Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,886
5,169
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects suspicious 'npm publish' or 'npm login' commands executed as child processes of 'node' or 'npm'. This pattern indicates programmatic execution from within package install hooks (such as preinstall or postinstall scripts) instead of manual developer interaction, a behavior characteristic of malicious npm supply chain attacks (e.g., IronWorm) aiming to trojanize packages using stolen tokens.
Detects User Account Control (UAC) bypass attempts where eventvwr.exe is abused via registry modification of HKCU\Software\Classes\mscfile\shell\open\command. The rule identifies suspicious child processes spawned by eventvwr.exe (such as mmc.exe, BQT.exe, or start.exe) that deviate from standard behavior, as observed in BQTLock ransomware activity.
Detects in-memory execution of the MYRA RAT originating from a node.exe process. The rule monitors for suspicious process creation patterns associated with fileless techniques, including execution from memory file descriptors (memfd), /proc/self/fd, or empty process image paths, as well as unauthorized process interaction with systemd-userdbd, indicative of node.js supply chain compromises.
Detects the execution of PowerShell (powershell.exe or pwsh.exe) containing command line arguments indicative of malicious activity, including encoded commands, memory loading, assembly loading, thread creation, or attempts to bypass AMSI (Antimalware Scan Interface). The rule specifically excludes processes signed by Microsoft to reduce false positives.
Detects node.exe executing 'test.js' as a child process of NPM lifecycle scripts (postinstall/preinstall). This behavior is characteristic of malicious NPM packages like 'ts-bn-lint' and 'log-taker' used in the Polymarket Trap campaign to execute an embedded infostealer payload.
Detects reconnaissance activity where an attacker executes system discovery commands to identify the FreeBSD kernel version and kTLS configuration (specifically 'kern.ipc.mb_use_ext_pgs'). This enumeration is performed to fingerprint potential targets for the BUMSRAKETE exploit (CVE-2026-45257).
Detects the execution of the BUMSRAKETE exploit for CVE-2026-45257, which targets kTLS-RX page-cache corruption in FreeBSD to achieve local privilege escalation. The rule monitors for pre-exploitation sysctl enumeration of kernel memory management parameters and the subsequent spawning of privileged shells (su/sh) by the exploit process.
Detects node.exe and script execution patterns associated with the Polymarket Trap supply chain attack. The rule monitors for the usage of specific environment variables (e.g., DFC_SYNC_CONFIG), operator tags (e.g., piterpan), and C2 domain connections that indicate a malicious attempt to extract configuration data from an NPM package.json file.
Detects reconnaissance activity originating from npm or Node.js processes, specifically targeting system information (OS, network, user context, and hardware identifiers). This activity is associated with supply chain compromise attempts where malicious npm postinstall scripts or inline Node.js execution are used to enumerate the host environment.
Detects persistence mechanisms associated with the MYRA RAT. This includes Linux/macOS crontab modification using specific schedules or shell profile writes initiated by node/npm processes, as well as Windows scheduled task creation or task manipulation via schtasks.exe initiated by node/npm processes.
Detects various privilege escalation and reconnaissance techniques commonly associated with the 'Operation Poisson' campaign, including UAC bypass attempts, local administrator group enumeration, and administrative privilege verification triggered by script interpreters.
Detects malicious activity associated with the Miasma/MYRA infostealer campaign targeting DeFi developers. The rule monitors npm lifecycle scripts (postinstall/preinstall) for suspicious execution, C2 communication with known malicious domains, unauthorized access to browser-based credential storage, and persistence attempts via LD_PRELOAD on Linux environments.
This rule detects reconnaissance activity on FreeBSD systems by monitoring the execution of 'sysctl', 'uname', 'freebsd-version', and 'pkg' to query sensitive kernel parameters and system version information. Specifically, it flags queries related to CVE-2026-45257 (BUMSRAKETE), such as 'kern.ipc.mb_use_ext_pgs' and 'kern.tls.enable'. The rule differentiates risk levels based on the combination of targeted kernel parameter checks and system version enumeration.
Detects MYRA Linux RAT persistence mechanisms. The rule monitors for the creation of cron jobs scheduled to run every 13 minutes and the creation of a profile initialization script at /etc/profile.d/.sh.local, which is a common technique for ensuring code execution upon user shell session initialization.
Detects Tailscale installation, configuration, and mesh network enrollment activity. The rule monitors for the execution of Tailscale processes with enrollment flags, DNS lookups to Tailscale coordination servers, WireGuard UDP traffic on port 41641, and connections to the Tailscale CGNAT IP address space. This activity is often used by adversaries to establish persistent, encrypted remote access.
This rule detects potentially malicious activity related to cron job scheduling. It monitors for three distinct stages: (1) direct modification of crontab files or directories using common shell utilities, (2) suspicious file write operations to critical cron configuration paths, and (3) execution of shell scripts or binaries from unusual directories (e.g., /tmp, /dev/shm) where the parent process is a cron utility.
Detects malicious activity associated with npm supply chain compromise, including execution of known malicious npm lifecycle scripts, DNS queries to suspected C2 domains, and unauthorized access to sensitive developer credential files (such as .npmrc, .aws/credentials, and SSH keys) by Node.js processes.
This rule detects potentially malicious activity related to Node.js environments. It monitors for the execution of Node.js or NPM commands involving specific sensitive files ('sync-peer.cjs', 'peer-math.js') or suspicious packing destinations, as well as the creation of 'index.js' or 'package.json' files within a 'node_modules' directory, which can indicate software supply chain manipulation or malicious dependency installation.
Detects the execution of Python interpreters or scripts involving keylogging-related libraries (pynput, pyxhook, pywin32, keyboard) or direct access to Linux input devices (/dev/input/event*), correlated with the creation of temporary script files, which is a common pattern for Python-based keyloggers.
Detects execution patterns associated with fileless techniques on Linux systems, specifically looking for the usage of the memfd_create system call or referencing /proc/self/fd/ to execute code directly from memory. These methods are frequently used by adversaries to load and run malicious payloads without writing files to disk, bypassing traditional file-based antivirus scanners.
Detects instances of the 'systemd-userdbd' process that are either spawned from an unexpected parent process or exhibit path-based anomalies (such as running from 'node' or 'node_modules' directories), which may indicate masquerading or malicious activity.
Page 409 of 976