Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
20,590
11,933
5,910
5,194
4,872
Platforms
2
Products / Services
2
1
MITRE Techniques
2
2
2
1
1
Detects sustained spikes in AI/LLM API spend or token consumption for a given API key relative to its own dynamic rolling baseline, which may indicate a stolen/hijacked API key being resold or abused via gray-market proxy services (token jacking).
Detects users or applications whose AI API token consumption or spend is sustained above a dynamic baseline across multiple consecutive time buckets rather than a single burst, which may indicate token jacking, credential theft, or abuse of stolen AI API keys via gray-market proxy services.