Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
733 detections
Filters
Last updated
All Time
Detection languages
362
124
60
58
35
Contributors
222
123
75
46
32
Categories
334
253
143
139
101
Platforms
525
383
290
80
34
Products / Services
161
158
114
72
47
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
733
CVEs
4
3
3
2
2
IDS Classtypes
17
2
1
1
IDS Protocols
15
2
2
1
This rule identifies developer or contractor workstations that have Node.js/npm installed but currently lack active EDR sensor coverage (i.e., the sensor is either not onboarded or not in an active state). It employs a 24-hour grace period to filter out transient onboarding issues and ensures that the device has reported activity within the last 7 days to avoid alerting on decommissioned hardware. This gap in visibility increases the risk of undetected supply-chain malware execution and credential theft on sensitive developer endpoints.
Detects the presence of the malicious 'indexed-btree' npm package, which contains a backdoor that hooks 'BTree.prototype.set' to execute 'sharedLoad.min.js' at runtime. The rule monitors for characteristic file paths, function hooking patterns, and node process spawning behavior designed to evade installation-time static analysis.
This rule detects the presence of the malicious indexed-btree npm package by searching for its obfuscated runtime loader triggered via BTree.prototype.set. The malware attempts to spawn a detached Node.js process to execute a secondary payload (sharedLoad.min.js) instead of relying on standard installation scripts, allowing it to maintain persistence and bypass simple static analysis.
Detects the 'sharedLoad.min.js' loader script associated with the malicious 'indexed-btree' npm package family. This script utilizes X25519 ECDH for key exchange and AES-256 decryption to retrieve and execute a second-stage payload hosted on a Sepolia smart contract.
Detects the indexed-btree npm malware loader embedded in BTree.prototype.set that spawns a detached hidden Node.js child process and references sharedLoad.min.js
Detects the execution of npm commands to install specific, potentially malicious or typo-squatted npm packages. The rule filters for common npm install command line arguments and matches against a predefined list of package names that are often associated with supply chain compromise attempts.
Detects the execution of npm commands to install specific, potentially malicious or typo-squatted npm packages. The rule filters for common npm install command line arguments and matches against a predefined list of package names that are often associated with supply chain compromise attempts.
Detects the initialization of known-malicious Terraform providers (dockerd) followed within one hour by the execution of a 'go run' process from the .terraform directory. This pattern is indicative of a supply chain compromise where an adversary leverages a typosquatted or malicious Terraform provider to facilitate the execution of a secondary payload.
Detects the initialization of known-malicious Terraform providers (dockerd) followed within one hour by the execution of a 'go run' process from the .terraform directory. This pattern is indicative of a supply chain compromise where an adversary leverages a typosquatted or malicious Terraform provider to facilitate the execution of a secondary payload.
Detects malicious shell commands attempting to perform supply-chain persistence via environment variable manipulation in CI/CD environments. The rule identifies processes injecting BASH_ENV into GITHUB_ENV, a known technique used by the SCKIT supply-chain worm to perform credential harvesting during CI pipeline execution.
Detects the execution of the 'sckit' Go implant, a malicious binary associated with trojanized '@memtensor/memos-cloud-openclaw-plugin' or 'MemoryOS' packages. The rule identifies instances where this binary is spawned as a child process of a language runtime (Node.js or Python) when the execution originates from specific directory paths associated with these packages, or when the parent process command line indicates these packages are being initialized.
Detects BeaverTail JavaScript-based loader malware hidden inside NPM packages, distributed via GitHub or Bitbucket during fake technical interviews
This rule detects forced pushes to the main branch of a GitHub repository where a specific file named 'indexe.cjs' is added or a specific commit ID (d1d55e13) is pushed. This behavior is indicative of a supply chain compromise where an attacker rewrites git history to inject malicious loaders or backdoors into the source code.
Monitors GitHub Audit Logs for git pushes or workflow changes occurring after the September 16, 2026, reactivation window that reference the actions-cool/issues-helper or actions-cool/maintain-one-comment repositories. The rule excludes routine automated maintenance activity from trusted bots and common maintenance commit messages, aiming to identify unauthorized attempts to utilize or modify potentially compromised GitHub actions.
Monitors GitHub Audit Logs for git pushes or workflow changes occurring after the September 16, 2026, reactivation window that reference the actions-cool/issues-helper or actions-cool/maintain-one-comment repositories. The rule excludes routine automated maintenance activity from trusted bots and common maintenance commit messages, aiming to identify unauthorized attempts to utilize or modify potentially compromised GitHub actions.
Monitors GitHub Audit Logs for git pushes or workflow changes occurring after the September 16, 2026, reactivation window that reference the actions-cool/issues-helper or actions-cool/maintain-one-comment repositories. The rule excludes routine automated maintenance activity from trusted bots and common maintenance commit messages, aiming to identify unauthorized attempts to utilize or modify potentially compromised GitHub actions.
Monitors GitHub Audit Logs for git pushes or workflow changes occurring after the September 16, 2026, reactivation window that reference the actions-cool/issues-helper or actions-cool/maintain-one-comment repositories. The rule excludes routine automated maintenance activity from trusted bots and common maintenance commit messages, aiming to identify unauthorized attempts to utilize or modify potentially compromised GitHub actions.
Monitors GitHub Audit Logs for git pushes or workflow changes occurring after the September 16, 2026, reactivation window that reference the actions-cool/issues-helper or actions-cool/maintain-one-comment repositories. The rule excludes routine automated maintenance activity from trusted bots and common maintenance commit messages, aiming to identify unauthorized attempts to utilize or modify potentially compromised GitHub actions.
This rule detects GitHub Actions workflows that explicitly reference specific 'actions-cool' GitHub actions using a known-bad mutable version tag ('@v2.2.1'). This tag corresponds to malicious code introduced into these repositories, allowing for potential CI/CD pipeline poisoning and supply chain compromise.
This rule detects GitHub Actions workflows that explicitly reference specific 'actions-cool' GitHub actions using a known-bad mutable version tag ('@v2.2.1'). This tag corresponds to malicious code introduced into these repositories, allowing for potential CI/CD pipeline poisoning and supply chain compromise.
This rule detects GitHub Actions workflows that explicitly reference specific 'actions-cool' GitHub actions using a known-bad mutable version tag ('@v2.2.1'). This tag corresponds to malicious code introduced into these repositories, allowing for potential CI/CD pipeline poisoning and supply chain compromise.
Page 7 of 35