Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
41 detections
Filters
Last updated
All Time
Detection languages
26
8
3
2
1
Contributors
13
7
5
3
2
Categories
21
17
6
5
4
Platforms
37
5
3
2
1
Products / Services
20
4
1
1
1
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
8
IDS Classtypes
1
IDS Protocols
1
Detects the execution of node.exe or electron.exe with command-line arguments indicative of browser automation (e.g., launching headless browsers, cookie access) when executed from high-risk, writable directories like AppData\Temp, AppData\Roaming, ProgramData, or Users\Public. This behavior is frequently associated with information-stealing malware or unauthorized browser automation.
Detects the execution of node.exe or electron.exe with command-line arguments indicative of browser automation (e.g., launching headless browsers, cookie access) when executed from high-risk, writable directories like AppData\Temp, AppData\Roaming, ProgramData, or Users\Public. This behavior is frequently associated with information-stealing malware or unauthorized browser automation.
Detects the execution of node.exe or electron.exe with command-line arguments indicative of browser automation (e.g., launching headless browsers, cookie access) when executed from high-risk, writable directories like AppData\Temp, AppData\Roaming, ProgramData, or Users\Public. This behavior is frequently associated with information-stealing malware or unauthorized browser automation.
Detects the execution of node.exe or electron.exe with command-line arguments indicative of browser automation (e.g., launching headless browsers, cookie access) when executed from high-risk, writable directories like AppData\Temp, AppData\Roaming, ProgramData, or Users\Public. This behavior is frequently associated with information-stealing malware or unauthorized browser automation.
Detects the execution of node.exe or electron.exe with command-line arguments indicative of browser automation (e.g., launching headless browsers, cookie access) when executed from high-risk, writable directories like AppData\Temp, AppData\Roaming, ProgramData, or Users\Public. This behavior is frequently associated with information-stealing malware or unauthorized browser automation.
Detects instances where 'node.exe' is observed copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories. This activity is indicative of data staging or exfiltration, specifically linked to the 'protocal.cjs' backdoor from the 'easy-day-js' supply chain attack.
Detects PowerShell executing a reflective .NET assembly load, indicated by keywords like 'Reflection.Assembly', 'Load', and 'byte' in the command line. The detection is further refined by looking for 'Extension.SubRoutine', 'Run2', or the C2 domain 'hellolargeworld.com' in the command line, and specifically targets instances where the initiating process is 'node.exe'. This behavior is indicative of the 'protocal.cjs' backdoor.
Detects PowerShell executing a reflective .NET assembly load, potentially indicative of a backdoor, initiated by a Node.js process. The detection specifically looks for keywords related to .NET Reflection, assembly loading, byte arrays, and a suspicious C2 domain (hellolargeworld.com) or invocation method (Extension.SubRoutine.Run2).
Detects the execution of PowerShell or Bash commands, potentially for implant delivery, spawned from Visual Studio Code extension host processes (node.exe, code.exe, code-server, cursor). This rule specifically looks for command-line patterns associated with the GLASSWORM.WASM threat, such as 'irm', 'iex', 'curl -fsSL', 'Invoke-Expression', 'IEX', or combinations of 'powershell -Command', 'curl -fsSL', and 'bash -c'.
Detects node.exe copying browser history files to temporary directories, associated with the protocal.cjs backdoor.
Detects the execution of Node.js silently using 'conhost --headless', a technique used by EtherRAT and other malware to run malicious JavaScript payloads without displaying a console window to the user.
Detects Visual Studio Code or Cursor IDE spawning a node.js process that executes a payload disguised as a .woff2 font file. This behavior is associated with supply chain attacks where malicious npm packages use hidden VS Code workspace tasks (e.g., folderOpen) to execute arbitrary code.
Detects instances where 'node.exe' accesses browser extension LevelDB directories (associated with cryptocurrency wallets in Chrome, Edge, or Brave) or executes with suspicious command-line arguments such as 'protocal.cjs', 'NodePackages', or 'nvmconf'. This behavior is indicative of potential malware attempting to exfiltrate sensitive browser data or execute malicious code.
Detects the spawning of suspicious child processes (e.g., cmd.exe, PowerShell, node.exe, calc.exe) by the Lunar Client application. This behavior is indicative of an exploit targeting the Electron framework's preload IPC bridge, allowing a renderer process to execute commands or gain elevated privileges on the host system.
This rule detects the creation of Electron application runtime files (electron.exe, app.asar, index.js, package.json) by installers like UtilifySetup or Inno Setup in unusual or suspicious AppData\Local subdirectories. This behavior is associated with the Ghost ClickFix attack chain, where compromised systems are used to deploy malicious Electron applications. The rule specifically looks for file creations in paths matching `\appdata\local\(super|max|util)[^\\]*` and installer executables named `utilifysetup.exe`, `setup.exe`, or `is-[a-z0-9]+\.exe`.
Detects PowerShell commands executed by a Node.js process to gather system information, specifically targeting installed applications and packages. This could indicate malicious activity where a Node.js application or script is being used to enumerate system details.
Detects the creation of Electron runtime files (electron.exe, app.asar, index.js, package.json) by installers like UtilifySetup or Inno Setup in unusual subfolders within the AppData\Local directory. This behavior is indicative of potential malware, specifically referencing the 'super', 'max', or 'util' patterns in the path, which have been associated with campaigns like ClickFix.
Detects PowerShell executing a reflective .NET assembly load, potentially indicative of a backdoor, initiated by a Node.js process. The detection specifically looks for keywords related to .NET Reflection, assembly loading, byte arrays, and a specific C2 domain (hellolargeworld.com:443) or invocation method (Extension.SubRoutine.Run2) within the PowerShell command line. The initiating process is expected to be 'node.exe'.
Detects the creation of Electron runtime files (electron.exe, app.asar, index.js, package.json) by installers like UtilifySetup or Inno Setup in unusual subfolders within the AppData\Local directory. This behavior is indicative of potential malware, specifically referencing the 'super', 'max', or 'util' patterns in the path, which have been associated with campaigns like ClickFix.
Detects IDEs executing as a Node.js interpreter, a technique used to run malicious JS silently, as described in the UNK_DeadDrop campaign.
Detects attempts by Electron or Node.js applications to establish persistence by creating or modifying Run or RunOnce registry keys. The rule specifically looks for applications located within the AppData\Local directory, which is a common technique for malware or unwanted applications to maintain execution across system reboots. This rule leverages UDM for principal and target context to aid in correlation.
Page 1 of 2