Techniques
Sample rules
GenAI Prompt Contains Base64-Encoded Payload
- source: elastic
- technicques:
- T1027
Description
Detects base64-encoded content within GenAI prompt or completion text. The security_ai ML model has identified one or more candidate strings in the message that score as encoded payloads. Attackers embed base64 in prompts to smuggle instructions past content filters, exfiltrate data, or inject indirect prompt-injection payloads into model context.
Strings that match known credential formats (AWS access key IDs, API keys, private key headers, and similar) are excluded — those fire the dedicated “GenAI Prompt Contains Leaked Credential” rule instead at higher severity.
Detection logic
FROM logs-aws_bedrock.invocation-*, logs-openai_chatgpt_enterprise.codex_log-*, logs-openai_chatgpt_enterprise.conversation_message-*, logs-openai_chatgpt_enterprise.custom_agents_log-* METADATA _id, _version, _index
| EVAL Esql_priv.b64_strings = CONCAT(
COALESCE(MV_CONCAT(security_ai.encoding.input_messages.strings, "\n"), ""), "\n",
COALESCE(MV_CONCAT(security_ai.encoding.output_messages.strings, "\n"), ""))
| WHERE Esql_priv.b64_strings != "\n"
// Suppress credential-shaped content — those fire the dedicated credential rule instead.
// Credential formats are split across two RLIKEs because a single pattern with every format exceeds
// ES|QL's regex determinization limit. A key must not be glued to a preceding key character (or be
// preceded by a JSON-escaped \n, \r or \t); that also keeps the automaton small.
// Not lowercased: credential prefixes (AKIA, sk-, ghp_, etc.) are case-significant.
| WHERE NOT Esql_priv.b64_strings RLIKE """(.*([^A-Za-z0-9_\-]|\\[nrt]))?((AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}|ABSK[A-Za-z0-9+/=]{20}|AIza[0-9A-Za-z_\-]{35}|gh[pousr]_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_\-]{20,}|sk-ant-api03-[A-Za-z0-9_\-]{80,}|sk-proj-[A-Za-z0-9_\-]{20,}).*"""
| WHERE NOT Esql_priv.b64_strings RLIKE """(.*([^A-Za-z0-9_\-]|\\[nrt]))?(sk-[A-Za-z0-9]{48}|sk_live_[A-Za-z0-9]{24}|hf_[A-Za-z0-9]{34}|xox[baprs]-[A-Za-z0-9\-]{10,}|eyJ[A-Za-z0-9_\-]{10,}\.eyJ[A-Za-z0-9_\-]{10,}\..*|-----BEGIN [A-Z ]*PRIVATE KEY-----).*"""
| KEEP _id, _version, _index, @timestamp, security_ai.*, gen_ai.*, aws_bedrock.*, user.*, cloud.*, event.*, openai_chatgpt_enterprise.*