Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
259 detections
Filters
Last updated
All Time
Detection languages
127
47
23
16
14
Contributors
71
45
44
36
14
Categories
135
108
46
44
31
Platforms
176
147
110
22
10
Products / Services
68
57
39
34
15
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
IDS Classtypes
5
1
IDS Protocols
4
2
This rule detects attempts to download known malicious NPM packages from the public npm registry (registry.npmjs.org) by monitoring network connection logs. It specifically looks for tarball (.tgz) downloads of packages and versions that have been identified as compromised or malicious. The rule extracts the package name and version from the download URL and compares it against a predefined list of malicious packages for high-fidelity detection.
Detects the installation of specific malicious versions of several npm packages. Threat actors gained access to maintainer accounts via a phishing campaign and published compromised versions containing malware. The payloads ranged from a Windows-based information stealer (Scavenger) to a cross-platform JavaScript backdoor.
Detects Windows systems invoking rundll32.exe to execute DLLs associated with compromised npm package versions of eslint-config-prettier (10.1.6–10.1.9). These versions were published without corresponding GitHub commits and may initiate callbacks to FirebaseDotSu, indicating potential command-and-control activity.
Detects the installation of specific malicious npm packages associated with the North Korean "Contagious Interview" campaign. These packages are known to deliver the XORIndex malware loader.
Detects Octopus Scanner Malware.
This rule detects the creation of specific files associated with the Octopus Scanner malware. The malware creates files named 'Cache134.dat' and 'ExplorerSync.db' within the user's local AppData\Microsoft directory. This activity is indicative of the malware's presence and operation.
Detects Octopus Scanner Malware.
Page 13 of 13