API endpoint redirection
A command or saved configuration contains a recognized API endpoint override.
Why it is risky
Section titled “Why it is risky”A changed endpoint may send API credentials, prompts, or responses through a different operator. The replacement service may also alter results.
Example
Section titled “Example”An agent writes an API base URL pointing to an unfamiliar proxy as a proposed fix for an authentication error.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”The rule matches selected environment-variable assignments and endpoint-like configuration text. Some variable patterns flag any HTTP endpoint, even an official one.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_THREAT_API_BASE_URL_OVERRIDE | threat_command | Community | HIGH |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Verify endpoint ownership, TLS, data-handling expectations, and the credential intended for that service. Review traffic sent after an unexpected override.
False positives
Section titled “False positives”Approved gateways, local model servers, Azure endpoints, and ordinary SDK configuration can match. The text may also occur in a comment inside a staged file.
False negatives
Section titled “False negatives”Programmatic client overrides, unsupported setting names, alternative syntax, or changes absent from captured tool parameters can be missed.
Technical details
Section titled “Technical details”The rule retains HIGH base severity for staged content. It does not resolve domain ownership or prove that subsequent traffic used the override.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.