Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
733 detections
Filters
Last updated
All Time
Detection languages
362
124
60
58
35
Contributors
222
123
75
46
32
Categories
334
253
143
139
101
Platforms
525
383
290
80
34
Products / Services
161
158
114
72
47
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
733
CVEs
4
3
3
2
2
IDS Classtypes
17
2
1
1
IDS Protocols
15
2
2
1
This rule detects Terraform CLI activity interacting with suspicious domains or modules, specifically targeting known repositories or namespaces (e.g., gocommunity.io, gogets.dev). It monitors for Terraform initialization or application patterns referencing these domains in process command lines, as well as the creation of Terraform provider files within these specific namespaces. This behavior is indicative of potential supply chain compromise involving malicious Terraform modules or dependencies.
Detects malicious PHP web shell patterns (e.g., base64_decode, system, eval, passthru) within the WordPress plugins directory. This often indicates the presence of a trojanized plugin update or unauthorized file modification following a supply chain compromise.
Detects the presence of specific versions (2.35 and 2.36) of the Admin Menu Editor Pro WordPress plugin, which were reported to be distributed as trojanized versions via a compromised update infrastructure.
Detects the publication of a known malicious version (0.2.21) of the '@dforge-core/dforge-mcp' npm package. This activity is attributed to the GHAPPIER/PolinRider supply chain campaign, which leverages hijacked OIDC trusted-publishing pipelines to distribute compromised code.
Detects Git force-push events or protected branch policy overrides on main or master branches where the authenticated GitHub user differs from the commit author or committer, and the commit is unsigned. This pattern is indicative of credential abuse or account compromise where an attacker pushes unauthorized code while masquerading as a project maintainer.
Detects anomalous activity in GitHub repositories where a code push by an actor is followed by an NPM package publish event from the same actor within a 105-minute window. This behavioral pattern is indicative of a potential compromised maintainer session or malicious code injection into the software supply chain.
Detects multiple rapid modifications to GitHub Actions workflow files (.github/workflows/*.yaml) within a short timeframe (<= 20 minutes). This pattern is indicative of potential CI/CD pipeline poisoning or suspicious activity where an actor may be attempting to inject malicious code or configurations into the build process.
Detects unauthorized modifications to GitHub Actions workflow configuration files (.github/workflows/*.yml) that explicitly enable automated publishing triggers (push to main branch). The rule looks for specific content patterns in the workflow file indicating a push-to-main trigger and monitors for suspicious or known bad commit hashes associated with such changes.
Detects instances where a Gradle or Java build process invokes a shell (sh -c) containing suspicious build-related keywords such as 'preBuild', 'doLast', or 'tasks.all'. This pattern is commonly observed in supply chain compromises where malicious code is injected into build scripts to execute hidden payloads during the compilation phase.
Detects the PolinRider/GHAPPIER campaign signature of a malicious loader payload silently appended to the end of a legitimate project configuration file
Detects the PolinRider/GHAPPIER campaign signature of a malicious loader payload silently appended to the end of a legitimate project configuration file
Detects the PolinRider/GHAPPIER campaign signature of a malicious loader payload silently appended to the end of a legitimate project configuration file
Detects the PolinRider/GHAPPIER campaign signature of a malicious loader payload silently appended to the end of a legitimate project configuration file
This rule detects the installation or presence of ten identified malicious npm packages associated with the indexed-btree/sorted-btree typosquatting campaign. It monitors command-line activity for 'npm install' commands, package name resolution, and entries within 'package.json' files.
Detects the obfuscated first-stage JavaScript payload sharedLoad.min.js dropped by the malicious npm indexed-btree package, identified by string-array encoding and self-checksumming array rotation obfuscation patterns
Detects the obfuscated first-stage JavaScript payload sharedLoad.min.js dropped by the malicious npm indexed-btree package, identified by string-array encoding and self-checksumming array rotation obfuscation patterns
Detects malicious shell commands attempting to perform supply-chain persistence via environment variable manipulation in CI/CD environments. The rule identifies processes injecting BASH_ENV into GITHUB_ENV, a known technique used by the SCKIT supply-chain worm to perform credential harvesting during CI pipeline execution.
Detects malicious shell commands attempting to perform supply-chain persistence via environment variable manipulation in CI/CD environments. The rule identifies processes injecting BASH_ENV into GITHUB_ENV, a known technique used by the SCKIT supply-chain worm to perform credential harvesting during CI pipeline execution.
This rule detects the use of 'npm' or 'node' to install packages from a registry other than trusted, standard registries (e.g., npmjs.org, GitHub). It specifically monitors command lines involving 'claude-code' that utilize custom, non-standard registry URLs. This behavior is indicative of potential supply chain attacks or the installation of unauthorized/malicious dependencies.
This rule detects the use of 'npm' or 'node' to install packages from a registry other than trusted, standard registries (e.g., npmjs.org, GitHub). It specifically monitors command lines involving 'claude-code' that utilize custom, non-standard registry URLs. This behavior is indicative of potential supply chain attacks or the installation of unauthorized/malicious dependencies.
This rule detects the use of 'npm' or 'node' to install packages from a registry other than trusted, standard registries (e.g., npmjs.org, GitHub). It specifically monitors command lines involving 'claude-code' that utilize custom, non-standard registry URLs. This behavior is indicative of potential supply chain attacks or the installation of unauthorized/malicious dependencies.
Page 9 of 35