Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects persistence mechanisms associated with the MYRA Linux RAT, including the use of LD_PRELOAD to load a malicious shared library from a hidden path, persistent shell profile modification via /etc/profile.d/.sh.local, and process masquerading as systemd-userdbd. This rule is linked to the Polymarket Trap campaign involving malicious npm packages.
Detects instances where Node.js or NPM processes initiate common Windows discovery tools (e.g., systeminfo, whoami, tasklist, ipconfig, wmic). This behavior is often indicative of post-exploitation discovery or reconnaissance activity performed by an adversary utilizing an application or malicious script running within the Node.js runtime environment.
Detects the execution of Node.js lifecycle scripts (preinstall, postinstall, install-check, etc.) that trigger secondary process execution, such as command shells, downloaders (curl, wget), or security utilities (certutil, bitsadmin). This behavior is often associated with malicious npm package supply chain attacks aimed at downloading secondary payloads during installation.
This rule detects when a Node.js process spawns common command-line interpreters (e.g., cmd.exe, powershell.exe, bash) with command-line arguments indicative of potentially malicious activity. This includes common software development script names, build-related tasks, or obfuscated command execution patterns. The rule excludes processes signed by trusted publishers like Microsoft or the OpenJS Foundation.
This rule detects suspicious execution of rundll32.exe by looking for multiple instances of rundll32.exe executing with command lines containing both '.dll' and '/' characters from the same computer and account. This pattern can indicate an adversary attempting to proxy execution of malicious code via rundll32.exe.
This rule detects a high volume (5 or more within an hour) of process creation events where the command line contains keywords associated with remote access protocols like DCOM, WMI, or RPC. This could indicate an adversary utilizing these protocols for lateral movement or remote execution.
This rule detects potentially malicious software supply chain attacks by identifying suspicious child processes spawned by package managers (pip, npm) or Python scripting engines within a short timeframe. It specifically looks for shells (cmd, powershell, bash, etc.) being invoked immediately after a package installation or script execution, and correlates this activity with suspicious outbound network connections originating from these processes.
This rule detects when a node.exe process, commonly used for executing npm lifecycle hooks (such as preinstall, postinstall, or various .cjs scripts), spawns suspicious child processes including shells (cmd.exe, powershell.exe, sh, bash) or scripting engines (wscript.exe, cscript.exe). This pattern is frequently observed in malicious npm packages designed to achieve code execution on a developer's machine during the package installation or build process.
Detects the execution of known Remcos Remote Access Trojan (RAT) watchdog processes (e.g., iexplore.exe, svchost.exe, fsutil.exe) when spawned by suspicious parent processes or running from non-standard file paths such as Temp, AppData, or ProgramData, which are common indicators of malicious activity.
Detects suspicious discovery commands often used by adversaries for environmental reconnaissance, including querying security product status via WMIC, enumerating installed software, or executing tasklist.exe from non-standard system paths.
Detects reconnaissance activities performed by system binaries (wmic.exe, reg.exe, tasklist.exe) that are commonly used to enumerate security software, registry keys, and system configuration. Additionally, it alerts on any of these tools being spawned by processes originating from the ProgramData\Remcos directory, which is a known indicator of the Remcos Remote Access Trojan (RAT).
Detects the execution of npm lifecycle scripts (such as postinstall, preinstall, or custom install-related scripts) by node.exe. These scripts are frequently abused in supply chain attacks to execute malicious code automatically when a package is installed.
This rule detects instances where a Node.js process spawns or executes the systemd-userdbd utility. systemd-userdbd is a system daemon used for user/group database lookups. Execution of this component by a user-land Node.js application is highly atypical and may indicate a compromise where an attacker is abusing system binaries for persistence, privilege escalation, or reconnaissance.
This rule detects suspicious command-line activity indicative of potential token impersonation or theft. It specifically looks for the keywords 'token' or 'impersonate' within process creation command lines (EventID 4688) and triggers an alert if these keywords appear 3 or more times within an hour on the same computer by the same account. This could indicate an adversary attempting to manipulate access tokens to elevate privileges or operate under a different security context.
This rule detects the execution of Node.js processes ('node' or 'node.exe') with command-line arguments that match known patterns often associated with software installation scripts, post-installation tasks, or peer verification activities. While these file names can be legitimate, they are also commonly leveraged by attackers for malicious script execution or persistence.
Detects anomalous self-upgrade behavior in npm packages where a node process spawns child processes using npm pack or specific command-line arguments to overwrite installed package files. This pattern is associated with malicious supply chain activity, specifically seen in the wshu.net campaign where packages download and replace their own contents at runtime.
Detects node.exe or npm processes accessing directory paths associated with popular browser cryptocurrency wallet extensions, a behavior indicative of the Miasma infostealer used in supply chain attacks.
Detects Remcos RAT utilizing a COM-based UAC bypass technique. The malware leverages the CMSTPLUA CLSID ({3E5FC7F9-9A51-4367-9063-A120244FBEC7}) and the ICMLuaUtil interface to spawn an elevated process without a UAC prompt. This rule monitors for DllHost.exe acting as a COM surrogate and spawning suspicious child processes (cmd.exe, powershell.exe) or being initiated with the specific CMSTPLUA CLSID, as well as fodhelper/computerdefaults UAC bypass variants.
Detects information stealer malware, such as LokiBot or StealC, attempting to enumerate installed security software, firewall configurations, and system services. The rule monitors for WMI queries to 'SecurityCenter2' or registry enumeration of uninstallation/service keys originating from processes executing within user-writable, high-risk directories such as Temp, Downloads, or ProgramData, while filtering out known legitimate system processes.
Detects the use of NTFS Alternate Data Streams (ADS) by monitoring process command lines, initiating process command lines, and folder paths for patterns indicative of ADS notation. The rule specifically flags potential execution or access patterns involving common script interpreters (wscript, cscript, powershell, pwsh) combined with ADS, as well as general ADS usage in file paths.
This rule detects a multi-stage loader chain behavior. Stage 1 identifies PowerShell spawning mshta.exe or wscript.exe, which is commonly used to execute malicious scripts or loaders. Stage 2 detects mshta.exe or wscript.exe subsequently executing schtasks.exe or wmic.exe with command-line arguments indicative of establishing persistence via scheduled tasks or WMI event subscriptions.
Page 417 of 976