Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,331 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects adversarial prompts designed to induce an Large Language Model (LLM) to disclose sensitive information, such as PII, secrets, or internal training data. This rule monitors the input prompt for extraction-based patterns and evaluates the model's response for indicators of a sensitive data leak (DLP hit).
Detects attempts to perform a Denial of Service (DoS) attack against an AI-enabled system by flooding the inference API with high volumes of requests or overly large inputs (high token counts). The rule identifies potential resource exhaustion by correlating high request rates or large input sizes with system-wide impacts, such as increased inference queue depth or excessive GPU utilization, which could impede service availability for other users.
This rule detects attempts to bypass LLM safety guardrails using adversarial prompting techniques (e.g., 'DAN' persona, hypothetical scenarios) or by identifying patterns of repeated moderation flags and refusals. It specifically looks for user prompts containing known jailbreak templates or an excessive frequency of safety-related trigger events, while excluding authorized red-team and safety evaluation accounts.
Detects evidence of indirect prompt injection attacks where an adversary introduces malicious instructions into data sources retrieved by an LLM or agent. The rule identifies common obfuscation and override techniques, including the use of zero-width characters, HTML comments for prompt breaking, base64 encoded instruction verbs, and specific override phrases within retrieved documents or tool outputs.
Detects unauthorized or anomalous modifications to machine learning model checkpoints. The rule triggers on significant deviations in weight delta percentages outside of scheduled fine-tuning windows, or when a model checkpoint hash is altered by users or service accounts without corresponding CI/CD pipeline approval or documented code review.
Detects suspicious AI agent behavior by identifying two primary scenarios: 1) The invocation of sensitive tools (e.g., code execution, file deletion) within a short timeframe following a flagged prompt injection or jailbreak attempt in the same conversation; or 2) The invocation of a tool by an AI agent that is not explicitly defined in its allowed tool list for the given workflow.
This rule monitors package installation logs for indicators of packages potentially generated or suggested by AI tools (e.g., Copilot, code assistants) being installed in a target environment. It specifically looks for a low volume of installations (<=3) for packages that have been published within the last 14 days, which is a pattern often associated with the 'Publish Hallucinated Entities' technique in AI systems, where malicious or hallucinated code packages are introduced into the supply chain.
Detects the execution of suspicious child processes (e.g., cmd.exe, powershell.exe, bash, wget) spawned by processes associated with public-facing appliances like Fortinet SSL-VPN, Veeam Backup & Replication, Citrix ADC, and cPanel/WHM. This behavior is often indicative of exploitation of public-facing applications (T1190) for initial access, frequently associated with ransomware actors targeting unpatched infrastructure.
This rule detects various process injection techniques (such as CreateRemoteThread, QueueUserAPC, and remote memory writes) initiated by external processes targeting high-value, commonly abused Windows system processes like svchost.exe, lsass.exe, and explorer.exe. These techniques are often used by ransomware and other malware to hide malicious code execution within trusted system memory space.
This rule detects potential lateral movement by identifying processes spawned via WMI (e.g., wmic.exe, WmiPrvSE.exe) or PowerShell Remoting (WinRM, Invoke-Command, Enter-PSSession) that occur shortly after a successful network or remote interactive logon on the same host.
Page 60 of 1168