Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
733 detections
Filters
Last updated
All Time
Detection languages
362
124
60
58
35
Contributors
222
123
75
46
32
Categories
334
253
143
139
101
Platforms
525
383
290
80
34
Products / Services
161
158
114
72
47
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
733
CVEs
4
3
3
2
2
IDS Classtypes
17
2
1
1
IDS Protocols
15
2
2
1
Looking for certain techniques implementing Unicode selectors for code injection, used in linked research blog.
Therefore, characters that do not render in code editors or during standard code review.
Therefore, characters that do not render in code editors or during standard code review.
Masqueraded wt.exe - Branch A: Impostor Binary Named wt.exe Detects a process with image name wt.exe whose OriginalFileName does NOT match wt.exe — i.e., a renamed binary masquerading as Windows Terminal.
Branch B: Legitimate wt.exe from Non-Standard Path Detects execution of a binary with OriginalFileName=wt.exe running from outside the expected Windows Terminal directories (WindowsApps).
Branch B: Legitimate wt.exe from Non-Standard Path Detects execution of a binary with OriginalFileName=wt.exe running from outside the expected Windows Terminal directories (WindowsApps).
This rule detects a potential software supply chain compromise by correlating `npm install`, `npm ci`, or `npm update` activity with the subsequent execution of a `node setup.js` script on the same device within a 30-minute window. It specifically looks for `setup.js` execution or processes running from the `/node_modules/plain-crypto-js` directory, which is indicative of the Axios npm supply chain compromise.
Detects the execution of a process named 'wt.exe' (Windows Terminal) from a non-standard directory, or deliberately renamed. This behavior is associated with the Axios npm supply chain attack, where the Windows RAT dropper copies 'powershell.exe' to '%PROGRAMDATA%\wt.exe' to masquerade its execution.
Detects network connections to malicious domains, associated IPs, execution of related malicious file hashes, registry persistence, and postinstall script executions related to UNC1069 NPM/Axios supply chain attacks deploying SILKBELL and WAVESHAPER.V2. Categorized into risk-scored scenarios.
Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations.
This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.
This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.
Detects indicators of the TeamPCP LiteLLM supply chain compromise. This includes the creation or modification of specific malicious files (litellm_init.pth, tpcp.tar.gz, sysmon.py, sysmon.service), execution of commands related to persistence (systemctl for sysmon.service), data archiving (tar for tpcp.tar.gz), or direct execution of the backdoor (sysmon.py). It also identifies network connections or DNS queries to known command and control (C2) domains (models.litellm.cloud, checkmarx.zone) and HTTP requests to checkmarx.zone. Furthermore, the rule detects unauthorized AWS API calls (ListSecrets, GetSecretValue, DescribeParameters) made using the 'python-urllib' user agent, which is indicative of custom scripting rather than standard boto3 usage.
Detects outbound HTTP POST requests using a specific, hardcoded Internet Explorer 8 User-Agent string over a specific port. This combination is highly indicative of the cross-platform RAT deployed via the compromised Axios npm packages.
Detects suspicious process execution originating from npm postinstall scripts, which can indicate a supply chain compromise. Specifically, this rule looks for npm, node, or npm.cmd processes with 'postinstall' or 'plain-crypto-js' in their command line, spawning suspicious executables like curl, wget, python, bash, sh, cmd, powershell, or wt, or connecting to known malicious domains/IPs or specific file names associated with the 'plain-crypto-js' RAT dropper.
Detects file events related to the 'plain-crypto-js' folder path, which has been associated with the AXIOS supply chain compromise. This rule monitors for any file activity within this specific folder, indicating potential malicious code injection or modification as part of a software supply chain attack.
This detection helps you spot activity linked to TeamPCP LiteLLM PyPI compromise (litellm 1.82.7 / 1.82.8) using the specific indicators in the linked source. It is written to be high confidence by focusing on exact versions, domains, paths, or file fingerprints that were observed in the reporting. A match does not prove a system is compromised by itself, but it is a strong reason to investigate. Confirm the affected host and user, check whether the access was expected, and review nearby activity for follow-on steps like additional downloads, new persistence, or repeated connections. Use the source link to support incident.
Detects PowerShell being copied and renamed to 'wt.exe' in the ProgramData directory, initiated by cmd.exe, powershell.exe, or pwsh.exe, and executing a command line containing '-curl'. This behavior has been documented in the Axios npm supply chain attack.
Detects the creation of known malicious Remote Access Trojan (RAT) file artifacts on Windows, Linux, and macOS systems. These artifacts are associated with the plain-crypto-js@4.2.1 NPM package supply chain compromise, which dropped RAT payloads via a postinstall script. Specifically, it looks for 'wt.exe' in '%PROGRAMDATA%' on Windows, 'ld.py' in '/tmp/' on Linux, and 'com.apple.act.mond' in '/Library/Caches/' on macOS.
Detects known malicious file hashes associated with compromised axios npm package (RAT activity)
This query hunts for suspicious child interpreter processes spawned by Node.js/npm execution, consistent with malicious npm postinstall activity observed in supply chain attacks (including compromised Axios package delivery chains).
KQL Query
Detects network connections to known Command and Control (C2) infrastructure associated with the compromised axios NPM package, which was found to drop a Remote Access Trojan (RAT). The rule specifically looks for connections to the IP address 142.11.206.73 or DNS queries for 'sfrclak.com'.
Detects supply chain compromise activity targeting telecommunications infrastructure
This detection rule identifies activity related to the TeamPCP Telnyx PyPI backdoor, specifically targeting versions 4.87.1 and 4.87.2 of the 'telnyx' package. It looks for command-line executions involving 'pip install telnyx==4.87.1' or 'pip install telnyx==4.87.2'. Additionally, it detects network connections to the IP address 83.142.209.203 on port 8080 requesting 'ringtone.wav' or 'hangup.wav', which are indicators of the backdoor's communication. The rule also identifies persistence mechanisms by looking for 'msbuild.exe' in the Windows Startup folder path '\Microsoft\Windows\Start Menu\Programs\Startup\msbuild.exe'.
This rule detects activity associated with the TeamPCP Telnyx PyPI backdoor, specifically targeting versions 4.87.1 and 4.87.2 of the 'telnyx' package. It identifies two main indicators: first, process command lines that show the installation of these specific malicious versions via 'pip' or 'python -m pip'; second, network connections to a known command and control (C2) IP address (83.142.209.203) or specific C2 URLs involving '.wav' files, which are known to be used for steganography in this campaign. A match indicates a high confidence of potential compromise and warrants immediate investigation to confirm the affected host and user, assess the legitimacy of the activity, and review for follow-on malicious actions.
KQL Query
Page 30 of 35