Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,084 copies47 likes38,471 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects high volumes of near-identical, incrementally-varied queries directed at an AI model API. This behavior is indicative of a black-box adversarial optimization loop, where an attacker attempts to infer model vulnerabilities, bypass safety filters, or perform model evasion by observing how slight input variations change model responses.
Detects LLM jailbreak attempts using a 'crescendo' multi-turn strategy. The rule monitors for sequences where an initial prompt contains known jailbreak-intent keywords leading to an AI refusal, followed shortly by a compliant AI response to a rephrased request within the same conversation session.
This rule detects high volumes of near-identical, incrementally-varied queries directed at an AI model API. This behavior is indicative of a black-box adversarial optimization loop, where an attacker attempts to infer model vulnerabilities, bypass safety filters, or perform model evasion by observing how slight input variations change model responses.
Detects anomalous data ingestion events in a Retrieval-Augmented Generation (RAG) pipeline. The rule flags 'Create' operations performed outside of scheduled batch ingestion jobs by identities that have not previously ingested data into the index. It further filters for ingested content that does not match any known document hashes within the existing corpus, identifying potential unauthorized or malicious document injection.
This rule detects high volumes of near-identical, incrementally-varied queries directed at an AI model API. This behavior is indicative of a black-box adversarial optimization loop, where an attacker attempts to infer model vulnerabilities, bypass safety filters, or perform model evasion by observing how slight input variations change model responses.
Detects anomalous data ingestion events in a Retrieval-Augmented Generation (RAG) pipeline. The rule flags 'Create' operations performed outside of scheduled batch ingestion jobs by identities that have not previously ingested data into the index. It further filters for ingested content that does not match any known document hashes within the existing corpus, identifying potential unauthorized or malicious document injection.
Detects potential training data poisoning attempts by monitoring anomalies in ingestion volume, shifts in label distribution, and high-volume submissions from feedback channels. This rule uses statistical analysis to identify spikes in data input or abnormal distributions that deviate from established historical baselines.
This rule detects potentially malicious activity related to AI agent tool manipulation. It flags two primary scenarios: 1) The invocation of an AI tool shortly after an unmanaged or potentially unauthorized modification to its definition, and 2) Detection of prompt injection patterns within the output generated by an AI agent tool, which could indicate an attacker attempting to override the agent's instructions.
This rule detects potentially malicious activity related to AI agent tool manipulation. It flags two primary scenarios: 1) The invocation of an AI tool shortly after an unmanaged or potentially unauthorized modification to its definition, and 2) Detection of prompt injection patterns within the output generated by an AI agent tool, which could indicate an attacker attempting to override the agent's instructions.
This rule detects anomalous behavior in AI agent tool invocations, specifically monitoring for high volumes of tool calls, high costs associated with token consumption, or suspicious tool interactions following a flagged indirect prompt injection. This behavior is indicative of potential resource exhaustion (denial of service) or abusive agent behavior as defined by the MITRE ATLAS framework for AI security.
Page 225 of 1168