SOC Prime Bias: Critical

16 Nov 2025 09:05
newspaper icon Microsoft

SesameOp Backdoor Detection: Microsoft Discovers New Malware Abusing OpenAI Assistants API in Cyber-Attacks

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
SesameOp Backdoor Detection: Microsoft Discovers New Malware Abusing OpenAI Assistants API in Cyber-Attacks
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


SesameOp Malware Attacks

Microsoft DART discovered a new backdoor named SesameOp that leverages the OpenAI Assistants API as a covert command-and-control channel. The malware is delivered via a .NET DLL loader (Netapi64.dll) that is injected using AppDomainManager techniques, fetches encrypted commands from OpenAI vector stores and assistants, executes them, and returns encrypted results.

Attack Flow

SesameOp Backdoor Payload

Executive Summary

Test Case ID: TC-20251104-A1B2C
TTPs: T1055, T1105
Detection Rule Logic Summary: Detects creation of Netapi64.start or Netapi64.Exception files in C:\Windows\Temp\, indicating Netapi64.dll backdoor initialization or runtime errors.
Detection Rule Language/Format: sigma (yaml)
Target Security Environment: OS: Windows 10/Server 2019 + Logging: Windows File‑System Auditing (Object Access) for C:\Windows\Temp\ + Security Stack: SIEM/EDR that consumes Sigma rules (e.g., Azure Sentinel, Splunk, Elastic).
Resilience Score (1-5): 2
Justification: The rule relies solely on…
View Full Simulations

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for free