Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
14 detections
Filters
Last updated
All Time
Detection languages
12
1
1
Contributors
9
3
2
Categories
12
10
6
4
3
Platforms
14
13
13
Products / Services
11
7
5
2
1
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
This rule monitors for the installation of specific known-malicious or suspicious NPM packages that are commonly used in supply chain attacks. It identifies the execution of npm (or node) commands to install or add packages explicitly listed as malicious by security research, which may indicate a supply chain compromise or an attempt to introduce unauthorized code into the development environment.
Detects the installation of a specific known malicious npm package named 'tw-pkgprobe-7731' via the command line, which may indicate a supply chain compromise or an attempt to execute malicious code within a development environment.
This rule monitors for the installation of the 'indexed-btree' JavaScript package via common package managers (npm, yarn, pnpm) or its presence within a 'node_modules' directory. This specific package has been associated with supply chain attacks where malicious code is embedded within dependencies to compromise build systems or environments.
Detects the installation of specific known malicious NPM packages (indexed-btree, btree-core, mutex-forge) or execution of npm install commands targeting these packages, which are indicative of software supply chain compromise attempts.
This rule detects the use of package managers like 'pip' or 'npm' to install specific suspicious software packages or tools often associated with supply chain compromise or malicious library installation (e.g., 'huggingface-cli', 'unused-imports', 'react-codeshift').
This rule detects the use of package managers like 'pip' or 'npm' to install specific suspicious software packages or tools often associated with supply chain compromise or malicious library installation (e.g., 'huggingface-cli', 'unused-imports', 'react-codeshift').
This rule detects the use of package managers like 'pip' or 'npm' to install specific suspicious software packages or tools often associated with supply chain compromise or malicious library installation (e.g., 'huggingface-cli', 'unused-imports', 'react-codeshift').
This rule detects the use of package managers like 'pip' or 'npm' to install specific suspicious software packages or tools often associated with supply chain compromise or malicious library installation (e.g., 'huggingface-cli', 'unused-imports', 'react-codeshift').
This rule detects the use of package managers like 'pip' or 'npm' to install specific suspicious software packages or tools often associated with supply chain compromise or malicious library installation (e.g., 'huggingface-cli', 'unused-imports', 'react-codeshift').
This rule detects the use of package managers like 'pip' or 'npm' to install specific suspicious software packages or tools often associated with supply chain compromise or malicious library installation (e.g., 'huggingface-cli', 'unused-imports', 'react-codeshift').
This rule monitors file events to detect the presence of known malicious npm packages identified in a supply chain attack. It specifically checks for files created or modified within 'node_modules' directories that match a predefined list of malicious package names.
This rule monitors file events to detect the presence of known malicious npm packages identified in a supply chain attack. It specifically checks for files created or modified within 'node_modules' directories that match a predefined list of malicious package names.
Detects the execution of unusual or unauthorized processes spawned during an 'npm install' operation, specifically those occurring within a 'node_modules' folder context. This behavior is indicative of potential supply chain attacks where a malicious package executes unauthorized code during installation.
This rule detects the installation of a specific potentially malicious NPM package ('mouse5212-super-formatter') via the npm command-line interface, followed by the execution of a node process initiated by the npm command within a 5-minute window. This behavior is indicative of a software supply chain attack where a developer or automated process is tricked into installing a backdoored dependency that subsequently executes malicious code.