Cybersecurity analysts are increasingly turning to artificial intelligence (AI) to aid in their work, and one recent experiment with a Large Language Model (LLM) has yielded some surprising insights. A cybersecurity professional used Gemma4, an LLM, to analyze file hashes uploaded to the DShield sensor over the past 30 days. The model was tasked with determining whether certain files were malicious and providing recommendations for action.
The analysis involved submitting several questions to Gemma4, including asking it to identify indicators of compromise (IoCs) in the data stream, provide a comparative analysis of threat intelligence from two external websites – VirusTotal and CyberGordon – and recommend actions to prevent actors or bots from successfully compromising the sensor. The results were revealing.
The sheer volume of hashes analyzed, over 126,000 events, raised concerns about malicious intent. While high volumes don’t automatically confirm malicious activity, in this case, the files were being downloaded from an interactive sensor like Cowrie, indicating successful actor persistence and data exfiltration attempts. The analysis also highlighted indicators of compromise (IoCs) in the hashes themselves, which resolve to known malware families or C2 infrastructure components.
Moreover, the tactics employed by the actors suggest **Persistence**, **Command and Control (C2)** communication, and potentially **Lateral Movement/Exfiltration**. This means that the actors are not merely querying the system; they are downloading specific files repeatedly, which is a hallmark of malicious activity.
The analysis also compared threat intelligence from VirusTotal and CyberGordon. While both sources provided some insight, VirusTotal emerged as superior for immediate threat context, while CyberGordon offered supporting research. However, it was noted that the lack of a result on either site should not be treated as “safe.” This highlights the importance of developing a structured workflow to ensure that results pages are fully processed and captured.
The recommendations from Gemma4’s analysis were clear: treat any machine connected through this sensor as compromised, isolate the host, and initiate forensic imaging immediately. Additionally, update Cowrie’s logging and alerting capabilities to track file execution attempts, not just downloads. Implement stricter egress filtering on the network hosting the sensors and review user access policies and network segmentation rules.
The experiment with Gemma4 has shown that AI can be a valuable tool in cybersecurity analysis. However, it is essential to remember that AI should supplement human expertise, not replace it. The takeaway from this exercise is that cybersecurity professionals must develop a structured workflow to ensure they are capturing all relevant threat intelligence and taking immediate action when necessary.
In practical terms, this means that organizations should invest in developing a comprehensive threat hunting program, utilizing internal Endpoint Detection and Response (EDR) solutions across the entire enterprise. Regularly review user access policies and network segmentation rules to prevent persistent gaps in perimeter controls. By combining human expertise with AI-driven insights, cybersecurity professionals can stay one step ahead of malicious actors and protect their organizations from compromise.
Source: SANS ISC — 2026-08-13