Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
6
3
Contributors
5
3
1
Categories
8
6
5
3
3
Platforms
9
1
1
Products / Services
8
1
1
MITRE Techniques
18,176
15,735
12,661
8,477
6,292
Detects unauthorized execution of a Bun runtime executing an 'index.js' payload within a GitHub Actions workflow context, specifically targeting known compromised action paths (e.g., issues-helper, maintain-one-comment). The detection requires correlation with either sensitive environment/secret access or anomalous outbound network activity originating from the same process, indicating potential credential theft or C2 communication by a malicious CI/CD pipeline component.
Detects unauthorized execution of a Bun runtime executing an 'index.js' payload within a GitHub Actions workflow context, specifically targeting known compromised action paths (e.g., issues-helper, maintain-one-comment). The detection requires correlation with either sensitive environment/secret access or anomalous outbound network activity originating from the same process, indicating potential credential theft or C2 communication by a malicious CI/CD pipeline component.
Detects unauthorized execution of a Bun runtime executing an 'index.js' payload within a GitHub Actions workflow context, specifically targeting known compromised action paths (e.g., issues-helper, maintain-one-comment). The detection requires correlation with either sensitive environment/secret access or anomalous outbound network activity originating from the same process, indicating potential credential theft or C2 communication by a malicious CI/CD pipeline component.
Detects unauthorized execution of a Bun runtime executing an 'index.js' payload within a GitHub Actions workflow context, specifically targeting known compromised action paths (e.g., issues-helper, maintain-one-comment). The detection requires correlation with either sensitive environment/secret access or anomalous outbound network activity originating from the same process, indicating potential credential theft or C2 communication by a malicious CI/CD pipeline component.
Detects unauthorized execution of a Bun runtime executing an 'index.js' payload within a GitHub Actions workflow context, specifically targeting known compromised action paths (e.g., issues-helper, maintain-one-comment). The detection requires correlation with either sensitive environment/secret access or anomalous outbound network activity originating from the same process, indicating potential credential theft or C2 communication by a malicious CI/CD pipeline component.
Detects the execution of the Bun JavaScript runtime by npm or node.js during lifecycle tasks (preinstall, postinstall, etc.). This behavior is highly indicative of the ChainDrop/Shai-Hulud supply chain worm, which uses npm lifecycle scripts to download and execute a second-stage payload using the Bun runtime.
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.