Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
733 detections
Filters
Last updated
All Time
Detection languages
362
124
60
58
35
Contributors
222
123
75
46
32
Categories
334
253
143
139
101
Platforms
525
383
290
80
34
Products / Services
161
158
114
72
47
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
733
CVEs
4
3
3
2
2
IDS Classtypes
17
2
1
1
IDS Protocols
15
2
2
1
This rule detects potential supply chain compromise in Node.js projects by monitoring for the execution of known malicious npm package install/preinstall/postinstall scripts. It identifies unauthorized access to sensitive developer credential files (such as .ssh, .git-credentials, and .npmrc) and suspicious network outbound connections associated with identified malicious package scopes.
Detects the execution of Node.js lifecycle scripts (preinstall, postinstall, install-check, etc.) that trigger secondary process execution, such as command shells, downloaders (curl, wget), or security utilities (certutil, bitsadmin). This behavior is often associated with malicious npm package supply chain attacks aimed at downloading secondary payloads during installation.
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
Detects the execution of npm lifecycle scripts (such as postinstall, preinstall, or custom install-related scripts) by node.exe. These scripts are frequently abused in supply chain attacks to execute malicious code automatically when a package is installed.
This rule detects a sequence of suspicious activities: the creation or modification of an executable file (.exe or .dll) within a directory path containing update-related keywords, followed by the execution of a file in that same location, and culminating in an outbound network connection from that process. This pattern is characteristic of a software supply chain compromise or an adversary deploying a malicious payload via a fake or compromised update mechanism.
Detects command lines that reference known supply chain attack targets or commonly used package management tools like npm and pypi, which can be indicators of supply chain compromise.
Detects the post-download execution stage of the abdrizak PostCSS typosquatting Windows RAT campaign. Covers three indicators: (1) wscript.exe executing a .vbs file from %TEMP% or subdirectory (e.g. update.vbs from winPatch), (2) chost.exe or any process launching loader.py as a command-line argument, (3) cmd.exe using tar to extract a .zip archive from %TEMP%.
This rule monitors process creation events for 'git' or 'npm' command-line activities that are highly indicative of potential software supply chain attacks. It triggers when known malicious package names or suspicious patterns are detected within command-line arguments, or when a workflow involves a git clone followed by subsequent npm installation, which is a common vector for deploying malicious dependencies.
Detects Node.js executing the malicious 'setup.cjs' script with the '--no-warnings' flag. This execution sequence is associated with the 'easy-day-js' typosquat postinstall hook used in the Mastra npm supply chain compromise.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects the creation of specific AI assistant configuration files (e.g., Cursor, Claude, Gemini, VS Code) by alternative runtimes. The Miasma malware targets modern AI coding assistants to inject hidden backdoors that trigger automatically when projects are opened.
Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.
Detects Node.js executing the malicious setup.cjs script or easy-day-js with the --no-warnings flag, associated with the Mastra npm supply chain compromise.
Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.
This rule monitors network logs (proxy, DNS, network) for connections to domains associated with the Unistream SDK. This SDK has been identified as a component of the BadBlocker malicious Chrome extension family, which facilitates unauthorized background activity. The rule serves as an indicator of potential command and control (C2) communication from a compromised host.
This rule detects suspicious activity associated with the Bun runtime after an npm package install. It flags instances where Bun, or download utilities (curl/wget) fetching 'bun.sh', are spawned from Node.js-related processes (npm, node, node-gyp) particularly when located in common temporary or cache directories, indicating potential supply chain compromise or unauthorized runtime deployment during build processes.
This rule detects a sequence of suspicious activities: the creation or modification of an executable file (.exe or .dll) within a directory path containing update-related keywords, followed by the execution of a file in that same location, and culminating in an outbound network connection from that process. This pattern is characteristic of a software supply chain compromise or an adversary deploying a malicious payload via a fake or compromised update mechanism.
Identifies file, registry, network, and process indicators associated with the @mastra/* npm supply chain compromise. This rule detects the presence of specific malicious files, registry modifications for persistence, outbound network connections to known command and control (C2) infrastructure, and the execution of malicious scripts related to the attack.
This rule detects the suspicious execution of the Bun runtime spawned as a child process of Node.js or during npm package installation, which is a pattern observed in the Miasma/Mini Shai-Hulud supply chain attacks. It monitors for child processes named 'bun' or 'bun.exe' initiated by Node.js, or activities involving 'bun run _index.js' and 'node-gyp' which are characteristic of loader chains used to facilitate credential theft during package installation.
Detects unauthorized npm package publish events or file uploads associated with compromised maintainer accounts (czirker, llxlr) and specific malicious packages linked to the Miasma Mini Shai-Hulud supply chain attack.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Page 18 of 35