Skip to content
Apart Research
Apart Research
Contact us
Sprint projectNov 23, 2025Tel aviv

LLM-ExecGuard - Real-Time Detection of Malicious Shell Behavior in LLM Agents

Nitzan Shulman, Yael Landau, Liran Markin, Matan Sokolovsky, Gal Wiernik, Alon Wolf · Team Heron friends

Submitted to Defensive Acceleration Hackathon. Sprint projects are early-stage work by participants, not Apart Research publications.

Read the report

Report: LLM-ExecGuard - Real-Time Detection of Malicious Shell Behavior in LLM Agents

Open in a new tab (opens in new tab)
Recording (opens in new tab)Code (opens in new tab)
Share

LLM-ExecGuard is a real-time monitoring system designed to detect malicious behavior by LLM-based agents operating in shell environments. It observes the commands an agent executes and evaluates them using Sigma rules mapped to MITRE ATT&CK tactics. Our prototype hooks into the terminal stream, logs commands outside the agent’s container, and assigns each session a verdict (BENIGN → MALICIOUS) with an associated suspicion score. We implemented high-signal rules (covering credential access, persistence, privilege escalation, defense evasion, and exfiltration) and showed they can reliably flag simple malicious agents with low latency. As part of red-teaming our own system, we also succeeded in crafting an agent that exfiltrates data while completing its assigned task and evading our current ruleset, demonstrating both the promise and limits of rule-based detection.

Reviews

Judging this Sprint?

Review this project

Your public critique appears on this page without your name. Your private critique is not published; only the Apart team reads it. If you agree below, we share your review with grantmaking.ai (opens in new tab) and the Transformative AI Fund so strong projects can be funded.

Not shown on this page.

Shown on this page, without your name.

Only the Apart team reads this, and funders if you agree below.

Share my name publicly on grantmaking.ai *
Share my private critique with funders *

Does this reduce AI-related catastrophic or existential risks?

Scoring guide
  1. 1Minimal Impact. The project has minimal relevance to AI safety. It doesn't meaningfully address risks uniquely enabled or accelerated by advanced AI systems.
  2. 2Tangential Connection. The project touches on AI safety concepts but lacks depth or specificity. The connection to AI-enabled threats (bio, cyber, or AI misuse) is weak or unclear.
  3. 3Clear AI Safety Value. The project clearly reduces AI-related risks with valuable contributions. It addresses specific threats from AI systems and engages meaningfully with biosecurity, cybersecurity, or AI safety challenges.
  4. 4Significant Impact Potential. The above, plus the project demonstrates scalable safety mechanisms or defensive approaches. It shows clear potential to buy time for solving harder problems like alignment, or creates positive externalities for the broader AI safety ecosystem.
  5. 5Major Advancement. The above, plus the project represents a significant leap forward in defensive AI safety. Judges would eagerly share this with biosecurity, cybersecurity, or AI safety researchers and expect it to influence the field.

Does this strengthen the shield against AI-enabled threats?

Scoring guide
  1. 1Minimal Relevance. The project is only tangentially related to defensive technology or societal protection. Connection to biosecurity, cybersecurity, or defensive infrastructure is unclear or missing.
  2. 2Some Relevance. The project has some relevance to defensive acceleration, but the connection is broad or generic. It touches on defense without specific focus on AI-enabled threats or protective capabilities.
  3. 3Clear Relevance. The project clearly addresses defensive gaps against AI-enabled threats. It connects to at least one track (biosecurity, cybersecurity, or defense infrastructure) and demonstrates understanding of the threat landscape.
  4. 4Strong Contribution. The above, plus the project builds on existing defensive approaches and offers novel tools, frameworks, or implementations. It explicitly explains how it strengthens defensive capabilities with realistic deployment potential.
  5. 5Breakthrough Impact. The above, plus the project provides breakthrough insights or tools that could significantly influence defensive technology development. It identifies critical gaps and presents compelling solutions with clear paths from prototype to deployed system.

Did you build something that actually works?

Scoring guide
  1. 1Incomplete or Flawed. The project appears rushed or incomplete. Technical implementation is flawed, core functionality doesn't work, or the approach is fundamentally unsound. Little to no documentation.
  2. 2Basic Competence. The project shows reasonable effort with basic technical competence. Core functionality partially works. Documentation exists but may be incomplete. Some limitations are acknowledged.
  3. 3Solid Hackathon Project. The project is technically solid and well-scoped for 48 hours. Core functionality works and is documented. Code/methods are understandable and limitations are honestly addressed. This is what a good weekend prototype should look like.
  4. 4Impressive Implementation. The above, plus the implementation exceeds typical hackathon quality. Clear methodology, thorough documentation, and working demo. The tool/prototype is immediately useful for defenders and could realistically be built upon.
  5. 5Exceptional Execution. The project far exceeds expectations with exceptional technical execution. The implementation is elegant, fully functional, and includes something special (e.g., deployed demo, exceptional documentation, innovative architecture, or clear startup potential).

  1. Strengths: This is exactly what d/acc should look like! The team smartly demonstrated that human attacker detection frameworks transfer to AI agent monitoring because malicious objectives (credential theft, persistence, exfiltration) manifest through identical shell patterns regardless of who's issuing the commands. The TeeLogger architecture is a real contribution. Sub-second detection latency makes this production-viable. And the red-team section where you bypassed your own system is intellectually honest and valuable. Most teams didn’t publish their own failure modes.

    Susggestions: The limitations you identified (command obfuscation, fileless attacks, no role-based context) are the natural next steps. Integration with network telemetry may close the fileless attack gap, as a possible future step.

    POV from a Halcyon Ventures investor: This maps directly to our interest in AI agent security, specifically around next-gen malware detection. The SIEM integration path is smart. Would love to see this mature toward agent monitoring infrastructure that enterprises can deploy at scale. Great work!

    Read full reviewShow less

  2. Nice prototype and use of Sigma/MITRE; it feels like a natural fit for SOC workflows. It also seems to overlap with ongoing work on LLM agent isolation and command-level safeguards (sandboxed shells, approval flows, allow/deny lists). It would be great to see future iterations add role-/agent-aware policies so the system can better distinguish malicious behavior from legitimate system/security activity.

  3. Well written report with a clear security angle. I’d like to see a bit more context on where this would actually be deployed. What harm is it best at preventing? What industries is it best suited for? Using existing security standards is great, but without a deployment story it is hard to see how this gets adopted.

    It would also help to include a quick comparison to similar work so it’s clear what is new here and why this approach might be better.

    I agree with the next steps you outlined in the report, especially working to block high-risk commands before execution. Given how many other approaches are able to use this work flow, I think it would make this project much more appealing.

Cite this project

@misc{shulman2025llmexecguard,
  title = {{LLM-ExecGuard - Real-Time Detection of Malicious Shell Behavior in LLM Agents}},
  author = {Nitzan Shulman and Yael Landau and Liran Markin and Matan Sokolovsky and Gal Wiernik and Alon Wolf},
  year = {2025},
  month = nov,
  note = {Submitted to Defensive Acceleration Hackathon, an Apart Research Sprint},
  howpublished = {\url{https://apartresearch.com/sprints/projects/llmexecguard-realtime-detection-of-malicious-shell-behavior-in-llm-agents-p3fj}},
  url = {https://apartresearch.com/sprints/projects/llmexecguard-realtime-detection-of-malicious-shell-behavior-in-llm-agents-p3fj}
}

More from Defensive Acceleration Hackathon

All 84 entriesBrowse all projects

Build something like this at the next Sprint

AI Collusion Research Sprint · Oct 23 - 25, 2026