Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

GenAI CLI Started with Unsafe Permission Bypass

Identifies GenAI agent CLIs started with permission-bypass or auto-approval flags that disable human-in-the-loop guardrails. These modes are intended for isolated sandboxes but are frequently misused on internet-connected developer workstations, allowing prompt injection, compromised dependencies, or malicious skills to execute commands, modify files, or reach sensitive paths without confirmation.

ATT&CK coverage

Outside the enterprise matrix

T1685Disable or Modify ToolsMapped as T1562 and T1562.001, withdrawn by ATT&CK.

Detection requirements

Log source category: event_index

What the source says

References

Tagged by the source as

Data Source: Elastic DefendDomain: EndpointDomain: LLMOS: LinuxOS: macOSOS: WindowsResources: Investigation GuideTactic: Defense EvasionUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.