Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
733 detections
Filters
Last updated
All Time
Detection languages
362
124
60
58
35
Contributors
222
123
75
46
32
Categories
334
253
143
139
101
Platforms
525
383
290
80
34
Products / Services
161
158
114
72
47
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
733
CVEs
4
3
3
2
2
IDS Classtypes
17
2
1
1
IDS Protocols
15
2
2
1
Detects the loading of specific DLLs from AppData paths associated with the Notepad++ supply chain attack. This activity is related to DLL sideloading and Lua script execution techniques used by the threat actor. Sysmon EVID 7 is critical for detecting the library load.
Detects the legitimate Notepad++ updater (GUP.exe) spawning suspicious child processes. This behavior was observed during the Notepad++ supply chain attack where the updater was abused to download and execute malicious installers and command interpreters.
The malware used the legitimate curl.exe to upload data to temp[.]sh. This is a high-fidelity indicator as legitimate business processes rarely upload data to ephemeral pastebins via command line.
Detects WinGUp (gup.exe) making network connections to domains other than the legitimate Notepad++ update infrastructure. Per Kevin Beaumont, gup.exe should only connect to notepad-plus-plus.org, github.com, and release-assets.githubusercontent.com.
This query hunts for the specific "reconnaissance batch" behavior observed in this campaign: a process piping netstat, systeminfo, or tasklist output into a text file (specifically a.txt as seen in the report, though looking for any single-letter text file is a good heuristic).
Detects network connections or DNS queries to known malicious domains identified as being used for Cobalt Strike C2, data exfiltration, and secondary payload delivery during the Notepad++ supply chain attack. This rule specifically targets the domains 'cdncheck.it.com', 'safe-dns.it.com', 'self-dns.it.com', 'api.wiresguard.com', 'api.skycloudcenter.com', and 'temp.sh'.
This rule looks for the GUP.exe process (the legitimate updater) spawning unexpected child processes like cmd.exe or the known malicious AutoUpdater.exe.
Detects the legitimate Notepad++ updater process (GUP.exe) spawning suspicious child processes. This behavior was observed during the Notepad++ supply chain attack where the updater was used to launch malicious payloads. The rule specifically looks for GUP.exe as the parent process and child processes with filenames like 'update.exe', 'install.exe', 'AutoUpdater.exe', 'curl.exe', or 'cmd.exe'.
Detects the use of curl.exe to upload files to the temp.sh service while simultaneously passing the resulting temp.sh URL within the User-Agent string to a C2 server. This specific exfiltration and beaconing TTP was observed in the Notepad++ supply chain attack.
Detects a sequence of reconnaissance commands (whoami, tasklist, systeminfo, netstat) executed by the command prompt and piped to a text file. This specific TTP was used in the Notepad++ supply chain attack to gather system information for exfiltration.
This rule identifies the use of specific malicious code signing certificates by matching their SHA1 thumbprints against a predefined list. These certificates are known to be associated with various threat actors or malicious software, indicating potential supply chain compromise or the use of signed malware.
Detects suspicious child process creation by the Notepad++ updater process (gup.exe).
This could indicate potential exploitation of the updater component to deliver unwanted malware.
This could indicate potential exploitation of the updater component to deliver unwanted malware.
Detects AI/ML model configuration files (e.g., config.json, model_config.yaml) containing a suspicious '_target_' value, which could indicate an attempt to exploit a Hydra instantiation vulnerability for remote code execution (RCE).
This rule detects indicators associated with the 'Office Assistant' supply chain attack. It identifies malicious browser extensions by their IDs in file paths or names, and also detects known malicious file MD5s and C2 communication domains. The rule correlates file events and network events to provide a comprehensive view of the attack.
This rule detects the presence of known malicious browser extensions on devices. It identifies extensions based on a curated list of Extension IDs associated with various threats, including Urban VPN, extensions that turned malicious, general malicious browser extensions, and those involved in Chrome extension supply chain attacks. The rule queries `DeviceTvmBrowserExtensions` to find any activated extensions matching these IDs.
Detects the installation of specific NPM packages that have been identified as compromised by the Shai-Hulud "Second Coming" worm. Installation of these packages can lead to credential theft and further propagation of the malware.
Detects the creation or modification of files with SHA256 hashes known to be associated with the Shai-Hulud 2.0 npm supply chain attack campaign. This rule specifically looks for file creation or renaming events where the SHA256 hash of the file matches a predefined list of malicious hashes.
This rule set detects several indicators of compromise related to the Shai-Hulud threat activity. It identifies specific malicious file hashes (SHA256) for 'bundle.js' files, the execution of the 'trufflehog' tool which is often abused for secrets discovery, the presence of a malicious YAML file named 'shai-hulud-workflow.yml', and network connections to 'webhook.site' domains, optionally with a specific URI, which are used for data exfiltration or command and control.
Detects the creation of files associated with NPM packages compromised in the "Sha1-Hulud: The Second Coming" campaign. This is a broad query intended for hunting and requires manual verification of package versions.
Detects process execution patterns associated with the "Sha1-Hulud: The Second Coming" NPM supply chain attack. This includes the silent installation of the 'bun' runtime during an 'npm install' and a destructive file shredding command. The rule filters out legitimate manual installations by developers by checking the initiating parent process.
This query detects execution of processes related to Visual Studio Code extension signing or caching that involve known Glassworm-compromised extensions. Based on indicators published by KOI (October 20, 2025), it identifies suspicious .vsix package operations potentially associated with self-propagating malicious VSCode extensions observed in OpenVSX and Microsoft VSCode marketplaces.
To extract vscode extension version I used this the https://detections.ai/rules/924f7b5f-d8df-4eed-ba06-08c657f65891.
To extract vscode extension version I used this the https://detections.ai/rules/924f7b5f-d8df-4eed-ba06-08c657f65891.
Page 33 of 35