Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,116 copies47 likes38,555 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects anomalous query patterns against an AI inference API, characteristic of a membership inference attack. The rule identifies callers submitting a high volume of near-duplicate or minimally-perturbed inputs while requesting raw confidence scores, suggesting an attempt to probe the model to determine if specific data points were used in its training set.
Detects sustained, statistically significant degradation in AI model performance (confidence and accuracy) and anomalous drift scores associated with specific callers or input sources. This behavior suggests a targeted attempt to erode model integrity through adversarial inputs rather than organic data drift.
Detects attempts to perform prompt injection or meta-prompt probing against an LLM gateway to extract confidential system instructions, as well as instances where the LLM response echoes sensitive system-level boilerplate consistent with a successful prompt extraction attack.
Detects attempts to perform prompt injection or meta-prompt probing against an LLM gateway to extract confidential system instructions, as well as instances where the LLM response echoes sensitive system-level boilerplate consistent with a successful prompt extraction attack.
Detects anomalous high-frequency requests to machine learning model endpoints from a single client, a pattern indicative of model extraction (stealing) attacks. This rule monitors inference request paths and success statuses to identify potential systematic input-space probing.
Detects attempts to evade machine learning model classifications by crafting adversarial perturbations against an inference endpoint. The rule identifies suspicious patterns, including a high volume of near-identical inputs from a single client resulting in confidence scores near the model's decision boundary, which is indicative of an automated optimization loop searching for an adversarial evasion attack (MITRE ATLAS T0043).
This rule monitors for potential exploitation of AI supply chain vulnerabilities, specifically targeting AML.T0058 (Publish Poisoned Models). It identifies the download of suspicious model artifact files (e.g., .pt, .pkl, .h5, .onnx) via common tools like curl, wget, or pip, and detects the subsequent insecure deserialization of these files using Python's pickle library when dangerous opcodes (REDUCE/GLOBAL) are combined with system command execution primitives (os.system, subprocess).
Detects Large Language Model (LLM) responses that contain sensitive information such as PII, internal proprietary markers, or credentials. This rule monitors model output for patterns matching social security numbers, credit card numbers, private keys, API keys, and internal company confidentiality labels, which could indicate data leakage or unintended disclosure.
Detects anomalous high-volume API requests from a single user/key to AI model inference endpoints. The rule tracks query diversity and total volume within an hour to identify behavior consistent with model extraction or cloning (AML.T0024.002) via systematic input/output pair collection.
Detects anomalous high-frequency queries to machine learning model inference endpoints involving probability or confidence score outputs. This behavior is indicative of a membership inference attack, where an adversary attempts to determine if specific data samples were included in a model's training set by harvesting confidence scores.
Page 406 of 1168