Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,531 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects anomalous process spawning behavior initiated by Python interpreters (pip/conda) on machine learning developer or training hosts, which may indicate a supply chain compromise where a malicious package executes code during or shortly after installation.
Detects the execution of the Windows FTP client (ftp.exe) using command-line arguments that include scripts (-s:), initiated by unconventional parent processes such as explorer.exe or cmd.exe. This behavior is often associated with the execution of automated FTP scripts for data exfiltration or malware delivery.
Detects a specific sandbox/analysis evasion pattern associated with the QUICAgent malware, which involves a tight hashing loop and a randomized 100-600ms delay occurring between process initiation and the first outbound network connection.
Detects file creation, renaming, or deletion events within the Recycle Bin directory involving suspicious filenames or PDF files, which may indicate an adversary attempting to hide, stage, or delete evidence.
This rule monitors for suspicious network traffic to SMTP services and specific external email addresses, as well as process command lines containing these indicators. Additionally, it tracks email events involving specific sender, recipient, and subject indicators which may be indicative of unauthorized communication or data exfiltration attempts.
Detects instances where an AI agent or LLM invokes a high-privilege or sensitive tool (such as code execution, outbound HTTP, or credential store access) immediately following a prompt that exhibits characteristics of prompt injection or jailbreaking. This behavior matches MITRE ATLAS pattern AML.T0053, suggesting an attempt to use the AI agent as a pivot or execution vehicle for unauthorized actions.
Detects potential indirect prompt injection attacks against a Large Language Model (LLM) where untrusted context (e.g., RAG-retrieved documents, web content, or tool outputs) containing instruction-override or persona-switch keywords is ingested. This is followed by the LLM performing an anomalous privileged tool call within the same session, indicating a possible compromise of agent autonomy or unauthorized action execution.
Detects attempts to trigger a poisoned machine learning model through anomalous inference requests. The rule identifies inference API calls flagged as statistically anomalous by an upstream detector (e.g., unusual pixel patterns, token sequences, or steganographic payloads) that are correlated with a specific, spike-related output class across multiple distinct users.
Detects potential LLM jailbreak attempts by identifying a high frequency of guardrail-blocked responses followed by user prompts containing known jailbreak strategy fingerprints (such as roleplay, persona switching, or instruction overrides) within a 15-minute window.
This rule detects potential cost harvesting or unauthorized resource abuse by monitoring API endpoints (typically AI model gateways) for high-volume or resource-intensive queries associated with a specific identity. It correlates these patterns with billing or autoscaling trigger events (e.g., cost spikes, quota exhaustion) and identifies agentic sessions that exhibit abnormally long reasoning loops, which suggests an attempt to waste computational budget.
Page 288 of 1168