cyber.hendryadrian.com
Security News · securelist.com

Kaspersky Details Controls for AI-Agent Risks in Corporate Systems

· Original article ↗

Summary

Kaspersky describes controls for identifying and restricting AI agents, detecting risky behavior, and scanning agent skills and LLM files. Its EDR rules cover sensitive-file access, unsafe execution settings, MCP artifacts, and unusual LLM API use.

Key points

  • Kaspersky says its Application Control can identify AI agents on endpoints and allow or block them by organizational policy; Web Control can restrict access to AI services.
  • Kaspersky EDR rules flag agents accessing files with credentials or keys, running with auto-approval or disabled sandboxing, and unusual applications connecting to external LLM APIs.
  • A separate rule detects MCP server scripts created or modified in hidden, temporary, or cache directories; other rules can record known agent launches and local model-file changes.
  • Kaspersky says its Threat Intelligence Portal provides AI-agent profiles with platform, privilege, actor-use, and detection information, while Hunt Hub provides detection-rule logic and related details.
  • Kaspersky Scan Engine can scan agent skills, associated scripts, generated files, and potentially dangerous LLM formats for malicious code.
  • The article describes an Armored Likho campaign in which Kaspersky found signs of AI-generated loader and dropper samples and a BusySnake module; it says conventional rules detected suspicious PowerShell and rundll32 activity.

Article Details

Event Type
Kaspersky announced capabilities for detecting and controlling AI agents and related threats, and reported signs of AI use in a recent Armored Likho campaign.
Impact
The described Kaspersky capabilities monitor and restrict AI-agent activity, detect risky behavior and malicious code in agent skills and LLM files, and support response actions such as stopping processes or isolating hosts. Kaspersky also reported signs that AI was used to create loader and dropper samples and develop modules for BusySnake malware.

MITRE ATT&CK

T1053.005 · Scheduled TaskThe article identifies persistence via Task Scheduler as a behavior whose traces can be detected.T1059.001 · PowerShellThe article says PowerShell commands executed by malware samples are detected by a Kaspersky rule.T1218.011 · Rundll32The article says malware commands executed via rundll32 are detected by a Kaspersky rule.

Threat Actors

Armored LikhoKaspersky reported signs that AI was used to create loader and dropper samples in a recent Armored Likho campaign, and said the group continues to generate modules for BusySnake malware.

Malware

BusySnake RATIn addition, the group continues to generate new modules for its BusySnake Stealer and BusySnake RAT samples.BusySnake StealerIn addition, the group continues to generate new modules for its BusySnake Stealer and BusySnake RAT samples.

Vendors

KasperskyThis post describes new expertise built into Kaspersky products that helps counter the threats posed by the proliferation of AI agents.

Products

Kaspersky EDRThat is why Kaspersky EDR (KEDR) uses both conventional behavioral rules and rules written and adapted to detect AI tools.Kaspersky Endpoint SecurityYou can use Kaspersky Endpoint Security, now also available as Kaspersky Next, to control and restrict the launch of AI agents.Kaspersky NextYou can use Kaspersky Endpoint Security, now also available as Kaspersky Next, to control and restrict the launch of AI agents.Kaspersky Scan EngineKaspersky Scan Engine analyzes installed applications to detect these threats and also checks LLM files for malicious code.Kaspersky Security CenterThis makes it easier for the Kaspersky Security Center (KSC) administrator to control applications.Kaspersky Threat Intelligence PortalTo this end, we added profiles to the Kaspersky Threat Intelligence Portal that describe various AI agents and how attackers exploit them.

Related Articles