Suspicious Process Outbound Connection to AI API Endpoints (T1567)

Ankit Mehta@Secvyn

•updated Jun 27, 2026•1•0•2

Detects DNS lookups and network connections to known AI API endpoints (OpenAI, Anthropic, Google Generative Language) initiated by non-standard processes. This rule excludes common web browsers, productivity applications, and development tools to identify potentially unauthorized or suspicious interaction with AI services from internal processes.