Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,099 downloads4,369 copies51 likes26,049 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects a multi-stage authentication bypass attempt against LiteLLM MCP endpoints. The rule tracks an initial malformed Authorization Bearer token request to the /mcp/ endpoint, followed by a server response returning a 200 OK status code accompanied by an 'mcp-session-id' header, confirming the exploitation of CVE-2026-59822.
Detects a multi-stage authentication bypass attempt against LiteLLM MCP endpoints. The rule tracks an initial malformed Authorization Bearer token request to the /mcp/ endpoint, followed by a server response returning a 200 OK status code accompanied by an 'mcp-session-id' header, confirming the exploitation of CVE-2026-59822.
Detects attempts by non-privileged (non-PROXY_ADMIN) API keys to modify pass-through routes in LiteLLM via configuration update endpoints. This activity is indicative of exploitation of CVE-2026-35029, which allows unauthenticated or low-privilege users to bypass configuration restrictions.
Detects attempts by non-privileged (non-PROXY_ADMIN) API keys to modify pass-through routes in LiteLLM via configuration update endpoints. This activity is indicative of exploitation of CVE-2026-35029, which allows unauthenticated or low-privilege users to bypass configuration restrictions.
Detects attempts by non-privileged (non-PROXY_ADMIN) API keys to modify pass-through routes in LiteLLM via configuration update endpoints. This activity is indicative of exploitation of CVE-2026-35029, which allows unauthenticated or low-privilege users to bypass configuration restrictions.
Detects attempts by non-privileged (non-PROXY_ADMIN) API keys to modify pass-through routes in LiteLLM via configuration update endpoints. This activity is indicative of exploitation of CVE-2026-35029, which allows unauthenticated or low-privilege users to bypass configuration restrictions.
This rule detects anomalous high-frequency, short-duration bursts of CAPWAP (Control and Provisioning of Wireless Access Points) traffic originating from external sources and targeting internal FortiGate devices. This behavior is indicative of automated exploitation attempts, specifically targeting known heap-grooming activities used in vulnerabilities like CVE-2023-27997, which rely on repetitive 'Add-Station' operations. Legitimate controller traffic is filtered by focusing on internal-to-internal communication patterns.
Detects requests to a LiteLLM proxy that have been assigned the 'PROXY_ADMIN' role despite the absence of valid authentication credentials (Authorization headers, JWT tokens, or OAuth2 tokens). This pattern typically indicates that the LiteLLM instance is misconfigured, specifically that a 'master_key' is missing, causing the proxy to default to a permissive mode where every request is treated as having administrative privileges.
Detects requests to a LiteLLM proxy that have been assigned the 'PROXY_ADMIN' role despite the absence of valid authentication credentials (Authorization headers, JWT tokens, or OAuth2 tokens). This pattern typically indicates that the LiteLLM instance is misconfigured, specifically that a 'master_key' is missing, causing the proxy to default to a permissive mode where every request is treated as having administrative privileges.
Detects requests to a LiteLLM proxy that have been assigned the 'PROXY_ADMIN' role despite the absence of valid authentication credentials (Authorization headers, JWT tokens, or OAuth2 tokens). This pattern typically indicates that the LiteLLM instance is misconfigured, specifically that a 'master_key' is missing, causing the proxy to default to a permissive mode where every request is treated as having administrative privileges.
Page 592 of 756