Modifying GenAI Configuration File (kuery)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Connection to Unusual Domain (kuery)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Connection to Suspicious Top Level Domain (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Compiling or Generating Executables (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Accessing Sensitive Files (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Performing Encoding/Chunking Prior to Network Activity (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

…ior_to_network_activity.toml Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

tradebot-elastic · 2025-12-05T18:08:28Z

⛔️ Test failed

Results

❌ Unusual Process Modifying GenAI Configuration File (kuery)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Connection to Unusual Domain (kuery)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Connection to Suspicious Top Level Domain (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Compiling or Generating Executables (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Accessing Sensitive Files (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Performing Encoding/Chunking Prior to Network Activity (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

terrancedejesus

LGTM peer review with @Mikaayenson

tradebot-elastic · 2025-12-05T18:14:11Z

⛔️ Test failed

Results

❌ Unusual Process Modifying GenAI Configuration File (kuery)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Connection to Unusual Domain (kuery)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Connection to Suspicious Top Level Domain (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Compiling or Generating Executables (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Accessing Sensitive Files (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Performing Encoding/Chunking Prior to Network Activity (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

…c/detection-rules into additional_genai_coverage

tradebot-elastic · 2025-12-05T18:15:04Z

⛔️ Test failed

Results

❌ Unusual Process Modifying GenAI Configuration File (kuery)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Connection to Unusual Domain (kuery)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Connection to Suspicious Top Level Domain (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Compiling or Generating Executables (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Accessing Sensitive Files (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ GenAI Process Performing Encoding/Chunking Prior to Network Activity (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

Mikaayenson · 2025-12-05T18:26:15Z

@Aegrah ill take event.action and expand the scope for some of the rules in the next round (e.g. potentially working in FIM). I've address most of the other comments . 🙇 thanks for the extra eyes.

Add atlas coverage and additional genai protections

a056686

This comment was marked as duplicate.

Sign in to view

Mikaayenson added enhancement New feature or request Rule: New Proposal for new rule labels Nov 22, 2025

Mikaayenson self-assigned this Nov 22, 2025

Mikaayenson added the python Internal python for the repository label Nov 22, 2025

Mikaayenson requested a review from Samirbous November 22, 2025 00:33

lint and bump version

e87c15d

This comment was marked as duplicate.

Sign in to view

Mikaayenson changed the title ~~Add MITRE ATLAS framework support and GenAI threat detection rules~~ [New Rules] Add MITRE ATLAS framework support and GenAI threat detection rules Nov 22, 2025

Mikaayenson added the patch label Nov 22, 2025

lint

15e0b8c

This comment was marked as duplicate.

Sign in to view

lint

384ea21

This comment was marked as duplicate.

Sign in to view

Mikaayenson commented Nov 23, 2025

View reviewed changes

rules/cross-platform/command_and_control_genai_process_suspicious_tld_connection.toml Outdated Show resolved Hide resolved

Samirbous reviewed Nov 24, 2025

View reviewed changes

rules/cross-platform/collection_genai_process_sensitive_file_access.toml Outdated Show resolved Hide resolved

Update rules/cross-platform/collection_genai_process_sensitive_file_a…

288178b

…ccess.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

This comment was marked as duplicate.

Sign in to view

Mikaayenson marked this pull request as ready for review December 4, 2025 06:15

Mikaayenson requested review from eric-forte-elastic and traut as code owners December 4, 2025 06:15

github-actions bot added the backport: auto label Dec 4, 2025

botelastic bot added bbr Building Block Rules schema labels Dec 4, 2025

Samirbous reviewed Dec 4, 2025

View reviewed changes

Mikaayenson added 2 commits December 4, 2025 12:48

Add checks for ATLAS id

38387e3

Merge branch 'additional_genai_coverage' of https://github.com/elasti…

653d09a

…c/detection-rules into additional_genai_coverage

Samirbous reviewed Dec 4, 2025

View reviewed changes

rules/cross-platform/defense_evasion_genai_config_modification.toml Show resolved Hide resolved

This comment was marked as duplicate.

Sign in to view

bump version

e697bba

This comment was marked as duplicate.

Sign in to view

Samirbous reviewed Dec 4, 2025

View reviewed changes

rules/cross-platform/command_and_control_genai_process_unusual_domain.toml Outdated Show resolved Hide resolved

Samirbous approved these changes Dec 4, 2025

View reviewed changes

Mikaayenson and others added 3 commits December 4, 2025 13:12

reduce both new-terms rules for now

1082885

lint atlas

831ac18

Merge branch 'main' into additional_genai_coverage

6a93795

This comment was marked as duplicate.

Sign in to view

eric-forte-elastic approved these changes Dec 4, 2025

View reviewed changes

Mikaayenson commented Dec 4, 2025

View reviewed changes

Mikaayenson requested a review from Aegrah December 4, 2025 20:31

Aegrah approved these changes Dec 5, 2025

View reviewed changes

Update rules/cross-platform/defense_evasion_genai_process_compiling_e…

ddd8f6a

…xecutables.toml Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

Update rules/cross-platform/defense_evasion_genai_process_encoding_pr…

85126a0

…ior_to_network_activity.toml Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

terrancedejesus approved these changes Dec 5, 2025

View reviewed changes

Merge branch 'main' into additional_genai_coverage

3e43fa4

Mikaayenson added 2 commits December 5, 2025 12:14

add feedback changes

55c41fb

Merge branch 'additional_genai_coverage' of https://github.com/elasti…

34da4f2

…c/detection-rules into additional_genai_coverage

Mikaayenson merged commit f40a383 into main Dec 5, 2025
17 checks passed

Mikaayenson deleted the additional_genai_coverage branch December 5, 2025 18:26

[New Rules] Add MITRE ATLAS framework support and GenAI threat detection rules #5352

[New Rules] Add MITRE ATLAS framework support and GenAI threat detection rules #5352

Uh oh!

Conversation

Mikaayenson commented Nov 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request

Summary - What I changed

Framework Support

New Detection Rules

How To Test

Manual Testing

Expected Test Results

Checklist

Uh oh!

This comment was marked as duplicate.

github-actions bot commented Nov 22, 2025

Enhancement - Guidelines

Documentation and Context

Code Standards and Practices

Testing

Additional Checks

Uh oh!

This comment was marked as duplicate.

This comment was marked as duplicate.

This comment was marked as duplicate.

Uh oh!

Uh oh!

This comment was marked as duplicate.

cla-checker-service bot commented Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tradebot-elastic commented Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tradebot-elastic commented Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

This comment was marked as duplicate.

This comment was marked as duplicate.

Uh oh!

This comment was marked as duplicate.

This comment was marked as duplicate.

eric-forte-elastic left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Aegrah left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Mikaayenson commented Nov 22, 2025 •

edited

Loading

cla-checker-service bot commented Dec 4, 2025 •

edited

Loading

tradebot-elastic commented Dec 4, 2025 •

edited

Loading

tradebot-elastic commented Dec 4, 2025 •

edited

Loading

tradebot-elastic commented Dec 5, 2025 •

edited

Loading

tradebot-elastic commented Dec 5, 2025 •

edited

Loading

tradebot-elastic commented Dec 5, 2025 •

edited

Loading

tradebot-elastic commented Dec 5, 2025 •

edited

Loading