Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,431 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects attempts to inject code into an AI agent orchestrator process by monitoring for suspicious CreateRemoteThread events. This rule is designed to identify potential process hijacking attacks by malicious actors seeking to bypass application-layer controls, while excluding common legitimate security monitoring tools that may exhibit similar behavior.
Detects anomalous AI agent behavior where the agent ingests untrusted external content (e.g., tool outputs, RAG retrievals, or web fetches) and subsequently invokes high-risk or sensitive capabilities (such as shell execution, secret reading, or unauthorized network calls) within the same session. This pattern is indicative of an indirect prompt injection attack attempting to leverage the agent's internal tool-calling mechanisms for unauthorized actions.
Detects attempts to disable Windows Defender features via PowerShell, terminate critical security services using administrative tools like sc.exe or net.exe, or inject/patch AMSI (Antimalware Scan Interface) within a process context to evade detection.
Detects unauthorized or suspicious modifications to AI model artifacts, including fine-tuned weights and LoRA adapters. This rule identifies tampering attempts via unsigned uploads, bypassing CI/CD production deployment approvals, or mismatches in hash/checksum compared to known-good versions.
Detects an AI agent identity accessing an unusually high number of distinct internal repositories, such as wikis, ticketing systems, code repositories, or customer data stores within a 15-minute window. This behavior is consistent with automated discovery or collection (T1213) by an AI agent.
Detects the presence of a specific, hardcoded Ed25519 public key associated with malicious cross-platform payloads (npm, Go modules, Terraform providers) that use Slack for C2 communication.
Detects AI agents attempting to disable or bypass security guardrails, approval gates, or content filters. Additionally, it identifies high-risk or destructive actions taken by an AI agent that lack the required preceding human-approval audit record.
Detects anomalous behavior by an AI agent identity by monitoring for off-hours activity, significant statistical spikes in task invocation volumes compared to a 30-day baseline, or the execution of task categories not previously associated with that specific agent. Such behaviors may indicate account hijacking or unauthorized command injection.
Detects potential poisoning of an AI agent's RAG knowledge base or vector store through suspicious bulk ingestion or injection of imperative instruction-style content. The rule correlates these ingestion events with subsequent anomalous tool usage patterns by the same agent session, indicating a possible prompt injection or data manipulation attack aimed at altering agent behavior.
Detects the Graphalgo Go-based remote access trojan (RAT) sending an initial system report containing device and user information to the Slack API. This activity occurs during the initial check-in phase before establishing a primary command and control channel.
Page 192 of 1168