Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,534 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects the execution of a specific Visual Basic script named 'Telegram_Private_Call_Session.vbs' by Windows scripting utilities (wscript.exe, cscript.exe) or the Microsoft HTML Application host (mshta.exe). This pattern is often associated with the execution of malicious scripts disguised as legitimate communication application components.
Detects the execution of PowerShell with obfuscation-related flags (-NoProfile, -WindowStyle Hidden, -EncodedCommand) initiated by common scripting interpreters (wscript.exe, mshta.exe, cscript.exe). This pattern is often indicative of malicious scripts, such as HTA or VBScript files, attempting to execute encoded PowerShell commands in a high-privilege context.
Detects attempts to disable PowerShell Script Block Logging via registry modification or by using the Set-ItemProperty command. Disabling this security feature prevents visibility into the actual contents of executed PowerShell scripts, which is a common tactic used by adversaries to evade detection.
Detects adversarial attempts to poison Retrieval-Augmented Generation (RAG) knowledge bases. This includes the ingestion of documents containing prompt injection directives (e.g., 'ignore previous instructions'), hidden malicious markup intended to manipulate LLM inference, unauthenticated data ingestion, or abnormal volume spikes from a single source.
Detects unauthorized or anomalous write operations (upsert/insert) to a vector database, which could indicate a Retrieval-Augmented Generation (RAG) injection attack. The rule monitors for writes from non-sanctioned identities, operations outside of established maintenance or ingestion windows, or entries that lack necessary provenance metadata such as source document IDs or content hashes.
This rule detects potential Training Data Poisoning (AML.T0020) by monitoring for anomalous activities in ML data pipelines. It triggers when ingestion jobs utilize untrusted sources, unregistered source paths, unauthorized accounts write to datasets, or when significant data volume bursts or schema/checksum drifts occur immediately prior to a scheduled training run.
Detects instances where an LLM agent initiates sensitive or out-of-sandbox tool calls (such as file system access or arbitrary command execution) following input that contains suspicious directive-override or prompt injection patterns. This behavior indicates that the agent has been compromised by a prompt injection attack, allowing an unauthorized actor to control the agent's tool-calling capabilities.
Detects Cost Harvesting activity (AML.T0034) targeting ML inference services, characterized by a significant spike in request volume or compute consumption coupled with low payload uniqueness. This behavior suggests an adversary is intentionally driving up billing costs by submitting redundant or low-value requests to the API.
Detects potential Denial of ML Service (DoMLs) attacks targeting inference endpoints. The rule identifies anomalous behavior characterized by large request payloads (oversized requests) correlated with increased latency or high GPU utilization, suggesting an attempt to exhaust compute resources and impact model availability.
Detects Large Language Model (LLM) responses that contain instructions designed to propagate the current prompt to other users, systems, or agents. This pattern is indicative of a self-replicating prompt worm, which aims to spread malicious instructions across an AI ecosystem by leveraging the model's ability to generate text that instructs subsequent interactions.
Page 287 of 1168