Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
733 detections
Filters
Last updated
All Time
Detection languages
362
124
60
58
35
Contributors
222
123
75
46
32
Categories
334
253
143
139
101
Platforms
525
383
290
80
34
Products / Services
161
158
114
72
47
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
733
CVEs
4
3
3
2
2
IDS Classtypes
17
2
1
1
IDS Protocols
15
2
2
1
Detects the execution of Node.js scripts associated with the Polymarket Trap / Trum3it npm supply chain campaign. This rule monitors process launch events for Node.js command lines that include suspicious lifecycle hook scripts (e.g., install-check.cjs, postinstall-run.js) often used by malicious packages to achieve initial code execution on developer machines.
Detects the execution of a malicious npm package ('@withgoogle/stitch-sdk') which uses scope-squatting to impersonate a legitimate library. The rule flags the execution of preinstall scripts that involve references to the malicious exfiltration domain 'stitch-production.org' or the identified maintainer 'maximus-mcmillan', indicating unauthorized credential harvesting.
This rule detects an unusually high number of command-line executions containing keywords related to 'dependency' or 'library' and 'update' or 'upgrade' within a one-hour window on a single computer. This behavior could indicate an adversary attempting to modify system components, install malicious libraries, or compromise the software supply chain by frequently updating or upgrading software dependencies.
This rule detects a high volume of file creation events (100 or more within an hour) occurring in common development-related directories such as 'node_modules', 'packages', or 'vendor'. This activity can be indicative of legitimate software development processes like dependency installation or project builds. However, it can also signal malicious activity, particularly if observed on systems not typically used for development, or as part of a supply chain compromise where malicious dependencies are being introduced or built.
This rule detects a high frequency of process creations (Event ID 4688) with command-line arguments containing keywords indicative of software publishing or deployment, such as 'publish', 'deploy', 'artifact', or 'release'. A count of 3 or more such events within a one-hour window from the same computer and account is considered suspicious. This pattern could indicate legitimate CI/CD activities, but also potential abuse of software deployment tools or a software supply chain compromise by an adversary.
This rule detects the creation of 'requirements.txt' or 'pom.xml' files on a system. These files are commonly used in software development projects (Python and Java/Maven, respectively) to manage dependencies and project configurations. Monitoring their creation can help identify legitimate development activities, but also potential malicious actions such as supply chain compromise where an adversary might introduce or modify project dependencies.
This rule detects processes making a high number of successful network connections (10 or more within an hour) to known public container registries such as docker.io or quay.io. This activity could indicate legitimate containerization operations, but also potential malicious activity like downloading malicious container images as part of a supply chain attack, or ingress of tools.
Detects instances where a node.exe process, operating in an npm install or lifecycle hook context, executes a child process (such as cmd, powershell, or bash) that matches known suspicious patterns or actor-defined malicious filenames, indicative of potential supply chain compromise via malicious npm packages.
Detects instances where npm or node.exe spawn shell interpreters (cmd.exe, powershell.exe, bash, sh) with suspicious command-line arguments indicative of malicious activity, such as credential harvesting or unauthorized script execution within package lifecycle hooks (postinstall, preinstall). This is associated with supply chain attacks like the Miasma infostealer and MYRA RAT.
Detects unauthorized access to SSH private key files by processes spawned directly or indirectly from npm lifecycle hooks (e.g., postinstall, preinstall). This behavioral pattern is associated with supply chain attacks such as the Miasma infostealer, where malicious dependencies attempt to exfiltrate credentials during the installation phase.
Detects a malicious post-install technique where an npm package utilizes node.exe to perform an 'npm pack' and overwrite critical files within the node_modules directory. This behavior, observed in the Miasma/Polymarket Trap, is designed to bypass static analysis performed during initial installation by swapping legitimate files with malicious variants after the fact.
Detects a Node.js process spawning a detached JavaScript file with a randomly generated 24-character hexadecimal filename in a temporary directory. This behavior is indicative of the stage-2 payload execution observed in the Mastra npm supply chain attack (easy-day-js typosquat).
Detects a Node.js process spawning a detached JavaScript file with a randomly generated 24-character hexadecimal filename in a temporary directory. This behavior is indicative of the stage-2 payload execution observed in the Mastra npm supply chain attack (easy-day-js typosquat).
Detects attempts to create rogue WordPress administrator accounts using indicators associated with the OptinMonster/TrustPulse supply chain attack. The rule specifically looks for POST requests to WordPress user creation endpoints (REST API, admin form, AJAX) containing campaign-specific identifiers like 'developer_api1', 'customer1usx', or patterns like 'dev_xxxxxx' in the response body or request URL. This covers the known vectors of the attack, aiming to identify the unauthorized creation of administrative users.
Detects node.exe spawning powershell.exe as a child process, consistent with malicious npm postinstall lifecycle hooks used by the PostCSS typosquatting campaign (postcss-minify-selector-parser / postcss-minify-selector). The attack chain decrypts an AES-256-GCM blob at runtime and executes a PowerShell downloader stage.
Detects PowerShell execution patterns used for host reconnaissance and application enumeration, specifically looking for combinations of Get-StartApps and Get-AppxPackage with silent error handling. This behavior was observed in the easy-day-js malware dropped via the Mastra npm supply chain compromise.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories. This activity is indicative of data staging or exfiltration, specifically linked to the 'protocal.cjs' backdoor from the 'easy-day-js' supply chain attack.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
This rule detects potentially malicious child processes spawned by Node.js or npm, as well as specific file activity related to VS Code configuration or Node module directories that may indicate supply chain or development environment tampering. It flags processes like cmd.exe, powershell.exe, or python.exe being executed by code.exe or node.exe, and monitors for modifications to tasks.json or eslint-check files within sensitive directories.
Detects a web process modifying a .php file within WooCommerce paths, immediately followed by a DNS resolution for the 'generate.2faplugin.org' domain. This activity is indicative of the ShapedPlugin supply chain compromise where backdoored plugins are distributed, leading to file modification and subsequent communication with a malicious 2FA plugin domain.
Page 22 of 35