Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
694 detections
Filters
Last updated
All Time
Detection languages
267
179
70
42
40
Contributors
200
97
66
47
34
Categories
441
397
254
82
78
Platforms
598
233
198
21
5
Products / Services
192
161
157
68
41
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
6
3
2
2
2
IDS Classtypes
6
3
1
1
IDS Protocols
9
1
Identifies browsers executing highly obfuscated Tycoon2FA JavaScript payloads utilizing eval or specific array mapping functions to hide the phishing kit logic, specifically when interacting with authentication or login pages.
This rule detects the execution of Node.js or Bun JavaScript runtime processes with command-line arguments often associated with CI/CD automation, dependency updates, or potential obfuscated script execution patterns.
This rule detects multiple indicators of suspicious activity on Linux systems, including LD_PRELOAD hijacking, memfd_create fileless execution, suspicious process masquerading, periodic cron task execution, and the creation of configuration files associated with common IDEs and AI tools. These patterns are frequently used to establish persistence, hide malicious activity, or facilitate lateral movement by compromising development environments.
Detects the creation of '.pkg_history' or '.pkg_logs' files in the OS temporary directory by a Node.js process. This behavior is linked to the easy-day-js supply chain dropper, where the '.pkg_logs' file contains XOR-encoded campaign marker bytes.
Detects the execution of a suspicious 'setup.cjs' script via Node.js triggered during an 'npm install' process, characteristic of the malicious payload delivery mechanism found in compromised Mastra packages. The rule specifically monitors for Node.js spawning a process with command-line arguments including 'setup.cjs' and the '--no-warnings' flag.
Udm Ghost Dynamic Js
YARA-L
Targets JavaScript containing atob decoding, dynamic appendChild, and one-time localStorage keys. The UDM rule retains principal and target context for correlation.
Detects the execution of Windows script files (JS, VBS, HTA) using wscript.exe or cscript.exe from common staging areas like AppData, Temp, or ProgramData, specifically when the initiating process is not a signed Microsoft binary. This pattern is highly indicative of potential malicious script execution often used in phishing delivery or secondary payload stages.
Detects the multi-stage loader's evasion tactic where JScript copies itself from a Temp directory to Public and relaunches. Specifically, it looks for wscript.exe executing another wscript.exe process with a command line containing "C:\Users\Public" and "//nologo".
Detects a multi-stage attack pattern involving the creation of JavaScript or XML files in a specific public user directory, followed by their execution via wscript.exe or cscript.exe, and subsequently, the spawning of curl.exe by these script hosts to download additional content. This sequence is indicative of malware staging and execution, often used for initial access or further payload delivery.
Detects the creation of scheduled tasks (schtasks.exe) spawned by common scripting or social engineering-related parent processes (PowerShell, Cmd, WScript, MSHTA). The rule specifically looks for payloads associated with common attack patterns, such as downloading remote content or executing encoded commands, which indicates potential persistence or payload delivery activities.
Detects deno.exe executing encoded base64 blobs via the '-e' parameter. This activity is associated with the MuddyWater APT group.
Detects deno.exe executing inline scripts via 'eval', indicating DINODANCE/Tsundere malware execution. This behavior is associated with the MuddyWater APT group.
Detects IDEs executing as a Node.js interpreter, a technique used to run malicious JS silently, as described in the UNK_DeadDrop campaign.
Detects node.exe initiating outbound network connections to external IPs/domains shortly after an npm.exe or npx.exe process event, excluding common legitimate NPM and GitHub domains. This behavior is indicative of supply chain compromise where malicious NPM packages might execute code and establish C2 communication.
Description: Detects the Stage 2 C2 tasking loop from the malicious Next.js developer-targeting campaign.Stage 2 spawns a child Node.js process and executes attacker-supplied JavaScript via STDIN ('-') or eval ('-e'), sourced from a parent Node process that previously beaconed to Vercel staging infrastructure. Trojanized assets involved include jquery.min.js and env-setup.js loaded from
known malicious repo structures.
known malicious repo structures.
Detects the execution of processes with filenames commonly associated with malicious scripts, exploits, or malware. This rule monitors Windows Security Event ID 4688 (process creation) for specific filenames such as 'malware.ps1', 'payload.vbs', 'exploit.js', 'attack.bat', 'backdoor.cmd', 'dropper.exe', 'loader.exe', and 'injector.exe'.
Udm Ghost Dynamic Js
YARA-L
Targets JavaScript containing atob decoding, dynamic appendChild, and one-time localStorage keys. The UDM rule retains principal and target context for correlation.
Detects wscript.exe running JavaScript payloads dropped specifically into the AppData\Local\Temp path, typical of SocGholish fake update execution.
Detects the simultaneous extraction of at least three different script types (VBS, PS1, JS, or DAT) from archives, followed by their execution by their respective interpreters (wscript.exe, powershell.exe, node.exe, or bun.exe). This behavior is indicative of multi-stage attacks where adversaries use various scripting languages for different phases of their operations, often to evade detection or to ensure compatibility across different system configurations. The inclusion of '.dat' files suggests that the rule is also looking for potentially obfuscated or custom script formats that are then interpreted by one of the listed executables.
This rule detects the execution of JavaScript files named 'bw_setup.js' or 'execution.js' using the 'bun' runtime, immediately followed by an outbound network connection to the command and control (C2) domain 't.m-kosche.com'. The detection logic correlates process execution events with network connection events within a 10-minute window, indicating potential malicious activity associated with supply chain attacks.
Detects the execution of VBScript or JScript files (via wscript.exe or cscript.exe) where the command line contains common VBScript argument handling keywords. This pattern can indicate malicious script execution attempting to parse arguments for further actions, potentially as part of a phishing attack or malware execution chain.
Page 22 of 34