development tooling that includes git commit shas, docker image digests, or package checksums in prompts for ci/cd automation.

t1110
security_ai
elastic

Techniques

T1110

Sample rules

GenAI Prompt Contains Cryptographic Hash String

source: elastic
technicques:
- T1110

Description

Detects hex-encoded hash strings (MD5, SHA-1, SHA-256, SHA-512) within GenAI prompt or completion text. The security_ai ML model has identified one or more candidate strings whose character distribution matches a cryptographic digest. Attackers may pass hashes in prompts to exfiltrate credentials for offline cracking, to reference stolen data without sending plaintext, or as part of prompt injection payloads that encode malicious instructions as hex data.

Detection logic

data_stream.dataset : (
    "aws_bedrock.invocation" or
    "openai_chatgpt_enterprise.codex_log" or
    "openai_chatgpt_enterprise.conversation_message" or
    "openai_chatgpt_enterprise.custom_agents_log"
) and (security_ai.hash_string.input_messages.strings : * or security_ai.hash_string.output_messages.strings : *)