Lazarus: Weight-Space Backdoor Technique Hidden in Dormant AI Model Neurons (Microsoft Research)

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5811 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Lazarus Backdoored Agent - Download-and-Execute Issued by AI Agent Runtime Shell

Detects a shell spawned under an AI agent runtime (LangChain, AutoGen, CrewAI, MCP server, OpenHands and similar) that downloads remote content and pipes it to an interpreter or runs certutil/bitsadmin/IEX download cradles. This is the payload Microsoft describes for a triggered Lazarus-backdoored model (TL-2026-5811) executing with the agent's existing access. Maps to T1059, T1059.001 and T1105.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059, T1059.001, T1105
• Data sources: sysmon, microsoft_defender_endpoint
• Severity: high
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| where match(ParentCommandLine, "(?i)(langchain|langgraph|autogen|crewai|openai|anthropic|claude|mcp[-_]server|llama[-_]?index|smolagents|openhands|semantic[-_]kernel)")
| where match(Image, "(?i)[^a-z0-9](cmd|powershell|pwsh|bash|sh|wsl)[.]exe$")
```Download-and-execute chain issued by an agent runtime child shell (T1059 and T1105)```
| where match(CommandLine, "(?i)((curl|wget|iwr|invoke-webrequest|invoke-restmethod)[ ].*([|]|;|&&)[ ]*(sh|bash|zsh|iex|invoke-expression|python3?|chmod)([ ]|$)|(iex|invoke-expression).*(downloadstring|net[.]webclient|iwr|invoke-webrequest)|certutil.*-urlcache|bitsadmin.*/transfer)")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as shell_commands by host, User, ParentImage, Image
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table host User ParentImage Image count first_seen last_seen shell_commands

Microsoft KQL

let AgentRuntime = '(?i)(langchain|langgraph|autogen|crewai|openai|anthropic|claude|mcp[-_]server|llama[-_]?index|smolagents|openhands|semantic[-_]kernel)';
let DownloadExec = '(?i)((curl|wget|iwr|invoke-webrequest|invoke-restmethod)[ ].*([|]|;|&&)[ ]*(sh|bash|zsh|iex|invoke-expression|python3?|chmod)([ ]|$)|(iex|invoke-expression).*(downloadstring|net[.]webclient|iwr|invoke-webrequest)|certutil.*-urlcache|bitsadmin.*/transfer)';
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessCommandLine matches regex AgentRuntime
| where FileName in~ ('bash','sh','zsh','dash','cmd.exe','powershell.exe','pwsh.exe')
| where ProcessCommandLine matches regex DownloadExec
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: Lazarus - Download and Execute Issued by AI Agent Runtime Shell
id: c3e5f7a9-2d4b-4c6e-9a1f-0b3d5e7f9a03
status: experimental
description: Detects a shell spawned by an AI agent runtime that downloads remote content and executes it, the example payload of a triggered Lazarus weight-space backdoor (TL-2026-5811).
references:
  - https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.execution
  - attack.t1059
  - attack.t1059.004
  - attack.t1059.001
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'langchain'
      - 'langgraph'
      - 'autogen'
      - 'crewai'
      - 'openai'
      - 'anthropic'
      - 'claude'
      - 'mcp-server'
      - 'mcp_server'
      - 'llama_index'
      - 'smolagents'
      - 'openhands'
      - 'semantic_kernel'
  selection_shell:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
      - '/dash'
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_fetch:
    CommandLine|contains:
      - 'curl '
      - 'wget '
      - 'iwr '
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
  selection_pipe:
    CommandLine|contains:
      - '| sh'
      - '|sh'
      - '| bash'
      - '|bash'
      - '| zsh'
      - '| iex'
      - '|iex'
  selection_iex:
    CommandLine|contains|all:
      - 'IEX'
      - 'DownloadString'
  selection_certutil:
    CommandLine|contains|all:
      - 'certutil'
      - '-urlcache'
  condition: selection_parent and selection_shell and ((selection_fetch and selection_pipe) or selection_iex or selection_certutil)
falsepositives:
  - Agentic coding assistants that run approved installer scripts such as curl-based installs
  - Developer agents bootstrapping toolchains in sandboxes
level: high

Known false positives:

• Agentic coding assistants running approved curl-based installer scripts
• Developer agents bootstrapping toolchains inside sandboxes

Tuning notes: Extend the agent-runtime regex with the frameworks and wrapper scripts actually deployed. Exclude approved installer URLs and sandbox hosts. Enforce egress restrictions and human approval for shell tool calls as Microsoft advises. For Linux hosts use Sysmon for Linux or the DeviceProcessEvents flavor.

• 🔒 Lazarus Weight-Space Backdoor - Model Weights Written to Cloud Storage by Non-Pipeline Principal · unlock with TL Creds
• 🔒 Lazarus Weight-Space Backdoor - Model Registry Version Written by Non-Pipeline Identity · unlock with TL Creds
• 🔒 Lazarus Dormant-Trigger Activation - First-Seen Shell Execution by AI Agent Runtime · unlock with TL Creds
• 🔒 Lazarus Model Supply Chain - Model Weights Downloaded from Unvetted Source via CLI · unlock with TL Creds
• 🔒 Lazarus Model Integrity - Inference Server Loading Checkpoint from User-Writable Path · unlock with TL Creds
• 🔒 Lazarus Backdoored Agent - Agent Runtime Fetching Payload from Raw IP or Ephemeral Hosting · unlock with TL Creds
• 🔒 Lazarus Weight-Space Backdoor - Model Checkpoint Written by Shell, Transfer or Browser Process · unlock with TL Creds
• 🔒 Lazarus Weight-Space Backdoor - Inline Python Loads and Re-Saves Model Weights · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5811.

Technical analysis

Lazarus (paper title: 'Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents', Microsoft Research, published 2026-11-10; author named on the research blog: Dimitris Papailiopoulos) is a proof-of-concept model-integrity attack. Instead of poisoning training data, the attacker edits a model checkpoint directly. Every LLM contains many neurons that rarely fire; Microsoft reports these can be reprogrammed to fire only when a trigger is present. Pretraining organizes internal representations so well that a linear classifier trained on about 50 examples can separate triggered from clean inputs. A single reprogrammed neuron can force one token into the residual stream, and chaining several neurons can produce arbitrary payloads that run in a terminal.

In the published example, the trigger is a date change (the clock passing midnight into 2027) during an ordinary task. The agent then emits a command that downloads and runs attacker-controlled code, executing with whatever access the agent already holds. The backdoored model passes standard evaluations and behaves normally until the trigger appears. The specific neuron-selection procedure, the models tested, the benchmarks used and success rates are not disclosed in the blog posts. The study began as an experiment in which Claude Code with Opus 4.5 was asked to backdoor a model, and the authors report it discovered most of the method autonomously.

Prerequisites are modest. No training is needed; weight editing requires only inference-level compute (enough RAM to load the model). The attacker needs write access to a checkpoint, for example through a compromised account, development pipeline or storage location, so internally developed models are as exposed as third-party ones. This makes the technique a model supply-chain and model-integrity risk for any organization deploying agentic AI with tool or shell access.

Defensive guidance from Microsoft Threat Intelligence: diff every checkpoint against its declared base model before deployment and after each update (legitimate fine-tunes and quantizations change weights broadly, while implanted edits tend to show large changes to a few weight vectors); flag statistical outliers and reject models with no verifiable base; use frontier AI agents as auditors of weight diffs; complement diffing with behavioral backdoor scanning and red-teaming for hidden triggers (PyRIT, AI Red Teaming Agent in Microsoft Foundry); treat third-party models, fine-tunes, merges, quantizations and adapters as untrusted until audited, with hash verification and private registries; and limit agent impact with least-privilege identities, sandboxed code execution, egress restrictions, human approval for high-impact tool calls and runtime monitoring. Microsoft stresses that no audit can prove a model is safe, so these controls are layers of defense-in-depth. Planned Microsoft work includes AI-powered weight scanning, a red-team harness for weight-level attacks, and cryptographic model signing with tamper-evident audit trails.

Status: research demonstration only. No CVE, no in-the-wild exploitation, no named threat actor or malware, and no network or file IOCs have been published. 'Lazarus' is the technique name and is unrelated to the North Korean Lazarus Group.

MITRE ATT&CK / ATLAS techniques by tactic:

Initial Access

AML.T0010 AI Supply Chain Compromise; T1078 Valid Accounts; T1195 Supply Chain Compromise

Persistence

AML.T0018 Manipulate AI Model

Execution

T1059 Command and Scripting Interpreter

Defense Evasion

T1480 Execution Guardrails

Impact

T1565.001 Data Manipulation: Stored Data Manipulation

Remediation

Immediate actions

• Inventory all models, fine-tunes, merges, quantizations and adapters used by agents and record their declared base model
• Diff each checkpoint against its declared base weights and flag large changes concentrated in a few weight vectors
• Reject or quarantine models that lack a verifiable base or provenance
• Restrict write access to model checkpoints, registries and storage to least-privilege accounts and pipelines

Workarounds

• Run agent-generated code in isolated sandboxes
• Restrict agent egress to required destinations
• Require human approval for high-impact tool calls such as shell commands or permission changes
• Give agents least-privilege identities and monitor agent actions at runtime

Longer-term hardening

• Verify model hashes and use private model registries; adopt cryptographic model signing and tamper-evident audit trails as available
• Red-team models for hidden triggers (for example PyRIT or the AI Red Teaming Agent in Microsoft Foundry) and run behavioral backdoor scanning
• Use frontier AI agents as auditors of weight diffs in model intake pipelines
• Record audit results in the model registry and re-audit after every update

Affected and fixed versions

• Multiple / vendor-agnostic — LLM-based AI agents loading model checkpoints from writable storage or third-party sources
  Vulnerable versions: Not model-specific; Microsoft does not name the models tested

Timeline

• 2026-02-04 Microsoft publishes 'Detecting backdoored language models at scale', a scanner for open-weight sleeper-agent backdoors, cited as related prior work.
• 2026-11-10 Microsoft Threat Intelligence publishes 'Detecting sleeper agents hiding in AI model neurons' with checkpoint diffing, red-teaming and agent-containment guidance; states no threat-actor use observed.
• 2026-11-10 Lazarus paper PDF linked from the Microsoft Research blog.
• 2026-11-10 Microsoft Research publishes 'Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents' (Dimitris Papailiopoulos), describing the Lazarus weight-space backdoor.
• 2026-11-11 Help Net Security reports the technique, including the date-change trigger and the compromised account, pipeline or storage access routes.
• 2026-11-12 Threadlinqs begins monitoring the technique as a research-stage AI supply-chain threat; no CVE, IOCs or in-the-wild exploitation reported.

Sources cited

• Detecting sleeper agents hiding in AI model neurons (Microsoft Security Blog) Microsoft · Vendor report · 2026-11-10
• Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents (Microsoft Research Blog) Microsoft · Research · 2026-11-10
• Lazarus paper (PDF) GitHub · Research · 2026-11-10
• Microsoft Research publication page: Lazare, veni foras Microsoft · Research · 2026-11-10
• Detecting backdoored language models at scale (Microsoft Security Blog) Microsoft · Vendor report · 2026-02-04
• PyRIT - Python Risk Identification Tool for generative AI GitHub · Code repository
• Microsoft researchers demonstrate hidden backdoor technique for AI agents (Help Net Security) Help Net Security · News · 2026-11-11

More in threat intel

• School Bomb Threat Emails: Sender Accounts Linked to Infostealer Data (Vidar, AlienTXTBASE)
• Abuse of legitimate RMM and remote access tools (MeshAgent, ScreenConnect, Ammyy Admin, RDP): Acronis TRU analysis of RMM tool risk for SMBs, incl. CVE-2024-1709
• QuoIntelligence Weekly Snapshot W39 2026: ClickFix/Exvicy, Graphalgo Go RAT, RemControl Android trojan, Windows Defender zero-day exploit (Nightmare Eclipse)
• CRAFTY FALCON: AI-Assisted Financial Threat Actor Targeting Indian BFSI (CERT-In CIAD-2026-0058)
• ~45 Open-Source AI Hacking Frameworks Mapped; Hundreds of Agent Attack Consoles Exposed Online (ARTEX Family)