Strix/Cairn/Hermes AI Attack Chain: DeepSeek + Anthropic API from Same Host

Ibrahim Saud@tektrix

•updated 7 days ago•0•0•0

This rule detects a multi-tool attack chain involving the Cairn autonomous exploitation engine and the Hermes Agent. It flags the co-occurrence of outbound network traffic to both the DeepSeek API (Cairn engine) and the Anthropic Claude API (Hermes Agent) from the same host within a one-hour window. This behavior is indicative of an automated, AI-driven post-exploitation orchestration campaign.