Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,534 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects anomalous, high-frequency enumeration of AI/ML assets such as model registries, container image repositories, and training data buckets. This activity is indicative of reconnaissance for AI supply chain attacks, specifically tracking with MITRE ATLAS AML.T0007 (Discover AI Artifacts), where an actor probes infrastructure to identify targets for model theft, data poisoning, or unauthorized access.
Detects a sudden, anomalous spike in low-confidence actions or pending reviews originating from a single source within an AI agent action queue. This activity is indicative of a 'chaff' flooding attack, where an adversary submits a high volume of low-quality or irrelevant requests to overwhelm human-in-the-loop review systems, potentially causing a denial-of-service or masking malicious activity.
Detects potential Denial of Service (DoS) against AI/LLM inference endpoints. It monitors for high-frequency request spikes or abnormally large request payloads (oversized context windows) directed at common model endpoints that could lead to disproportionate compute resource consumption.
Detects anomalous usage patterns for AI-platform API keys consistent with account takeover, specifically identifying concurrent multi-geographic access and the exercise of elevated administrative, write, or model-registry scopes within a short timeframe.
Detects anomalous, unauthorized access to machine learning model artifacts (e.g., .onnx, .pt, .h5) within object storage or model registries. The rule identifies suspicious patterns including high-volume file reads by non-ML team identities, lack of multi-factor authentication, or access from geolocations outside approved operating regions, indicative of potential model exfiltration or intellectual property theft.
Detects the execution of PowerShell with execution policy bypass flags that simultaneously attempts to use curl.exe and Copy-Item to interact with suspicious remote domains or obfuscated command line arguments, potentially indicating a malicious payload delivery and staging attempt.
This rule detects the use of xcopy.exe with a specific set of flags (/s, /e, /y, /c, /q, /h, /b) typically used for recursive, forced, and quiet file copying, when executed from a path matching 'C:\Users\Public\[A-Za-z0-9]+'. This behavior is often associated with adversaries staging data for exfiltration or moving lateral movement tools within a compromise directory.
Detects the registration of the 'gitlab-runner' Windows Event Log provider on hosts that are not recognized as legitimate CI/CD build servers. This can indicate unauthorized installation of GitLab runner agents or persistence mechanisms leveraging service-related event logging.
Detects anomalous PowerShell script execution originating from GitLab CI runners where the environment variables suggest unauthorized command execution, specifically identifying usage of 'IEX' to execute commands passed via the 'CMD' environment variable, often used in GitRunner C2 techniques.
Detects network traffic (DNS queries, TLS SNI, and HTTP Host headers) associated with the known TukTuk C2 infrastructure domain 'borjumaniya.store'.
Page 289 of 1168