Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
733 detections
Filters
Last updated
All Time
Detection languages
362
124
60
58
35
Contributors
222
123
75
46
32
Categories
334
253
143
139
101
Platforms
525
383
290
80
34
Products / Services
161
158
114
72
47
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
733
CVEs
4
3
3
2
2
IDS Classtypes
17
2
1
1
IDS Protocols
15
2
2
1
Detects Visual Studio Code or Cursor IDE spawning a node.js process that executes a payload disguised as a .woff2 font file. This behavior is associated with supply chain attacks where malicious npm packages use hidden VS Code workspace tasks (e.g., folderOpen) to execute arbitrary code.
Detects Node.js executing the malicious setup.cjs script or easy-day-js with the --no-warnings flag, associated with the Mastra npm supply chain compromise.
Detects suspicious activities associated with malicious npm package installations, including Node.js spawning shells during lifecycle hooks (preinstall, postinstall), connections to known command-and-control (C2) domains used in software supply chain campaigns, and the creation of artifacts within the node_modules directory.
This rule detects the installation and execution of malicious typosquatted npm packages associated with the Polymarket Trap campaign. It monitors for the creation of specific directory names within node_modules, npm install commands referencing these package names, and network activity or DNS lookups to 'log-taker' infrastructure from Node.js processes.
Detects anomalous self-upgrade behavior in npm packages where a node process spawns child processes using npm pack or specific command-line arguments to overwrite installed package files. This pattern is associated with malicious supply chain activity, specifically seen in the wshu.net campaign where packages download and replace their own contents at runtime.
Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.
Detects the use of curl.exe to upload files to the temp.sh service while simultaneously passing the resulting temp.sh URL within the User-Agent string to a C2 server. This specific exfiltration and beaconing TTP was observed in the Notepad++ supply chain attack.
Detects the use of Node.js package managers (npm, node, npx) to execute 'install' commands in conjunction with the creation of specific Model Context Protocol (MCP) configuration files (.vscode/mcp.json, .amazonq/mcp.json, or .cursor/mcp.json). This pattern may indicate the installation of potentially untrusted or malicious development extensions or AI-assistant integrations within common development environments.
Detects PowerShell execution patterns used for host reconnaissance and application enumeration, specifically looking for combinations of Get-StartApps and Get-AppxPackage with silent error handling. This behavior was observed in the easy-day-js malware dropped via the Mastra npm supply chain compromise.
Detects network connections from Node.js or Bun runtime processes to common cloud instance metadata service IPs (AWS, Azure, GCP) or to the default HashiCorp Vault port (8200). This activity can indicate credential access attempts, especially in the context of a supply chain attack where malicious code might be injected into a Node.js/Bun application to exfiltrate sensitive information or gain further access. The rule correlates network connection events with process execution events to identify the specific runtime responsible.
Detects the creation of hidden tracking files (.pkg_history and .pkg_logs) in the system's temporary directory. These markers are dropped by the setup.cjs dropper as part of the easy-day-js typosquat in the Mastra npm supply chain compromise.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects the use of weaponized GitHub Actions workflows (e.g., impersonating 'Run Copilot' or 'Dependabot Updates') designed to exfiltrate CI/CD secrets via artifacts, as observed in the Miasma/Mini Shai-Hulud supply chain campaign.
Detects anomalous bulk publication of NPM packages by a specific compromised maintainer account (czirker) targeting the LeoPlatform and LeoInsights organizations, indicative of malicious propagation behavior similar to the Miasma worm.
Detects the execution of processes with command-line arguments containing keywords related to known supply chain attacks (e.g., solarwinds, 3cx, kaseya, npm, pypi). This rule is intended for threat hunting to identify potential exploitation attempts or malicious activity involving software supply chain components.
Detects the creation of suspicious IDE configuration files (e.g., .vscode/tasks.json or .claude/index.js) associated with the poisoned verana-blockchain Go module, as well as the subsequent execution of these files by the Node.js runtime. This detection aims to identify supply chain compromise attempts targeting developers.
Detects Node.js executing the malicious setup.cjs script or easy-day-js with the --no-warnings flag, associated with the Mastra npm supply chain compromise.
This rule detects potentially malicious software supply chain activity by monitoring for the execution of 'node-gyp' or 'node-pre-gyp' during the installation of Node.js packages (e.g., via npm or yarn). It specifically flags instances where the process or its parent involves suspicious file names or directory paths often associated with 'Miasma' supply chain campaigns, such as references to 'leo-logger', 'binding.gyp', or 'index.js' inside 'node_modules' directories.
Detects a sequence of reconnaissance commands (whoami, tasklist, systeminfo, netstat) executed by the command prompt and piped to a text file. This specific TTP was used in the Notepad++ supply chain attack to gather system information for exfiltration. The detection is scoped to specific AppData directories to reduce false positives.
Detects new app installations, expansions of OAuth scopes, or the addition of collaborators to Slack applications. These activities can indicate an adversary attempting to gain persistent access, escalate privileges, or exfiltrate data from Slack by leveraging malicious or compromised applications.
Detects unauthorized npm package publication events triggered by specific compromised maintainer accounts (czirker, llxlr) associated with the Miasma/Mini Shai-Hulud supply chain attack campaign, specifically targeting LeoPlatform or Verana Blockchain related packages.
Page 20 of 35