Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
3
1
Contributors
4
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
4
1
Products / Services
4
2
2
MITRE Techniques
2
2
2
1
1
IDS Classtypes
1
Detects a privileged/elevated AI-agent tool invocation whose arguments are sourced from sandbox runtime output within 30 seconds of a PBKDF2/AES decrypt event, with no provenance tag distinguishing that output from trusted state — the generic post-decryption privileged-action sequence behind Cryptographic Context Injection attacks.
Detects an AI agent sandbox exfiltrating harvested PII/session context by embedding it as an x-auth-token query parameter in an outbound HTTP request to an external host — the network-observable exfiltration stage of Cryptographic Context Injection.
Detects an AI agent disclosing system-prompt or safety-policy content, or returning sandbox re-encrypted ciphertext-only output, immediately following a cryptographic-injection-style probe request in the same session — the safety-policy-bypass stage of Cryptographic Context Injection.
Detects an AI agent's code-execution sandbox decrypting attacker-supplied AES/PBKDF2 ciphertext immediately after fetching untrusted external content — the core trust-laundering mechanism behind Cryptographic Context Injection attacks.