Threat video1:00
VoidLink AI-Generated Malware Tells: Detection & IOCs
VoidLink was largely AI-authored and PROMPTSTEAL queries an LLM at runtime, so this page maps 16 IOCs, 9 detection rules and a free Splunk SPL rule.
Read the full threat intel for VoidLink AI-Generated Malware Tells: Detection & IOCs →
Chapters
- 0:00The hook88,000+ lines of AI-generated malware.
- 0:04The storyResearchers tracked AI-generated malware.
- 0:10Attack pathDevelopers used AI to write obfuscated code, querying LLMs for command execution.
- 0:27AttributionNo threat actor: this was defensive research.
- 0:31Indicators of compromise8 indicators to hunt: 5 SHA-256 hashes, 1 file name and 2 paths.
- 0:38MITRE ATT&CK techniques17 ATT&CK techniques, from resource development to command and control.
- 0:44Remediation3 steps now: Hunt for non-browser processes connecting to LLM API endpoints such.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0088,000+ lines of AI-generated malware.
0:05Researchers tracked AI-generated malware.
0:07Generation shifted to hundreds of variants.
0:11Developers used AI to write obfuscated code, querying LLMs for command execution.
0:17They enumerated systems, collected documents, then exfiltrated.
0:21Persistence modules included eBPF and LKM rootkits.
0:28No threat actor: this was defensive research.
0:328 indicators to hunt: 5 SHA-256 hashes, 1 file name and 2 paths.
0:3917 ATT&CK techniques, from resource development to command and control.
0:443 steps now: Hunt for non-browser processes connecting to LLM API endpoints such.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.