Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
259 detections
Filters
Last updated
All Time
Detection languages
127
47
23
16
14
Contributors
71
45
44
36
14
Categories
135
108
46
44
31
Platforms
176
147
110
22
10
Products / Services
68
57
39
34
15
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
IDS Classtypes
5
1
IDS Protocols
4
2
Detects node.exe launching with hardcoded easy-day-js C2 IP and port combinations passed as command-line arguments, indicative of the Mastra NPM supply chain compromise.
Detects the simultaneous creation of .pkg_history and .pkg_logs in a temporary directory, indicating the setup.cjs dropper associated with the Mastra NPM supply chain attack.
This rule detects instances where 'node.exe' is executed from a temporary directory (e.g., 'temp' or 'tmp') and initiates a network connection to an IP address within the '23.254.164.0/24' subnet. This behavior is indicative of the Mastra NPM supply chain compromise, where malicious node packages drop and execute payloads from temporary locations to establish C2 communication.
Detects node.exe deleting a 24-character hexadecimal JavaScript file from the Temp directory after execution, which is indicative of the Mastra NPM supply chain attack.
Detects if multiple distinct node.exe processes attempt to connect to known easy-day-js C2 IPs within a short span, indicating potential compromise related to the Mastra NPM supply chain attack.
This rule detects repeated execution of 'maven' or 'gradle' commands on a system within a one-hour window. A high count (5 or more) of these commands from the same account on the same computer within an hour could indicate unusual development activity, automated build processes, or potentially malicious activity related to software supply chain compromise or development environment abuse.
Detects Node.js executing the 'utils.cjs' script, which serves as the obfuscated malware dropper for a North Korean-linked infostealer campaign. This script is typically triggered by a malicious npm postinstall hook to download the second-stage payload.
This rule detects the creation of 'requirements.txt' or 'pom.xml' files on a system. These files are commonly used in software development projects (Python and Java/Maven, respectively) to manage dependencies and project configurations. Monitoring their creation can help identify legitimate development activities, but also potential malicious actions such as supply chain compromise where an adversary might introduce or modify project dependencies.
Detects tampering with 'binding.gyp' files by processes other than 'npm', 'node', or 'yarn'. Modifying these build scripts can allow attackers to achieve arbitrary code execution during the 'npm install' phase, indicating a potential supply chain compromise.
This rule detects the execution of package managers by common parent processes (code.exe, cmd.exe, powershell.exe) when they are used to install or add packages. It looks for package names that include scope (e.g., @scope/package), version numbers (e.g., package@1.2.3). This pattern could indicate an attempt to introduce malicious or unauthorized packages into a development environment or system.
This rule detects a high volume of file creation events (100 or more within an hour) occurring in common development-related directories such as 'node_modules', 'packages', or 'vendor'. This activity can be indicative of legitimate software development processes like dependency installation or project builds. However, it can also signal malicious activity, particularly if observed on systems not typically used for development, or as part of a supply chain compromise where malicious dependencies are being introduced or built.
This rule detects a high volume of file creation events (100 or more within an hour) occurring in common development-related directories such as 'node_modules', 'packages', or 'vendor'. This activity can be indicative of legitimate software development processes like dependency installation or project builds. However, it can also signal malicious activity, particularly if observed on systems not typically used for development, or as part of a supply chain compromise where malicious dependencies are being introduced or built.
This rule detects attempts to download typosquatted NPM packages from registry.npmjs.org. It specifically looks for HTTP requests to the NPM registry where the URI contains common typos of popular packages like 'lodash', 'requests', 'express', 'mongoose', and 'momentjs'. This indicates a potential supply chain attack where developers might accidentally download malicious packages due to a typo.
This rule detects attempts to download Python packages from the official Python Package Index (PyPI) where the package name in the URI appears to be a typosquatted version of common legitimate packages. Specifically, it looks for HTTP requests to pypi.org with URIs containing 'requets' (instead of 'requests'), 'boto' (instead of 'boto3' or similar), 'djang0' (instead of 'django'), 'flask2' (instead of 'flask'), or 'numpy2' (instead of 'numpy'). This indicates a potential supply chain attack where an attacker has registered a similarly named malicious package to trick users into downloading it.
Detects the creation of a scheduled task named 'SystemUpdate' using 'schtasks.exe', which is a persistence mechanism observed in the Phantom Bot malware distributed via malicious npm packages. The rule specifically looks for the 'create' action and the 'SystemUpdate' task name in the command line.
This rule detects the creation of 'requirements.txt' or 'pom.xml' files on a system. These files are commonly used in software development projects (Python and Java/Maven, respectively) to manage dependencies and project configurations. Monitoring their creation can help identify legitimate development activities, but also potential malicious actions such as supply chain compromise where an adversary might introduce or modify project dependencies.
Detects installation or update of a VSCode extension from an unapproved publisher by monitoring for vsce-sign.exe signature verification events in DeviceProcessEvents. VSCode invokes vsce-sign.exe once per extension install or auto-update to verify the extension's marketplace signature before extraction. The full extension slug is passed as the --package argument, making this a reliable, install-time signal that fires for all extension types regardless of whether the extension has a background process or language server.
Extensions are evaluated against an approved publisher list maintained as an embedded datatable. Publishers are matched on the prefix before the first . in the extension slug (e.g., ms-python from ms-python.python), allowing publisher-level approval rather than per-extension management.
This detection was developed in response to the TeamPCP supply chain campaign (May 2026), in which malicious VSCode extensions were distributed via fake GitHub issue notifications targeting developers.
Extensions are evaluated against an approved publisher list maintained as an embedded datatable. Publishers are matched on the prefix before the first . in the extension slug (e.g., ms-python from ms-python.python), allowing publisher-level approval rather than per-extension management.
This detection was developed in response to the TeamPCP supply chain campaign (May 2026), in which malicious VSCode extensions were distributed via fake GitHub issue notifications targeting developers.
Identifies the creation of a stage-2 binary named 'payload.bin' within a 'node_modules' directory. This artifact is dropped by the Gen-1 stager used in the vpmdhaj malicious npm campaign, which targets cloud and CI/CD credentials.
This suite of rules detects various activities associated with the Mini Shai-Hulud npm worm, including the execution of its payload via bun, network connections to its exfiltration domain, attempts by Node.js or Bun processes to access AWS IMDS for credential theft, access to local HashiCorp Vault instances, identification of known malicious script file hashes, and the installation of its specific malicious GitHub dependency.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
This rule detects the execution of package managers by common parent processes when they are used to install or add packages. It looks for package names that include scope (e.g., @scope/package), version numbers (e.g., package@1.2.3). This pattern could indicate an attempt to introduce malicious or unauthorized packages into a development environment or system.
Page 11 of 13