# Lazarus: Weight-Space Backdoor Technique Hidden in Dormant AI Model Neurons (Microsoft Research)

> Microsoft researchers demonstrated 'Lazarus', a weight-space programming technique that reprograms fewer than 10 dormant neurons so an AI agent runs an attacker-chosen command when a trigger appears, with no retraining and while behaving normally under standard evaluations. Microsoft has not observed threat actors using the technique.

- **Published:** 2026-11-12T01:42:40Z
- **Last reviewed:** 2026-11-12T01:42:40Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5811
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5811.png
- **ID:** TL-2026-5811
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 7

## Description

Lazarus (paper title: 'Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents', Microsoft Research, published 2026-11-10; author named on the research blog: Dimitris Papailiopoulos) is a proof-of-concept model-integrity attack. Instead of poisoning training data, the attacker edits a model checkpoint directly. Every LLM contains many neurons that rarely fire; Microsoft reports these can be reprogrammed to fire only when a trigger is present. Pretraining organizes internal representations so well that a linear classifier trained on about 50 examples can separate triggered from clean inputs. A single reprogrammed neuron can force one token into the residual stream, and chaining several neurons can produce arbitrary payloads that run in a terminal.

In the published example, the trigger is a date change (the clock passing midnight into 2027) during an ordinary task. The agent then emits a command that downloads and runs attacker-controlled code, executing with whatever access the agent already holds. The backdoored model passes standard evaluations and behaves normally until the trigger appears. The specific neuron-selection procedure, the models tested, the benchmarks used and success rates are not disclosed in the blog posts. The study began as an experiment in which Claude Code with Opus 4.5 was asked to backdoor a model, and the authors report it discovered most of the method autonomously.

Prerequisites are modest. No training is needed; weight editing requires only inference-level compute (enough RAM to load the model). The attacker needs write access to a checkpoint, for example through a compromised account, development pipeline or storage location, so internally developed models are as exposed as third-party ones. This makes the technique a model supply-chain and model-integrity risk for any organization deploying agentic AI with tool or shell access.

Defensive guidance from Microsoft Threat Intelligence: diff every checkpoint against its declared base model before deployment and after each update (legitimate fine-tunes and quantizations change weights broadly, while implanted edits tend to show large changes to a few weight vectors); flag statistical outliers and reject models with no verifiable base; use frontier AI agents as auditors of weight diffs; complement diffing with behavioral backdoor scanning and red-teaming for hidden triggers (PyRIT, AI Red Teaming Agent in Microsoft Foundry); treat third-party models, fine-tunes, merges, quantizations and adapters as untrusted until audited, with hash verification and private registries; and limit agent impact with least-privilege identities, sandboxed code execution, egress restrictions, human approval for high-impact tool calls and runtime monitoring. Microsoft stresses that no audit can prove a model is safe, so these controls are layers of defense-in-depth. Planned Microsoft work includes AI-powered weight scanning, a red-team harness for weight-level attacks, and cryptographic model signing with tamper-evident audit trails.

Status: research demonstration only. No CVE, no in-the-wild exploitation, no named threat actor or malware, and no network or file IOCs have been published. 'Lazarus' is the technique name and is unrelated to the North Korean Lazarus Group.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1480 Execution Guardrails
- T1059 Command and Scripting Interpreter
- AML.T0010 AI Supply Chain Compromise
- AML.T0018 Manipulate AI Model

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Lazarus Backdoored Agent - Download-and-Execute Issued by AI Agent Runtime Shell** (`TL-2026-5811-SPL-003`)

Detects a shell spawned under an AI agent runtime (LangChain, AutoGen, CrewAI, MCP server, OpenHands and similar) that downloads remote content and pipes it to an interpreter or runs certutil/bitsadmin/IEX download cradles. This is the payload Microsoft describes for a triggered Lazarus-backdoored model (TL-2026-5811) executing with the agent's existing access. Maps to T1059, T1059.001 and T1105.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059, T1059.001, T1105
- **Data sources:** sysmon, microsoft_defender_endpoint
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| where match(ParentCommandLine, "(?i)(langchain|langgraph|autogen|crewai|openai|anthropic|claude|mcp[-_]server|llama[-_]?index|smolagents|openhands|semantic[-_]kernel)")
| where match(Image, "(?i)[^a-z0-9](cmd|powershell|pwsh|bash|sh|wsl)[.]exe$")
```Download-and-execute chain issued by an agent runtime child shell (T1059 and T1105)```
| where match(CommandLine, "(?i)((curl|wget|iwr|invoke-webrequest|invoke-restmethod)[ ].*([|]|;|&&)[ ]*(sh|bash|zsh|iex|invoke-expression|python3?|chmod)([ ]|$)|(iex|invoke-expression).*(downloadstring|net[.]webclient|iwr|invoke-webrequest)|certutil.*-urlcache|bitsadmin.*/transfer)")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as shell_commands by host, User, ParentImage, Image
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table host User ParentImage Image count first_seen last_seen shell_commands
````

### Microsoft KQL

```kql
let AgentRuntime = '(?i)(langchain|langgraph|autogen|crewai|openai|anthropic|claude|mcp[-_]server|llama[-_]?index|smolagents|openhands|semantic[-_]kernel)';
let DownloadExec = '(?i)((curl|wget|iwr|invoke-webrequest|invoke-restmethod)[ ].*([|]|;|&&)[ ]*(sh|bash|zsh|iex|invoke-expression|python3?|chmod)([ ]|$)|(iex|invoke-expression).*(downloadstring|net[.]webclient|iwr|invoke-webrequest)|certutil.*-urlcache|bitsadmin.*/transfer)';
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessCommandLine matches regex AgentRuntime
| where FileName in~ ('bash','sh','zsh','dash','cmd.exe','powershell.exe','pwsh.exe')
| where ProcessCommandLine matches regex DownloadExec
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: Lazarus - Download and Execute Issued by AI Agent Runtime Shell
id: c3e5f7a9-2d4b-4c6e-9a1f-0b3d5e7f9a03
status: experimental
description: Detects a shell spawned by an AI agent runtime that downloads remote content and executes it, the example payload of a triggered Lazarus weight-space backdoor (TL-2026-5811).
references:
  - https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.execution
  - attack.t1059
  - attack.t1059.004
  - attack.t1059.001
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'langchain'
      - 'langgraph'
      - 'autogen'
      - 'crewai'
      - 'openai'
      - 'anthropic'
      - 'claude'
      - 'mcp-server'
      - 'mcp_server'
      - 'llama_index'
      - 'smolagents'
      - 'openhands'
      - 'semantic_kernel'
  selection_shell:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
      - '/dash'
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_fetch:
    CommandLine|contains:
      - 'curl '
      - 'wget '
      - 'iwr '
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
  selection_pipe:
    CommandLine|contains:
      - '| sh'
      - '|sh'
      - '| bash'
      - '|bash'
      - '| zsh'
      - '| iex'
      - '|iex'
  selection_iex:
    CommandLine|contains|all:
      - 'IEX'
      - 'DownloadString'
  selection_certutil:
    CommandLine|contains|all:
      - 'certutil'
      - '-urlcache'
  condition: selection_parent and selection_shell and ((selection_fetch and selection_pipe) or selection_iex or selection_certutil)
falsepositives:
  - Agentic coding assistants that run approved installer scripts such as curl-based installs
  - Developer agents bootstrapping toolchains in sandboxes
level: high
```

**Known false positives:**

- Agentic coding assistants running approved curl-based installer scripts
- Developer agents bootstrapping toolchains inside sandboxes

**Tuning notes:** Extend the agent-runtime regex with the frameworks and wrapper scripts actually deployed. Exclude approved installer URLs and sandbox hosts. Enforce egress restrictions and human approval for shell tool calls as Microsoft advises. For Linux hosts use Sysmon for Linux or the DeviceProcessEvents flavor.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Lazarus Weight-Space Backdoor - Model Weights Written to Cloud Storage by Non-Pipeline Principal (locked: unlock with TL Creds)
- Lazarus Weight-Space Backdoor - Model Registry Version Written by Non-Pipeline Identity (locked: unlock with TL Creds)
- Lazarus Dormant-Trigger Activation - First-Seen Shell Execution by AI Agent Runtime (locked: unlock with TL Creds)
- Lazarus Model Supply Chain - Model Weights Downloaded from Unvetted Source via CLI (locked: unlock with TL Creds)
- Lazarus Model Integrity - Inference Server Loading Checkpoint from User-Writable Path (locked: unlock with TL Creds)
- Lazarus Backdoored Agent - Agent Runtime Fetching Payload from Raw IP or Ephemeral Hosting (locked: unlock with TL Creds)
- Lazarus Weight-Space Backdoor - Model Checkpoint Written by Shell, Transfer or Browser Process (locked: unlock with TL Creds)
- Lazarus Weight-Space Backdoor - Inline Python Loads and Re-Saves Model Weights (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Detecting sleeper agents hiding in AI model neurons (Microsoft Security Blog)](https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/)
- [Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents (Microsoft Research Blog)](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/)
- [Lazarus paper (PDF)](https://github.com/anadim/anadim.github.io/blob/master/papers/Lazarus.pdf)
- [Microsoft researchers demonstrate hidden backdoor technique for AI agents (Help Net Security)](https://www.helpnetsecurity.com/2026/11/11/microsoft-hidden-ai-backdoors-lazarus/)
- [Microsoft Research publication page: Lazare, veni foras](https://www.microsoft.com/en-us/research/publication/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/)
- [Detecting backdoored language models at scale (Microsoft Security Blog)](https://microsoft.com/en-us/security/blog/2026/02/04/detecting-backdoored-language-models-at-scale)
- [PyRIT - Python Risk Identification Tool for generative AI](https://github.com/microsoft/PyRIT)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5811