Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
733 detections
Filters
Last updated
All Time
Detection languages
362
124
60
58
35
Contributors
222
123
75
46
32
Categories
334
253
143
139
101
Platforms
525
383
290
80
34
Products / Services
161
158
114
72
47
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
733
CVEs
4
3
3
2
2
IDS Classtypes
17
2
1
1
IDS Protocols
15
2
2
1
Correlates the drop of a 24-character hex .js file with its immediate execution by node.exe, indicating potential compromise via a supply chain attack like Mastra NPM.
Detects an environment where 'bun' is executing both the primary ('setup.mjs') and secondary ('execution.js' or 'bw_setup.js') payloads within an hour, indicating a potential supply chain attack.
Correlates the dropping of 'install-persistent.php' within a 'woocommerce' folder with a subsequent network connection to the C2 IP '194.76.217.28' on custom port '2871' within a one-hour window. This activity is indicative of a supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels.
Identifies devices with FFmpeg installations below version 9.0 that include the vulnerable MagicYUV decoder (libavcodec), exposing the host to heap out-of-bounds write RCE via crafted AVI, MKV, or MOV files (CVE-2026-8461).
Detects a signed or expected game updater loading an unsigned DLL from the application directory, consistent with a compromised update package or side-loading chain. This rule specifically looks for image load events where the loaded module is a DLL, the module path is within common program directories (Games, Program Files, ProgramData), and the actor process is identified as a game, launcher, updater, or patch executable.
This rule detects suspicious activity related to package managers (nuget, dotnet) where an attempt is made to install or restore packages that are explicitly not marked as 'official' or 'trusted' and contain keywords like '-modified', '-patched', or '-update' in their URL. This could indicate an attempt to inject malicious or tampered dependencies into a project, a common technique in supply chain attacks. The rule triggers if two or more such events occur within an hour on the same computer by the same user.
Detects suspicious activity involving the upload of multiple unique packages to common CI/CD package repositories (like npmjs, pypi, Artifactory, Nexus, Maven) from a single device within a short timeframe. This could indicate a compromised build server or developer account attempting to inject malicious dependencies into the software supply chain.
Detects new app installations, expansions of OAuth scopes, or the addition of collaborators to Slack applications. These activities can indicate an adversary attempting to establish persistent access, escalate privileges, or exfiltrate data from Slack by leveraging malicious or compromised applications.
Detects endpoint connections to infrastructure utilized by SmartApeSG after compromising the Okendo Reviews widget. Specifically, this rule looks for network connections to the domains 'api.wigetticks.com' and 'api.wizzleticks.com', which have been associated with the SmartApeSG supply chain attack targeting the Okendo Reviews widget.
Detects Node.js or Bun executing specific hidden setup files indicative of the Miasma payload being triggered by IDE configuration files (Cursor, Claude, Gemini, VSCode). This rule looks for process execution where the filename is 'node.exe', 'node', 'bun.exe', 'bun', or common shells ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'bash', 'sh', 'zsh') and the command line contains specific Miasma payload patterns like '.github/setup.js', '.claude/setup.mjs', or 'bun run' with '.config/index.js'.
This rule detects suspicious downloads of Python packages from pypi.org or pypi.python.org by pip or python executables. It specifically looks for a high volume (5 or more) of downloads of common package names (numpy, requests, pandas, util, common) within a one-hour window from a single device. This could indicate an attempt to compromise the software supply chain by introducing malicious versions of popular packages.
Detects suspicious activity involving the upload of multiple unique packages to common CI/CD package repositories (like npmjs, pypi, Artifactory, Nexus, Maven) from a single device within a short timeframe. This could indicate a compromised build server or developer account attempting to inject malicious dependencies into the software supply chain.
This rule broadly searches for the unique dead drop string 'OhNoWhatsGoingOnWithGitHub' across all command line executions, independent of node/bun, indicating potential compromise related to the Mini Shai-Hulud supply chain attack.
This rule detects the execution of Node.js processes that include specific attacker IP addresses (23.254.164.123:443 or 23.254.164.92:8000) in their command line arguments, combined with the creation of a file named '.pkg_logs'. This behavior is indicative of the Mastra NPM supply chain attack, where malicious packages drop a logging file after execution.
This rule detects the anomalous execution of 'bun.exe' when it originates from deeply nested temporary npm cache paths. This pattern is indicative of potential software supply chain attacks where malicious code might be injected into development dependencies.
Identifies rapid dropping of many distinct files deep within the .npm/_npx/ directory structure, a precursor to worm execution. This rule specifically looks for more than 20 distinct file creations within a 5-minute window in paths matching the regex ".npm[\]_npx[\][0-9a-fA-F]+".
The "Miasma" npm supply chain attack exploits native build processes using a weaponized binding.gyp file to execute self-propagating malware and steal CI/CD credentials. This worm automates the infection of dozens of packages by bypassing security scanners, targeting cloud secrets, and forging provenance
Ref: https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm
Ref: https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm
Detects anomalous connections to Sigstore infrastructure (Fulcio/Rekor) by non-standard processes. This activity could indicate an attempt to forge or manipulate supply chain signatures, potentially by malware like Miasma.
Detects a game updater overwriting an established executable in the platform directory with a new binary from a temporary staging path. This behavior can be indicative of a supply chain attack where legitimate game update mechanisms are compromised to deliver malicious payloads.
Detects downloads of typosquatted packages from npm or PyPI
Detects downloads of typosquatted packages from npm or PyPI
Page 25 of 35