Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
34 detections
Filters
Last updated
All Time
Detection languages
20
9
3
1
1
Contributors
11
9
6
2
1
Categories
9
8
7
7
5
Platforms
15
9
6
5
5
Products / Services
11
9
8
7
4
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
IDS Classtypes
8
1
1
IDS Protocols
9
Detects connections from internal hosts to the ARTEX-linked actor host 38.244.50.120, including requests for the exposed .claude/CLAUDE.md file and its open-directory port 18899.
Detects connections from internal hosts to the ARTEX-linked actor host 38.244.50.120, including requests for the exposed .claude/CLAUDE.md file and its open-directory port 18899.
Detects HTTP responses and requests involving exposed Claude Code open directories (.claude/CLAUDE.md) tied to ARTEX operator infrastructure.
Detects connections from internal hosts to the ARTEX-linked actor host 38.244.50.120, including requests for the exposed .claude/CLAUDE.md file and its open-directory port 18899.
Detects HTTP responses and requests involving exposed Claude Code open directories (.claude/CLAUDE.md) tied to ARTEX operator infrastructure.
Detects HTTP responses and requests involving exposed Claude Code open directories (.claude/CLAUDE.md) tied to ARTEX operator infrastructure.
Detects connections from internal hosts to the ARTEX-linked actor host 38.244.50.120, including requests for the exposed .claude/CLAUDE.md file and its open-directory port 18899.
Detects HTTP responses and requests involving exposed Claude Code open directories (.claude/CLAUDE.md) tied to ARTEX operator infrastructure.
This rule identifies potential prompt injection attempts against Microsoft Copilot and Azure OpenAI services by monitoring CloudAppEvents for specific adversarial markers, encoded instruction blocks, or hidden text patterns. It flags recurring attempts from a single user as suspicious probing activity.
This rule detects network activity and cloud API events indicative of an adversary utilizing the VAPI.ai platform to orchestrate automated voice-phishing (vishing) campaigns. It correlates outbound network connections to VAPI.ai endpoints with specific webhook callback patterns used to track call status for victim records.
This rule identifies potential prompt injection attempts against Microsoft Copilot and Azure OpenAI services by monitoring CloudAppEvents for specific adversarial markers, encoded instruction blocks, or hidden text patterns. It flags recurring attempts from a single user as suspicious probing activity.
This rule detects potentially malicious interactions with Azure OpenAI deployments, specifically looking for prompts indicative of malware-authoring, safety filter bypass attempts, and abnormal volumes of requests from a single identity.
This rule detects potential prompt injection and jailbreak attempts targeting internal Generative AI applications by monitoring prompt content for known adversarial patterns (e.g., DAN roleplay, hypothetical bypasses, and explicit disregard for safety instructions). The rule tracks repeat offenders or successful bypass attempts (where the application did not block the request).
Detects text/report artifacts (markdown, JSON, plain text) produced by an autonomous AI-driven vulnerability research pipeline that decompiles binaries, traces cross-references, hypothesizes memory-safety flaws, and generates/debugs proof-of-concept exploits
Detects text/report artifacts (markdown, JSON, plain text) produced by an autonomous AI-driven vulnerability research pipeline that decompiles binaries, traces cross-references, hypothesizes memory-safety flaws, and generates/debugs proof-of-concept exploits
Detects text/report artifacts (markdown, JSON, plain text) produced by an autonomous AI-driven vulnerability research pipeline that decompiles binaries, traces cross-references, hypothesizes memory-safety flaws, and generates/debugs proof-of-concept exploits
This rule monitors for security alerts related to Azure AI services, specifically detecting credential theft attempts and LLM jailbreak attempts that have been blocked or detected by Azure's built-in content filtering mechanisms.
This rule monitors for security alerts related to Azure AI services, specifically detecting credential theft attempts and LLM jailbreak attempts that have been blocked or detected by Azure's built-in content filtering mechanisms.
This rule monitors for security alerts related to Azure AI services, specifically detecting credential theft attempts and LLM jailbreak attempts that have been blocked or detected by Azure's built-in content filtering mechanisms.
Detects vLLM establishing outbound network connections to fetch external media files (e.g., .mov, .mp4, .jp2) from non-private IP addresses. This activity may indicate exploitation of CVE-2026-22778, allowing for remote code execution by fetching malicious content.
This rule detects HTTP requests made to well-known AI service API endpoints (OpenAI, Anthropic, Google Generative Language) specifically targeting 'completions' functionality. It triggers an alert if a single source IP makes more than 30 such requests within a 60-second window, indicating potential automated or high-volume use of AI tools for content generation, which could be leveraged for attack content.
Page 1 of 2