Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule monitors for suspicious activity associated with npm or Node.js processes. This includes potential credential misuse during npm publish or login, unauthorized build-time execution via node-gyp, and the use of unconventional preinstall/postinstall hooks that spawn external binaries or scripts, which are often indicative of software supply chain attacks.
Detects suspicious 'npm publish' or 'npm login' commands executed as child processes of 'node' or 'npm'. This pattern indicates programmatic execution from within package install hooks (such as preinstall or postinstall scripts) instead of manual developer interaction, a behavior characteristic of malicious npm supply chain attacks (e.g., IronWorm) aiming to trojanize packages using stolen tokens.
Detects in-memory execution of the MYRA RAT originating from a node.exe process. The rule monitors for suspicious process creation patterns associated with fileless techniques, including execution from memory file descriptors (memfd), /proc/self/fd, or empty process image paths, as well as unauthorized process interaction with systemd-userdbd, indicative of node.js supply chain compromises.
This rule detects potentially malicious activity within Linux environments or containers where a single user context concurrently performs credential hunting (via environment variable dumping or accessing .env files) and terminates processes associated with known cryptocurrency miners or competing malicious actors. This behavior is highly indicative of a cryptojacking infection or a malicious actor clearing out existing resource-hijacking threats.
Detects HTTP requests where the URI or request body contains indicators of internal network references (e.g., localhost, 127.0.0.1, or RFC 1918 private IP address ranges). This pattern is consistent with Server-Side Request Forgery (SSRF) attempts, where an attacker tries to force a vulnerable web application to perform unauthorized requests to internal resources.
Detects reconnaissance activity where an attacker executes system discovery commands to identify the FreeBSD kernel version and kTLS configuration (specifically 'kern.ipc.mb_use_ext_pgs'). This enumeration is performed to fingerprint potential targets for the BUMSRAKETE exploit (CVE-2026-45257).
Detects the execution of the BUMSRAKETE exploit for CVE-2026-45257, which targets kTLS-RX page-cache corruption in FreeBSD to achieve local privilege escalation. The rule monitors for pre-exploitation sysctl enumeration of kernel memory management parameters and the subsequent spawning of privileged shells (su/sh) by the exploit process.
Detects Node.js processes accessing sensitive AWS credential or configuration files. This behavior is indicative of unauthorized information gathering, often associated with infostealer malware payloads delivered via malicious npm packages.
Detects reconnaissance activity originating from npm or Node.js processes, specifically targeting system information (OS, network, user context, and hardware identifiers). This activity is associated with supply chain compromise attempts where malicious npm postinstall scripts or inline Node.js execution are used to enumerate the host environment.
Detects persistence mechanisms associated with the MYRA RAT. This includes Linux/macOS crontab modification using specific schedules or shell profile writes initiated by node/npm processes, as well as Windows scheduled task creation or task manipulation via schtasks.exe initiated by node/npm processes.
Detects malicious activity associated with the Miasma/MYRA infostealer campaign targeting DeFi developers. The rule monitors npm lifecycle scripts (postinstall/preinstall) for suspicious execution, C2 communication with known malicious domains, unauthorized access to browser-based credential storage, and persistence attempts via LD_PRELOAD on Linux environments.
This rule detects reconnaissance activity on FreeBSD systems by monitoring the execution of 'sysctl', 'uname', 'freebsd-version', and 'pkg' to query sensitive kernel parameters and system version information. Specifically, it flags queries related to CVE-2026-45257 (BUMSRAKETE), such as 'kern.ipc.mb_use_ext_pgs' and 'kern.tls.enable'. The rule differentiates risk levels based on the combination of targeted kernel parameter checks and system version enumeration.
Detects MYRA Linux RAT persistence mechanisms. The rule monitors for the creation of cron jobs scheduled to run every 13 minutes and the creation of a profile initialization script at /etc/profile.d/.sh.local, which is a common technique for ensuring code execution upon user shell session initialization.
Detects Tailscale installation, configuration, and mesh network enrollment activity. The rule monitors for the execution of Tailscale processes with enrollment flags, DNS lookups to Tailscale coordination servers, WireGuard UDP traffic on port 41641, and connections to the Tailscale CGNAT IP address space. This activity is often used by adversaries to establish persistent, encrypted remote access.
This rule detects potentially malicious activity related to cron job scheduling. It monitors for three distinct stages: (1) direct modification of crontab files or directories using common shell utilities, (2) suspicious file write operations to critical cron configuration paths, and (3) execution of shell scripts or binaries from unusual directories (e.g., /tmp, /dev/shm) where the parent process is a cron utility.
Detects Node.js or npm processes that access multiple SSH-related files within a short timeframe while also establishing external network connections, which is consistent with credential exfiltration patterns.
This rule detects potentially malicious activity related to Node.js environments. It monitors for the execution of Node.js or NPM commands involving specific sensitive files ('sync-peer.cjs', 'peer-math.js') or suspicious packing destinations, as well as the creation of 'index.js' or 'package.json' files within a 'node_modules' directory, which can indicate software supply chain manipulation or malicious dependency installation.
This rule detects when a Node.js or NPM process accesses multiple sensitive browser credential files (Login Data or Cookies) within a short window, while simultaneously reading shell history files (bash_history, zsh_history, or fish_history). This behavior is characteristic of an automated credential harvester or infostealer script executing within a Node.js environment.
Detects the execution of Python interpreters or scripts involving keylogging-related libraries (pynput, pyxhook, pywin32, keyboard) or direct access to Linux input devices (/dev/input/event*), correlated with the creation of temporary script files, which is a common pattern for Python-based keyloggers.
Detects suspicious kernel-level activity following a potential privilege escalation event on Linux systems. The rule monitors for unauthorized kernel module loading (via non-standard paths) or direct write access to /dev/kmem, which is indicative of rootkit installation or kernel-level memory manipulation.
Detects execution patterns associated with fileless techniques on Linux systems, specifically looking for the usage of the memfd_create system call or referencing /proc/self/fd/ to execute code directly from memory. These methods are frequently used by adversaries to load and run malicious payloads without writing files to disk, bypassing traditional file-based antivirus scanners.
Page 191 of 347