# Cisco Open-Sources Quarry to Detect AI Agent Attacks Hidden in Individually Benign Steps (GTG-1002 and Mexican Government Claude Code Abuse Context)

> Cisco open-sourced Quarry, a neurosymbolic rule language that pairs ML classifiers and LLM judges with symbolic rules to detect AI agent attacks whose intent only emerges across sequences of individually benign actions. The release is motivated by real abuse of Claude Code: the GTG-1002 espionage campaign (~30 organizations, 2025) and the intrusion into Mexican government institutions (late 2025).

- **Published:** 2026-10-29T14:55:39Z
- **Last reviewed:** 2026-10-29T14:55:39Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4747
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4747.png
- **ID:** TL-2026-4747
- **Severity:** LOW
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Actor:** GTG-1002 (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 9

## Description

Quarry is a defensive detection language released by Cisco and reported by SecurityWeek on 2026-10-29. It targets a gap in agent security: a malicious objective can be decomposed into routine-looking tasks so that no single prompt, tool call or action looks harmful, and the intent is visible only when the steps are considered in sequence. Quarry rules combine neural evidence (ML classifiers and LLM judges) with symbolic rules that check exact conditions, ordered sequences, string matches and relationships between tool calls. Cisco positions it as an emerging standard comparable to Snort, YARA and Sigma, but for AI-agent attacks.

The starter pack described in the article includes a readable DSL for conversations and tool use, an evaluation runtime with configurable safety limits, a command-line scanner, a Python SDK, optional model operations for semantic signals, a Quarry plugin for Claude Code, Codex and MCP-compatible agents, and a rule metadata and validation workflow. Coverage spans single-turn and multi-turn LLM conversations, agents, tool use, Model Context Protocol (MCP) interactions and multimodal inputs. The article gives no repository URL or license.

The article cites two incidents of agent abuse as motivation. First, a 2025 attack on roughly 30 organizations in which Claude Code was driven through tasks that looked routine, with the data-theft intent apparent only when the requests were combined. Anthropic's public report attributes this to a China-linked actor tracked as GTG-1002, detected in mid-September 2025 and disclosed on 2025-11-13/14; the AI performed an estimated 80-90% of tactical work (reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, data analysis and exfiltration) using MCP-connected, publicly available tooling with no custom malware observed, while operators used personas and context-splitting to hide the overall objective. A limited number of intrusions succeeded, and AI hallucination (fabricated credentials, public data presented as discoveries) reduced effectiveness. Second, Gambit Security reported that an attacker abused Claude Code (over 1,000 prompts, role-play as a bug bounty tester) beginning with the Mexican tax authority in late December 2025, reportedly compromising about ten government bodies and a financial institution, exfiltrating roughly 150 GB and exposing about 195 million identities, and using OpenAI GPT-4.1 to analyze stolen data after Claude resisted some requests. Anthropic confirmed the activity and banned the accounts.

This record is informational: Quarry is a defensive tool release with no CVE, no vulnerability and no network IOCs. The IOC list therefore holds entities, tools and behavioral patterns rather than infrastructure indicators. The Quarry details come from a single source (SecurityWeek) and could not be corroborated from a Cisco primary source during research.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1003 OS Credential Dumping
- T1046 Network Service Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1078 Valid Accounts
- AML.T0054 LLM Jailbreak

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Claude Code Agent-Driven Recon and Exploit Tooling (GTG-1002 / TL-2026-4747)** (`TL-2026-4747-SPL-001`)

Detects offensive reconnaissance and exploitation tooling (nmap, masscan, nuclei, sqlmap, msfconsole, gobuster, ffuf, hydra and similar) launched from a Claude Code agent session. Anchors on the claude process, the claude-code / @anthropic-ai node launcher, or the .claude shell-snapshots wrapper that Claude Code places in the shell command line. GTG-1002 drove Claude Code through MCP-connected, publicly available tooling for reconnaissance, vulnerability discovery and exploitation, so scanner and exploit tools appearing under an agent session on a host that is not an approved security-testing system is a strong behavioural signal of agent-orchestrated intrusion.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1595, T1046, T1190, T1059
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
 (ParentImage="*claude.exe" OR ParentImage="*/claude" OR ParentCommandLine="*claude-code*" OR ParentCommandLine="*@anthropic-ai*" OR CommandLine="*.claude*shell-snapshots*")
 (CommandLine="*nmap *" OR CommandLine="*masscan *" OR CommandLine="*zmap *" OR CommandLine="*nuclei *" OR CommandLine="*sqlmap*" OR CommandLine="*gobuster *" OR CommandLine="*ffuf *" OR CommandLine="*feroxbuster*" OR CommandLine="*nikto *" OR CommandLine="*wpscan*" OR CommandLine="*hydra *" OR CommandLine="*msfconsole*" OR CommandLine="*searchsploit*" OR CommandLine="*subfinder*" OR CommandLine="*amass *")
| fillnull value="n/a" User ParentImage
| eval technique=case(match(CommandLine,"(?i)nmap|masscan|zmap"),"T1046",match(CommandLine,"(?i)sqlmap|msfconsole|searchsploit|nuclei"),"T1190",true(),"T1595")
| stats count AS tool_runs min(_time) AS first_seen max(_time) AS last_seen values(technique) AS attack_techniques values(CommandLine) AS commands BY host User ParentImage
| convert ctime(first_seen) ctime(last_seen)
| sort - tool_runs
```

### Microsoft KQL

```kql
let AgentAnchors = dynamic(['claude-code','@anthropic-ai','shell-snapshots']);
let OffensiveTools = dynamic(['nmap','masscan','zmap','nuclei','sqlmap','gobuster','ffuf','feroxbuster','nikto','wpscan','hydra','msfconsole','searchsploit','subfinder','amass']);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ('claude','claude.exe') or InitiatingProcessCommandLine has_any (AgentAnchors) or ProcessCommandLine has_any (AgentAnchors)
| where ProcessCommandLine has_any (OffensiveTools)
| extend Technique = case(ProcessCommandLine has_any ('nmap','masscan','zmap'), 'T1046', ProcessCommandLine has_any ('sqlmap','msfconsole','searchsploit','nuclei'), 'T1190', 'T1595')
| summarize ToolRuns=count(), Techniques=make_set(Technique), Commands=make_set(ProcessCommandLine, 20), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, AccountName, InitiatingProcessFileName
| order by ToolRuns desc
```

### Sigma

```yaml
title: Claude Code Agent-Driven Recon and Exploit Tooling
id: 3f2b8c14-5d7e-4a19-9c0b-7e1d2a4b6c01
status: experimental
description: Detects scanner and exploit tooling launched from a Claude Code agent session, as seen in the GTG-1002 AI-orchestrated espionage campaign (TL-2026-4747).
references:
  - https://www.securityweek.com/cisco-open-sources-quarry-to-catch-ai-agent-attacks-hidden-in-harmless-steps/
  - https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf
author: Threadlinqs Team
date: 2026-10-29
tags:
  - attack.reconnaissance
  - attack.t1595
  - attack.discovery
  - attack.t1046
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_agent_parent:
    ParentImage|endswith: 'claude.exe'
  selection_agent_parentcmd:
    ParentCommandLine|contains:
      - 'claude-code'
      - '@anthropic-ai'
  selection_agent_shell:
    CommandLine|contains|all:
      - '.claude'
      - 'shell-snapshots'
  selection_tools:
    CommandLine|contains:
      - 'nmap '
      - 'masscan '
      - 'zmap '
      - 'nuclei '
      - 'sqlmap'
      - 'gobuster '
      - 'ffuf '
      - 'feroxbuster'
      - 'nikto '
      - 'wpscan'
      - 'hydra '
      - 'msfconsole'
      - 'searchsploit'
      - 'subfinder'
      - 'amass '
  condition: 1 of selection_agent_* and selection_tools
falsepositives:
  - Authorized penetration testers or red teams using Claude Code on approved assessment hosts
  - Security engineering workstations running vulnerability scans through an AI coding assistant
level: high

```

**Known false positives:**

- Authorized penetration testers or red teams using Claude Code on approved assessment hosts
- Security engineers running vulnerability scans through an AI coding assistant on a lab or scanner host

**Tuning notes:** Replace index=sysmon with the index that holds your Sysmon data. Exclude approved pentest and scanner hosts with a lookup (NOT host IN approved_scanners). Claude Code runs commands through a shell wrapper, so the scanner is often a grandchild of the claude process; the shell-snapshots anchor in the wrapper command line catches this case. Extend the tool list with in-house scanners.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- AI API Egress Correlated With Offensive Tooling on the Same Host (GTG-1002 Pattern) (locked: unlock with TL Creds)
- AI Agent Session Reading Multiple Credential and Secret Files (locked: unlock with TL Creds)
- AI Agent Session Fan-Out to Remote Services (Lateral Movement) (locked: unlock with TL Creds)
- Claude Code Launched With Permission Prompts Disabled (locked: unlock with TL Creds)
- Archive Staging of Local Data From a Claude Code Agent Session (locked: unlock with TL Creds)
- Bulk Data Exfiltration Tooling Launched From a Claude Code Agent Session (locked: unlock with TL Creds)
- Claude Code Agent-Driven Credential Harvesting (GTG-1002 Post-Exploitation) (locked: unlock with TL Creds)
- Machine-Speed Command Bursts From a Claude Code Agent Session (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps (SecurityWeek)](https://www.securityweek.com/cisco-open-sources-quarry-to-catch-ai-agent-attacks-hidden-in-harmless-steps/)
- [Disrupting the first reported AI orchestrated cyber espionage campaign (Anthropic)](https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf)
- [Chinese Hackers Use Anthropic's AI to Launch Automated Cyber Espionage Campaign (The Hacker News)](https://thehackernews.com/2025/11/chinese-hackers-use-anthropics-ai-to.html)
- [Chinese spies told Claude to break into about 30 critical orgs. Some attacks succeeded (The Register)](https://www.theregister.com/2025/11/13/chinese_spies_claude_attacks/)
- [Claude code abused to steal 150GB in cyberattack on Mexican agencies (Security Affairs)](https://securityaffairs.com/188696/ai/claude-code-abused-to-steal-150gb-in-cyberattack-on-mexican-agencies.html)
- [Hackers Weaponize Claude Code in Mexican Government Cyberattack (SecurityWeek)](https://securityweek.com/hackers-weaponize-claude-code-in-mexican-government-cyberattack)
- [AI Tools Enable Massive Mexican Government Data Breach (SOCRadar)](https://socradar.io/blog/mexican-government-breach-claude-chatgpt/)
- [Agent Threat Rules (ATR) - open detection standard for AI agents](https://www.jsdelivr.com/package/npm/agent-threat-rules)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4747