security or forensics workflows that send file hashes to a model for threat intelligence lookup or malware triage. review the surrounding context and verify the hash does not correspond to a credential or sensitive artifact.

t1110
security_ai
elastic

Techniques

T1110

Sample rules

GenAI Prompt Contains Cryptographic Hash String

source: elastic
technicques:
- T1110

Description

Detects hex-encoded hash strings (MD5, SHA-1, SHA-256, SHA-512) within GenAI prompt or completion text. The security_ai ML model has identified one or more candidate strings whose character distribution matches a cryptographic digest. Attackers may pass hashes in prompts to exfiltrate credentials for offline cracking, to reference stolen data without sending plaintext, or as part of prompt injection payloads that encode malicious instructions as hex data.

Detection logic

data_stream.dataset : (
    "aws_bedrock.invocation" or
    "openai_chatgpt_enterprise.codex_log" or
    "openai_chatgpt_enterprise.conversation_message" or
    "openai_chatgpt_enterprise.custom_agents_log"
) and (security_ai.hash_string.input_messages.strings : * or security_ai.hash_string.output_messages.strings : *)