Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
49 detections
Filters
Last updated
All Time
Detection languages
49
Contributors
37
11
1
Categories
8
7
7
5
5
Platforms
20
11
7
5
5
Products / Services
10,799
9,795
6,757
4,421
3,768
MITRE Techniques
20
11
10
8
7
CVEs
3
1
Detects correlated host-profiling reconnaissance by the DeviceManager RAT: three or more distinct indicators (MachineGuid, volume serial, user SID, AV product enumeration, domain/workgroup enumeration) executed within a 15-minute window from the same python.exe/pythonw.exe parent process.
Detects sign-ins from the same user account occurring from two different countries within a short time window, where the implied travel velocity exceeds physically achievable speeds, indicating impossible travel or anomalous geolocation change consistent with a hijacked account or API key credential, with special attention to sudden access from China-based infrastructure.
Detects sustained spikes in AI/LLM API spend or token consumption for a given API key relative to its own dynamic rolling baseline, which may indicate a stolen/hijacked API key being resold or abused via gray-market proxy services (token jacking).
Detects users or applications whose AI API token consumption or spend is sustained above a dynamic baseline across multiple consecutive time buckets rather than a single burst, which may indicate token jacking, credential theft, or abuse of stolen AI API keys via gray-market proxy services.
Detects developer accounts whose daily count of API key creation or model provisioning operations exceeds their own 15-day historical per-user baseline plus several standard deviations, excluding service principals/apps, which may indicate compromised credentials being abused to provision or harvest AI API keys for resale (token jacking).
Detects cloud app account activity indicating that usage alerting or audit logging has been disabled, which could allow attackers to hide token jacking or unauthorized AI resource consumption.
Detects operations that remove, disable, delete, or update billing limits, spending limits, usage alerts, spend notifications, billing thresholds, or cost alerts on AI service accounts, which may indicate an attacker attempting to remove financial guardrails to enable unrestricted abuse of stolen AI API credentials.
Page 3 of 3