Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the use of PowerShell commands that leverage 'Invoke-Expression' (IEX) in conjunction with 'Net.WebClient' or 'DownloadString' methods to download and execute code directly from the internet into memory.
Detects instances where 'node.exe' executes 'protocal.cjs' from 'NodePackages' paths, subsequently spawning child processes that perform host reconnaissance activities. These activities include PowerShell registry queries and process listing commands, indicative of potential malicious behavior.
Detects attempts to register an AppxPackage from a UNC path using PowerShell, which is a prerequisite for the UnCanny LPE/Coercion attack. This technique leverages the Add-AppxPackage cmdlet with the -Register parameter and a UNC path.
Detects node.exe spawning powershell.exe as a child process, consistent with malicious npm postinstall lifecycle hooks used by the PostCSS typosquatting campaign (postcss-minify-selector-parser / postcss-minify-selector). The attack chain decrypts an AES-256-GCM blob at runtime and executes a PowerShell downloader stage.
Detects PowerShell execution patterns used for host reconnaissance and application enumeration, specifically looking for combinations of Get-StartApps and Get-AppxPackage with silent error handling. This behavior was observed in the easy-day-js malware dropped via the Mastra npm supply chain compromise.
Detects PowerShell execution involving Node.js related artifacts such as downloads from nodejs.org, extraction of specific Node.js archive versions, or interaction with Node.js installation directories. This activity is indicative of potential unauthorized software installation or preparation for execution of Node.js-based applications or tools on a Windows system.
This rule monitors for modification of Windows Registry Run keys (a common persistence mechanism) by node.exe or powershell.exe, specifically targeting paths related to local Node.js installations. This behavior is indicative of an adversary attempting to establish persistence by setting an executable to run automatically upon user logon.
Detects suspicious execution chains where common Windows scripting hosts (powershell.exe, cmd.exe, wscript.exe, etc.) spawn node.exe to run JavaScript files from user-writable directories (Temp, AppData, etc.). The rule flags execution patterns often associated with the TONResolver RAT, including specific PowerShell encoding or cryptography patterns and node.js scripts running from non-standard application paths.
This rule detects malicious activity associated with the TONResolver RAT, which leverages node.exe to execute JavaScript payloads stored in AppData\Local\Nodejs. The rule monitors for multiple suspicious behaviors, including outbound C2 beaconing to known malicious domains, spawning of suspicious child processes (powershell.exe, cmd.exe, wscript.exe, cscript.exe), unauthorized access to browser-based credential stores (Login Data and Cookies), and establishment of persistence via Windows Registry Run keys.
Detects a suspicious PowerShell command sequence involving network downloads to temporary directories followed by the execution of a Node.js binary from within the user's AppData directory within a 30-minute window. This behavior is indicative of a dropper pattern where a malicious script retrieves and executes a secondary stage payload.
Detects instances where node.exe is launched from common user-mode applications (like browsers or shells) and executes a JavaScript file from temporary or user application data directories, followed by a DNS request to domains associated with high-risk TLDs (shop, bond, sbs, cfd). This behavior is characteristic of certain remote access trojans (RATs) that utilize node.js for secondary payloads.
Detects the correlation of a PowerShell process spawned by Explorer using a bypass execution policy, followed by a local Node.js process accessing web browser cookie files (Chrome, Edge, or Brave). This behavior is indicative of a potential credential theft attempt where an attacker uses PowerShell to prepare the environment and a helper process to extract browser session cookies.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell processes. This is achieved by monitoring command-line arguments for keywords associated with memory patching or reflection techniques, such as modifying AmsiScanBuffer, AmsiUtils, or interacting with amsi.dll to neutralize security scanning.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell processes. This is achieved by monitoring command-line arguments for keywords associated with memory patching or reflection techniques, such as modifying AmsiScanBuffer, AmsiUtils, or interacting with amsi.dll to neutralize security scanning.
Detects PowerShell executing a reflective .NET assembly load, potentially indicative of a backdoor, initiated by a Node.js process. The detection specifically looks for keywords related to .NET Reflection, assembly loading, byte arrays, and a specific C2 domain (hellolargeworld.com:443) or invocation method (Extension.SubRoutine.Run2) within the PowerShell command line. The initiating process is expected to be 'node.exe'.
This rule detects the use of PowerShell or Command Prompt to execute commands related to Remote Monitoring and Management (RMM) software or remote management tools such as IDrive or TeamViewer. It specifically looks for command-line arguments involving RMM-related keywords combined with execution flags or piping operators, which is a common pattern for automating the deployment, configuration, or malicious use of these remote access tools.
Detects instances of curl.exe being executed by suspicious parent processes (such as shells, scripting engines, or Office applications) while using command-line arguments to download files from remote URLs to sensitive or common directory paths. This behavior is indicative of a living-off-the-land (LOLBin) attack pattern used to stage malicious payloads.
Detects the use of administrative tools (vssadmin, wmic, or PowerShell) to delete Volume Shadow Copies. This activity is a common pre-ransomware step used to inhibit system recovery and force data impact.
Detects instances where common video conferencing and collaboration applications (such as Microsoft Teams, Zoom, Webex, or Slack) initiate a command shell (cmd.exe, powershell.exe, or wscript.exe). This behavior is often indicative of social engineering or phishing attacks where an adversary executes malicious code via a meeting invite or chat message.
Detects instances of curl.exe being executed by suspicious parent processes (such as shells, scripting engines, or Office applications) while using command-line arguments to download files from remote URLs to sensitive or common directory paths. This behavior is indicative of a living-off-the-land (LOLBin) attack pattern used to stage malicious payloads.
Detects when common package management tools (npm, pip, nuget, python) spawn potentially malicious child processes such as cmd.exe, powershell.exe, curl.exe, or certutil.exe. This activity is a classic indicator of supply chain attacks where a compromised dependency or installation hook attempts to execute arbitrary commands or download secondary payloads on a developer or build machine.
Page 113 of 213