Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
733 detections
Filters
Last updated
All Time
Detection languages
362
124
60
58
35
Contributors
222
123
75
46
32
Categories
334
253
143
139
101
Platforms
525
383
290
80
34
Products / Services
161
158
114
72
47
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
733
CVEs
4
3
3
2
2
IDS Classtypes
17
2
1
1
IDS Protocols
15
2
2
1
Detects specific malicious activity patterns associated with the Miasma/Mini Shai-Hulud campaign targeting GitHub repositories. The rule monitors for unauthorized workflow creation, specific suspicious commit messages, and the use of orphan branches that impersonate dependabot or mimic specific campaign indicators.
Detects the creation of GitHub Actions workflow files within the .github/workflows/ directory that mimic Dependabot naming conventions while containing suspicious indicators associated with the Miasma/Mini Shai-Hulud supply chain attack. Indicators include hardcoded secret references, specific operational markers like 'RevokeAndItGoesKaboom', and unauthorized OIDC token permissions.
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Detects instances where npm or node processes execute potentially malicious scripts (such as 'tools/setup' or '.github/scripts/precheck') during the package installation lifecycle, specifically when operating within a 'node_modules' context. This is indicative of supply chain attacks where malicious actors inject code into project dependencies.
Detects the execution of non-JavaScript ELF binaries (e.g., Rust-compiled binaries) from within npm package directories or specific setup paths, typically during 'preinstall' or 'postinstall' npm lifecycle hooks. This behavior is indicative of potential supply-chain attacks where malicious code is executed during dependency installation.
Detects behavior associated with the IronWorm threat, including Tor-based command and control communication by unsigned binaries or Node.js processes, unauthorized DNS resolution of .onion domains, automated npm package management operations by Node.js, and git configuration modifications attempting to impersonate common developer automation identities.
Detects node.exe copying browser history files to temporary directories, associated with the protocal.cjs backdoor.
Detects instances where npm or node processes spawn child processes associated with common software supply chain attack patterns, specifically targeting 'preinstall' or setup lifecycle hooks as seen in IronWorm-like activity. The rule monitors for child processes executing in 'tools/setup', '.github/scripts/precheck', or within 'node_modules/.bin' directories while filtering out legitimate node-gyp build operations.
This rule monitors for suspicious child processes spawned by Node.js or npm-related processes (e.g., node, npm, node-gyp). It identifies potentially malicious activity such as shells, Python scripts, or custom scripts executing within the context of 'preinstall', 'postinstall', or 'binding.gyp' phases, which are common vectors for software supply chain compromises via malicious npm packages.
Detects potential supply chain attacks where a suspicious Python package is installed via 'pip' followed by execution of suspicious commands or network activity from 'python.exe' within a short timeframe. This rule correlates process creation events involving pip installations with subsequent suspicious command-line activity or external network connections from Python processes.
Detects node.exe and script execution patterns associated with the Polymarket Trap supply chain attack. The rule monitors for the usage of specific environment variables (e.g., DFC_SYNC_CONFIG), operator tags (e.g., piterpan), and C2 domain connections that indicate a malicious attempt to extract configuration data from an NPM package.json file.
Detects malicious npm package behavior where a postinstall lifecycle hook uses 'npm pack' or similar commands to overwrite local node_modules contents with a newer version, a technique used by packages like 'decimal-format-utils' to bypass static analysis.
Detects npm package installation activity or network communication originating from npm-related processes that involve identified malicious packages, maintainers, or scopes associated with supply chain attacks. Specifically monitors for the '@withgoogle' scope squatting, as well as specific malicious package names and maintainer accounts, and tracks related outbound network connections to suspicious C2 domains.
Detects malicious npm dependency sideloading where a node.exe process spawns cmd.exe from a path containing 'node_modules'. This rule specifically targets the behavior observed in the Polymarket Trap / wshu.net supply chain campaign, where indirect dependencies execute malicious scripts that bypass security restrictions by launching Windows command shells at runtime.
Detects malicious activity associated with npm supply chain compromise, including execution of known malicious npm lifecycle scripts, DNS queries to suspected C2 domains, and unauthorized access to sensitive developer credential files (such as .npmrc, .aws/credentials, and SSH keys) by Node.js processes.
This rule detects potentially malicious activity related to Node.js environments. It monitors for the execution of Node.js or NPM commands involving specific sensitive files ('sync-peer.cjs', 'peer-math.js') or suspicious packing destinations, as well as the creation of 'index.js' or 'package.json' files within a 'node_modules' directory, which can indicate software supply chain manipulation or malicious dependency installation.
Detects Node.js processes or npm-related parent processes writing suspicious files (e.g., .cjs, .tgz, package.json) into the node_modules directory. This behavior is often indicative of malicious supply chain activities, such as dependency confusion or post-install script injections observed in campaigns like Operation Poisson.
This rule detects potentially malicious activity associated with the MetaKit software, including DNS lookups to the 'metakit.fireant.vn' update server and the execution of 'setup.exe' processes spawned by parent processes associated with 'metakit'. This pattern is indicative of potential supply-chain execution or suspicious software update behavior.
Page 19 of 35