Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11 detections
Filters
Last updated
All Time
Detection languages
6
5
Contributors
11
Categories
6
6
4
4
2
Platforms
7
6
5
3
Products / Services
6
6
3
2
MITRE Techniques
6
5
4
2
2
CVEs
71
71
64
58
49
IDS Classtypes
4
IDS Protocols
6
This rule detects HTTP POST requests containing the specific string 'GEMINI_TRUST_WORKSPACE', which is associated with environment variable injection attacks targeting CI/CD pipeline configurations.
This rule detects HTTP POST requests containing the specific string 'GEMINI_TRUST_WORKSPACE', which is associated with environment variable injection attacks targeting CI/CD pipeline configurations.
Detects attempts to exploit CVE-2026-12537 in the Google Gemini CLI, which allows for unauthorized manipulation of the .gemini/.env configuration file. The rule triggers on GET or POST requests attempting to access or modify this specific environment file, potentially enabling malicious environment variable injection.
This rule detects attempts to access sensitive .env configuration files in Gemini CLI applications, which may indicate an attempt to exploit CVE-2026-12537. Attackers target these files to retrieve credentials or environment variables that could lead to Remote Code Execution (RCE) within CI/CD pipelines or deployment environments.
Detects attempts to exploit CVE-2026-12537 in the Google Gemini CLI, which allows for unauthorized manipulation of the .gemini/.env configuration file. The rule triggers on GET or POST requests attempting to access or modify this specific environment file, potentially enabling malicious environment variable injection.
This rule detects attempts to access sensitive .env configuration files in Gemini CLI applications, which may indicate an attempt to exploit CVE-2026-12537. Attackers target these files to retrieve credentials or environment variables that could lead to Remote Code Execution (RCE) within CI/CD pipelines or deployment environments.
Detects the creation or modification of '.env' files within '.gemini' directories, often found in CI/CD pipelines or developer environments. This activity may indicate an attempt to inject malicious environment variables to hijack the execution flow of the Gemini CLI or related tooling.
Detects instances where the Gemini CLI (gemini-cli) is used to spawn system shell interpreters (e.g., cmd.exe, bash, powershell) within CI/CD runner environments. This pattern is associated with potential abuse of the Gemini CLI workspace trust bypass or 'yolo' mode, which can lead to unauthorized code execution.
Detects the unauthorized injection of the 'GEMINI_TRUST_WORKSPACE=true' environment variable via process command lines or shell environments. This rule identifies potential exploitation attempts related to CVE-2026-12537 by flagging instances where this variable is set outside of defined, trusted CI/CD runner environments.
Detects instances where the Gemini CLI (gemini-cli) is used to spawn system shell interpreters (e.g., cmd.exe, bash, powershell) within CI/CD runner environments. This pattern is associated with potential abuse of the Gemini CLI workspace trust bypass or 'yolo' mode, which can lead to unauthorized code execution.
Detects the unauthorized injection of the 'GEMINI_TRUST_WORKSPACE=true' environment variable via process command lines or shell environments. This rule identifies potential exploitation attempts related to CVE-2026-12537 by flagging instances where this variable is set outside of defined, trusted CI/CD runner environments.