Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
694 detections
Filters
Last updated
All Time
Detection languages
267
179
70
42
40
Contributors
200
97
66
47
34
Categories
441
397
254
82
78
Platforms
598
233
198
21
5
Products / Services
192
161
157
68
41
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
6
3
2
2
2
IDS Classtypes
6
3
1
1
IDS Protocols
9
1
This rule helps identify suspicious repository files that may try to run code automatically when a developer opens a project in an editor or when a build starts. It searches for the exact wording used by the editor to auto run tasks when a folder is opened, and it also looks for a set of web addresses published in public reporting that were used to deliver additional code. A match does not always mean the repository is malicious, but it does mean the file deserves careful review before it is executed on a developer machine. If you see a hit, confirm the repository source, check for unexpected scripts or obfuscated code, and review recent network traffic for connections to the listed staging sites. If the repository is not clearly trusted, isolate the environment, remove the project from production developer workstations, and rotate any secrets that may have been available. This rule is meant to provide a clear and understandable safety check for teams that regularly clone and run new code.
This rule detects when Node.js executes a script named 'env-setup.js' located within a '.vscode' directory. This pattern is often associated with malicious code execution within development projects, particularly when a developer opens and trusts a repository. The rule specifically looks for 'node.exe' as the image and the script path containing either '\.vscode\env-setup.js' or '/.vscode/env-setup.js' in the command line.
Detects LOLBin processes (mshta.exe, wscript.exe, cscript.exe) making outbound network connections to non-standard ports. This behavior is characteristic of the PeckBirdy framework's C2 communication.
Detects a node.js process spawning another node.js process to evaluate a script from the command line or stdin. This is a key technique used by malware, as referenced in the Jamf Threat Labs report on DPRK-linked actors, to execute additional payloads received from a C2 server persistently.
Detects the execution of the .NET compiler utility 'Aspnet_compiler.exe' by a scripting engine like PowerShell or JScript/VBScript. This behavior is highly unusual and is a known technique used by malware like Agent Tesla to perform process hollowing, where the legitimate 'Aspnet_compiler.exe' process is hollowed out and injected with malicious code.
Detects JavaScript-based drive-by compromise execution
This rule detects suspicious process creation events where `explorer.exe` (Windows Explorer) launches various scripting or utility executables (`powershell.exe`, `cmd.exe`, `wscript.exe`, `mshta.exe`, `rundll32.exe`, `regsvr32.exe`, `installutil.exe`, `wmic.exe`, `certutil.exe`, `msdt.exe`). The detection is specifically triggered when the command line of the launched process contains indicators of network communication (e.g., `http://`, `https://`, `iwr`, `invoke-webrequest`, `curl`, `wget`, `bitsadmin`, `downloadstring`, `downloadfile`), encoded commands (`-e` or `-encodedcommand` with base64-like strings), or UNC paths (`\\`). It also specifically looks for `certutil` being used with `-urlcache`, `-decode`, or `-f` flags. The rule includes exclusions for common legitimate activities such as downloads from `chocolatey.org`, `nuget.org`, `aka.ms`, `cmd.exe` launching a browser to a URL, and `certutil -hashfile` operations.
Detects the execution of 'cmd.exe' initiated by common Microsoft Office applications, scripting engines, or msiexec.exe, where the command line includes 'curl' for downloading a '.pdf' file and also attempts to delete files using 'del /s /q'. This behavior is often associated with initial access, download of malicious payloads, and cleanup activities by adversaries. The rule specifically looks for command lines that interact with 'Users\Public', 'conhost.exe', or use the '--headless' flag, which can indicate automated or background execution.
PowerShell (parent explorer) launches WScript with minimized window and Invoke-WebRequest. Lampion campaign pattern per Microsoft blog.
Detects browser processes making direct network connections to known Large Language Model (LLM) API endpoints. This activity is unusual when originating from general user web browsing, as it may indicate a malicious website is using an LLM to dynamically generate and fetch malicious code (e.g., JavaScript for a phishing page) at runtime.
Detects TTPs associated with the Lazarus Group malware families OtterCookie and BeaverTail. This rule identifies persistence via registry run keys and scheduled tasks, suspicious node.js execution for keylogging, and network connections to known C2 infrastructure.
Detects when a Visual Studio Code process spawns a shell that immediately downloads and executes a script using a tool like `curl` and pipes it to a runtime like `node`. This indicates the abuse of `tasks.json` for code execution, a technique used by DPRK-linked actors.
Detects instances where Visual Studio Code spawns a shell process to download a remote script via tools like 'curl' or 'wget' and pipe it directly into the Node.js runtime. This technique has been observed in the "Contagious Interview" campaign, where threat actors abuse VS Code's 'tasks.json' to execute malicious payloads in memory.
Detects a Windows script host (wscript.exe or cscript.exe) spawning a Java process to execute a JAR file, a behavior observed in STRRAT malware delivery chains.
Detects the execution of Node.js (node.exe) when spawned by PowerShell or the Command Prompt from a user-writable directory. This behavior is characteristic of the Tsundere Bot delivery chain used by threat actors like TA584 (Storm-0900), who use a PowerShell script to install and run the Node.js-based malware.
This rule detects suspicious Node.js activity potentially related to EtherRAT's React2Shell exploitation (CVE-2025-55182) and fileless execution. It looks for combinations of fileless Node.js execution patterns (using -e, --eval, or --input-type=module with common modules like require, import, fetch, http) alongside Ethereum RPC queries (eth_call, eth_getStorageAt, infura.io, alchemy.com, cloudflare-eth). It also identifies scenarios where Node.js is downloaded from nodejs.org and then persistence mechanisms are set up via .bashrc, .profile, .bash_profile, systemd, or cron. Another detection path involves fileless Node.js execution combined with systemd or cron persistence. The rule specifically targets Linux environments and process creation events.
Detects cscript.exe executing a JScript file using a legacy NTFS 8.3 shortname. This is a known technique used by Gootloader during its persistence phase to obfuscate the script's path and name.
Detects the execution of a JScript file by cscript.exe using a legacy NTFS 8.3 shortname format. This is a specific behavior observed in Gootloader's persistence mechanism, where a .LNK file in the Startup folder executes a second-stage script.
Detects indicators of React2shell exploitation originating from 'node' or 'next' processes on web-facing or internet-facing assets. This rule identifies suspicious network connections to common web ports (3000, 8080, 443, 80) or process executions containing command-line arguments indicative of prototype pollution exploitation (e.g., '__proto__', 'constructor:constructor', 'process.mainModule.require', 'execSync', 'vm.runInThisContext', 'fs.readFileSync') or common post-exploitation commands ('whoami', '/etc/passwd', 'id', 'env', 'hostname').
Detects the execution of Node.js with the '-e' flag, which evaluates a string as JavaScript. This technique is used by the EtherRAT implant for fileless execution, particularly for privilege escalation attempts.
Detects React2Shell exploitation attempts via prototype pollution and Node.js
gadget invocation. Covers vulnerability scanning, gadget testing, and active
RCE exploitation.
gadget invocation. Covers vulnerability scanning, gadget testing, and active
RCE exploitation.
Page 27 of 34