Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
733 detections
Filters
Last updated
All Time
Detection languages
362
124
60
58
35
Contributors
222
123
75
46
32
Categories
334
253
143
139
101
Platforms
525
383
290
80
34
Products / Services
161
158
114
72
47
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
733
CVEs
4
3
3
2
2
IDS Classtypes
17
2
1
1
IDS Protocols
15
2
2
1
Detects the execution of npm install commands that include known malicious package names associated with a supply chain attack linked to the Lazarus Group. These packages are designed to impersonate the legitimate 'rollup-plugin-polyfill-node' package.
Detects signs of a supply chain attack, specifically referencing the IronWorm/Shai-Hulud pattern, involving the backdating of git commits, manipulation of git environment variables (GIT_COMMITTER_DATE/GIT_AUTHOR_DATE) to mask malicious activity history, and the use of 'touch' commands to modify file timestamps on project-related binaries and configuration files.
Detects the autonomous execution of package manager commands (pip, npm, yarn) initiated by processes associated with AI agent pipelines, automation scripts, or CI/CD runners. This behavior is indicative of potential malicious activity where automated agents may be tricked into installing hallucinated or malicious packages from untrusted domains without human oversight.
Detects instances where common package management utilities (pip, npm, wget, curl) establish network connections to domains outside of verified official package registry endpoints. This pattern is often used in software supply chain attacks to retrieve malicious packages from attacker-controlled infrastructure.
Detects the installation of known malicious npm packages designed to impersonate the legitimate 'rollup-plugin-polyfill-node' dependency. This pattern is associated with Lazarus Group supply chain attacks targeting developer environments and CI/CD pipelines.
This rule detects node.js processes, typically initiated via npm or during package installation scripts, accessing sensitive Claude Code configuration or credential files. This behavior is indicative of a malicious supply chain attack where a compromised npm package attempts to exfiltrate developer authentication secrets.
Detects Node.js executing the malicious setup.cjs script or easy-day-js with the --no-warnings flag, associated with the Mastra npm supply chain compromise.
Detects a suspicious sequence of events involving the creation of an .amazonq/mcp.json file shortly after a git clone operation, followed by an AI coding assistant (Amazon Q, VS Code, Cursor, Windsurf) spawning runtime interpreters (node, npx, python). This behavior aligns with potential exploitation attempts against AI-assisted development environments, such as CVE-2026-12957, where malicious configuration files are used to trigger unauthorized code execution.
Detects the spawning of potential Model Context Protocol (MCP) server processes immediately following or by package installation commands (npm, pip). This behavior is characteristic of malicious packages or typosquatted dependencies attempting to register or execute a malicious MCP server configuration upon installation in a developer environment.
Detects the execution of known malicious or hijacked npm and Go packages associated with the Lazarus Group 'Contagious Interview' supply chain campaign. The rule monitors for node.exe or go.exe spawning unexpected child processes like shells or download utilities (e.g., curl, powershell) and the presence of specific malicious package names in command lines.
Detects anomalous child process execution spawned by Lunar Client or associated Java runtime processes, typically stemming from a malicious Modrinth modpack. This exploit path leverages Electron framework vulnerabilities to execute arbitrary system binaries (e.g., cmd.exe, powershell.exe, explorer.exe) via shell commands triggered by modpack installation or execution.
Detects node.exe spawning cmd.exe or powershell.exe during npm package installation process, indicating potential malicious use of preinstall or postinstall scripts. This pattern has been observed in supply chain attacks involving infostealers like Miasma and MYRA.
Detects network proxy activity associated with the 'Polymarket Trap' supply chain attack, where developers are lured into cloning a fake arbitrage bot repository or fetching malicious npm packages from the wshu.net domain. The rule monitors for access to known malicious repositories (Trum3it/polymarket-arbitrage-bot) and malicious dependencies (clob-client-math).
Detects instances where npm or node processes execute suspicious shell commands or scripts, often associated with software supply chain attacks. The rule looks for child processes like shell interpreters (sh, bash) or utilities (curl, wget, python) initiated by node/npm, combined with suspicious command-line patterns indicative of obfuscated execution or malicious package lifecycle scripts.
This rule detects when package management tools like npm or go get spawn suspicious child processes, such as interpreters (python, powershell, cmd, bash) or utility binaries (mshta, wscript), during the installation lifecycle. This behavior is indicative of malicious code execution triggered by compromised or hijacked software packages.
Detects the installation of known malicious npm packages designed to impersonate the legitimate 'rollup-plugin-polyfill-node' dependency. This pattern is associated with Lazarus Group supply chain attacks targeting developer environments and CI/CD pipelines.
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Detects instances where package managers like npm, pip, or python execute shells or scripting interpreters with command-line arguments indicative of software installation or build processes. This pattern is common in supply chain attacks where malicious packages run code during their installation phase.
Detects anomalous process spawning where VS Code or Amazon Q language server processes (e.g., node, amazonq-lsp) execute shell utilities (e.g., bash, curl) with arguments related to .amazonq/mcp.json or specific credential/exfiltration commands. This behavior is associated with the exploitation of the MCP server auto-execution vulnerability (CVE-2026-12957).
Detects instances where 'node.exe' is observed copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories. This activity is indicative of data staging or exfiltration, specifically linked to the 'protocal.cjs' backdoor from the 'easy-day-js' supply chain attack.
Detects unauthorized execution of native binaries initiated by npm during the package installation process. This rule targets the IronWorm supply-chain campaign, where compromised npm packages utilize preinstall hooks or node-gyp build processes to execute malicious binaries (often Rust-based) from unconventional paths within the package directory.
Page 16 of 35