SUSP_AI_Agent_Execution_Mar26

Rule Info

Name
SUSP_AI_Agent_Execution_Mar26
Author
Marius Benthin
Description
Detects suspicious indicators of AI agent execution
Score
70
Reference
https://socket.dev/blog/unauthorized-ai-agent-execution-code-published-to-openvsx-in-aqua-trivy-vs-code-extension
Date
2026-03-03
Minimum Yara
3.5.0
Rule Hash
0c4c0b53b6ba0b5a9ca041e04b4b7c14
Tags
['SUSP']
Required Modules
[]
Virustotal Matches
https://www.virustotal.com/gui/search/susp_ai_agent_execution_mar26/comments

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
0
Suspicious (< 10 engines)
0
Clean (0 engines)
34

Rule Matches

Timestamp
Positives
Total
Hash
VT
2026-10-28 03:07:47
0
63
719b99d8aefe8b2ed1a976c71c2029fe1da0e2977d3863c4b42f69c5bef5d6e7
2026-10-27 01:34:08
0
61
e3a4bea21f522e64e0ace84159562b4e7f4574d75bcf2477499f0c10a8a97841
2026-10-27 01:33:09
0
61
c8746067379ddd09266490dc64ba06ff2bc7ba95c0c9dca59c02ea203ddaeb89
2026-10-25 17:21:38
0
62
ad011622be8745287d371eda6cf04fc182b4001776b3f70fd3ba52e890778b8c
2026-10-24 23:24:03
0
62
52a06babba22144941e18e1c13e3abc36982e594361755181da5c02458e89109
2026-10-24 23:24:01
0
62
59425038860eb5622a0b286d68a58c444f9c62ecb662595eeae5db96d15cfad7
2026-10-24 01:20:36
0
62
0e7274309f8222b46a556a82a6d0ba66f04b6db0e9aed3fc3e4f25ab3f587b1f
2026-10-24 00:05:18
0
61
c891cb3d99b8f31b3be88978007f11e81efc06f1825a736562f74127a2383e56
2026-10-24 00:04:08
0
62
73cd8da763ca8acddeb0e9d14f4e472547b5b78a94c409ada03f0efe2758f035
2026-10-23 21:29:50
0
62
77d4773661209bf62107b0aa562b69c5d05cd369b672906b86a38ede1aec91af
2026-10-23 21:28:37
0
62
0c09ea945ac87beb1e5c5e2495e70e602e8f5a99b3ec329d0f12e907adc0f16d
2026-10-21 20:09:00
0
62
eb15e73abe52807a247efb57c1a70cad3ace87abe050e5da88f180be25dcba3e
2026-10-21 20:02:09
0
62
917fcae336580d3f2c3841db30fcd92261211e12e9f89114c11d9ddd0ecb34c0
2026-07-01 00:04:54
0
61
96f3c80badb3cb914eef9bc475c6bdbe9acb686cc62e19187c77015d129eb5b5
2026-06-21 06:23:44
0
61
7db095e0a1cca9f4e7cb38f0bffd21da8844e75fc857fbbffb7c7eefbbc037ce
2026-06-21 03:33:34
0
61
04e8b83e7005c67112e80bdf0f24a97af8a8bf02e242b71abd0cb4993f89695c
2026-06-20 19:27:36
0
61
ec6dea8dbc0e2ab16bc6321ef5bbe385e3fe6ce885895eb977f2134267fd6da8
2026-06-18 11:17:45
0
60
06a15201850d87dbeddf2f1fa095adef51069b8a1f9f6fc408a534e588ea4dfa
2026-06-13 19:40:24
0
62
a21f5b7aa4e3253205f29815ac7c3ecc7976f48f29d118945d08700c96fb4162
2026-06-12 22:38:45
0
60
4ab03a3f9ad37c88ae7f7a96f52076375f620cba1db5403af7b5e4a33731142a
2026-06-12 02:56:55
0
62
b76f58d2ac8797195a3c817fbbbee548463e56ef85c51e9e774f78a1ab3977c8
2026-05-26 04:30:14
0
53
364d140124b6127c9549c0c4c0582d5d92e4279f50dc793f620d2138c8c888bf
2026-05-24 21:20:34
0
63
11a60f6318f988f43f455ae1e83c7e8ccadcd01b193e87eb53f07a0a3c434a38
2026-05-24 07:28:43
0
63
42442e6bd2240d14cab9682e3e00b5749580d126988ee9f8d6c682ec315c6f07
2026-05-22 01:29:24
0
63
960245053cc3e9b08023f8d48ae8d60fb59dc426aba24234b1e2e1ffaa814d9f
2026-05-21 20:23:47
0
63
00fffbd8a7184afaab1dfae1b57f53254c84107925ac26f7abcfa74361b550d8
2026-05-21 05:42:15
0
63
bc125fd015e45041513dc39f0d8b7296ececc38c166eb019d7c5ffb68ced3d5c
2026-05-18 23:32:45
0
59
5d18c4941905037987fc53fd64ad7160e2e65bd939d811e01d8d1e6516eab3a5
2026-05-17 19:50:04
0
63
ebcda4a92a57353d1d63314437f50348b99a5c44b17adc02b2b0068fabb65f3d
2026-05-17 07:59:14
0
63
b9045331034a3289692d3b8fe620d64040ce01815137a62c3f1d5cc43e4385cb
2026-05-17 01:52:44
0
63
7f9a23fe04106f3d3ed8969c8fd8b93ec3072dd98e9626fa9acba7336abc62c3
2026-05-16 23:41:04
0
63
927a84b8a5e36e9d26d2ee33a9bd8a821e7e6a64312023aa5abbd5daffe6d114
2026-05-16 09:34:44
0
63
7d06c0f1120d7ca6194d2bab6e15b6b4f86bfc402b64fc98b3d22c112f8cbb8a
2026-05-13 01:33:47
0
62
24edd298cf711aa5feac2e747e93bed872d9b9cc3d0bac5e0f29ea81d2aa6d42

Rule Matches per Month (last 24 months)

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022