Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,054 copies47 likes38,395 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the spawning of script interpreters or loaders by Visual Studio Code (Code.exe) shortly after a workspace is initialized, specifically looking for command-line arguments referencing .vscode or tasks.json. This behavior is consistent with exploitation techniques where a user accepts a 'Trust Workspace' prompt, allowing malicious tasks defined in a repository's .vscode folder to execute.
Detects anomalous high-volume API requests to machine learning model inference endpoints (e.g., predict, classify, score). This behavior is characteristic of adversarial example crafting, where an attacker sends rapid, near-duplicate requests to estimate gradients or probe confidence scores to manipulate model output.
This rule detects unauthorized or anomalous file modifications or creations to machine learning training datasets (e.g., fine-tuning data, training corpora) by users not belonging to the authorized data engineering group, occurring within one hour of a scheduled training or fine-tuning job execution. This behavioral pattern is indicative of potential data poisoning, where an adversary attempts to inject malicious data into the training set to bias or compromise the resulting model.
Detects malicious instruction-override payloads, hidden HTML comments, or obscured text (e.g., zero-font size) in third-party content ingested into LLM/RAG systems, commonly used for indirect prompt injection.
Detects unauthorized or suspicious modifications to machine learning model artifacts within a model registry or deployment pipeline. The rule triggers on detected checksum mismatches, bypassed security/approval workflows, or significant, anomalous deviations in model file size compared to previous versions, which are common indicators of malicious tampering (AML.T0018).
Detects potential ML model-stealing attacks against inference API endpoints. The rule identifies anomalous behavior characterized by an extremely high volume of diverse queries from a single API key over a 24-hour period. Such patterns are consistent with systematic decision-boundary probing or input-space coverage attempts used for training a replica model (distillation or knockoff attacks) without direct access to model weights.
Detects systematic and high-frequency probing of internet-exposed LLM chatbot or API gateway endpoints. The rule monitors for sequences of requests, use of known prompt-infiltration or jailbreak testing toolkits, and varied path access indicative of automated reconnaissance or adversarial prompt engineering attempts.
This rule detects modifications to critical AI agent configurations—such as system prompts, tool allowlists, permission scopes, or model parameters—by users who are not part of the authorized 'agent-ops' group. It flags potentially high-risk changes, particularly when those changes fall outside established maintenance windows or involve an expansion of agent permissions.
Detects suspicious AI inference API activity indicative of credential compromise or misuse. The rule identifies three main signals: rapid authentication failures (credential stuffing), anomalous geolocation/ASN usage for successful requests, and successful API calls occurring after a key rotation event.
Detects attempts to bypass LLM safety guardrails and system instructions via malicious user prompts containing injection phrases or privilege escalation keywords, which could lead to unauthorized tool execution or sensitive data disclosure.
Page 103 of 1168