Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,064 copies47 likes38,439 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects instances where an AI agent tool invocation contains potential credential data (API keys, tokens) followed by a suspicious sign-in or Key Vault access event from an atypical location for that specific identity within a short timeframe. This rule monitors for potential exfiltration or abuse of credentials handled or exposed by AI agents.
Detects execution of package management commands (pip, npm, conda) that attempt to pull packages from registries other than the approved internal repositories. This behavior is indicative of potential AI supply-chain compromise, including malicious packages or namesquatting targeted at machine-learning or LLM-related development workflows.
Detects potential AI model backdoor trigger attempts by identifying inference requests from a single caller that result in high-confidence, rare-label predictions across multiple distinct input artifacts. This pattern is indicative of an adversary probing or activating a poisoned model by injecting specific triggers designed to force anomalous outputs.
Detects unauthorized or unreviewed modifications to AI model weights, retraining jobs, or pushes to the model registry within MLOps pipelines. This activity is monitored to prevent AI model weight poisoning, ensuring that all model-related changes undergo required peer-review or approval processes before deployment.
Detects adversarial evasion attempts against AI-based classification models by identifying inputs that result in a benign or low-risk prediction with confidence scores just below a configured threshold. The detection specifically looks for artifacts that share a hash prefix with previously confirmed malicious samples, indicating a potential iterative perturbation technique used to bypass model boundaries.
Detects external email or chat messages containing markers typical of Large Language Models (LLMs) combined with urgent language soliciting sensitive information, such as credentials or financial details. The rule correlates these findings with messages from domains that have been recently observed in the environment, indicating potential automated, personalized social engineering campaigns.
This rule monitors for suspicious activity related to AI service accounts and API keys. It detects potential account or key compromise by identifying impossible travel sign-ins coupled with AI API usage, simultaneous usage of a single API key from multiple disjoint network locations, and sudden, high-volume activity from previously dormant service account API keys.
Detects instances where machine learning runtime processes (e.g., Python, torch-model-loader) load serialized model files (e.g., .pkl, .joblib, .pth) and subsequently spawn suspicious child processes like command shells, scripting engines, or download utilities. This behavior is indicative of arbitrary code execution via unsafe deserialization of a malicious model artifact.
Detects unauthorized modifications or non-pipeline uploads to an ML model registry. The rule flags events where model artifacts lack valid signatures, fail checksum verification, or are uploaded/promoted by non-authorized identities or without required CI/CD provenance, indicating potential ML model backdooring or poisoning.
Detects potential data exfiltration from ML inference APIs by identifying responses to untrusted clients containing patterns indicative of memorized PII (SSN, Email, Credit Card) or detecting automated, repeated extraction-style queries.
Page 197 of 1168