Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
6
1
Contributors
5
2
Categories
6
5
1
1
1
Platforms
7
Products / Services
6
1
1
MITRE Techniques
7
6
1
1
CVEs
71
71
64
58
49
Detects rapid, closely-spaced network requests from the Microsoft Edge process (msedge.exe) to Microsoft-hosted domains within a very short timeframe. This behavior is indicative of a race-condition exploitation technique (CVE-2026-55945) intended to manipulate the Edge AI agent's state transitions, specifically forcing it from 'think' mode into 'act' mode to facilitate unauthorized command injection.
Detects the execution of specific web browsers (Chrome, Edge, Opera) to facilitate identification of vulnerable browser versions as indicated by CVE-2026-0628 and CVE-2026-55945. This rule does not perform version checking directly but serves as a telemetry trigger for external asset inventory correlation.
Detects rapid AI agent state transitions (from 'think' to 'act') within Microsoft Edge processes, specifically identifying potential exploitation of the CVE-2026-55945 race condition vulnerability, which could be used to force the unauthorized execution of an injected prompt.
Detects rapid AI agent state transitions (from 'think' to 'act') within Microsoft Edge processes, specifically identifying potential exploitation of the CVE-2026-55945 race condition vulnerability, which could be used to force the unauthorized execution of an injected prompt.
Detects rapid AI agent state transitions (from 'think' to 'act') within Microsoft Edge processes, specifically identifying potential exploitation of the CVE-2026-55945 race condition vulnerability, which could be used to force the unauthorized execution of an injected prompt.
Detects rapid AI agent state transitions (from 'think' to 'act') within Microsoft Edge processes, specifically identifying potential exploitation of the CVE-2026-55945 race condition vulnerability, which could be used to force the unauthorized execution of an injected prompt.
Detects rapid AI agent state transitions (from 'think' to 'act') within Microsoft Edge processes, specifically identifying potential exploitation of the CVE-2026-55945 race condition vulnerability, which could be used to force the unauthorized execution of an injected prompt.
