Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
301 detections
Filters
Last updated
All Time
Detection languages
190
26
21
20
17
Contributors
60
58
57
14
12
Categories
97
96
58
43
40
Platforms
198
130
93
28
17
Products / Services
87
31
30
29
24
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
1
1
IDS Classtypes
1
1
1
1
IDS Protocols
1
1
Detects a vulnerable GitHub Actions workflow configuration known as a "Pwn Request". This occurs when a workflow is triggered by `pull_request_target` but checks out and executes untrusted code from the head of the pull request (`${{ github.event.pull_request.head.sha }}`). This allows an attacker to run arbitrary code with the permissions of the target repository, including access to secrets. This pattern was actively exploited by the 'hackerbot-claw' campaign. This rule should be applied to files in the `.github/workflows/` directory.
This rule detects the execution of specific Node.js scripts associated with the StegaBin package campaign. It looks for 'node.exe' or 'node' processes executing command lines containing 'scripts/test/install.js' or 'vendor/scrypt-js/version.js'. The intent is to identify the initial phase of a malicious package installation chain, which could lead to further compromise.
Detects installation of the typosquatted NuGet package StripeApi.Net reported as malicious and targeting Stripe integrations.
This rule detects the presence of hardcoded tokens associated with the dYdX supply chain attack. These tokens were used for C2 authentication and as an API key for data exfiltration. The rule searches across process command lines, network URLs, network headers, and common security logs for these specific tokens.
This rule detects Python processes that are executed with command-line arguments indicative of silent execution or output redirection to null devices, combined with execution from a temporary directory. This pattern was observed in the dYdX PyPI package compromise, where a RAT ran undetected using these techniques.
This rule detects network connections to malicious infrastructure associated with a supply chain attack targeting dYdX npm and PyPI packages. The infrastructure is used for credential exfiltration and as a C2 for a RAT.
Detects the loading of specific DLLs from AppData paths associated with the Notepad++ supply chain attack. This activity is related to DLL sideloading and Lua script execution techniques used by the threat actor. Sysmon EVID 7 is critical for detecting the library load.
This rule identifies the use of specific malicious code signing certificates by matching their SHA1 thumbprints against a predefined list. These certificates are known to be associated with various threat actors or malicious software, indicating potential supply chain compromise or the use of signed malware.
This rule detects indicators associated with the 'Office Assistant' supply chain attack. It identifies malicious browser extensions by their IDs in file paths or names, and also detects known malicious file MD5s and C2 communication domains. The rule correlates file events and network events to provide a comprehensive view of the attack.
Detects the installation of malicious npm packages associated with the Shai-Hulud 2.0 supply chain attack campaign.
This rule detects the presence of known malicious browser extensions on devices. It identifies extensions based on a curated list of Extension IDs associated with various threats, including Urban VPN, extensions that turned malicious, general malicious browser extensions, and those involved in Chrome extension supply chain attacks. The rule queries `DeviceTvmBrowserExtensions` to find any activated extensions matching these IDs.
Extremely basic & rough KQL for the purpose of finding if these extension id's are in any folders across your estate.
This rule set detects several indicators of compromise related to the Shai-Hulud threat activity. It identifies specific malicious file hashes (SHA256) for 'bundle.js' files, the execution of the 'trufflehog' tool which is often abused for secrets discovery, the presence of a malicious YAML file named 'shai-hulud-workflow.yml', and network connections to 'webhook.site' domains, optionally with a specific URI, which are used for data exfiltration or command and control.
Detects the creation of a project-local OpenAI Codex configuration file (`.codex/config.toml`) followed by the execution of the `codex` CLI from the same directory. This pattern is indicative of an attempt to exploit CVE-2025-61260, a command injection vulnerability that allows for arbitrary code execution.
Detects the creation or modification of a GitHub Actions workflow file that attempts to exfiltrate secrets. This pattern is associated with the Shai-Hulud worm, which injects malicious workflows to steal credentials using `toJSON(secrets)` and exfiltrate them using tools like `curl` and `base64`.
Malicious NPM Package Version Download
Cortex XDR
This rule detects the download or installation of known malicious NPM package versions by monitoring process command-line arguments for specific package names and versions. It targets common package managers like npm, yarn, and pnpm, as well as node.exe, to identify instances where a compromised or intentionally malicious package is being introduced into a development or production environment.
This rule detects network connections initiated by a process with a command line containing "filesystem", "--json", and "--results=verified", which is used to scan the entire filesystem.
This specific combination of command-line arguments is associated with the Shai-Hulud malware.
This specific combination of command-line arguments is associated with the Shai-Hulud malware.
This rule detects the creation of an executable file (.exe) that is being extracted by an archive where the command line includes 'tar -xzf' and a '.tar.gz' archive.
Detects network connections to the 'webhook.site' domain, which is used as an exfiltration endpoint by the 'Shai-Halud' supply chain attack campaign. The risk score is elevated if the specific malicious URL path is observed.
Detects indicators associated with a supply chain attack compromising popular NPM packages like 'chalk' and 'debug'. The rule identifies network connections to known malicious domains and command-line activity related to the installation of compromised packages.
This rule detects attempts to download known malicious NPM packages from the public npm registry (registry.npmjs.org) by monitoring network connection logs. It specifically looks for tarball (.tgz) downloads of packages and versions that have been identified as compromised or malicious. The rule extracts the package name and version from the download URL and compares it against a predefined list of malicious packages for high-fidelity detection.
Page 13 of 15