Living-off-the-Land Data Exfiltration via LOLBins
This detects an AI agent running standard command-line utilities in patterns known to move data off a machine without going through a monitored web/HTTP connection. Attackers (or a compromised/misused agent) favor these built-in tools because they blend into normal admin activity and evade tools that only watch HTTP traffic.
How the attack works
An AI agent with command-line execution ability spawns a system utility instead of using its normal HTTP client. This can look like scp/rsync/sftp pushing files to a remote user@host target, netcat/ncat opening a raw TCP connection to send data, openssl s_client used to tunnel local file contents over TLS, sendmail/mutt emailing data out as an attachment or piped input, base64/certutil encoding a file and piping it straight into a transfer tool, or bitsadmin uploading a file via BITS. In each case the data leaves the host through a channel that isn't the agent's usual monitored web request path.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 6f3e9c2a-8b41-4d7a-9f3c-2e5b7a1d4c9e
- Severity
- High
Why it matters
An organization can lose sensitive data through a channel that its usual network monitoring (focused on HTTP traffic) never sees, because the transfer rides on trusted system utilities instead of the agent's normal outbound connection.
What you can do
- →Restrict which command-line utilities an AI agent is allowed to invoke, and block or gate scp/rsync/sftp/nc/ncat/openssl/sendmail/mutt/certutil/bitsadmin unless explicitly required.
- →Log and alert on command lines matching these transfer patterns, not just on the agent's HTTP requests.
- →Require known backup/reporting jobs that legitimately use rsync, scp, or mail-based reporting to run from separate service accounts or scheduled tasks, not through the agent's execution context.
- →Review egress firewall rules to ensure raw TCP, SMTP, and BITS traffic from agent hosts is restricted to only what's operationally needed.
Known benign look-alikes
- Legitimate rsync/scp/sftp deployment or backup jobs that push build artifacts or archives to a remote host using the user@host: target syntax
- Scripted TLS/certificate connectivity checks using openssl s_client fed from /dev/null (filtered explicitly)
- Automated reporting jobs that email log files or reports as attachments via sendmail or mutt
- Rare legitimate certutil -encode usage to convert a certificate to base64/PEM format
- Rsync executed with --dry-run during deployment testing (filtered explicitly)