October 29, 2026

This content release includes:

4 new rules that give visibility into AI usage and AI-specific threats on endpoints and in web traffic
2 new First Seen rules that flag the first time a local AI runtime (such as Ollama, vLLM, LM Studio, llama.cpp, GPT4All, or ComfyUI) runs on a host, and the first time an external IP address connects to one. Unapproved AI runtimes are a shadow IT and AI governance concern, and runtimes such as Ollama listen on all network interfaces without authentication by default, so a new external client can mean the service is exposed to the internet. Both rules learn a 14-day baseline before they fire
A new chain rule that correlates a Data Loss Prevention (DLP) finding with an upload to a Generative AI (GenAI) tool such as ChatGPT, Claude, Gemini, or Copilot for the same entity within 10 minutes, which can mean sensitive data was shared outside the organization. Add approved GenAI domains to the allowed_ai_domains match list to exclude them
A new chain rule that detects malicious machine learning models: a Python process loads a serialized model file (such as .pkl, .pt, or .ckpt) and then spawns a reverse shell, a download-and-execute command, an encoded payload, or a read of /etc/shadow or /etc/passwd on the same host within 10 minutes. Attackers have published weaponized models on public repositories such as Hugging Face that run code as soon as they are loaded. Add CI/CD build servers to the ci_cd_hosts match list to exclude them
The McAfee Web Gateway CSV parser now also parses space-delimited McAfee Web Gateway access logs sent over syslog. Access log fields are extracted with the same names as CSV fields, so the existing log mapper and rules apply to both formats
Changes are enumerated below

Rules

[New] FIRST-S00103 First Seen AI Runtime on Endpoint
[New] FIRST-S00104 First Seen External Client to AI Runtime
[New] CHAIN-S00028 Sensitive Data Sent to Generative AI Tool - Cross-Vendor
[New] CHAIN-S00029 Suspicious Child Process Spawned After Python Model Deserialization

Parsers

[Updated] /Parsers/System/McAfee/McAfee Web Gateway CSV

Rules​

Parsers​

Rules

Parsers