Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
733 detections
Filters
Last updated
All Time
Detection languages
362
124
60
58
35
Contributors
222
123
75
46
32
Categories
334
253
143
139
101
Platforms
525
383
290
80
34
Products / Services
161
158
114
72
47
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
733
CVEs
4
3
3
2
2
IDS Classtypes
17
2
1
1
IDS Protocols
15
2
2
1
Detects an anomalous volume of NPM package publications by specific users associated with internal naming conventions (leo-*, @leoplatform/*, verana-blockchain*). The rule identifies potential supply chain compromise attempts by monitoring for burst activity (3+ publishes or 3+ unique packages within a 10-second window).
Detects malicious command injection where GitHub Actions interpolates ${{ github.event.comment.body }} directly into a bash run block, specifically looking for patterns associated with the 'curl.litter.catbox.moe..sh' domain.
Identifies developers or CI pipelines executing the hijacked @bitwarden/cli npm package (v2026.4.0) during the exposure window.
Detects the creation of '.pkg_history' or '.pkg_logs' files in the OS temporary directory by a Node.js process. This behavior is linked to the easy-day-js supply chain dropper, where the '.pkg_logs' file contains XOR-encoded campaign marker bytes.
Detects the execution of a suspicious 'setup.cjs' script via Node.js triggered during an 'npm install' process, characteristic of the malicious payload delivery mechanism found in compromised Mastra packages. The rule specifically monitors for Node.js spawning a process with command-line arguments including 'setup.cjs' and the '--no-warnings' flag.
Detects the creation of a 'protocal.cjs' file within the '~/.config/systemd/nvmconf/' directory. This activity is associated with the 'easy-day-js' supply chain attack, where a malicious Node.js script is established as a persistent user-level systemd service named 'nvmconf'.
Detects HTTP GET requests for JavaScript or CSS resources from netdna-ssl.com or wpengine.netdna-ssl.com subdomains. This activity could indicate a supply chain compromise where malicious code is injected into legitimate web resources served from these content delivery networks.
Identifies web server processes initiating network connections to the credential-stealing generate.2faplugin.org domain. This activity is indicative of a supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels, leading to data exfiltration.
This rule identifies newly created PHP files within specific WordPress plugin folders ("woocommerce-subscription" or "woocommerce-notification") that have a rare SHA256 hash count (less than 5 occurrences in the enterprise). This behavior is indicative of web shells or backdoored plugin files, potentially introduced via a supply chain compromise.
Correlates a non-browser headless runtime (Node/Bun) querying the GitHub API for the specific commit 'OhNoWhatsGoingOnWithGitHub'. This could indicate a supply chain attack where malicious code within a Node.js or Bun.js application attempts to communicate with a GitHub dead drop for command and control or data exfiltration.
Detects w3wp.exe directly passing backdoor files as command line arguments to a PHP runtime. This activity is indicative of a supply chain compromise where malicious PHP files are executed by the IIS worker process.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories. This activity is indicative of data staging or collection, specifically linked to the 'protocal.cjs' backdoor from the 'easy-day-js' supply chain attack.
Detects the uploading of a plugin matching known disguised slugs ('content-delivery-helper' or 'database-optimizer') used by attackers to install backdoors after establishing a rogue admin account in WordPress environments. This rule specifically targets POST requests to the WordPress plugin update endpoint with these malicious plugin names in the query string.
Detects suspicious execution patterns (such as encoded commands, downloading files via web clients, or using administration utilities) originating from third-party update, monitoring, or deployment agents. This behavior is indicative of a supply chain compromise or malicious activity leveraging trusted binaries to execute arbitrary code.
This rule detects the execution of JavaScript files named 'bw_setup.js' or 'execution.js' using the 'bun' runtime, immediately followed by an outbound network connection to the command and control (C2) domain 't.m-kosche.com'. The detection logic correlates process execution events with network connection events within a 10-minute window, indicating potential malicious activity associated with supply chain attacks.
Detects the use of `wget` or `curl` to specifically target a GitHub API endpoint with a suspicious string, indicating an attempt to download initial stage malware or tools from a dead drop. This pattern is associated with supply chain attacks where GitHub is used as a temporary hosting for malicious components.
This rule detects the execution of specific Node.js scripts (`setup.cjs` or `protocal.cjs`) that are associated with the Mastra npm supply chain attack. It identifies Node.js process executions across Windows, macOS, and Linux, looking for these malicious script names in the command line.
Bitwarden Cli Npm Hijack
YARA-L
Identifies developers or CI pipelines executing the hijacked @bitwarden/cli npm package (v2026.4.0) during the exposure window.
Detects the creation or modification of Git pre-commit hooks (.githooks/pre-commit). Contagious Interview actors use this technique to automatically execute malicious code when a target clones and interacts with a compromised repository.
Detects interaction with specific web shell or remote code execution parameters ('developer_api1_fm', 'developer_api1_eval') associated with the self-hiding backdoor plugin dropped during the OptinMonster supply chain attack. This rule identifies HTTP requests containing these parameters, which are highly specific to the threat actor involved in the OptinMonster supply chain compromise.
Identifies HTTP POST requests indicative of rogue administrator account creation patterns ('dev_xxxxxx' or 'developer_api1') used in the OptinMonster, TrustPulse, and PushEngage supply chain attack. This rule specifically looks for POST requests to WordPress user creation endpoints containing attacker-controlled account names in the URI query.
Page 24 of 35