Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
733 detections
Filters
Last updated
All Time
Detection languages
362
124
60
58
35
Contributors
222
123
75
46
32
Categories
334
253
143
139
101
Platforms
525
383
290
80
34
Products / Services
161
158
114
72
47
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
733
CVEs
4
3
3
2
2
IDS Classtypes
17
2
1
1
IDS Protocols
15
2
2
1
This rule detects the use of the malicious GitHub Action 'ci-quality/code-quality-check@v1' associated with the SANDWORM_MODE campaign. This action is designed to harvest CI secrets and propagate the malware by being referenced in a GitHub workflow file. The rule searches for the specific string of the malicious GitHub action within file content or file/audit paths, specifically targeting GitHub workflow files (.yml or .yaml) in '.github/workflows/' directories.
Detects execution of curl.exe uploading data to temp.sh using custom user-agent parameters, consistent with publicly reported malicious Notepad++ updater activity.
Detects file creation or process execution events involving the SHA256 hashes of malicious DLLs from the NCryptYo, DOMOAuth2_, IRAOAuth2.0, and SimpleWriter_ NuGet packages. This rule identifies the presence or execution of known malicious components associated with a supply chain compromise targeting ASP.NET developers.
This rule detects network connections to malicious infrastructure associated with a supply chain attack targeting dYdX npm and PyPI packages. The infrastructure is used for credential exfiltration and as a C2 for a RAT.
This rule detects a multi-stage attack chain. The first rule identifies the Notepad++ updater (GUP.exe) spawning curl.exe to upload reconnaissance output to 'temp.sh/upload', indicating a potential supply-chain attack. The second rule detects the execution of 'ProShow.exe' from an unusual location within the AppData\Roaming\ProShow directory, which is part of a described execution chain. The third rule identifies the execution of 'script.exe' with 'alien.ini' from the AppData\Roaming\Adobe\Scripts directory, matching another stage of the supply-chain attack.
SPL Query
This rule alerts on outbound network activity initiated by gup.exe where the destination URL is not associated with expected Notepad++ update endpoints.
Detects file operations involving known malicious hashes associated with a Notepad++ supply chain compromise. The rule identifies files with specific SHA1 hashes and provides contextual information such as action type, device name, file path, and initiating process details. The enhanced version further categorizes risk levels, enriches data with Notepad++ specific context, and aggregates events for a summary view, including threat metrics and prioritization for response actions.
Detects the Notepad++ updater process (GUP.exe) spawning a child process named 'update.exe'. This behavior was observed during the Lotus Blossom supply chain attack where the Notepad++ update infrastructure was compromised to deliver the Chrysalis backdoor.
Detects the Notepad++ updater process (gup.exe) making network connections to domains other than the official Notepad++ or GitHub domains. This could indicate a compromised update process or a supply chain attack where the updater is redirected to a malicious download location.
This rule detects the execution of suspicious Visual Studio Code extensions, specifically those associated with known malicious extensions like ClawBot. It identifies instances where the VS Code executable initiates a process with command-line arguments containing keywords related to these malicious extensions.
Detects the Notepad++ updater (GUP.exe) spawning child processes with suspicious names (update.exe, install.exe, AutoUpdater.exe) from the Local Temp directory. This behavior was a primary vector for all three execution chains identified in the Notepad++ supply chain attack.
This rule detects the execution of reconnaissance commands (whoami, tasklist, systeminfo, netstat) via `cmd.exe` where the parent process is either `GUP.exe` or `AutoUpdater.exe`. This behavior is indicative of the Notepad++ supply chain attack, where malicious updates could execute system reconnaissance commands. The detection specifically looks for output redirection, which is a common technique for adversaries to save command output.
Detects an unusual exfiltration technique where a URL, typically from temp.sh, is embedded within the User-Agent string of an HTTP request. This TTP was observed in the Notepad++ supply chain attack in 2025 for exfiltrating system information.
Detects network connections to domains and IPs associated with the Notepad++ supply chain attack. These indicators are linked to the distribution of Cobalt Strike and the Chrysalis backdoor.
Detects the creation of specific directories (Bluetooth, ProShow, Adobe\Scripts) in the AppData folder by the Notepad++ updater (GUP.exe), a behavior associated with the Chrysalis backdoor persistence mechanism.
Detects suspicious child processes spawned by Notepad++ updater (gup.exe) including cmd.exe with reconnaissance commands or scripting engines.
Detects HTTP requests where the User-Agent string contains a full URL pointing to 'temp.sh'. This technique was observed in the Notepad++ supply chain attack where attackers passed the URL of exfiltrated data back to their C2 server within the User-Agent header.
Detects the creation of specific files in AppData paths associated with the second and third infection chains of the Notepad++ supply chain attack. These files are related to Lua script execution and DLL sideloading for persistence and execution.
Detects the use of curl.exe where the User-Agent header is abused to pass a URL. This is a specific technique observed in the Notepad++ supply chain attack where attackers used it to exfiltrate reconnaissance data by sending a temp.sh URL to their C2 server.
Detects the execution of processes named 'openclaw-agent.exe' or 'openclaw-agent'. These binaries are being distributed as malicious 'prerequisites' in weaponized OpenClaw AI agent skills to install infostealers and other malware.
Page 32 of 35