AI/ML 공격 및 침해에 대한 오픈소스 탐지 서명.

LLM 애플리케이션, MCP 서버, 머신러닝 공급망, AI 인프라, AI 기반 내부 위협, RAG/벡터 데이터베이스 공격의 침해 탐지를 위한 Sigma, YARA, Suricata 규칙을 벤더 중립적으로 수집한 컬렉션입니다.

depalmar.github.io/ai-dfir-toolkit 에서 탐색하세요 — 유물 목록, 탐지 규칙, ATLAS/OWASP 매핑, 케이스 연구와 조사 가이드는 이 저장소에서 재구성되어 있습니다. 페이지가 콘텐츠에서 벗어나지 않도록 푸시하세요.

공격 배경, 법의학 유물, 인어 공격 연쇄 도표, 직접 수사 절차가 포함된 동반 수사 가이드는 docs/ai-dfir-investigation-guide.md를 참조하세요.

라이선스: Apache 2.0.

---

면책 조항

이 프로젝트는 독립적인 개인 프로젝트입니다. 어떠한 고용주와도 관련이 없으며, 승인하거나 제작하지 않습니다. 모든 연구는 공개된 출처를 기반으로 합니다 — 공개된 CVE, 벤더 권고, 학술 논문, 벤더 중립적인 보안 연구 등입니다. 커뮤니티의 기여를 환영합니다.

---

왜 이런 게 존재하는가

AI/ML DFIR Detection Pack

Open-source detection signatures for AI/ML attacks and breaches.

A vendor-neutral collection of Sigma, YARA, and Suricata rules for detecting compromise of LLM applications, MCP servers, ML supply chains, AI infrastructure, AI-powered insider threats, and RAG/vector database attacks.

Browse it at depalmar.github.io/ai-dfir-toolkit — the artifact catalog, the detection rules, the ATLAS/OWASP mappings, the case studies, and the investigation guide, rebuilt from this repository on every push so the page cannot drift from the content.

For the companion investigation guide with attack background, forensic artifacts, Mermaid attack-chain diagrams, and hands-on investigation procedures, see docs/ai-dfir-investigation-guide.md.

License: Apache 2.0.

---

Disclaimer

This is an independent personal project. It is not affiliated with, endorsed by, or produced on behalf of any employer. All research is based on public sources — published CVEs, vendor advisories, academic papers, and vendor-neutral security research. Contributions are welcome from the community.

---

Why this exists

Most existing detection content is either locked behind vendor SIEMs or scattered across blog posts. AI/ML attacks need detection coverage that spans:

• Endpoint (Claude Desktop / Cursor / Copilot config tampering)
• Cloud SaaS logs (Bedrock, Azure OpenAI, M365 Copilot)
• Network (vector DB exfil, model exfil, ShadowRay C2)
• File artifacts (poisoned pickle models, malicious MCP configs)

This pack uses open standards only so the rules can be deployed in any modern detection stack via open Sigma/YARA/Suricata tooling.

---

Structure

ai-dfir-toolkit/
├── 01-llm-prompt-injection/      # Prompt injection, jailbreaks, indirect injection
├── 02-mcp-attacks/                # MCP tool poisoning, config tampering, rug pulls
├── 03-model-supply-chain/         # Pickle exploits, HuggingFace, dependency confusion
├── 04-ai-infrastructure/          # ShadowRay, Triton, MLflow, GPU abuse
├── 05-copilot-assistant-abuse/    # M365 Copilot, GitHub Copilot, Claude, Cursor
├── 06-rag-vector-db/              # Vector DB exposure, RAG poisoning
├── 07-runtime-ai-malware/         # Malware calling an LLM API at runtime
├── 08-agentic-orchestration/      # Agent-as-operator, AI service API as C2
├── 09-agent-memory-forensics/     # Memory as persistence, context poisoning
├── collectors/                    # Read-only acquisition with chain of custody
├── playbooks/                     # CACAO v2.0 response playbooks
├── artifacts/                     # Machine-readable AI agent artifact catalog
├── skills/                        # Agent skills for maintaining the catalog
├── docs/                          # Investigation guide
├── tests/                         # Sample events / test files