Threadlinqs companion to Anthropic's "Detecting and countering misuse of AI: September 2026"

Coverage matrix: every case against our corpus

Each row is one case group: the report's 43 case studies, as we count them, fold into 32 GTG groups (GTG-16012 and GTG-16003 share a write-up) plus one policy-level row for the six GTG-labelled weapons cases and one for the five unlabelled biology cases, neither scored on indicators. GTG numbers are Anthropic's own tracking labels (PDF p. 4), not public actor names; case sections add public names where a named source supplies one.

Each cell shows the strongest relation that survived verification:

• A: an actor-controlled indicator from Anthropic's list in a record created before publication.
• B: the same actor or campaign, per a named vendor or government source.
• C: a shared tool or distinctive technique cluster, with no claim about who is behind it.
• D: related context only (region, sector or trend), never identity.
• drv: dated September 10, 2026 or later, ours or others'; listed for reference, never prior coverage.

Detections count rules on tier A-C records only.

SPLindex=proxy OR index=dns OR index=network earliest=-120d
| eval ioc=lower(coalesce(query, url_domain, dest_host, dest_ip, dest))
| lookup threadlinqs_anthropic_ai_misuse_2026_09.csv indicator AS ioc
    OUTPUT gtg role anthropic_handling threadlinqs_status
| where isnotnull(gtg) AND threadlinqs_status!="context-only" AND anthropic_handling!="context"
| stats count min(_time) AS first_seen max(_time) AS last_seen values(src) AS src
    BY ioc gtg role anthropic_handling
| convert ctime(first_seen) ctime(last_seen)
| sort - count

KQL · networklet iocs = externaldata(indicator:string, indicator_defanged:string, type:string, platform:string, gtg:string,
    case_name:string, role:string, anthropic_description:string, anthropic_handling:string, first_seen:string,
    last_seen:string, stale_before_report:string, threadlinqs_status:string, threadlinqs_threats_before:string,
    threadlinqs_threats_after:string, threadlinqs_related:string, role_judgement:string, source:string,
    anthropic_id:string, reference_url:string)
  [@"https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/iocs.csv"] with (format="csv", ignoreFirstRecord=true)
  | where threadlinqs_status != "context-only" and anthropic_handling != "context";
let hosts = toscalar(iocs | where type in ("domain", "hostname", "onion") | summarize make_set(indicator));
let ips = toscalar(iocs | where type in ("ipv4", "ipv6") | summarize make_set(indicator));
DeviceNetworkEvents
| where Timestamp > ago(120d)
| where RemoteIP in (ips) or RemoteUrl has_any (hosts)
| summarize hits = count(), first = min(Timestamp), last = max(Timestamp), devices = dcount(DeviceId)
    by RemoteIP, RemoteUrl
| order by hits desc

KQL · hostlet iocs = externaldata(indicator:string, indicator_defanged:string, type:string, platform:string, gtg:string,
    case_name:string, role:string, anthropic_description:string, anthropic_handling:string, first_seen:string,
    last_seen:string, stale_before_report:string, threadlinqs_status:string, threadlinqs_threats_before:string,
    threadlinqs_threats_after:string, threadlinqs_related:string, role_judgement:string, source:string,
    anthropic_id:string, reference_url:string)
  [@"https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/iocs.csv"] with (format="csv", ignoreFirstRecord=true)
  | where threadlinqs_status != "context-only" and anthropic_handling != "context";
let hashes = toscalar(iocs | where type == "sha256" | summarize make_set(indicator));
let files = toscalar(iocs | where type == "filename" | summarize make_set(indicator));
union DeviceFileEvents, DeviceProcessEvents
| where Timestamp > ago(120d)
| where SHA256 in (hashes) or FileName in~ (files)
    or FolderPath has @"\ProgramData\fontdrivehostServicePackages\"
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName;
DeviceEvents
| where Timestamp > ago(120d) and ActionType == "ScheduledTaskCreated"
| where AdditionalFields has_any ("SECOMS64_AdminTask", "Calc_AdminTask");
let senders = toscalar(iocs | where type == "email" | summarize make_set(indicator));
EmailEvents
| where Timestamp > ago(120d)
| where SenderFromAddress in~ (senders) or SenderMailFromAddress in~ (senders)
| project Timestamp, SenderFromAddress, RecipientEmailAddress, Subject, NetworkMessageId

How we cross-referenced the report

We froze the corpus first: every comparison ran against a September 25, 2026 export of the Threadlinqs D1 database (2,473 threats, 62,332 IoCs, 22,696 detections). From Anthropic we took the report PDF and its 209-row indicator CSV, and wrote a paraphrased inventory of each case. TL-2026-NNNN identifiers are Threadlinqs threat records, each with indicators, ATT&CK mapping and detections.

Indicator matching is deterministic string comparison. Each value was refanged, lower-cased and searched across IoC values and context notes, record text, timelines, update logs, detection bodies, DNS enrichment and C2 tables. Domains matched exactly, as subdomains or at registrable-domain level, but shared-hosting, dynamic-DNS and multi-part-suffix parents never count. IPv4 addresses also matched inside CIDR ranges in our records; a registrable-domain or in-range hit alone is a weak signal, and /24 neighbours count for nothing. Indicators printed only in the PDF, mostly media outlets and public accounts, were checked the same way; none matched actor infrastructure in our corpus. Nothing was resolved, fetched or visited.

Case-level links came from AI-assisted finders that pivoted on infrastructure, resolved actor, alias, malware and tool names, and searched tradecraft semantically and by ATT&CK/ATLAS, with a second round on leads a case judge flagged. Every claimed link needed a quote that is an exact substring of the snapshot record, or it was dropped.

Then we tried to break every claim. Role judges classified each overlapping indicator (actor-controlled, public resource, victim infrastructure, leaked code, researcher host or unclear), and only actor-controlled overlaps can make tier A. Three independent skeptics attacked each tier-A claim and each case's tier-B set on presence, timing, role and attribution; where a record and Anthropic name different clusters, we report both and merge neither. A separate judge kept, downgraded or dropped tier C and D candidates, and in doubt the weaker relation won.

A record created on or after September 10, 2026, or one citing Anthropic's report, is marked drv and never counts as prior coverage; nor does an indicator that entered an older record only through a post-publication update. Where we held something early, the lead time belongs to the vendor that published it first.

Cyber operations

In Anthropic's cyber chapter, Claude carries much of each campaign's hands-on work while people still choose targets and review the take (report section, PDF pp. 4–5).

Prior visibility splits the four cases below cleanly (the chapter's AI-supply-chain cases, GTG-50021 and GTG-50020, are in their own section). GTG-20006 is the only case in the report whose published indicators were already in Threadlinqs; the other three existed in our corpus only as technique-level analogues.

Anthropic's trend pages (PDF pp. 38–39) put GTG-20006 at both ends of their autonomy range: a human approved each target, yet its token refreshes and cloud-storage pulls ran as unattended jobs. Agent teams ran for hours to days in GTG-50014 and GTG-50029, and GTG-10007's collectors on a timer. Autonomy drives scale, not severity. For defenders, the CaptiveCrunch and UNC7005 infrastructure behind all but two of our advance matches will rotate; the device-code, key-validation and mu-plugin rules outlast it.

The AI supply chain as a target

Anthropic's supply-chain section treats AI access as something criminals attack, sell and run on: a stolen key can be resold, pays for attack compute and pins the activity on its owner (report section, PDF pp. 28–30). Its trends chapter sees a marketplace growing around that access (trends chapter, PDF p. 38).

The ground was already well covered: between February and our September 25, 2026 snapshot, 188 Threadlinqs records had AI systems as their main target theme (LLMjacking, exposed model servers, AI-gateway flaws, prompt injection), nearly all before the report. None of the indicators Anthropic published for either group appeared in them; the community had mapped the economy, not these operators.

Together, the two cases show stolen keys flowing both ways: keys lifted from developers stock cheap resale, and keys lifted from an AI vendor funded further intrusion attempts against that vendor and others. Detection starts with how a key is used, not where the traffic comes from.

Influence operations

Nine influence operations sit under this heading, aimed at audiences on six continents and scored for reach on the Breakout Scale (report section, PDF pp. 41–43). Claude scrubbed state sourcing from recycled copy, sub-edited for existing newsrooms, and ran back-office work: manuals, target lists, doctrine held in memory files.

We hold analogues, not the operations: Trend Micro's solo 'Patriot Bait' operator, whose jailbroken LLM rewrote news for Telegram (TL-2026-0582, TL-2026-1356), ClearSky's Houthi fake-outlet network (TL-2026-0760) and Recorded Future on Iranian state AI propaganda (TL-2026-1417). Later independent coverage: Pravda-network LLM grooming (TL-2026-2631) and a new UK information-defence centre (TL-2026-2638).

These six have only thematic context in our corpus, nothing a hunter could act on.

Route these cues to registrars, hosting providers, platform trust-and-safety teams and targeted communities, not a SOC blocklist.

Surveillance operations

Anthropic's surveillance block covers operations by Chinese, Iranian and West African operators and one commercial vendor, disrupted from January to July 2026 (surv-intro, PDF pp. 81–82). Its three lessons: a lone engineer with a model now replaces a development team, models are fed bulk-collected data to choose targets, and state security bureaucracies are wiring AI into routine work.

Our corpus splits along national lines. The Iranian cases have technique-level analogues, led by CRESCENTHARVEST (TL-2026-0159) and APT42's phone-number data agent (TL-2026-1508). The PRC cases have almost none: PlugX and ShadowPad appear, but we hold no dedicated records of the long-running campaigns against Tibetan, Uyghur and Falun Gong communities, an ingestion gap rather than a search miss.

The six remaining cases sit where our corpus is thinnest.

Start with the GTG-30006 host artefacts, then behaviour-based LSASS-access detection and browser-extension inventory. Blocklists add little: the network destinations published for these cases are public services.

Conventional weapons

Six disrupted cases make up the weapons section (report section, PDF pp. 111–128): four in which Claude helped write weapons software or design documents, and two on procurement and open-source collection. The table below maps each one. The actors broke their work into fragments so that no single session exposed the programme, and at least one reached Claude over VPNs from a blocked region (PDF p. 124). Anthropic banned the accounts, shared findings with partners and added classifiers aimed at weapons-development traffic.

Our corpus has nothing on these cases, by design. For defence-industrial defenders the nearest context is Russian cyber pressure on drone makers: intrusions into Ukrainian FPV drone workshops (TL-2026-0377) and APT28 targeting of the European drone supply chain (TL-2026-2031).

Biological misuse

Like the weapons section, the biology section falls outside our corpus's subject matter and publishes no indicators to sweep. What it does document is how the researchers reached the models. That access layer we track, in 10 records, all created before the report. Read what follows as access-control material, not a hunt.

For a SOC, the practical output is a procurement rule, not a SIEM rule: staff and contractors reach frontier models only through accounts you own and can audit, and use of a discount reseller counts as a data-governance incident whatever the work.

Scams and fraud

The report's one scams case is consumer fraud at industrial volume: AI personas do most of the deceiving, with paid humans mixed in mainly where a video call or follow-back must look real (PDF pp. 139–142). Little of it crosses a corporate network, so the levers sit with app stores, MDM owners and AI providers.

Illicit distillation

Anthropic's September 10, 2026 report names seven China-based labs that ran distillation campaigns against Claude after its February disclosure (distill-intro, PDF pp. 143–146): Alibaba, Moonshot AI, DeepSeek, Zhipu (Z.ai), Xiaomi, SenseTime and MiniMax. A distilled copy keeps Claude's capabilities but not its safeguards, Anthropic warns, and it says DeepSeek, Moonshot and Xiaomi fed their own users' conversations, some of them sensitive, into Claude.

Apart from GTG-20006, distillation is the only area where Threadlinqs held actor-level coverage before the report. CISA/NSA/FBI advisory AA26-251A, public since September 8, 2026 and in Threadlinqs since September 8-9 (TL-2026-2405, TL-2026-2413), names Alibaba, Moonshot AI, DeepSeek, Z.ai and MiniMax, but not Xiaomi or SenseTime. The match is at company level, not campaign level. Anthropic adds covert relaying of customers' prompts, thinking-signature replay, replay of real user sessions, a named buyer of harvested transcripts and a shell-company proxy.

None of these cases came with indicators to block. Providers and LLM gateway owners with prompt-level logs can hunt behaviour: reasoning-forcing instructions repeated across accounts, round-the-clock throughput with no human rhythm, many accounts sharing one payment or routing fingerprint. Seed pattern lists with Anthropic's sample extraction prompts, such as a request to "translate" earlier reasoning (PDF pp. 145–146), and borrow from its playbook (PDF pp. 153–154): tie proxy accounts to the organisation behind them, and demand identity checks on resale signals. Everyone else owns the data path: know which routers, resellers, extensions and assistants see your prompts, and vet them like any processor of company data.

The unusual part: pre-burned infrastructure, public tooling and a server we read differently

Only one case has actor-controlled indicator overlap that predates publication, and other vendors got there first. Of the 55 GTG-20006 rows, 17 actor-controlled ones were already in our corpus, most via ReliaQuest's and Microsoft's CaptiveCrunch reporting (lookalike domains, rogue DNS resolver, ChocoShell C2, both malware hashes; held since July 31, 2026, TL-2026-1808) or Google's UNC7005 reporting (since August 21, 2026, TL-2026-2091). Anthropic cites Microsoft's July write-up. So the operator used infrastructure Microsoft and Google already tracked as Storm-2945 and UNC7005. That does not put every GTG-20006 workstream in the cluster: most of the case's rows match nothing, and no pre-publication record mentions PowerChrome, WUEngine, Shadow C2, GiftDrop or Embassy Kit.

The oldest overlap is the weakest. cdncounter[.]net and its static host have sat in our DarkSword record since March 18, 2026 (TL-2026-0245) as delivery domains Google ties to UNC6353. DarkSword has several users and its source leaked, so whether GTG-20006 and UNC6353 are one operator stays open.

Public tools recur. MiniPlasma, listed with the operator's Windows malware, shares its name with a privilege-escalation proof of concept an independent researcher released on GitHub on May 15, 2026 (TL-2026-0523); that researcher's server is also on Anthropic's list, so the same code is likely. The operator used the open-source WPPConnect library for some of its WhatsApp hijacks, and the library already appears in a Brazilian banking-trojan campaign (TL-2026-1785). GTG-30004 modified NanoDump, also seen in The Gentlemen ransomware tradecraft (TL-2026-0076); GTG-50014 ran TruffleHog and GTG-50029 BeEF. Tool names make poor pivots.

Anthropic labels projectnightcrawler[.]dev operator or lure infrastructure. Our records from June and August 2026 (TL-2026-0835, TL-2026-1865) describe it as the platform that same researcher self-hosted after GitHub and GitLab takedowns, mirroring other proofs of concept (RoguePlanet, GreatXML, LegacyHive). Most likely the operator fetched public exploit code there, though Anthropic may have seen a lure use we cannot. We mark it context-only and keep it out of the sweeps.

Naive /24 pivots mislead too. GTG-20006 addresses sit in /24s beside servers our corpus records as North Korean C2 and BlueNoroff infrastructure, a GTG-50014 egress address neighbours a host from our TeamPCP reporting, and GTG-50020's 178.16.54[.]141 falls in a /22 that Intrinsec and Spamhaus tie to bulletproof hosting (TL-2026-0617). None of this is evidence: cheap VPS and VPN space is shared by design.

Cross-cutting trends: what our corpus shows

Between February and the September 25, 2026 snapshot, 455 of the 2,462 threat records we created involve AI. A keyword classifier, which misses some, files each in one bucket: AI used by attackers (234), AI systems as targets (188) and AI brands as lures (33). Volume dipped in spring after 28 in February, peaked at 154 in July, then eased; September is partial. Part of that peak is ingestion: in July we logged Check Point's annual AI security report (TL-2026-1286) and, late, GTIG's November 2025 write-up of AI-enabled malware (TL-2026-1508).

The report's core argument, that the techniques are old and only the labour got cheaper, matches what vendors documented before September 10, 2026: a financially motivated cluster working Mexican government targets through a Claude-backed agentic CLI (Trend Micro, TL-2026-0498), a Russian-speaking operator breaking into FortiGate appliances with commercial models and a custom MCP server (Amazon, TL-2026-0131), a ransomware crew running Cursor Agent on a Claude model inside victim networks (Gambit Security, TL-2026-2243) and a suspected China-linked operator driving the Hermes and OpenClaw frameworks near-autonomously against Taiwan under a pentest cover story (Israeli firm Dream, TL-2026-2063). Anthropic adds the operator's side: prompts, agent configurations and how much of the loop the model ran.

The targets bucket describes the same key-theft economy as Anthropic's supply-chain cases: Langflow exploitation feeding a key-harvesting botnet (TL-2026-0514), the LiteLLM SQL injection (TL-2026-0487), scanning for MCP servers and agent credentials (TL-2026-1278) and transfer-station resale (TL-2026-1911). None of these records involves GTG-50014, GTG-50020 or GTG-50021. Lures are the smallest bucket but the likeliest to reach a developer laptop (TL-2026-0403, TL-2026-1845).

Two blind spots show. Distillation barely registers until the AA26-251A records in September, filed under targets. Influence and surveillance, the two largest groups in Anthropic's case list, hardly appear: our vendor and government sources follow intrusions and malware far more closely than content operations or domestic surveillance. That collection bias explains most empty cells in the coverage matrix.

ATT&CK and ATLAS mapping

Most top-cited techniques on the strip sit before compromise: gathering victim identity information (T1589), acquiring domains (T1583.001), creating social media accounts (T1585.001) and obtaining AI capabilities (T1588.007). Apart from domains, visible in passive DNS and certificate logs, their bars are short: that work happens on the provider's platform and the operator's kit, beyond any SOC sensor. Coverage runs deep where cases touch your estate: public-facing exploits (T1190), valid accounts (T1078), token theft (T1528) and exfiltration over C2 (T1041). In ATLAS terms, most cases use AI model inference API access (AML.T0040); jailbreaks (AML.T0054) recur across groups, distillation adds model extraction (AML.T0024.002), and key theft adds unsecured credentials (AML.T0055) and cost harvesting (AML.T0034). The full map below lists every id from our case extractions. ATLAS is reporting vocabulary; the ATT&CK bars show where detection engineering pays.

Entity graph: cases, actors, records and shared indicators

Rectangles are Anthropic's cases; circles are Threadlinqs records, shaded from pale violet (tier A) through B to deep violet (C), grey for records dated September 10, 2026 or later. Orange nodes are actors named in those records; small green nodes are indicators held before the report, linked only to pre-publication records. Tier D is left out. Grey nodes say nothing about lead time. An actor reached through a tier-C record is that record's actor, not the case's: the GTG-50014 path to ShinyHunters runs through technique parallels. Several distillation cases sharing the AA26-251A records (TL-2026-2405, TL-2026-2413) reflect one advisory naming several labs.

Defender playbook

• Sweep the actor-controlled GTG-20006 rows first. Run the hunt pack sweeps over DNS, proxy and EDR logs: the 17 indicators public before the report, then the 23 Storm-2945 and UNC7005 indicators Anthropic did not list, such as wa-connect[.]net, globsec[.]net and 107.189.26[.]194 (TL-2026-2091, TL-2026-1838).
• Retro-hunt the stale egress; don't block it. Search each "hunt" row within its own first- and last-seen dates (late February to mid-June); a match is a lead, not a verdict.
• Hunt device-code phishing by behaviour. TL-2026-0943-KQL-003 (TL-2026-0943) flags Graph tokens used from an IP that never approved the code; limit the device-code flow with Conditional Access. Check new Entra device registrations for ROADtools defaults such as DESKTOP- plus an eight-character random suffix (TL-2026-0561).
• Check travellers' laptops for the hotel Wi-Fi chain. Look for WPAD auto-proxy use on guest networks (DNS wpad lookups or DHCP option 252), ChocoShell's beacon path /t/pixel.gif and exfiltration path /t/event, and a CornFlake service named "Cloud Sync Service" (TL-2026-1808, TL-2026-1857).
• Re-label projectnightcrawler[.]dev. A hit is not GTG-20006 C2, so keep it off espionage block lists (web filtering is a separate call); pair any unexpected hit with a hunt for MiniPlasma artefacts such as %LOCALAPPDATA%\MiniPlasma\placeholder.dat (TL-2026-0523).
• Treat AI keys as credentials with a blast radius. Scan your apps, images and repos for secrets first: GTG-50014 ran TruffleHog over 1.8 million APKs, GTG-50029 a custom scanner over public containers. Alert on STS GetCallerIdentity then Bedrock use by one principal (TL-2026-0514-KQL-002, TL-2026-0514) and on Bedrock logging checks plus model enablement by one key (TL-2026-0012-SPL-002, TL-2026-0012).
• Watch developer endpoints for fake AI clients. Hunt ClaudeCode_x64.exe and look-alike installers in user folders (TL-2026-0403, TL-2026-1845). If an infostealer hits a developer host, reimage it, then revoke AI sessions, rotate keys and check billing (TL-2026-2257, TL-2026-2416).
• Close the WordPress persistence GTG-50029 used. Alert on new or changed files in wp-content/mu-plugins (TL-2026-0817-SPL-002; its KQL twin in TL-2026-0817 also requires a web-server process) and audit for hidden admin accounts (TL-2026-1978).
• Trim our derivative rule. TL-2026-2466-SIG-003, from TL-2026-2466, our write-up of Anthropic's disclosure, rates five hunt-flagged GTG-50014 addresses (162.128.129[.]106, 185.65.134[.]246, 193.32.249[.]161, 45.148.10[.]242 and the VPS 195.178.110[.]131) critical with no expected false positives. If you copy it, keep its domains and three detect-or-block GTG-20006 addresses and move those five to a scheduled hunt.
• Catch agentic recon on your hosts. TL-2026-2390-KQL-001 (TL-2026-2390) joins scanner processes and LLM API calls from one host within 15 minutes, no indicators needed.

SPL: DNS lookups of CaptiveCrunch Microsoft 365 lookalike domains

TL-2026-1857-SPL-001 · from TL-2026-1857 · Flags DNS resolution of Microsoft 365 lookalike names published for this case. ReliaQuest disclosed the activity on July 23, 2026 and Microsoft named it CaptiveCrunch on July 31; the rule dates from our August 4 record.

SPLindex=dns sourcetype=dns query IN ("ms365-device.com","ms365-live.com","m365-owa.com","owa-ms365.com") answer!="NXDOMAIN" answer!="0.0.0.0"
| stats count min(_time) as firstTime max(_time) as lastTime by src_ip,query,answer
| eval threat_name="CaptiveCrunch_Doppelganger_DNS",technique="T1557"
| convert ctime(firstTime) ctime(lastTime)
| table src_ip,query,answer,count,firstTime,lastTime
| sort - count

KQL: device-code token replayed to Microsoft Graph from a new IP

TL-2026-0943-KQL-003 · from TL-2026-0943 · Device-code phishing was the case's main access route. Flags Graph/Office token use from IPs where the user never approved the code; technique-level rule, independent of burned infrastructure.

KQLlet interactive = SigninLogs
    | where TimeGenerated > ago(24h)
    | where AuthenticationProtocol =~ "deviceCode" and ResultType == 0
    | summarize ApprovalIPs = make_set(IPAddress, 50) by UserPrincipalName;
union AADNonInteractiveUserSignInLogs, SigninLogs
| where TimeGenerated > ago(24h)
| where ResourceDisplayName == "Microsoft Graph" or AppId in ("04b07795-8ddb-461a-bbee-02f9e1bf7b46","d3590ed6-52b3-4102-aeff-aad2292ab01c")
| where ResultType == 0
| join kind=inner interactive on UserPrincipalName
| where ApprovalIPs !has IPAddress
| project TimeGenerated, UserPrincipalName, AppId, ResourceDisplayName, IPAddress, ApprovalIPs, AutonomousSystemNumber, Location
| order by TimeGenerated asc

KQL: SecFlow Claude/DeepSeek relay and SecBox C2 infrastructure hits

TL-2026-2325-KQL-003 · from TL-2026-2325 · Anthropic published no GTG-10007 indicators. This uses the closest analog instead: a Chinese-speaking operator driving Claude through niestools[.]com relays. It flags that operator's ten hosts, relay domain and C2 ports.

KQLlet KnownC2IPs = dynamic(["81.70.240.170","43.99.61.170","152.42.200.25","129.211.184.149","159.223.64.67","158.247.234.124","207.148.109.245","211.159.155.240","103.45.65.93","43.162.217.10"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIP in (KnownC2IPs)
    or RemoteUrl has "niestools.com"
    or RemoteUrl has "trycloudflare.com"
    or RemotePort in (18000, 64288, 35888)
| extend C2Indicator = case(
    RemoteUrl has "niestools.com", "SecFlow-AI-Proxy-Relay",
    RemoteUrl has "trycloudflare.com", "SecBox-DeadDropResolver-Fallback",
    RemotePort == 35888, "SOCKS5-Exfil-Relay",
    "SecBox-Known-C2-Infra")
| summarize count(), Devices=make_set(DeviceName) by RemoteIP, RemoteUrl, RemotePort, C2Indicator

KQL: scanner tooling and LLM API calls from one host within 15 min

TL-2026-2390-KQL-001 · from TL-2026-2390 · Catches the continuous-recon loop on hosts you own: nmap, nuclei or sqlmap runs plus Claude, DeepSeek, OpenAI or Gemini API calls within 15 minutes. Still works after infrastructure is burned.

KQLlet scanner_procs = DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where ProcessCommandLine has_any ("nmap", "masscan", "nuclei", "sqlmap", "rustscan", "zmap", "gobuster", "ffuf")
| project DeviceId, DeviceName, ProcTime = TimeGenerated, ProcessCommandLine, AccountName;
let llm_api_calls = DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemoteUrl has_any ("generativelanguage.googleapis.com", "api.anthropic.com", "api.openai.com", "api.deepseek.com")
| project DeviceId, DeviceName, NetTime = TimeGenerated, RemoteUrl;
scanner_procs
| join kind=inner llm_api_calls on DeviceId, DeviceName
| where abs(datetime_diff("second", NetTime, ProcTime)) <= 900
| project ProcTime, DeviceName, AccountName, ProcessCommandLine, RemoteUrl
| sort by ProcTime desc

Sigma: GTG-20006 and GTG-50014 domains, carding shop and addresses (after-report rule)

TL-2026-2466-SIG-003 · from TL-2026-2466 · The only Threadlinqs rule holding any GTG-50014 indicators, and it holds only some of them. It comes from our write-up of Anthropic's disclosure, so it adds nothing Anthropic did not publish.

Sigmatitle: Beacon to Known GTG-20006/GTG-50014 C2 and Carding Infrastructure
id: 4c3b2a1f-0e9d-4c7b-9a8f-6e5d4c3b2a10
status: experimental
description: Detects DNS/network connections to confirmed GTG-20006 and GTG-50014 attacker-controlled infrastructure.
references:
    - https://www.anthropic.com/threat-intelligence-report-september-2026
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-12
tags:
    - attack.command-and-control
    - attack.exfiltration
    - attack.t1567
    - attack.t1584.002
    - attack.t1583.001
    - attack.tool.soraki
logsource:
    category: network_connection
detection:
    selection_domain:
        DestinationHostname|contains:
            - 'ms365-live.com'
            - 'owa-ms365.com'
            - 'teams.ms365-live.com'
            - 'updatebeacon.duckdns.org'
            - 'soraki.cc'
            - 'soraki.work'
            - 'policenationale.cc'
            - 'autoshop.policenationale.cc'
    selection_ip:
        DestinationIp:
            - '104.145.210.184'
            - '31.57.243.154'
            - '144.172.114.192'
            - '162.128.129.106'
            - '195.178.110.131'
            - '45.148.10.242'
            - '185.65.134.246'
            - '193.32.249.161'
    condition: selection_domain or selection_ip
falsepositives:
    - None expected — these are attacker-registered/attacker-controlled domains and egress IPs
level: critical

KQL: LLMjacking key check — STS GetCallerIdentity then Bedrock use

TL-2026-0514-KQL-002 · from TL-2026-0514 · Indicator-free: one principal calling STS GetCallerIdentity then Bedrock within five minutes, the test-then-use step behind the case's theft of AI keys. Prefer the SPL body; KQL needs UserIdentityArn.

KQL// KeyHunter / LLMjacking AWS validation chain: STS GetCallerIdentity -> Bedrock list/invoke within 5 min
let sts = AWSCloudTrail
  | where TimeGenerated > ago(24h)
  | where EventName == "GetCallerIdentity" and EventSource == "sts.amazonaws.com"
  | project sts_t=TimeGenerated, principal=tostring(parse_json(UserIdentity).arn), src_ip=SourceIpAddress, sts_region=AwsRegion;
let bedrock = AWSCloudTrail
  | where TimeGenerated > ago(24h)
  | where EventSource == "bedrock.amazonaws.com"
  | where EventName in ("ListFoundationModels","InvokeModel","InvokeModelWithResponseStream")
  | project br_t=TimeGenerated, principal=tostring(parse_json(UserIdentity).arn), br_src=SourceIpAddress, br_event=EventName, br_region=AwsRegion;
sts
| join kind=inner (bedrock) on principal
| where br_t between (sts_t .. sts_t + 5m)
| extend severity="High", threat="KeyHunter LLMjacking validation chain", mitre="T1526,T1580,T1496"
| project sts_t, principal, src_ip, br_src, br_event, br_region, severity, threat, mitre

KQL: fake Claude Code dropper ClaudeCode_x64.exe run from user folders

TL-2026-0403-KQL-001 · from TL-2026-0403 · No rule contains Anthropic's seven GTG-50021 indicators. This one matches a documented fake Claude Code binary that installs Vidar, the same fake-AI-client credential-theft vector the case describes.

KQLlet DropperNames = dynamic(["TradeAI.exe","ClaudeCode_x64.exe"]);
let UserPaths = dynamic([@"\Users\", @"\Temp\", @"\Downloads\", @"\AppData\"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (DropperNames)
| where FolderPath has_any (UserPaths)
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, MD5
| extend LureVariant = case(
    FileName =~ "TradeAI.exe", "TradeAI-rust-dropper",
    FileName =~ "ClaudeCode_x64.exe", "ClaudeCode_x64-rust-dropper",
    "unknown")
| order by Timestamp desc

SPL: Bedrock logging check and model enablement by one AWS key

TL-2026-0012-SPL-002 · from TL-2026-0012 · LLMjackers test stolen AWS keys by checking Bedrock invocation logging and switching models on. The rule groups those calls per key and flags multi-step chains, independent of reseller infrastructure.

SPLindex=aws sourcetype=aws:cloudtrail
| where eventSource="bedrock.amazonaws.com"
| where eventName IN ("GetModelInvocationLoggingConfiguration", "PutFoundationModelEntitlement", "PutUseCaseForModelAccess", "ListFoundationModels", "GetFoundationModelAvailability")
| eval action_type=case(
    eventName="GetModelInvocationLoggingConfiguration", "LOGGING_EVASION_CHECK",
    eventName="PutFoundationModelEntitlement", "MODEL_ACTIVATION",
    eventName="PutUseCaseForModelAccess", "USE_CASE_REGISTRATION",
    eventName="ListFoundationModels", "MODEL_ENUMERATION",
    eventName="GetFoundationModelAvailability", "AVAILABILITY_CHECK",
    1==1, "OTHER"
)
| eval severity=case(
    action_type="MODEL_ACTIVATION", "CRITICAL",
    action_type="LOGGING_EVASION_CHECK", "HIGH",
    action_type="USE_CASE_REGISTRATION", "HIGH",
    1==1, "MEDIUM"
)
| stats count as api_calls, values(action_type) as actions, values(eventName) as events, values(sourceIPAddress) as source_ips, values(awsRegion) as regions, earliest(_time) as first_call, latest(_time) as last_call by userIdentity.arn, userIdentity.accessKeyId
| where api_calls > 0
| eval recon_chain=if(mvcount(actions) >= 2, "MULTI-STEP RECON CHAIN", "SINGLE ACTION")
| table first_call, last_call, userIdentity.arn, userIdentity.accessKeyId, actions, events, source_ips, regions, api_calls, recon_chain, severity

KQL: VAPT exploit-pipeline marker strings in process command lines

TL-2026-1076-KQL-001 · from TL-2026-1076 · No rule holds this case's egress IPs. Near-zero-FP marker match for an autonomous exploit pipeline run on stolen AI inference, as GTG-50020 did; different operator (Sysdig VAPT).

KQLDeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("VAPTb3gin", "VAPTfin", "__VAPTCMD__")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName

SPL: machine-speed inference bursts against self-hosted LLM endpoints

TL-2026-1076-SPL-003 · from TL-2026-1076 · Catches machine-speed inference bursts from one source against your own self-hosted model endpoints: the footprint of an agent platform driving stolen or exposed compute.

SPLindex=web sourcetype="access_combined" uri_path="*/api/generate*" OR uri_path="*/api/chat*" OR uri_path="*/v1/completions*"
| bin _time span=5m
| stats count as request_count dc(uri_path) as endpoint_diversity by src_ip, _time
| where request_count > 60
| sort -request_count

SPL: known mu-plugin backdoor hashes, filenames and rogue WP admins

TL-2026-1978-SPL-002 · from TL-2026-1978 · No Threadlinqs rule contains Anthropic's 22 published indicators. This is the closest artifact match: known mu-plugin backdoor hashes and filenames plus rogue-admin creation, mirroring GTG-50029's WordPress persistence.

SPL(index=web sourcetype=access_combined uri_path="/wp-json/wp/v2/users" method=POST status=201)
OR (index=wordpress_audit sourcetype=wp_user_created (new_user_login="bd_*" OR new_user_email="*@wordpress.org" OR new_user_email="*@developer.wordpress.org"))
OR ((index=fim OR index=edr) md5 IN ("1024732009983dd5e54b4cf5593f04d4","7719cd98a35ffad2771f26d1ceab7d27","9aadc3e5c5242b273bd17c5bdc358845","e450ae5bc4bfc0d960dded06a76bb8e9"))
OR ((index=fim OR index=edr) (file_name="emer-run.php" OR file_path="*/wp-content/plugins/wp-smart-thumbnails/*" OR file_path="*/wp-content/mu-plugins/class-wp-token-validate.php" OR file_path="*/wp-content/mu-plugins/class-wp-query-*.php" OR file_path="*/wp-content/mu-plugins/wp-cache-optimizer.php"))
| eval detection_reason=case(
    match(uri_path, "wp-json/wp/v2/users"), "rest_api_user_creation",
    isnotnull(new_user_login), "rogue_admin_username_bd_prefix_or_spoofed_email",
    isnotnull(md5), "known_ioc_file_hash_match",
    1=1, "known_backdoor_filename_or_path")
| table _time, host, src_ip, new_user_login, new_user_email, uri_path, file_name, file_path, md5, detection_reason
| sort - _time

SPL: new or changed files in WordPress mu-plugins and theme functions.php (FIM)

TL-2026-0817-SPL-002 · from TL-2026-0817 · Fires on file-integrity create or modify events in wp-content/mu-plugins or a theme's functions.php, plus theme-editor POSTs. Its KQL twin adds the web-server-process check. That is where a credential-harvesting mu-plugin would land.

SPL(index=web sourcetype=access_combined uri_path="/wp-admin/theme-editor.php" (method=POST OR uri_query="*functions.php*"))
OR (index=linux sourcetype="fim:filechange" (object_path="*/wp-content/mu-plugins/*" OR object_path="*/themes/*/functions.php" OR object_path="*styIe.php*" OR object_path="*session-manager.php*") action IN ("created","modified"))
OR (index=web sourcetype=access_combined (header_x_wp_session=* OR uri_query="*key=*" header_user_agent IN ("*WPScan*","*Nikto*")))
| stats count values(uri_path) as uris values(object_path) as files values(action) as fileactions min(_time) as firstSeen by host src_ip
| where count > 0
| `ctime(firstSeen)`
| table host src_ip count uris files fileactions firstSeen

Indicator master table

The master table lists every hunt pack row, defanged; the CSV is refanged. For Anthropic's 209 rows, status says what we held and when: 17 were in the corpus before September 10, 2026, 15 appear only in our write-ups of the disclosure, 1 is a researcher's server we mark context-only, 1 sits only inside a hosting range we documented, and 175 match nothing. Our 23 added rows name their vendor cluster, not GTG-20006. Role carries Anthropic's handling flag and our stale marker. Account rows are Anthropic's attribution: accounts get bought, hijacked or reassigned, and a name-like handle does not identify a real person. We also checked the 33 indicators printed only in the PDF; none matched actor infrastructure in our corpus.