Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
733 detections
Filters
Last updated
All Time
Detection languages
362
124
60
58
35
Contributors
222
123
75
46
32
Categories
334
253
143
139
101
Platforms
525
383
290
80
34
Products / Services
161
158
114
72
47
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
733
CVEs
4
3
3
2
2
IDS Classtypes
17
2
1
1
IDS Protocols
15
2
2
1
Detects a Node.js process spawning a detached JavaScript file with a randomly generated 24-character hexadecimal filename in a temporary directory. This behavior is indicative of the stage-2 payload execution observed in the Mastra npm supply chain attack (easy-day-js typosquat).
Detects suspicious execution patterns (such as encoded commands, downloading files via web clients, or using administration utilities) originating from third-party update, monitoring, or deployment agents. This behavior is indicative of a supply chain compromise or malicious activity leveraging trusted binaries to execute arbitrary code.
Detects Content Security Policy (CSP) violation reports or network traffic containing references to 'netdna-ssl.com' or 'netdna-cdn.com'. These hostnames are legacy CDN domains that have been re-registered, presenting a significant supply chain risk where malicious content could be injected into web applications loading resources from these domains.
This rule detects the creation or modification of generic executable files (e.g., 'me.exe', 'update.exe') within the Hola installation directory. It specifically looks for executables whose names match common updater or service patterns and whose process command line includes 'hola', 'update', or 'installer'. This activity could indicate a compromised delivery pipeline or supply chain attack, as observed with the Hola browser.
This rule detects potentially malicious software supply chain activity by monitoring for the execution of 'node-gyp' or 'node-pre-gyp' during the installation of Node.js packages (e.g., via npm or yarn). It specifically flags instances where the process or its parent involves suspicious file names or directory paths often associated with 'Miasma' supply chain campaigns, such as references to 'leo-logger', 'binding.gyp', or 'index.js' inside 'node_modules' directories.
Detects DNS queries and network connections to 'netdna-ssl.com' and its subdomains, as well as specific IP addresses (104.21.72.58, 172.67.175.240) associated with the re-registered domain. This domain was re-registered by a third party in July 2025 and now resolves legacy WP Engine CDN hostnames, creating a potential supply chain risk.
Detects node.exe spawning powershell.exe as a child process, consistent with malicious npm postinstall lifecycle hooks used by the PostCSS typosquatting campaign (postcss-minify-selector-parser / postcss-minify-selector). The attack chain decrypts an AES-256-GCM blob at runtime and executes a PowerShell downloader stage.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories. This activity is associated with the 'protocal.cjs' backdoor from the easy-day-js supply chain attack, which aims to exfiltrate sensitive browser data.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
Detects anomalous child process creation from the Lunar Minecraft Client or its associated Java processes (java.exe/javaw.exe). This rule identifies potential supply-chain exploitation, where malicious mods or the client itself spawn shell interpreters (e.g., cmd.exe, powershell.exe, wscript.exe) or other suspicious binaries from the application's directory, which is characteristic of the lunar-modrinth-chain-poc exploit.
Detects the execution of Node.js processes associated with hijacked npm packages 'html-to-gutenberg' and 'fetch-page-assets'. The rule monitors for 'node' or 'node-gyp' processes spawned in conjunction with command-line arguments or file paths referencing these specific malicious packages, which are known to use binding.gyp command expansion for unauthorized code execution.
Detects command lines that reference known supply chain attack targets or commonly used package management tools like npm and pypi, which can be indicators of supply chain compromise.
Detects the legitimate Notepad++ updater process (GUP.exe) spawning suspicious child processes. This behavior was observed during the Notepad++ supply chain attack where the updater was used to launch malicious payloads.
Detects the execution of processes with command-line arguments containing keywords related to known supply chain attacks (e.g., solarwinds, 3cx, kaseya, npm, pypi). This rule is intended for threat hunting to identify potential exploitation attempts or malicious activity involving software supply chain components.
This rule detects the execution of specific Node.js scripts (`setup.cjs` or `protocal.cjs`) that are associated with the Mastra npm supply chain attack. It identifies Node.js process executions across Windows, macOS, and Linux, looking for these malicious script names in the command line.
Detects a web server process creating at least two different backdoored WooCommerce files within a 5-minute window. This behavior is indicative of a supply chain compromise targeting ShapedPlugin, where malicious plugins distribute backdoored files.
Detects Bun beaconing to the checkmarx or kosche C2s, followed immediately by dropping a new .js or .mjs file. This behavior is indicative of a supply chain attack where a compromised Bun package might be attempting to establish C2 communication and then deploy malicious JavaScript files.
This rule detects the dropping of a 24-character hexadecimal JavaScript payload followed by the creation of a '.pkg_history' or '.pkg_logs' marker file within a one-minute timeframe. This behavior is indicative of the Mastra NPM supply chain compromise.
This rule detects suspicious process execution patterns associated with malicious activities in GitHub Actions environments, specifically flagging the use of JavaScript runtimes (node, bun) to execute malicious payloads, git operations related to pull request data exfiltration (pwn-request), and the creation of orphan branches characteristic of the Miasma campaign.
This rule monitors GitHub audit logs for potentially malicious activities in repository management and CI/CD workflows. It detects suspicious commits by specific maintainers, impersonation of the Dependabot bot, usage of non-standard snapshot branch naming conventions, execution of unauthorized workflows, and specific commit message patterns indicative of unauthorized system modifications or testing.
Detects anomalous process execution patterns associated with supply chain compromises (specifically Miasma/Mini Shai-Hulud 'Phantom Gyp'), where node-gyp build processes or npm lifecycle scripts trigger the execution of unexpected scripts or unauthorized runtimes like Bun.
Page 23 of 35