Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
259 detections
Filters
Last updated
All Time
Detection languages
127
47
23
16
14
Contributors
71
45
44
36
14
Categories
135
108
46
44
31
Platforms
176
147
110
22
10
Products / Services
68
57
39
34
15
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
IDS Classtypes
5
1
IDS Protocols
4
2
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
This rule monitors file events to detect the presence of known malicious npm packages identified in a supply chain attack. It specifically checks for files created or modified within 'node_modules' directories that match a predefined list of malicious package names.
Detects the malicious Open VSX "recon" extension variant checking whether its own extension ID is referenced in the workspace devcontainer.json or .vscode/extensions.json to determine if the install was configuration-driven versus human-initiated
Detects HTTP network traffic containing the endpoint's local hostname transmitted within 30 seconds of a process starting, consistent with 'evil twin' Open VSX extensions that harvest developer environment metadata immediately upon activation.
Detects VS Code / Node.js extension host processes invoking command lines that reference CI/CD and repository environment variables (e.g., GITHUB_REPOSITORY, CI_PROJECT_PATH, Azure DevOps collection URI, Buildkite, CircleCI, Codespace, Gitpod), consistent with malicious Open VSX "evil twin" extensions harvesting developer and CI/CD metadata.
This rule monitors file events to detect the presence of known malicious npm packages identified in a supply chain attack. It specifically checks for files created or modified within 'node_modules' directories that match a predefined list of malicious package names.
Detects non-git processes such as VS Code, VS Code Server, or Node.js reading .git/HEAD or .git/refs files, which may indicate a malicious editor extension harvesting git repository metadata (branch names, commit refs) as observed in the Open VSX 'evil twin' extension campaign.
Detects a code editor process (VS Code, VS Code Insiders, code-server) opening or reading the .git/config or .git/HEAD file, which may indicate a malicious editor extension harvesting private repository and CI/CD configuration data, as seen in the Open VSX "evil twin" extension campaign.
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
Detects the execution of npm, pnpm, or yarn commands used to install or add specific beta releases of the @joyfill/layouts and @joyfill/components packages, which are known to contain malicious code designed to deliver a multi-stage RAT.
Detects a process accessing .git/config or .git/HEAD files followed by a network connection or HTTP request from the same agent within a short time window, consistent with the Open VSX 'evil twin' extension campaign harvesting private repository and CI metadata and exfiltrating it to attacker-controlled infrastructure.
Detects a settings.json (editor settings/telemetry opt-out) file read followed within a 30-second window by network transmission from the same host, a pattern consistent with the Open VSX 'evil twin' extension campaign in which extensions read local developer configuration/telemetry preference files and then exfiltrate the harvested data over the network.
Detects automated or scripted installation of VS Code extensions triggered via devcontainer.json provisioning or scripted parent processes (bash, sh, cmd.exe, powershell.exe, pwsh.exe, node.exe, python.exe, python3), flagging hosts with three or more install-extension invocations within a 5-minute window. This pattern is consistent with extension confusion / evil-twin extension campaigns abusing automated provisioning pipelines.
Detects VS Code / Node.js processes associated with editor extensions making outbound HTTP requests that contain CI/CD environment variable names (e.g. GITHUB_REPOSITORY, CI_PROJECT_PATH, GITLAB_CI, CIRCLECI, BUILDKITE, CODESPACES, GITPOD), consistent with the Open VSX 'evil twin' extension campaign that harvested private repository and CI/CD data from developer environments.
Detects installation of malicious "evil twin" Open VSX extensions impersonating AMD, Azure, or Salesforce that carry the tell-tale version 0.0.1 or 0.0.2, identified via file creation/write events in VS Code / Open VSX extension directories.
Detects command-line execution or application configuration referencing the disabling of TLS certificate verification, specifically using 'OpenSSL::SSL::VERIFY_NONE' or 'http.verify_mode'. This pattern is often indicative of malicious activity attempting to bypass secure communication validation, such as in supply chain attacks involving compromised dependencies or backdoors.
Detects an Xcode project or Git repository build-phase/pre-commit hook triggering an initial C2 beacon via curl GET /a?p=xcode_phase to retrieve the next infection stage.
Detects a code editor process (VS Code, Cursor, Windsurf, VSCodium) reading the MachineGuid registry value followed within 3-8 seconds by an outbound network connection to a non-private IP from the same process on the same host, consistent with Open VSX evil-twin extensions harvesting developer machine identifiers and exfiltrating fingerprinting data.
Detects the XCSSET zip_infect_finder worming module recursively traversing directories to infect Xcode projects packaged inside .zip archives.
Detects installation or require-time execution of known-malicious SleeperGem RubyGems package versions (git_credential_manager 2.8.0-2.8.3, Dendreo 1.1.3-1.1.4, fastlane-plugin-run_tests_firebase_testlab 0.3.2) via gem install/bin/install command lines, and matches the same version strings when found in Gemfile.lock dependency manifests.
Page 6 of 13