Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,624 detections
Filters
Last updated
All Time
Detection languages
1,749
374
349
273
255
Contributors
908
661
593
359
164
Categories
1,486
1,150
779
525
515
Platforms
39,897
7,231
6,523
3,864
3,624
Products / Services
802
512
432
340
297
MITRE Techniques
1,177
572
523
506
437
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Identifies Node.js or IDE-related processes initiating connections to the Solana mainnet RPC endpoint. This behavior is associated with GLASSWORM's WASM loader performing dead-drop C2 resolution via blockchain transaction memos.
Detects potential fileless execution of Meow RAT by monitoring process command lines for 'curl' fetching an AppleScript payload and piping it to 'osascript'. It also looks for specific Meow RAT indicators like C2 domains, payload names, and build hashes.
Detects the use of the 'ditto' command with specific arguments indicating data staging or collection activities, particularly when archiving to a temporary location like '/tmp/osalogging.zip'. This could be indicative of an adversary collecting data from the local system before exfiltration.
This rule detects potentially malicious activity related to the 'node-gyp' build tool used by npm. It monitors for two patterns: 1) npm spawning node-gyp, which can be an automated trigger for malicious binding.gyp files, and 2) node-gyp spawning node.exe with command-line arguments indicative of obfuscated JavaScript (e.g., base64 encoding, eval, AES-GCM patterns), a technique often seen in malicious Node.js packages.
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
This rule detects suspicious activity involving Node.js or Bun runtimes, specifically focusing on the access of sensitive configuration files (e.g., .npmrc, .aws/credentials, .ssh, .kube/config) or the execution of commands containing keywords associated with credential harvesting and automated data collection scripts.
Detects anomalous execution patterns involving Node.js and Bun runtimes, specifically identifying suspicious process lineage such as node processes spawned by node.gyp, or Bun execution patterns involving temporary files or specific command-line arguments. Additionally, it alerts on the execution of a specific known malicious file hash.
Detects execution of node-gyp to compile native Node.js addons, which can be leveraged by attackers to execute arbitrary code or build malicious modules during project installation or development. The rule looks for binding.gyp usage and build commands initiated by npm or node processes.
Detects execution patterns associated with the Miasma/Mini Shai-Hulud multi-layer obfuscated npm payload. This includes monitoring for bun runtime spawning from Node/NPM contexts, execution of bun with specific patterns from /tmp, downloading of specific bun versions from GitHub, and execution of suspicious index.js scripts within .claude directories.
Detects instances where 'node' or 'bun' runtime processes access multiple sensitive developer configuration or credential files (e.g., .ssh, .aws/credentials, .npmrc, .kube/config). This behavior is indicative of potential credential theft or reconnaissance activities by an adversary attempting to leverage developer environments.
Detects suspicious file creation or execution of Node.js scripts linked to VS Code or .claude directories. This behavior often suggests the presence of poisoned IDE configurations or malicious task automation attempts designed to execute code when a project or IDE folder is opened.
Detects process start events where the command line contains the specific string 'ShitSetupOn26126k'. This appears to be a specific indicator of compromise (IOC) related to a custom script or malware installation routine.
Detects the use of Amazon Q related configuration files (.amazonq, mcp.json) in conjunction with common command-line utilities such as bash, sh, npx, or node. This activity may indicate an attempt to interact with or exploit developer tools and environment configurations to perform unauthorized reconnaissance or execution.
Detects instances where common IDE-related processes (like VS Code, Amazon Q, or Node) spawn a shell to execute AWS CLI commands specifically focused on identifying the current caller identity using 'aws sts get-caller-identity' and 'curl'. This pattern often indicates attempts to verify compromised AWS credentials or discover account details from an environment.
Detects the execution of common command interpreters (node, python, shell) or processes with 'mcp' in the command line that reference sensitive cloud-related environment variables or identity-related commands, such as AWS access keys, session tokens, or SSH authentication sockets. This indicates potential credential theft or unauthorized cloud resource access.
Detects instances where the Amazon Q Developer extension spawns suspicious child processes, such as bash or npx, which may indicate the execution of arbitrary commands defined in a potentially malicious .amazonq/mcp.json workspace configuration file.
Detects the node.exe process attempting to read shell history files (.bash_history, .zsh_history, etc.), which are common targets for credential harvesting by malicious npm packages. This behavior is associated with the Polymarket Trap campaign involving Miasma and MYRA infostealers.
Detects node.exe processes attempting to access sensitive browser credential databases, such as cookies, login data, or key databases. This pattern is indicative of infostealer malware, specifically those associated with the Polymarket Trap supply-chain campaign, which abuse node.js processes to exfiltrate browser data.
Detects node.js executing known malicious npm lifecycle scripts (such as install-check.cjs, verify-peer.cjs, sync-peer.cjs, postinstall-run.js, and preinstall.js) often found in node_modules folders. These scripts are associated with the Polymarket Trap supply chain campaign, which leverages malicious npm hooks for initial access or malicious activity within a development environment.
Detects the execution of Node.js or npm processes that reference known malicious transitive npm dependencies or typosquatted packages identified in the Polymarket Trap supply chain campaign, such as 'log-taker' and various 'thirdweb' typosquats.
Detects a single process reading both SSH private keys and various developer-sensitive configuration or credential files (e.g., .aws/credentials, .npmrc, .pypirc) on a single host. This behavior is consistent with infostealer activity, such as the Miasma JavaScript infostealer used in supply chain campaigns, aiming to harvest credentials from developer workstations.
Page 122 of 173