AI Agent Detections

AI-agent detections

querysplunk ships an experimental starter pack under examples/detections/ai-agent/. These YAML searches use Splunk audit telemetry to produce bounded investigative leads without returning raw SPL, prompts, AI output, credentials, or tool output.

Included searches

• sensitive-data-enrichment.yml finds a credential-bearing REST source, lookup, or field that occurs before an ai command.
• downstream-action-pipeline.yml finds an ai command followed by a separate action-capable command such as sendemail, sendalert, collect, outputlookup, or script.
• dynamic-execution-pipeline.yml finds an ai_result_N field referenced by a later map or script command.
• ai-assisted-delete-pipeline.yml finds an ai command followed later by Splunk delete.

All four adaptations remain experimental. They are hunting guidance, not complete threat coverage or blocking controls.

Interpret results correctly

Splunk's ai command enriches or extracts features from the rows it receives. It does not itself send email, write a lookup, execute a script, invoke a tool, or hide indexed events. Those effects require a separate SPL command.

Command ordering is therefore an investigation lead, not proof that AI output caused the later action. An explicit ai_result_N reference provides stronger data-flow evidence, but does not prove malicious intent.

The delete detection reports event hiding. Splunk delete makes matching events unavailable to subsequent searches; it does not remove the underlying bucket data or reclaim disk space.

Matching safeguards

• Credential-bearing input must occur before AI enrichment.
• Quoted prompt text is stripped before downstream action matching.
• Dynamic-execution matching inspects every later map or script command.
• AI-result data flow requires an exact ai_result_N field or complete $ai_result_N$ substitution; prefixed and suffixed lookalike fields do not match.
• The delete detector constructs command names from fragments so it cannot match its own audit record.
• Quoted examples that mention a downstream command do not count as executed commands.
• Results are capped at 100 rows and classified as sensitive, temporary output with owner-only file permissions recommended.

Run a detection

Validate a YAML file offline before contacting Splunk:

querysplunk -validate-config examples/detections/ai-agent/sensitive-data-enrichment.yml

Then run it with your approved Splunk credentials:

querysplunk -config examples/detections/ai-agent/sensitive-data-enrichment.yml

Do not test the delete detector by executing a real delete command. Use synthetic audit rows for positive fixtures.

Attribution

This starter pack was inspired by the open-source Agent Threat Rules project. querysplunk manually adapts selected stable ATR concepts to observable Splunk telemetry; these YAML and SPL files are not upstream ATR releases.

Sources are pinned to revision 0c7a1f133fc176a732767363db65102aa0aae710:

• ATR-2026-00702: IPI credential exfiltration via agent action
• ATR-2026-00711: IPI system sabotage through destructive command
• ATR-2026-00714: Tool camouflage and forced tool call

Agent Threat Rules is distributed under the MIT License. See querysplunk's THIRD_PARTY_NOTICES.md and the provenance block in each detection YAML.