Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,456
11,839
5,876
5,155
4,865
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
This rule detects scenarios where an AI agent executes shell commands or system-level tools immediately after receiving a prompt injection attack from an untrusted source. It correlates agent audit logs—specifically identifying tool calls flagged for prompt injection—with actual endpoint process creation events. It flags process execution as 'High' severity if the command line matches common malicious patterns like encoded commands, IEX, or attempts to access credential material (e.g., lsass, mimikatz).
This rule detects illicit OAuth consent grant events where an application is granted high-risk delegated permissions. This behavior is indicative of consent phishing or 'ConsentFix' tradecraft, where attackers trick users into granting permissions to a malicious application, thereby enabling unauthorized access to mail and file data.
This rule detects illicit OAuth consent grant events where an application is granted high-risk delegated permissions. This behavior is indicative of consent phishing or 'ConsentFix' tradecraft, where attackers trick users into granting permissions to a malicious application, thereby enabling unauthorized access to mail and file data.
Detects the use of specific malicious versions (v2.2.1) of GitHub Actions (actions-cool/issues-helper or actions-cool/maintain-one-comment) in workflow runs that also involve the exposure or referencing of the GITHUB_TOKEN, indicating potential credential theft and CI/CD pipeline compromise.
Detects the presence of specific .NET deserialization gadget chain components (ExpandedWrapper, XamlServices, ObjectDataProvider, LosFormatter) within application traffic or logs, which are indicative of exploitation attempts targeting SharePoint pre-authentication remote code execution vulnerabilities like CVE-2026-65660.
Detects anomalous, high-volume, low-severity events flagged for human review originating from a single AI agent or source within a 10-minute window. This behavior is indicative of an adversary flooding the human-in-the-loop (HITL) review queue with chaff data (noise) to exhaust analyst capacity or conceal malicious activity.
This rule detects potential AI model training data poisoning attempts by monitoring data pipeline audit logs for suspicious activities. Specifically, it flags bulk modifications to production training sets, ingestion from newly introduced external sources, or failures in data integrity checksums, which are indicative of attempts to influence or corrupt machine learning model training pipelines.
Detects unauthorized or anomalous write operations (upsert/insert) to a vector database, which could indicate a Retrieval-Augmented Generation (RAG) injection attack. The rule monitors for writes from non-sanctioned identities, operations outside of established maintenance or ingestion windows, or entries that lack necessary provenance metadata such as source document IDs or content hashes.
This rule detects potential Training Data Poisoning (AML.T0020) by monitoring for anomalous activities in ML data pipelines. It triggers when ingestion jobs utilize untrusted sources, unregistered source paths, unauthorized accounts write to datasets, or when significant data volume bursts or schema/checksum drifts occur immediately prior to a scheduled training run.
Detects instances where an LLM agent initiates sensitive or out-of-sandbox tool calls (such as file system access or arbitrary command execution) following input that contains suspicious directive-override or prompt injection patterns. This behavior indicates that the agent has been compromised by a prompt injection attack, allowing an unauthorized actor to control the agent's tool-calling capabilities.
Detects Cost Harvesting activity (AML.T0034) targeting ML inference services, characterized by a significant spike in request volume or compute consumption coupled with low payload uniqueness. This behavior suggests an adversary is intentionally driving up billing costs by submitting redundant or low-value requests to the API.
Detects potential Denial of ML Service (DoMLs) attacks targeting inference endpoints. The rule identifies anomalous behavior characterized by large request payloads (oversized requests) correlated with increased latency or high GPU utilization, suggesting an attempt to exhaust compute resources and impact model availability.
Detects Large Language Model (LLM) responses that contain instructions designed to propagate the current prompt to other users, systems, or agents. This pattern is indicative of a self-replicating prompt worm, which aims to spread malicious instructions across an AI ecosystem by leveraging the model's ability to generate text that instructs subsequent interactions.
Detects instances where an AI agent or LLM invokes a high-privilege or sensitive tool (such as code execution, outbound HTTP, or credential store access) immediately following a prompt that exhibits characteristics of prompt injection or jailbreaking. This behavior matches MITRE ATLAS pattern AML.T0053, suggesting an attempt to use the AI agent as a pivot or execution vehicle for unauthorized actions.
Detects the registration of the 'gitlab-runner' Windows Event Log provider on hosts that are not recognized as legitimate CI/CD build servers. This can indicate unauthorized installation of GitLab runner agents or persistence mechanisms leveraging service-related event logging.
Detects potential Business Email Compromise (BEC) fraud involving AI voice-cloning. The rule correlates external or unrecognized Microsoft Teams activity (calls/chats) directed at finance users with high-value financial transactions or vendor bank detail updates occurring on the same day, specifically when these transactions lack evidence of legitimate out-of-band or second-approver verification.
Detects instances where an AI agent's persistent memory store is updated with suspicious content (e.g., prompt injection, role overrides, or embedded credentials) by a user other than the authorized agent owner, followed by subsequent tool invocations in an independent session. This behavior aligns with prompt injection attacks aimed at manipulating agent logic and unauthorized resource access via the AI agent.
Detects malicious prompt injection attempts within an LLM conversation session. The rule monitors for ingested content containing common instruction-override keywords (e.g., 'ignore previous instructions', 'system prompt override'), followed immediately by the agent process executing unauthorized actions such as process launch, network connections, or file creation within the same session/user context.
Detects the use of 'COPY TO PROGRAM' syntax within Cisco Email Security Appliance (ESA) logs. This pattern is indicative of potential command injection or OS command execution attempts often associated with exploitation of database-related functionalities, specifically targeting Cisco ESA management or backend interfaces.
Detects malicious prompt injection attempts within an LLM conversation session. The rule monitors for ingested content containing common instruction-override keywords (e.g., 'ignore previous instructions', 'system prompt override'), followed immediately by the agent process executing unauthorized actions such as process launch, network connections, or file creation within the same session/user context.
This rule detects potential prompt injection attacks against internal AI-powered assistants, agents, or LLM gateways. It monitors network HTTP requests for common patterns used to override system instructions, bypass safety filters, or force the model to adopt a privileged, unauthorized persona (e.g., administrator or debug mode). These techniques are often used in social engineering to manipulate the AI's output or security posture.
Page 18 of 83