Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
694 detections
Filters
Last updated
All Time
Detection languages
267
179
70
42
40
Contributors
200
97
66
47
34
Categories
441
397
254
82
78
Platforms
598
233
198
21
5
Products / Services
192
161
157
68
41
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
6
3
2
2
2
IDS Classtypes
6
3
1
1
IDS Protocols
9
1
Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI)
to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process
malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript.
The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it
with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common
LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.
to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process
malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript.
The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it
with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common
LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.
Detects install-time execution context consistent with the Axios npm supply chain compromise. This rule looks for 'node setup.js' launched from within 'node_modules/plain-crypto-js' or related npm install working directories, or for npm install commands involving 'axios' or 'plain-crypto-js'.
This rule detects a potential software supply chain compromise by correlating `npm install`, `npm ci`, or `npm update` activity with the subsequent execution of a `node setup.js` script on the same device within a 30-minute window. It specifically looks for `setup.js` execution or processes running from the `/node_modules/plain-crypto-js` directory, which is indicative of the Axios npm supply chain compromise.
Detects suspicious command-line arguments used with Windows utilities (LOLBAS)
Detects Node.js spawning shell processes which may indicate malicious npm package activity
Detects the execution of JavaScript code within the Deno runtime via data URIs. This technique can be used by adversaries to execute in-memory payloads, bypassing traditional file-based detection mechanisms. The rule specifically looks for 'deno.exe' in the process filename or original filename and the presence of 'data:application/javascript' in the process command line.
Detects the Deno runtime executing base64-encoded payloads via data URIs. This technique is used by threat actors, such as LeakNet, to run JavaScript payloads directly in memory, evading traditional file-based detection.
Detects the execution of the Deno runtime with specific command-line arguments used by the LeakNet group to execute a base64-encoded JavaScript payload directly in memory. This "Bring Your Own Runtime" (BYOR) technique helps evade file-based detections.
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
This rule detects the execution of specific malicious JavaScript files (`install.js` or `version.js`) associated with the StegaBin campaign, launched by the Node.js runtime. The detection focuses on the exact file paths identified in the campaign to minimize false positives, as these files are part of a harmful developer package designed to hide its next moves behind normal-looking setup work. Successful detection indicates the initial stage of a supply chain attack, potentially leading to secret theft, remote control, or further payload downloads.
Detects Node.js or Python processes executing highly obfuscated or large inline expressions via the '-e' (Node.js) or '-c' (Python) flags. This technique is a primary execution method for stagers associated with North Korean APTs, such as DEV#POPPER and OmniStealer, which are often hidden in legitimate-looking configuration files.
Detects the execution of script interpreters (wscript.exe, cscript.exe, cmd.exe, powershell.exe) where the script file being executed resides on a newly mounted virtual disk volume (VHD, ISO, etc.).
This technique is used by malware, such as in the Dead#Vax campaign, to bypass the Mark-of-the-Web (MotW) security feature, allowing malicious files inside the container to execute without standard untrusted file warnings.
This technique is used by malware, such as in the Dead#Vax campaign, to bypass the Mark-of-the-Web (MotW) security feature, allowing malicious files inside the container to execute without standard untrusted file warnings.
Detects the execution of a Windows Script File (.wsf) from a suspicious or non-standard directory, such as temporary folders or removable/mounted drives. This technique was observed in the Dead#Vax campaign where a WSF file was executed from a mounted VHD to initiate the infection chain.
Detects the execution of `deno.exe`, the Deno runtime for JavaScript and TypeScript. This was observed being leveraged by the Iranian APT group Seedworm (aka MuddyWater) to execute a new backdoor named Dindoor.
Detects files signed with a code-signing certificate issued to 'Amy Cherne'. This certificate was observed being used by the Iranian APT group Seedworm (aka MuddyWater) to sign new backdoors named Dindoor and Fakeset.
Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.
Detects the execution of `node` running scripts from a `vendor` directory during an `npm install` lifecycle. This behavior was observed in the StegaBin campaign where malicious npm packages used an install hook to execute a loader from 'vendor/scrypt-js/version.js'.
Detects Indirect Prompt Injection (IDPI) attempts where malicious instructions are dynamically injected into the DOM using JavaScript or concealed within HTML data attributes. Attackers use these methods to bypass static analysis tools and deliver hidden prompts to AI/LLM agents that process raw web content.
Detects Node.js package managers (npm, yarn, pnpm) spawning suspicious child processes like network utilities or shells during the installation of a package. This TTP is abused by malicious packages like 'ambar-src' which use 'preinstall' lifecycle scripts to download and execute secondary payloads.
This rule detects activity associated with a developer-targeting campaign leveraging malicious Next.js repositories. It identifies suspicious network connections to known Vercel staging domains and C2 IPs/ports/paths, as well as suspicious process execution patterns involving Node.js or VS Code related processes, and file events related to specific repository artifacts or sensitive file access by developer-adjacent processes. The detection logic covers network communication, process execution, and file system activities indicative of this specific threat.
This rule detects various indicators associated with a developer-targeting campaign, including Node.js fetching remote JavaScript from untrusted PaaS domains, dynamic loader behavior in next.config.js, repeated beaconing to C2 paths, detached child Node interpreters, directory enumeration and exfiltration behavior, and suspicious access to sensitive files on developer machines.
Page 26 of 34