AI Tradecraft - Non-Browser LLM API Interaction (T1071.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•13

Detects non-browser applications (Python, PowerShell, cURL, wget, node) communicating directly with OpenAI or ChatGPT API endpoints, indicative of automated AI tradecraft by threat actors. This rule specifically looks for network connections to api.openai.com initiated by these common scripting or command-line tools.