Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
27 detections
Filters
Last updated
All Time
Detection languages
10
5
3
3
2
Contributors
13
3
2
2
1
Categories
21
12
8
6
3
Platforms
20
10
8
1
1
Products / Services
8
7
6
4
4
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects the creation of persistence mechanisms on Linux systems using APT Pre/Post-Invoke hooks (e.g., /etc/apt/apt.conf.d/99sys-update) or user profile initialization scripts (e.g., /etc/profile.d/sys-init.sh). The rule monitors for these files containing suspicious command strings such as curl downloads, xmrig mining configurations, or specific init-hook markers often used by cryptomining botnets.
Detects the execution of malicious 'node.exe' processes that invoke 'setup.mjs' or 'math_init.js' scripts from within .vscode or .claude configuration directories. This pattern is characteristic of the ChainDrop/Shai-Hulud npm supply chain worm, which leverages VS Code tasks or Claude Code session hooks to achieve persistent execution of dropper scripts without triggering standard npm installation flows.
Detects the creation or renaming of .rbf (Rollback File) files within the C:\Config.Msi directory where the previous filename was 'marker.txt'. This behavior is associated with the Windows Installer service (msiexec.exe) and can be leveraged by adversaries to perform file operations or execute arbitrary code during installation processes.
This rule detects when the Microsoft Teams process (Teams.exe) creates an executable or installer file (.exe or .msi) in common user-writable directories such as AppData, Temp, or Users/Public. This behavior is indicative of potential malicious activity, as legitimate Teams application updates and add-ins typically reside in specific, protected subdirectories within the Teams folder structure.
Detects execution of unusual preinstall, setup, or GitHub scripts initiated by Node Package Manager (npm) or node processes. This behavior is indicative of a supply chain attack or malicious dependency execution during the installation process of a package.
Detects anomalous execution patterns of the Windows Package Manager (WinGet) DSC engine. It monitors for potential bypass of the standard winget.exe client by identifying direct calls to WindowsPackageManagerServer.exe with manual activation flags, unusual parentage of ConfigurationRemotingServer.exe, or usage of DSCourier-related binaries that interact with WinGet components, which may indicate unauthorized package installation or configuration management.
This rule detects the execution of specific malicious npm packages (jsonwebauth, fake-font) and associated script files (lserver.js, errorHandler.js) linked to Lazarus Group activity. It monitors node.exe processes for suspicious command lines, child processes originating from associated directories, and npm installation activities involving these packages.
Detects unauthorized execution of native binaries initiated by npm during the package installation process. This rule targets the IronWorm supply-chain campaign, where compromised npm packages utilize preinstall hooks or node-gyp build processes to execute malicious binaries (often Rust-based) from unconventional paths within the package directory.
Detects unexpected child process creation spawned by npm or node.exe that is characteristic of the IronWorm Rust-based infostealer. This rule monitors for malicious npm preinstall or postinstall hooks executing common living-off-the-land binaries (like curl, powershell, or regsvr32) from within a node_modules directory structure, common in supply chain compromise scenarios.
Detects unauthorized access to sensitive credential files (Docker, AWS, npm, PyPI, GCloud) by Node.js processes, specifically when those processes are triggered by common npm lifecycle scripts like preinstall, postinstall, or peer dependency scripts. This is a common pattern observed in supply chain attacks involving malicious npm packages.
This rule detects the execution of ConfigurationRemotingServer.exe, which is the backend process used by the Windows Package Manager (winget) when applying configuration files. The detection specifically monitors for this process being spawned by winget.exe with flags indicating the acceptance of configuration agreements and the execution of a configuration command.
Detects suspicious 'npm publish' or 'npm login' commands executed as child processes of 'node' or 'npm'. This pattern indicates programmatic execution from within package install hooks (such as preinstall or postinstall scripts) instead of manual developer interaction, a behavior characteristic of malicious npm supply chain attacks (e.g., IronWorm) aiming to trojanize packages using stolen tokens.
Detects the execution of npm lifecycle scripts (such as postinstall, preinstall, or custom install-related scripts) by node.exe. These scripts are frequently abused in supply chain attacks to execute malicious code automatically when a package is installed.
This rule detects when the Microsoft Teams process (Teams.exe) creates an executable or installer file (.exe or .msi) in common user-writable directories such as AppData, Temp, or Users/Public. This behavior is indicative of potential malicious activity, as legitimate Teams application updates and add-ins typically reside in specific, protected subdirectories within the Teams folder structure.
Detects a specific execution pattern where node-gyp.exe spawns node.exe to execute an 'index.js' file. This behavior is associated with the 'Miasma' or 'Mini Shai-Hulud' threat campaigns, which utilize malicious 'binding.gyp' files within npm packages to bypass standard lifecycle script (preinstall/postinstall) security scanners.
This rule detects when the Microsoft Teams process (Teams.exe) creates an executable or installer file (.exe or .msi) in common user-writable directories such as AppData, Temp, or Users/Public. This behavior is indicative of potential malicious activity, as legitimate Teams application updates and add-ins typically reside in specific, protected subdirectories within the Teams folder structure.
Detects outbound network communication from node.exe to the domain 'stitch-production.org'. This domain is associated with the 'Miasma' (also known as Mini Shai-Hulud) campaign, which uses malicious npm packages with post-install scripts to steal developer credentials, including Git, Docker, SSH, and cloud service configuration files.
Identifies the execution of the elementary.pth payload natively triggering on Python interpreter startup. This rule correlates process events for Python execution with file events indicating the presence of an 'elementary.pth' file on the same device.
This rule detects the download of installer packages (MSI, PKG, DEB, RPM) over HTTP that contain the string 'CustomAction'. This combination is often used by malicious installers to establish persistence on a system by creating custom actions that execute at specific events.
Detects install-time execution context consistent with the Axios npm supply chain compromise. This rule looks for 'node setup.js' launched from within 'node_modules/plain-crypto-js' or related npm install working directories, or for npm install commands involving 'axios' or 'plain-crypto-js'.
Detects abuse of package manager hooks for persistence, by hijacking the package manager execution flow
Page 1 of 2