Add UNC2814 LLM API abuse Gemini C2 from scripting host

[WRG-11]

Summary

New emerging-threat detection rule for UNC2814, a GTIG-tracked PRC-nexus threat cluster. Its AI-malware families (PROMPTFLUX, PROMPTSPY, HONESTCUE) call the Google Gemini API at runtime as a capability and command channel (mutating payloads, driving on-device navigation, or obfuscating code) instead of embedding that logic statically.

Detection

A Sysmon DNS query (Event ID 22) for generativelanguage.googleapis.com where the resolving process is a LOLBin scripting host (wscript, cscript, mshta, powershell, pwsh, rundll32, regsvr32) rather than a browser or a known SDK runtime.

Source

• Google Threat Intelligence Group (GTIG), Q2 2026 AI-vulnerability-exploitation reporting: https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access

Logsource and placement

• logsource: dns_query / windows (Sysmon Event ID 22)
• rules-emerging-threats/2026/TA/UNC2814/

False positives

Acknowledged in the rule: legitimate PowerShell or scripting automation that calls the Gemini API should be allowlisted by script path or signed automation account. Shipped as status: experimental because LLM API automation from scripting hosts is a growing legitimate pattern.

Testing

pySigma parse-validated locally; conforms to the dns_query field conventions (Image, QueryName).

[WRG-11]

Withdrawing this. On re-reading the cited GTIG report, the runtime Gemini-API C2 it documents is PROMPTSPY (Android), and UNC2814 is described doing persona-prompted vulnerability research rather than running these families. A Windows Sysmon DNS rule attributed to UNC2814 isn't supported by that source, so I'd rather pull it and resubmit something correctly attributed and platform-matched.