Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
259 detections
Filters
Last updated
All Time
Detection languages
127
47
23
16
14
Contributors
71
45
44
36
14
Categories
135
108
46
44
31
Platforms
176
147
110
22
10
Products / Services
68
57
39
34
15
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
IDS Classtypes
5
1
IDS Protocols
4
2
This rule detects the creation, writing, or renaming of specific files associated with the compromised Axios npm package versions 1.14.1 and 0.30.4. Upon installation, the postinstall script of these compromised packages deploys dropper scripts to download and install a remote access trojan on Mac, Linux, or Windows endpoints. The rule specifically looks for file paths indicative of these dropper activities across different operating systems.
A recent worldwide cyberattack campaign has been detected involving the npm package axios. Malicious versions were reportedly used to deploy a remote access trojan during installation, which may impact developer workstations and CI/CD environments.
Detects suspicious process execution originating from npm postinstall scripts, which can indicate a supply chain compromise. Specifically, this rule looks for npm, node, or npm.cmd processes with 'postinstall' or 'plain-crypto-js' in their command line, spawning suspicious executables like curl, wget, python, bash, sh, cmd, powershell, or wt, or connecting to known malicious domains/IPs or specific file names associated with the 'plain-crypto-js' RAT dropper.
Detects Node.js spawning shell processes which may indicate malicious npm package activity
Detects execution of processes from node_modules which may indicate malicious package behavior
This rule detects various indicators associated with the Shai-Hulud supply chain attack. It identifies known malicious hashes, suspicious file creations in GitHub workflows, destructive commands on Linux/macOS and Windows systems, initial execution via npm preinstall scripts, and the installation of specific vulnerable application names or applications from known vulnerable vendors.
Detects a vulnerable GitHub Actions workflow configuration known as a "Pwn Request". This occurs when a workflow is triggered by `pull_request_target` but checks out and executes untrusted code from the head of the pull request (`${{ github.event.pull_request.head.sha }}`). This allows an attacker to run arbitrary code with the permissions of the target repository, including access to secrets. This pattern was actively exploited by the 'hackerbot-claw' campaign. This rule should be applied to files in the `.github/workflows/` directory.
This rule detects the installation or execution of known malicious, typosquatted npm packages associated with the SANDWORM_MODE campaign. It identifies process creation events related to common Node.js package managers (npm, yarn, npx) and checks for command lines indicating package installation or execution, specifically looking for the presence of malicious package names from the SANDWORM_MODE campaign.
Detects suspicious modification of AI assistant configuration files potentially related to MCP server injection.
Detection attempts to modify package manager configurations to point to potentially malicious repositories, enabling supply chain attacks through dependency confusion.
This rule detects network connections to malicious infrastructure associated with a supply chain attack targeting dYdX npm and PyPI packages. The infrastructure is used for credential exfiltration and as a C2 for a RAT.
Detects the installation of malicious npm packages associated with the Shai-Hulud 2.0 supply chain attack campaign.
This query identifies an anomalous pattern associated with behavior performed by Sha1-Hulud to perform initial access, connect to C2, and establish persistence. Ref: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
This rule detects when an organization owner disables Dependabot alerts for private repositories or Dependabot security updates for all repositories within GitHub. Dependabot performs scans to detect insecure dependencies and sends alerts, so disabling these features can increase an organization's exposure to vulnerabilities.
Detects potential exploitation of the TARmageddon vulnerability (CVE-2025-62518) by identifying multiple writes to sensitive configuration files by the same process in a short time frame. This behavior can indicate a file overwrite attack where a malicious TAR archive smuggles and extracts a secondary file to hijack build processes or application configurations.
Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts.
This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.
This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.
Detects the creation or modification of a GitHub Actions workflow file that attempts to exfiltrate secrets. This pattern is associated with the Shai-Hulud worm, which injects malicious workflows to steal credentials using `toJSON(secrets)` and exfiltrate them using tools like `curl` and `base64`.
Malicious NPM Package Version Download
Cortex XDR
This rule detects the download or installation of known malicious NPM package versions by monitoring process command-line arguments for specific package names and versions. It targets common package managers like npm, yarn, and pnpm, as well as node.exe, to identify instances where a compromised or intentionally malicious package is being introduced into a development or production environment.
This rule detects network connections initiated by a process with a command line containing "filesystem", "--json", and "--results=verified", which is used to scan the entire filesystem.
This specific combination of command-line arguments is associated with the Shai-Hulud malware.
This specific combination of command-line arguments is associated with the Shai-Hulud malware.
Detects indicators associated with a supply chain attack compromising popular NPM packages like 'chalk' and 'debug'. The rule identifies network connections to known malicious domains and command-line activity related to the installation of compromised packages.
This power query is to detect NPM package is downloaded by the user, using the SentinelOne Singularity Power query.
Page 12 of 13