Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,065 copies47 likes38,444 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects LLM input containing known instruction-override patterns (e.g., 'ignore previous instructions', 'DAN' jailbreak) paired with requests for privileged system operations, indicating a malicious attempt to bypass guardrails and gain unauthorized control over the LLM model.
Detects LLM input containing known instruction-override patterns (e.g., 'ignore previous instructions', 'DAN' jailbreak) paired with requests for privileged system operations, indicating a malicious attempt to bypass guardrails and gain unauthorized control over the LLM model.
Detects high-volume outbound transfers of sensitive machine learning artifacts, such as model files, training datasets, and model registries, to unauthorized external destinations like personal email or unmanaged cloud storage. This behavior is indicative of potential intellectual property theft.
Detects anomalous access patterns to machine learning model inference endpoints, including unauthorized access attempts such as credential failures, scope violations, and quota exhaustion, indicating potential misuse or compromise of private model APIs.
Detects potential poisoning of machine learning training data by identifying unauthorized file modifications to datasets, DVC repositories, or model registries that occur outside of authorized ETL or CI/CD windows.
This rule detects potential AI/ML supply chain compromise by monitoring for package installations (via pip, conda, poetry, etc.) from non-standard repositories, direct URLs, or version control systems within data science and CI/CD pipelines (e.g., Jupyter, Airflow, Jenkins). It further correlates this activity with subsequent suspicious outbound network connections from the host, which is indicative of slopsquatting or malicious dependency execution.
Detects anomalous, exploratory query patterns by an API key or service account against an AI model inference API. High distinct resource access volume in a short timeframe, potentially combined with off-hours activity, indicates reconnaissance phases such as output-ontology or model-family enumeration, which may precede adversarial-example crafting or verification attempts.
Detects a sequence of potentially malicious activity involving the bulk reading or downloading of sensitive AI-related artifacts (model files, datasets), followed by the staging of these files into a compressed archive, and finally an outbound network transfer to an external IP address. This behavior pattern is indicative of data exfiltration of intellectual property.
Detects potential adversarial machine learning attacks by monitoring for a concentration of input requests flagged with known adversarial patterns that result in statistically significant degradation of inference confidence scores for a specific ML model endpoint.
This rule detects a multi-stage attack correlation where a user receives multiple inbound emails flagged for high likelihood of being LLM-generated (and containing urgency/credential-harvesting language) and subsequently performs a voice or video authentication attempt that is flagged by deepfake detection systems with a low confidence score, indicating a potential impersonation attempt.
Page 198 of 1168