Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
733 detections
Filters
Last updated
All Time
Detection languages
362
124
60
58
35
Contributors
222
123
75
46
32
Categories
334
253
143
139
101
Platforms
525
383
290
80
34
Products / Services
161
158
114
72
47
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
733
CVEs
4
3
3
2
2
IDS Classtypes
17
2
1
1
IDS Protocols
15
2
2
1
Detects multiple threat behaviors associated with the Mini Shai-Hulud supply chain worm campaign. This includes memory scraping for secrets, execution of malicious Node/Bun payloads, connection to known C2 domains, and file operations related to persistence.
Detects the creation of files indicative of the compromised Checkmarx AST plugin version 2026.5.09 being deployed. This rule identifies specific malicious filenames or known compromised SHA256 hashes associated with the TeamPCP backdoor.
Detects file creation events associated with the Mini Shai-Hulud npm/PyPI supply-chain attack campaign targeting TanStack, Mistral AI, OpenSearch, and Guardrails AI packages.
Detects git commits authored by claude@users.noreply.github.com that may indicate repository poisoning by the Mini Shai-Hulud worm.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects the creation of folders or files associated with the malicious ChatGPT-China and ChatMoss VS Code extensions (MaliciousCorgi campaign). These extensions silently exfiltrate developer source code to external servers.
Detects suspicious npm activity indicative of the PhantomRaven Wave 5 supply chain attack. This includes node.js processes executing scripts from temporary directories during npm install, node.js processes accessing credential files (.gitconfig, .npmrc, .aws/credentials, .ssh) during npm lifecycle events, and the installation of known malicious npm package names associated with PhantomRaven.
Detects network connections to known PhantomRaven Wave 5 command-and-control infrastructure. PhantomRaven is an NPM supply chain attack targeting DeFi, Cloud, and AI developers.
PhantomRaven Temporary Payload Creation
Cortex XDR
Detects Node.js dropping the PhantomRaven dynamic Stage-3 payload into the /tmp directory. The attack utilizes a file-based temporary dropper that operates outside of standard NPM package paths, bypassing static code analysis.
Bitwarden CLI (@bitwarden/cli@2026.4.0) was compromised in April 2026 as part of the Checkmarx-linked supply chain attack. Attackers injected malicious code via Bitwarden’s CI/CD pipeline.
Ref:
https://cyberinsider.com/bitwarden-cli-backdoored-in-checkmarx-supply-chain-attack
https://www.aikido.dev/blog/shai-hulud-npm-bitwarden-cli-compromise
Ref:
https://cyberinsider.com/bitwarden-cli-backdoored-in-checkmarx-supply-chain-attack
https://www.aikido.dev/blog/shai-hulud-npm-bitwarden-cli-compromise
Detects pip or pip3 installation commands targeting the specific compromised version of the elementary-data PyPI package. Installation of v0.23.3 indicates exposure to the supply chain compromise regardless of whether the marker file was subsequently observed. Also catches generic 'pip install elementary-data' without a version pin, which during the active window (2026-04-24 22:20 UTC to 2026-04-25 ~11:51 UTC) would have pulled the malicious version.
Bitwarden CLI (@bitwarden/cli@2026.4.0) was compromised in April 2026 as part of the Checkmarx-linked supply chain attack. Attackers injected malicious code via Bitwarden’s CI/CD pipeline.
Ref:
https://cyberinsider.com/bitwarden-cli-backdoored-in-checkmarx-supply-chain-attack
https://www.aikido.dev/blog/shai-hulud-npm-bitwarden-cli-compromise
Ref:
https://cyberinsider.com/bitwarden-cli-backdoored-in-checkmarx-supply-chain-attack
https://www.aikido.dev/blog/shai-hulud-npm-bitwarden-cli-compromise
This query hunts for suspicious child interpreter processes spawned by Node.js/npm execution, consistent with malicious npm postinstall activity observed in supply chain attacks (including compromised Axios package delivery chains)
This query hunts for potential execution linked to the Axios npm supply chain compromise by detecting node.exe process activity tied to suspicious npm lifecycle markers (postinstall, setup.js, plain-crypto-js). It helps identify systems that may have executed malicious install-time scripts.
Detects the full infection chain of a trojanized Proxifier installer hosted on GitHub (lukecodix/Proxifier releases) distributing ClipBanker RAT. Active since early 2025 with 2,000+ confirmed victims (India/Vietnam focus). The malicious wrapper adds Defender exclusions for TMP/powershell/conhost, creates a ~1.5KB stub (Proxifier*.tmp) as a donor process, injects api_updater.exe and proxifierupdater.exe, then hollows into conhost.exe and fontdrvhost.exe to deliver a fileless C++ ClipBanker payload that replaces crypto wallet addresses across 26+ blockchains (BTC, ETH, SOL, XRP, DOGE, LTC, XMR, ADA, BNB, etc.). Multi-stage payload retrieved from pastebin, snippet.host, chiaselinks.com, rlim.com, paste.kealper.com, and secondary GitHub/Gitea repos. Persistence via HKLM\SOFTWARE\System::Config (Base64 PowerShell) + scheduled task. 12 queries covering known hashes, trojanized binary names, Defender exclusion abuse, registry persistence, schtask-to-PowerShell-to-registry chain, process hollowing into OS binaries, C2/payload domains, Pastebin/Gist exact-path IOC hits, fontdrvhost/conhost outbound anomaly, Proxifier*.tmp stub detection, GitHub-release-to-execution correlation, and full kill-chain correlation.
This rule detects the creation of directories or files related to the malicious 'plain-crypto-js' package within 'node_modules' folders. This activity is associated with the WAVESHAPER.V2 RAT, which targets developer and CI/CD systems through supply chain compromise of npm packages like Axios.
Detects install-time execution context consistent with the Axios npm supply chain compromise. This rule looks for 'node setup.js' launched from within 'node_modules/plain-crypto-js' or related npm install working directories, or for npm install commands involving 'axios' or 'plain-crypto-js'.
Detects the execution of the prt-scan supply chain campaign payload by identifying specific hardcoded exfiltration and reconnaissance log markers in command line arguments. These markers include 'PRT_EXFIL', 'PRT_RECON', 'PRT_HARVEST', 'PRT_DELAYED', 'PRT_GIT_AUTH', and 'PRT_LABEL_BYPASS'.
Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure.
This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.
This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.
Detects the creation of hidden temporary workflow files (e.g., .prt_tmp_<nonce>.yml) indicative of the prt-scan supply chain campaign's DISPATCH phase used to capture secret values. This rule specifically looks for newly written script files with a filename matching the pattern /.github/workflows/.prt_tmp_[a-f0-9]+\.yml$/i.
This rule detects the creation, modification, or renaming of directories related to the malicious 'plain-crypto-js' npm package within a 'node_modules' folder. This activity is indicative of a supply chain compromise where a legitimate package (Axios) was found to include this malicious dependency.
Page 29 of 35