AI/ML攻撃や侵害のためのオープンソース検出シグネチャ。

Sigma、YARA、Suricataのベンダー中立的なルール群で、LLMアプリケーション、MCPサーバー、MLサプライチェーン、AIインフラ、AI搭載の内部脅威、RAG/ベクターデータベース攻撃の侵害を検出するためのコレクションです。

** depalmar.github.io/ai-dfir-toolkit で閲覧してください** — アーティファクトカタログ、検出ルール、ATLAS/OWASPマッピング、ケース 研究、調査ガイドはこのリポジトリから再構築され、すべての ページが内容から離れないようにプッシュします。

攻撃背景、法医学的遺物、マーメイドの攻撃連鎖図、実践的な調査手順を含む補随調査ガイドについては、docs/ai-dfir-investigation-guide.mdを参照してください。

ライセンス:Apache 2.0。

---

免責事項

これは独立した個人プロジェクトです。いかなる雇用主とも提携せず、承認も、または代表して作成もしていません。すべての研究は公開された情報源に基づいており、公開されたCVE、ベンダーのアドバイザリー、学術論文、ベンダー中立のセキュリティ研究などがあります。コミュニティからの貢献を歓迎します。

---

なぜこれが存在するのか

AI/ML DFIR Detection Pack

Open-source detection signatures for AI/ML attacks and breaches.

A vendor-neutral collection of Sigma, YARA, and Suricata rules for detecting compromise of LLM applications, MCP servers, ML supply chains, AI infrastructure, AI-powered insider threats, and RAG/vector database attacks.

Browse it at depalmar.github.io/ai-dfir-toolkit — the artifact catalog, the detection rules, the ATLAS/OWASP mappings, the case studies, and the investigation guide, rebuilt from this repository on every push so the page cannot drift from the content.

For the companion investigation guide with attack background, forensic artifacts, Mermaid attack-chain diagrams, and hands-on investigation procedures, see docs/ai-dfir-investigation-guide.md.

License: Apache 2.0.

---

Disclaimer

This is an independent personal project. It is not affiliated with, endorsed by, or produced on behalf of any employer. All research is based on public sources — published CVEs, vendor advisories, academic papers, and vendor-neutral security research. Contributions are welcome from the community.

---

Why this exists

Most existing detection content is either locked behind vendor SIEMs or scattered across blog posts. AI/ML attacks need detection coverage that spans:

• Endpoint (Claude Desktop / Cursor / Copilot config tampering)
• Cloud SaaS logs (Bedrock, Azure OpenAI, M365 Copilot)
• Network (vector DB exfil, model exfil, ShadowRay C2)
• File artifacts (poisoned pickle models, malicious MCP configs)

This pack uses open standards only so the rules can be deployed in any modern detection stack via open Sigma/YARA/Suricata tooling.

---

Structure

ai-dfir-toolkit/
├── 01-llm-prompt-injection/      # Prompt injection, jailbreaks, indirect injection
├── 02-mcp-attacks/                # MCP tool poisoning, config tampering, rug pulls
├── 03-model-supply-chain/         # Pickle exploits, HuggingFace, dependency confusion
├── 04-ai-infrastructure/          # ShadowRay, Triton, MLflow, GPU abuse
├── 05-copilot-assistant-abuse/    # M365 Copilot, GitHub Copilot, Claude, Cursor
├── 06-rag-vector-db/              # Vector DB exposure, RAG poisoning
├── 07-runtime-ai-malware/         # Malware calling an LLM API at runtime
├── 08-agentic-orchestration/      # Agent-as-operator, AI service API as C2
├── 09-agent-memory-forensics/     # Memory as persistence, context poisoning
├── collectors/                    # Read-only acquisition with chain of custody
├── playbooks/                     # CACAO v2.0 response playbooks
├── artifacts/                     # Machine-readable AI agent artifact catalog
├── skills/                        # Agent skills for maintaining the catalog
├── docs/                          # Investigation guide
├── tests/                         # Sample events / test files