Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
22 detections
Filters
Last updated
All Time
Detection languages
22
Contributors
16
4
2
Categories
18
10
8
4
4
Platforms
15
5
3
3
2
Products / Services
7
6
4
2
1
MITRE Techniques
10
6
5
5
5
CVEs
71
71
64
58
49
20
Detects application log patterns indicative of a memory leak exploitation attempt against vLLM using the Python Imaging Library (PIL). This behavior is associated with an ASLR bypass technique leveraging BytesIO object manipulation, a prerequisite for a subsequent heap overflow vulnerability.
Detects the spawning of unexpected child processes such as shell interpreters, download tools, or package managers from vLLM Python serving processes. This activity could indicate a successful exploitation of a vulnerability like CVE-2026-22778, leading to remote code execution through a function pointer overwrite.
Detects POST requests to vLLM multimodal inference endpoints that contain 'video_url' fields pointing to external resources or specific video file extensions (.jp2, .mov, .mp4). This activity is indicative of exploitation attempts related to CVE-2026-22778, where an attacker might try to inject malicious video URLs to trigger vulnerabilities in the vLLM service.
This rule detects two stages of a potential exploitation chain targeting vLLM multimodal endpoints. Stage 1 identifies POST requests to vLLM API endpoints that contain 'video_url' in the request context, which could indicate an attempt to exploit CVE-2026-22778. Stage 2 detects post-exploitation activity by looking for unexpected child processes (like shell interpreters or download utilities) spawned from vLLM or Python inference processes, suggesting successful remote code execution.
Detects unexpected child processes (e.g., shell, Python, network utilities) spawned from vLLM or Python worker processes, or suspicious file/network activity related to vLLM/Python processes. This rule aims to identify potential exploitation of CVE-2026-22778, an FFmpeg JPEG2000 heap overflow vulnerability, which could lead to arbitrary code execution within AI/ML environments.
Detects repeated restarts of vLLM pods (due to OOMKilled, CrashLoopBackOff, or other failure reasons) that are correlated with a burst of multimodal requests. This pattern can indicate a denial-of-service attack, resource exhaustion, or exploitation of vulnerabilities (such as CVE-2026-22778) targeting the vLLM service, potentially leading to service instability or compromise.
Detects responses from vLLM (or similar services) that leak a Python Imaging Library (PIL)/Pillow heap address through BytesIO exception text. This indicates Stage 1 of the CVE-2026-22778 ASLR bypass vulnerability, where memory addresses are exposed, which could be used by an attacker to bypass Address Space Layout Randomization (ASLR). The rule looks for specific error messages containing '_io.BytesIO object at 0x' followed by a hexadecimal address.
Detects the Python Imaging Library (PIL) memory leak used to bypass ASLR prior to the JPEG2000 heap overflow. This KQL query specifically looks for syslog messages containing 'cannot identify image file' and 'BytesIO object at 0x', which are indicators of this specific memory leak vulnerability being triggered.
Detects vLLM processes spawning Windows shells (cmd.exe, powershell.exe, pwsh.exe) if hosted in a Windows context, indicating potential exploitation of CVE-2026-22778 for remote code execution.
Detects segmentation faults or memory corruption crashes in vLLM components associated with media decoding, indicated by specific keywords in syslog messages. This rule aims to identify potential exploitation attempts related to CVE-2026-22778.
Detects POST requests to vLLM multimodal inference endpoints that contain 'video_url' fields pointing to external resources or specific video file extensions (.jp2, .mov, .mp4). This activity is indicative of exploitation attempts related to CVE-2026-22778, where an attacker might try to inject malicious video URLs to trigger vulnerabilities in the vLLM service.
Detects the presence of PIL exception messages in application logs that leak heap memory addresses. This is the first stage of the CVE-2026-22778 exploitation chain against vLLM instances used to bypass ASLR.
Detects vLLM processes spawning common reverse shell binaries, indicating potential exploitation of CVE-2026-22778.
Detects vLLM establishing outbound network connections to fetch external media files (e.g., .mov, .mp4, .jp2) from non-private IP addresses. This activity may indicate exploitation of CVE-2026-22778, allowing for remote code execution by fetching malicious content.
Detects vLLM performing unauthorized system reconnaissance by executing common system information discovery commands such as 'whoami', 'id', 'uname', 'hostname', 'ifconfig', and 'ip'. This activity is indicative of an attacker attempting to gather information about the compromised system.
Monitors web or API gateway logs for POST requests directed at vulnerable vLLM multimodal endpoints containing the 'video_url' parameter. This is the entry point for the CVE-2026-22778 exploit chain.
Detects unexpected shell or command interpreter processes spawned as children of the vLLM or Python worker processes. This behavior strongly indicates a successful Remote Code Execution (RCE) payload, such as a system() call, resulting from the CVE-2026-22778 JPEG2000 heap overflow exploit.
Detects vLLM processes spawning interactive Unix shells, a strong indicator of remote code execution, potentially exploiting CVE-2026-22778.
Detects vLLM executing inline Python commands using the '-c' flag, a common post-exploitation technique. This rule specifically looks for process command lines containing 'vllm' and a Python interpreter (python or python3) executing code via the '-c' flag, which is indicative of inline command execution.
Detects the presence of PIL exception messages in application logs that leak heap memory addresses. This is the first stage of the CVE-2026-22778 exploitation chain against vLLM instances used to bypass ASLR.
Detects vLLM spawning download utilities like curl or wget to pull secondary payloads post-exploitation, potentially indicating a compromise related to CVE-2026-22778.
Page 1 of 2