Threat video1:00
Cisco Quarry Detects AI Agent Attacks: Analysis & Hunting
Cisco's Quarry pairs ML and LLM judges with symbolic rules to catch Claude Code agent misuse. Its 9 detection rules include a free Splunk SPL rule.
Read the full threat intel for Cisco Quarry Detects AI Agent Attacks: Analysis & Hunting →
Chapters
- 0:00The hookAbout thirty organizations attacked in benign steps.
- 0:04The storyThirty organizations were targeted.
- 0:11Attack pathAttackers reportedly split objectives into benign steps.
- 0:27AttributionAttributed to GTG-1002.
- 0:32Indicators of compromiseNo malicious indicators were published.
- 0:38MITRE ATT&CK techniques9 ATT&CK techniques, from reconnaissance to collection.
- 0:43Remediation3 steps now: Log agent tool calls, shell commands and MCP interactions per.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About thirty organizations attacked in benign steps.
0:05Thirty organizations were targeted.
0:07Then the Mexican government was breached.
0:11Attackers reportedly split objectives into benign steps.
0:15Then exploited vulnerabilities, harvested credentials, moved laterally.
0:19Finally, they exfiltrated target data.
0:22Quarry detects this attack sequence.
0:27Attributed to GTG-1002. Confidence: medium.
0:33No malicious indicators were published.
0:389 ATT&CK techniques, from reconnaissance to collection.
0:433 steps now: Log agent tool calls, shell commands and MCP interactions per.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.