Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
2
Platforms
2
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
2
2
1
IDS Classtypes
1
1
IDS Protocols
1
Detects sustained high-volume automated HTTP request patterns from internal hosts to known new-api/one-api transfer station proxy domains (amutes.com, abb1.life) used to resell stolen AI API access, requiring volume above a dynamic baseline over a 10-minute window and excluding approved internal API gateways or vetted integration partners.
Detects successful DNS resolution responses, TLS SNI values, and HTTP Host headers referencing known Shai-Hulud/Miasma token-jacking transfer station infrastructure (amutes.com, abb1.life) used by attackers to resell stolen AI/LLM API access via gray-market proxy services.