Sunturai
Threat report

www.elastic.co/security-labs/elastic-advances-llm-security

https://www.elastic.co/security-labs/elastic-advances-llm-security
Published on
www.elastic.co

ATT&CK techniques those detections carry

  • T1027Obfuscated Files or Information
  • T1071Application Layer Protocol
  • T1005Data from Local System
  • T1027.004Compile After Delivery
  • T1030Data Transfer Size Limits
  • T1037Boot or Logon Initialization Scripts
  • T1037.004RC Scripts
  • T1071.001Web Protocols
  • +15 more
Open the original

21 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
DetectionSeverity
Anthropic Admin Role Assigned to UserHigh
GenAI Process Performing Encoding/Chunking Prior to Network ActivityMedium
GenAI Process Compiling or Generating ExecutablesMedium
Unusual Process Modifying GenAI Configuration FileMedium
GenAI Process Accessing Sensitive FilesHigh
GenAI Process Connection to Unusual DomainMedium
GenAI Process Connection to Suspicious Top Level DomainMedium
Unusual High Word Policy Blocks DetectedMedium
AWS Bedrock Detected Multiple Validation Exception Errors by a Single UserHigh
Unusual High Denied Topic Blocks DetectedMedium
Unusual High Denied Sensitive Information Policy Blocks DetectedMedium
AWS Bedrock Detected Multiple Attempts to use Denied Models by a Single UserHigh
Potential Abuse of Resources by High Token Count and Large Response SizesMedium
Unusual High Confidence Content Filter Blocks DetectedMedium
AWS Bedrock Guardrails Detected Multiple Policy Violations Within a Single Blocked RequestLow
AWS Bedrock Guardrails Detected Multiple Violations by a Single User Over a SessionMedium
AWS Bedrock Invocations without Guardrails Detected by a Single User Over a SessionMedium
AWS Bedrock High-Frequency Single-Model Inference API ProbingMedium
LLM-Based Compromised User Triage by UserCritical
Correlated Alerts on Similar User IdentitiesHigh
LLM-Based Attack Chain Triage by HostCritical

Showing 21 of 21

Filter in the catalogue

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice