The AI DFIR detection pack is a free set of 161 vendor-neutral detection rules across 9 AI attack classes — prompt injection, MCP tool poisoning, poisoned models, RAG attacks. This cybersecurity news check finds which ones your stack is blind to.
Key figure: The global average cost of a data breach was $4.44 million in 2025 (IBM, Cost of a Data Breach Report 2025).
— Ingenious AI security check.
If you cannot name a detection for prompt injection, MCP config tampering, or a poisoned model file in your environment, your AI footprint is flying blind. These attacks do not look like normal intrusions. The check below maps the pack's 161 rules to your stack and shows the gaps in 60 seconds.
Digital forensics and incident response for AI systems — detecting and investigating attacks that target models, prompts, agents, and the AI supply chain instead of traditional malware.
Prompt injection, MCP tool poisoning, poisoned AI models, RAG attacks, agents used as command-and-control — these don't look like "normal" intrusions, and most detection stacks are blind to them. The AI DFIR Toolkit answers with 161 free, vendor-neutral detection signatures (Sigma, YARA, Suricata) across 9 AI attack classes. Five questions to check whether your stack can see any of it.
Short answer: if you can't name a detection for prompt injection, MCP config tampering, or a poisoned model file in your environment, your AI footprint is flying blind. The pack's rules deploy anywhere via open formats — no vendor lock-in — and its artifact catalog tells responders exactly where AI agents leave forensic traces. Check your coverage below.
Answer for the environment you defend.
.yml (any SIEM via pySigma), YARA .yar (EDR, file/memory scanning), Suricata .rules (network IDS). No vendor query languages.| Attack class | Signatures | Examples |
|---|---|---|
| LLM prompt injection | 10 | Jailbreaks, indirect injection, system-prompt extraction |
| MCP attacks | 14 | Tool poisoning, config tampering, rug pulls |
| Model supply chain | 23 | Pickle exploits, HuggingFace implants, dependency confusion |
| AI infrastructure | 31 | ShadowRay, Triton, MLflow, GPU abuse |
| Copilot / assistant abuse | 19 | M365 Copilot, GitHub Copilot, Claude, Cursor misuse |
| RAG / vector DB | 17 | Vector-DB exposure, RAG poisoning |
| Runtime AI malware | 16 | Malware calling LLM APIs at runtime |
| Agentic orchestration | 12 | Agent-as-operator, AI service API as C2 |
| Agent memory forensics | 5 | Memory as persistence, context poisoning |
| Endpoint (cross-tool) | 14 | Agent behaviour on host + osquery inventory pack |
Sources: depalmar/ai-dfir-toolkit (GitHub) · browseable artifact catalog
Every rule ships with documented false-positive scenarios and severity levels; the recommended rollout is 7 days in a test index, triage, tune, then promote high+ to production.
On Elastic, matched content fields must be analyzed text, not keyword — a keyword mapping matches case-sensitively and silently misses capitalized attacker input.
The catalog's triage scripts (PowerShell/bash) and Velociraptor/KAPE commands answer the "which hosts have this" question Sigma rules can't. Pair detection with the collection plan.
A public, Apache-2.0-licensed collection (depalmar/ai-dfir-toolkit on GitHub) of 161 vendor-neutral detection signatures — Sigma, YARA, and Suricata rules — covering nine AI attack classes: LLM prompt injection, MCP attacks, model supply-chain compromise, AI infrastructure abuse, Copilot/assistant abuse, RAG and vector-database attacks, runtime AI malware, agentic orchestration, and agent memory forensics.
Prompt injection and jailbreaks, MCP tool poisoning and config tampering, poisoned pickle models and HuggingFace supply-chain attacks, ShadowRay-style AI infrastructure compromise, M365/GitHub Copilot abuse, vector-database exposure and RAG poisoning, malware that calls LLM APIs at runtime, AI services used as command-and-control, and memory/context poisoning as persistence.
Convert them to your SIEM's query language with pySigma backends (e.g. sigma-cli to Lucene for Elastic/Kibana).