Threat video1:00
PromptLogger AI Instruction Files: Detection & IOCs
PromptLogger instruction files turn coding agents into exfiltration tools: 9 detection rules, 15 IOCs and a free Splunk SPL rule.
Read the full threat intel for PromptLogger AI Instruction Files: Detection & IOCs →
Chapters
- 0:00The hookAI instruction files held 1,230+ hardcoded keys.
- 0:06The storyFake skills impersonated Paperclip and Browser Use.
- 0:13Attack pathPoisoned instruction files ride cloned repos and skills.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise11 indicators to hunt: 1 domain, 5 file names and 1 path, and more.
- 0:39MITRE ATT&CK techniques16 ATT&CK techniques, from initial access to impact.
- 0:43Remediation4 steps now: Scan every committed instruction-file path and block merges with Direct.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00AI instruction files held 1,230+ hardcoded keys.
0:06Fake skills impersonated Paperclip and Browser Use.
0:10They reached about 1.7M downloads.
0:14Poisoned instruction files ride cloned repos and skills.
0:18Then every prompt is captured silently.
0:20Secrets from the environment get sent out.
0:23Data leaves for an operator-controlled endpoint.
0:28No threat actor is attributed. Confidence: low.
0:3311 indicators to hunt: 1 domain, 5 file names and 1 path, and more.
0:3916 ATT&CK techniques, from initial access to impact.
0:444 steps now: Scan every committed instruction-file path and block merges with Direct.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.