Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
733 detections
Filters
Last updated
All Time
Detection languages
362
124
60
58
35
Contributors
222
123
75
46
32
Categories
334
253
143
139
101
Platforms
525
383
290
80
34
Products / Services
161
158
114
72
47
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
733
CVEs
4
3
3
2
2
IDS Classtypes
17
2
1
1
IDS Protocols
15
2
2
1
This rule identifies developer or contractor workstations that have Node.js/npm installed but currently lack active EDR sensor coverage (i.e., the sensor is either not onboarded or not in an active state). It employs a 24-hour grace period to filter out transient onboarding issues and ensures that the device has reported activity within the last 7 days to avoid alerting on decommissioned hardware. This gap in visibility increases the risk of undetected supply-chain malware execution and credential theft on sensitive developer endpoints.
This rule identifies developer or contractor workstations that have Node.js/npm installed but currently lack active EDR sensor coverage (i.e., the sensor is either not onboarded or not in an active state). It employs a 24-hour grace period to filter out transient onboarding issues and ensures that the device has reported activity within the last 7 days to avoid alerting on decommissioned hardware. This gap in visibility increases the risk of undetected supply-chain malware execution and credential theft on sensitive developer endpoints.
Detects usage of the 'gem' command (install, build, push, publish) that includes naming patterns or specific command strings associated with the GemStuffer supply chain compromise campaign. This targets attempts to introduce malicious dependencies into the environment using RubyGems.
Detects potential installation of compromised Admin Menu Editor Pro plugin updates by identifying sequential download events for specific plugin versions from the 'adminmenueditor.com' domain within a 24-hour window. This behavior is indicative of a supply chain attack where a legitimate update mechanism is leveraged to deliver malicious payloads without integrity verification.
Detects the creation of a git branch with a name consisting of exactly 40 hexadecimal characters. This naming convention is a known technique used to bypass security controls such as commit-pin verification in AI coding agent plugins and other CI/CD integrations (often associated with Plugin4Shell research).
Detects the creation of git branches named as a 40-character hexadecimal string, which corresponds to a full commit SHA. This naming convention is a technique used to perform checkout-hijacking, potentially allowing an attacker to override files or deceive automated processes that rely on branch-specific logic.
Detects outbound HTTP requests to the 'itorrents.org' repository for files with the '.torrent' extension, which may indicate the retrieval of malicious payload components associated with the MovieReaper supply chain campaign.
Detects high-velocity publication of Ruby packages by an account that uses naming conventions related to 'OAI' or a known-malicious contact email. This behavior is indicative of a supply chain attack involving the automated deployment of numerous malicious packages to the RubyGems ecosystem.
Detects high-velocity publication of Ruby packages by an account that uses naming conventions related to 'OAI' or a known-malicious contact email. This behavior is indicative of a supply chain attack involving the automated deployment of numerous malicious packages to the RubyGems ecosystem.
Detects the installation of software packages in build or CI pipelines where the package was published to its registry between 30 and 90 days prior to being first used in the environment. This pattern is indicative of potential dependency confusion or typosquatting attacks, where adversaries use newly created packages to deliver malicious code.
Detects the installation of software packages in build or CI pipelines where the package was published to its registry between 30 and 90 days prior to being first used in the environment. This pattern is indicative of potential dependency confusion or typosquatting attacks, where adversaries use newly created packages to deliver malicious code.
Detects the publication or upload of RubyGems packages containing embedded Server-Side Template Injection (SSTI) payloads within their author metadata, specifically targeting common testing strings like '<%= 7*7 %>'. This behavior is indicative of supply chain testing or potential exploitation attempts against package registry infrastructure or downstream consumers.
Detects outbound HTTP requests from the internal network to the domain 'adminmenueditor.com'. This domain has been associated with a compromised software supply chain attack targeting the Admin Menu Editor Pro WordPress plugin, which was used to distribute malicious code to users.
This rule detects network traffic directed at a potentially compromised server associated with the Admin Menu Editor Pro plugin, specifically looking for HTTP requests that indicate an attempt to download a malicious update.
Detects node.js or bun runtime processes accessing known sensitive cloud, CI, and package manager credential files on disk. This behavior is indicative of malicious npm supply chain attacks (e.g., Mini Shai-Hulud) attempting to exfiltrate secrets stored in standard configuration paths.
Detects the installation of software packages in build or CI pipelines where the package was published to its registry between 30 and 90 days prior to being first used in the environment. This pattern is indicative of potential dependency confusion or typosquatting attacks, where adversaries use newly created packages to deliver malicious code.
Detects high-velocity publication of Ruby packages by an account that uses naming conventions related to 'OAI' or a known-malicious contact email. This behavior is indicative of a supply chain attack involving the automated deployment of numerous malicious packages to the RubyGems ecosystem.
Detects the installation of software packages in build or CI pipelines where the package was published to its registry between 30 and 90 days prior to being first used in the environment. This pattern is indicative of potential dependency confusion or typosquatting attacks, where adversaries use newly created packages to deliver malicious code.
This rule detects the presence of specific file hashes known to be associated with backdoored software builds, specifically related to recent supply chain compromises affecting South Korean software vendors (e.g., HAProxy builds). It monitors device file events, process initiation, and identity logon events to identify systems that have deployed, executed, or been accessed by these malicious binaries.
Detects anomalous actions within the Coder registry, such as template creation, version updates, or dry-run/workspace builds with module caching disabled, that occurred during a known registry compromise window on August 31, 2026.
Detects cached malicious dlp.sh/dlp-docker.sh Terraform module artifacts served from the compromised registry.coder.com infrastructure
Page 11 of 35