----------------
🛠️ Tool
===================
AI/ML DFIR Detection Pack: open detection rules for AI attack surfaces
This repository collects Sigma, YARA, and Suricata signatures for detecting compromise of LLM applications, MCP servers, ML supply chains, AI infrastructure, AI-powered insider threats, and RAG/vector database attacks. The design decision that separates it from most existing AI detection content is the open-formats-only approach: no vendor-specific query languages, no proprietary field schemas. Rules deploy in any modern detection stack via pySigma backends.
Key features
• Nine threat categories: 01-llm-prompt-injection (direct, indirect, jailbreaks), 02-mcp-attacks (tool poisoning, config tampering, rug pulls), 03-model-supply-chain (pickle exploits, HuggingFace, dependency confusion), 04-ai-infrastructure (ShadowRay, Triton, MLflow, GPU abuse), 05-copilot-assistant-abuse (M365 Copilot, GitHub Copilot, Claude, Cursor), 06-rag-vector-db (vector DB exposure, RAG poisoning), 07-runtime-ai-malware (malware calling an LLM API at runtime), 08-agentic-orchestration (agent-as-operator, AI service API as C2), and 09-agent-memory-forensics (memory as persistence, context poisoning).
• Collectors for read-only acquisition with chain of custody, response playbooks in CACAO v2.0 format, a machine-readable artifact catalog, and tests with sample events.
• MAPPINGS.md cross-references MITRE ATLAS and OWASP, and the investigation guide at docs/ai-dfir-investigation-guide.md adds attack background, forensic artifacts, Mermaid attack-chain diagrams, and hands-on procedures.
Technical implementation
Sigma rules (.yml) target generic log-based detection. The documented quick start for Elastic/Kibana:
pip install sigma-cli pysigma-backend-elasticsearch
sigma convert -t lucene --without-pipeline ai-dfir-toolkit//*.yml > ai-dfir-toolkit.lu
YARA rules (.yar) cover file and memory artifacts, where pickle deserialization payloads and tampered desktop assistant configs live. Suricata rules (.rules) handle network detections, with a Snort-compatible subset and Zeek via translation.
The coverage map matches four surfaces the author names explicitly: endpoint (Claude Desktop, Cursor, Copilot config tampering), cloud SaaS logs (Bedrock, Azure OpenAI, M365 Copilot), network (vector DB exfiltration, model exfiltration, ShadowRay C2), and file artifacts (poisoned pickle models, malicious MCP configs).
Use cases
• Detection engineering teams extending a Sigma-based stack with AI attack coverage.
• DFIR responders planning investigations of assistant config tampering, MCP tool poisoning, or ShadowRay incidents.
• Threat research correlating AI attack patterns against ATLAS and OWASP LLM mappings.
Limitations
The disclaimer deserves a read before treating this as field-tested defense. It is an independent personal project with no employer affiliation, and the research is built from public sources only: published CVEs, vendor advisories, academic papers. Rules derive from what is documented, not from incident observations, so per-category maturity will vary. The rules were not independently tested for this writeup, which makes running the bundled test events a sensible first step before production rollout. The browsable site rebuilds from the repository on every push, which prevents documentation drift but says nothing about rule efficacy.
References
Site: depalmar.github.io/ai-dfir-toolkit (rebuilt from the repository on each push). Investigation guide path: docs/ai-dfir-investigation-guide.md. License: Apache 2.0, contributions open.
🔹 tool #DFIR #Sigma #YARA #Suricata
🔗 Source: https://github.com/depalmar/ai-dfir-toolkit