Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
733 detections
Filters
Last updated
All Time
Detection languages
362
124
60
58
35
Contributors
222
123
75
46
32
Categories
334
253
143
139
101
Platforms
525
383
290
80
34
Products / Services
161
158
114
72
47
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
733
CVEs
4
3
3
2
2
IDS Classtypes
17
2
1
1
IDS Protocols
15
2
2
1
Detects unexpected child processes spawned from directories associated with AI coding agent plugins (e.g., Claude Code, Copilot, Codex, Gemini CLI). This activity could indicate post-exploitation behavior, such as Plugin4Shell, where a malicious plugin auto-update facilitates remote code execution.
Detects anomalous git operations initiated by AI coding agents (e.g., Claude, Copilot, Gemini-cli) that suggest potential supply chain tampering. The rule identifies attempts to checkout via a raw SHA-1 hash, git refname ambiguity warnings, or mismatches between the pinned plugin manifest commit SHA and the actual HEAD SHA resolved during operations, which may indicate a malicious substitution of code during dependency installation or updates.
Detects compromised versions (2.35 and 2.36) of the 'Admin Menu Editor Pro' WordPress plugin that were distributed via the official update infrastructure. These versions include embedded web shell code, as indicated by the presence of both plugin identification strings and common PHP execution or command-line utility functions used in backdoors.
Detects the presence of PHP web shell code within specific versions (2.35/2.36) of the Admin Menu Editor Pro plugin. This rule targets malicious files introduced via a supply chain compromise of the plugin's update distribution channel, specifically looking for common PHP obfuscation and execution functions associated with web shells.
Detects the execution of the 'bun' JavaScript runtime invoking 'index.js' in the context of an npm package installation. This pattern is characteristic of the Shai-Hulud worm, which leverages the npm preinstall lifecycle hook to execute malicious code. The rule identifies suspicious process lineage where 'npm' spawns 'bun' for immediate payload execution, allowing for detection of the technique rather than specific artifacts.
Detects DNS queries or network connections to the itorrents.org domain, which has been identified as a compromised repository used in the MovieReaper supply-chain campaign to distribute malicious torrent files.
Detects the presence of known malicious RubyGems package names and Cross-Site Scripting (XSS) payloads within process commands, file paths, or network URLs, indicative of an attempt to target repository registries or administrative interfaces with supply chain injection attacks.
This rule detects potential web shell activity within the 'Admin Menu Editor Pro' WordPress plugin. It searches for PHP files containing a combination of sensitive execution functions (e.g., eval, base64_decode, system) which are characteristic of the malicious code injected into versions 2.35/2.36 of the plugin during its supply chain compromise.
This rule detects the use of 'npm' or 'node' to install packages from a registry other than trusted, standard registries (e.g., npmjs.org, GitHub). It specifically monitors command lines involving 'claude-code' that utilize custom, non-standard registry URLs. This behavior is indicative of potential supply chain attacks or the installation of unauthorized/malicious dependencies.
Detects BeaverTail JavaScript-based loader malware hidden inside NPM packages, distributed via GitHub or Bitbucket during fake technical interviews
Detects BeaverTail JavaScript-based loader malware hidden inside NPM packages, distributed via GitHub or Bitbucket during fake technical interviews
Detects an AI coding assistant (e.g., Claude, Copilot, Gemini CLI) attempting to checkout a Git repository and subsequently failing a manual verification check (git rev-parse HEAD) against an expected pinned commit hash. This behavior is indicative of a Plugin4Shell-style supply chain attack attempt, where an adversary tries to inject malicious code into a repository that the AI agent is instructed to use.
Detects suspicious activities in GitHub audit logs that could indicate RepoJacking or SkillJacking attempts, specifically focusing on repository ownership transfers, default branch modifications, repository deletion, and changes to organizational membership or roles.
Detects usage of the 'gem' command (install, build, push, publish) that includes naming patterns or specific command strings associated with the GemStuffer supply chain compromise campaign. This targets attempts to introduce malicious dependencies into the environment using RubyGems.
Detects the presence of PHP web shell code within the Admin Menu Editor Pro WordPress plugin directory. This rule targets indicators of a supply chain compromise where a legitimate plugin update is backdoored to include malicious PHP code designed for remote command execution via HTTP requests.
Detects download or installation attempts of specific trojanized versions (2.35 and 2.36) of the Admin Menu Editor Pro plugin, which were distributed via a compromised update channel on adminmenueditor.com.
Detects the execution of the Bun JavaScript runtime invoking 'index.js' as part of an npm lifecycle event (such as preinstall). This pattern is commonly used in supply chain attacks to execute arbitrary code during the installation of malicious packages.
Detects the execution of the Bun JavaScript runtime invoking 'index.js' as part of an npm lifecycle event (such as preinstall). This pattern is commonly used in supply chain attacks to execute arbitrary code during the installation of malicious packages.
This rule detects the presence of specific file hashes known to be associated with backdoored software builds, specifically related to recent supply chain compromises affecting South Korean software vendors (e.g., HAProxy builds). It monitors device file events, process initiation, and identity logon events to identify systems that have deployed, executed, or been accessed by these malicious binaries.
This rule identifies developer or contractor workstations that have Node.js/npm installed but currently lack active EDR sensor coverage (i.e., the sensor is either not onboarded or not in an active state). It employs a 24-hour grace period to filter out transient onboarding issues and ensures that the device has reported activity within the last 7 days to avoid alerting on decommissioned hardware. This gap in visibility increases the risk of undetected supply-chain malware execution and credential theft on sensitive developer endpoints.
This rule identifies developer or contractor workstations that have Node.js/npm installed but currently lack active EDR sensor coverage (i.e., the sensor is either not onboarded or not in an active state). It employs a 24-hour grace period to filter out transient onboarding issues and ensures that the device has reported activity within the last 7 days to avoid alerting on decommissioned hardware. This gap in visibility increases the risk of undetected supply-chain malware execution and credential theft on sensitive developer endpoints.
Page 10 of 35