Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,084 detections
Filters
Last updated
All Time
Detection languages
418
193
163
156
81
Contributors
381
251
92
71
40
Categories
498
271
255
135
123
Platforms
443
441
267
121
114
Products / Services
10,665
9,758
6,692
4,421
3,749
1,084
MITRE Techniques
278
229
180
177
151
CVEs
17
15
13
13
8
IDS Classtypes
4
IDS Protocols
4
Detects unauthenticated guest users abusing the Salesforce Experience Cloud Aura endpoint (/s/sfsites/aura) to perform high-volume metadata and schema enumeration. This activity typically involves tools like AuraInspector to harvest CRM data by repeatedly invoking Aura actions such as describeSObjects, getSObjectMetadata, ObjectInfoController, or RecordUiController.
Detects high-volume data exports or bulk API queries against sensitive Salesforce CRM objects (Accounts, Contacts, Cases, Opportunities) performed by connected applications. This pattern is characteristic of exfiltration efforts where a newly authorized OAuth application is used to quickly extract large quantities of sensitive records.
Detects unauthorized abuse of the OAuth 2.0 device authorization grant flow in Salesforce environments, commonly used by threat actors like ShinyHunters (UNC6240) to gain programmatic access. Attackers register malicious connected apps to impersonate legitimate tools, then use social engineering (vishing) to trick victims into approving device codes. This rule flags token issuance from non-allowlisted connected apps using the device_code grant type.
Detects high-volume data exports or bulk API queries against sensitive Salesforce CRM objects (Accounts, Contacts, Cases, Opportunities) performed by connected applications. This pattern is characteristic of exfiltration efforts where a newly authorized OAuth application is used to quickly extract large quantities of sensitive records.
Detects unauthorized attempts to delete or purge critical Salesforce audit logs, including the Setup Audit Trail, Login History, and Event Monitoring log files. This behavior is indicative of anti-forensic activity, often utilized by threat actors such as ShinyHunters to destroy audit evidence following unauthorized access, data export, or credential manipulation.
This rule detects potential prompt injection attacks against internal AI-powered assistants, agents, or LLM gateways. It monitors network HTTP requests for common patterns used to override system instructions, bypass safety filters, or force the model to adopt a privileged, unauthorized persona (e.g., administrator or debug mode). These techniques are often used in social engineering to manipulate the AI's output or security posture.
The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). This detection identifies suspicious command execution patterns associated with exploitation of this vulnerability, such as executing mesch.exe with specific arguments like b64exec or fullinstall. This activity is indicative of an attacker exploiting CVE-2025-31161 to gain unauthorized access to the CrushFTP server and perform post-exploitation activities.
Detects UNC6240 PSEMHUB.war web shell/tunnel/trojanized installer artifacts by distinctive content markers (x.jsp, u.jsp, tunnel.jsp/jspx, Ple64.exe)
Detects UNC6240 PSEMHUB.war web shell/tunnel/trojanized installer artifacts by distinctive content markers (x.jsp, u.jsp, tunnel.jsp/jspx, Ple64.exe)
Detects anomalous, high-volume querying against machine learning inference endpoints. The rule identifies potential model extraction or data exfiltration attempts by flagging high counts of requests from a single user/API key, particularly during off-hours or with high variance in unique inputs, which may indicate automated efforts to reconstruct proprietary models or extract sensitive training data.
Detects anomalous, high-volume querying against machine learning inference endpoints. The rule identifies potential model extraction or data exfiltration attempts by flagging high counts of requests from a single user/API key, particularly during off-hours or with high variance in unique inputs, which may indicate automated efforts to reconstruct proprietary models or extract sensitive training data.
Detects potential data leakage from an LLM application where a user repeatedly prompts the model to divulge its internal system instructions, configuration, or sensitive information (e.g., API keys, PII) and the model subsequently outputs that sensitive data.
Detects attempts to perform context or memory poisoning against an AI agent by injecting imperative, instruction-like payloads into the agent's long-term memory or context store. The rule specifically monitors updates originating from untrusted channels, such as tool outputs, external documents, or web content, which contain patterns commonly associated with prompt injection attacks (e.g., overriding system instructions or role definitions).
Detects an AI agent session that performs a data exfiltration action (e.g., sending an email, webhook, or file share) to an unauthorized or non-allowlisted destination shortly after the agent has ingested potentially untrusted external content. This behavior is indicative of an AI agent being manipulated to exfiltrate data after processing malicious or adversarial inputs.
Detects the ingestion of sensitive credentials (API keys, passwords, private keys) into a RAG (Retrieval-Augmented Generation) document store, followed by the retrieval of those credentials by an application agent, indicating potential credential harvesting within the LLM application pipeline.
Detects unauthorized modifications to AI Agent Model Context Protocol (MCP) tool manifests. This includes the injection of imperative instructions into tool descriptions, the addition of suspicious instruction-related fields to tool output schemas, or manifest updates initiated by unverified publishers.
Detects the installation of Model Context Protocol (MCP) servers or AI agent plugins that exhibit characteristics of supply chain risk, such as unverified or unknown publishers, requests for highly sensitive permissions (filesystem write, credential read, unrestricted network egress), or recent public listing, which aligns with AI model supply chain poisoning techniques (AML.T0104).
Detects systematic and high-frequency probing of internet-exposed LLM chatbot or API gateway endpoints. The rule monitors for sequences of requests, use of known prompt-infiltration or jailbreak testing toolkits, and varied path access indicative of automated reconnaissance or adversarial prompt engineering attempts.
Detects suspicious AI inference API activity indicative of credential compromise or misuse. The rule identifies three main signals: rapid authentication failures (credential stuffing), anomalous geolocation/ASN usage for successful requests, and successful API calls occurring after a key rotation event.
Detects high-volume API requests to an AI inference service that explicitly request gradient, confidence vector, or raw logit information. Such patterns are indicative of model inversion or training data reconstruction attacks, where an adversary attempts to extract private training data by exploiting detailed output from the model.
Detects attempts by users to extract the underlying system prompt from an LLM via prompt injection techniques or identifies successful leaks where the model's response matches a pre-calculated system prompt hash. Exposing system prompts can lead to the discovery of proprietary business logic, safety guidelines, and facilitate further adversarial jailbreaking.
Page 11 of 52