Best Detection of 2026 Series: ClickFix-style Encoded PowerShell/cmd Correlated with AI API Domain Beaconing

Ibrahim Saud@tektrix

•updated 9 days ago•0•0•1

This rule detects potentially malicious PowerShell, CMD, or PWSH command execution characterized by obfuscation techniques (such as Base64 encoding, decompression, or hidden command arguments) that are followed closely in time by network connections to public AI service domains (OpenAI, Anthropic, Google Generative Language, Mistral, Cohere). The detection correlates process-start events with outbound network requests from processes other than standard web browsers, suggesting potentially unauthorized use of AI APIs for exfiltration or automated processing of command results.