Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers159 downloads2,514 copies56 likes67,916 views
245 detections
Filters
Last updated
All Time
Detection languages
245
Categories
73
66
54
29
29
Platforms
83
58
36
26
24
Products / Services
35
26
23
21
19
MITRE Techniques
79
70
46
44
42
CVEs
4
4
Detects enumeration of Google Cloud Vertex AI models and endpoints by monitoring management-plane API calls such as ListModels, ListEndpoints, GetModel, GetEndpoint, and ListDeploymentResourcePools. Attackers often enumerate available AI models and endpoints for LLMjacking or unauthorized usage before invoking them.
Detects high-volume Exchange and SharePoint activity from a single identity where the source originates from hosted or datacenter infrastructure, residential proxies, or scripting user agents, indicative of automated bulk data exfiltration by threat actors like Helix.
Detects indicators of compromise associated with a trojanized Claude Code VS Code extension distributed through Cursor's marketplace. The rule identifies file modifications to authorized_keys, process executions establishing reverse SSH tunnels, specific hardcoded C2 IP addresses, and references to the attacker's SSH key 'svc-telemetry'.
Detects the creation, modification, enabling, or removal of Microsoft Exchange transport rules. Transport rules operate at the organization level, allowing attackers with administrative privileges to create rules that redirect, copy, or delete mail across the entire organization.
Detects the LLMjacking kill chain in GCP Vertex AI by correlating model enumeration, probing, and execution phases from a single identity.
Detects persistence mechanisms installed by the trojanized Claude Code extension on Cursor or Node-based applications. On macOS, it detects the creation of LaunchAgent property list files. On Windows, it detects scheduled tasks created via schtasks.exe or event logs, and modifications to the Startup folder.
Detects the deletion or movement to deleted items of emails containing security-related keywords such as MFA, sign-in alerts, password resets, or security notifications. This behavior indicates potential anti-forensics or defense evasion tactics by an attacker attempting to hide evidence or buy time.
Detects SharePoint search queries using content class parameters (STS_Site or STS_Web) combined with wildcard patterns to discover and inventory all reachable SharePoint sites and content.
Detects a single principal making a high volume of model invocation calls in GCP Vertex AI. This pattern is indicative of LLMjacking where attackers run inference at scale to monetize compromised cloud credentials.
Detects Vertex AI model invocations such as GenerateContent, Predict, and RawPredict originating from common scripting user agents (e.g., Python requests, curl, Wget), which can indicate potential LLM jacking or unauthorized resource consumption.
Page 1 of 25